Privacy at EkoDrive

1. Data controller

The controller responsible for EkoDrive's processing of personal data through this website and for the test arrangements described here is:

Fahrschule EkoDrive GmbH
Karl-Krämer-Straße 29
71364 Winnenden, Germany
Represented by Managing Director Elias Dwayne Antil
Phone: 07195 2090047
Mobile: 01590 1442221
Email: info@ekodrive.de

You can send privacy questions and requests to exercise your data protection rights to the address above.

2. Principles and legal bases

We process personal data only as necessary for the relevant purpose. Depending on the activity, the legal bases are in particular Article 6(1)(b) GDPR (performance of the training contract, handling enquiries and taking pre-contractual steps at the data subject's request), Article 6(1)(f) GDPR (legitimate interests, such as operating a secure website and answering general enquiries) and, where applicable, Article 6(1)(c) GDPR (statutory retention or documentation obligations). Where required in an individual case, we rely on expressly given consent under Article 6(1)(a) GDPR.

Required form information is marked as mandatory. You can generally use our website without providing contact or pre-registration details. However, we cannot process certain enquiries or pre-registrations without the necessary contact information.

3. Hosting by STRATO and server log files

The website and email account are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. When you visit our pages, technically necessary connection data is processed, such as your IP address, time of access, requested file or URL, data volume transferred, response status, browser details and, where applicable, operating system information. This is necessary to deliver and operate the website and prevent abuse and attacks (Article 6(1)(f) GDPR).

STRATO states that it stores IP addresses from website visits for a maximum of seven days to detect and prevent attacks. Statistical or available log reports may contain anonymised information. Further details are available in STRATO's information on privacy and data processing.

STRATO provides technical hosting and email services. Where STRATO processes data on our behalf, the requirements of Article 28 GDPR apply. We manage the relevant contractual documents and settings in our STRATO customer account.

4. Contact form

When you use our contact form, we collect your name, email address, telephone number if supplied, selected enquiry topic and message. We process this data to answer your message and, where applicable, clarify pre-contractual questions about driving lessons. The legal basis is Article 6(1)(b) GDPR and, for general enquiries, also Article 6(1)(f) GDPR.

The form also processes technically necessary security data, particularly session information and data used to detect abuse or spam. Messages are sent from our server at STRATO to info@ekodrive.de. Your message is stored in our email account for processing. This does not guarantee end-to-end encryption of the email content.

Please do not include identity document numbers or copies, health information or other particularly sensitive data in the message field.

5. Non-binding online pre-registration

If you pre-register online, we process the following information in particular to prepare your registration: name, email address, telephone number, desired licence category and application type (first licence, additional category or exchange), plus, where applicable, licence categories already held, issuing country and the voluntary indication of whether the applicant is under 18. For applicants who are minors, we also collect the name and telephone number of the specified parent or legal guardian. Any optional comments are processed solely to handle the pre-registration.

We use this information to handle your enquiry and contact you, or the specified parent or guardian where applicable, by telephone to prepare the contract. Date and place of birth, nationality, address and required supporting documents are collected only during in-person registration. The legal basis is Article 6(1)(b) GDPR. For parent or guardian details, we also rely on our legitimate interest in properly preparing the registration (Article 6(1)(f) GDPR).

Pre-registration is free and non-binding. It does not establish a training contract. The contract is signed later, in person at the driving school. We do not collect identity document numbers or copies through the online form. Supporting documents may be required when you visit us.

Form data is transmitted to our web server over HTTPS and then sent from the server by email to our STRATO mailbox. The email content is not end-to-end encrypted. Please do not use the free-text field to send sensitive documents or medical information.

Within our company, only the managing director has access to messages from the contact form and online pre-registration. These messages are not automatically forwarded to other email accounts.

6. Contact by email and telephone

When you contact us by email or telephone, we process the information you provide, particularly your name, email address or telephone number, time of contact and the content of your enquiry. We use your telephone number to call you back. STRATO provides our incoming and outgoing email service; the relevant telecommunications providers are also technically involved in telephone calls.

We process this information to answer your enquiry or take pre-contractual steps (Article 6(1)(b) GDPR), or in our legitimate interest in communicating with prospective and existing customers (Article 6(1)(f) GDPR). Please note that unencrypted emails do not offer the same protection as communication that is end-to-end encrypted throughout.

7. Contact via WhatsApp

Our website contains a WhatsApp link to our mobile number 01590 1442221. This is a normal external link. Simply visiting our website does not load WhatsApp content or activate WhatsApp tracking. WhatsApp or its website opens only when you click the link. Data may then be transmitted to WhatsApp for technical reasons.

When you message us on WhatsApp, we process your telephone number, profile name if available and message content to communicate with you. The legal basis for training enquiries is Article 6(1)(b) GDPR; for other enquiries it is Article 6(1)(f) GDPR.

For users in the European Economic Area, WhatsApp is provided by WhatsApp Ireland Limited. WhatsApp processes its own usage, connection and metadata under its terms. This may include transfers to countries outside the European Economic Area. Further information: WhatsApp Privacy Policy.

Contacting us via WhatsApp is optional. You can always reach us by telephone, email or our contact form instead. Please do not send identity document copies, medical records or other particularly sensitive documents via WhatsApp.

8. Instagram and TikTok

Our website contains external links to our profiles Instagram @ekodrivee and TikTok @ekodrivee. The icons are displayed locally on our website. We use no automatically loading social media feeds, embedded posts or tracking pixels. Simply viewing our website therefore does not establish a connection to Instagram or TikTok through these links.

Clicking these links takes you away from our website. Each platform processes data under its own responsibility, such as IP addresses, device details, usage behaviour and, where applicable, profile information. Data may be transferred outside the European Economic Area. If you interact with our profile there, we can see the information you make public or provide through the platform and process it to respond. Further processing by the platforms is governed by their privacy terms:

• Meta privacy information (Instagram)
• TikTok Privacy Policy

9. Google Maps and Google reviews: external links

Our contact and location information includes a normal external link to directions on Google Maps. No interactive Google Maps map is embedded in our website. Simply opening our page therefore does not transmit data to Google Maps through this link. The relevant Google page opens only when you click it; the provider is responsible for data processing there. See the Google Privacy Policy.

Google reviews: external link

Our homepage displays our own paraphrased summaries of recurring themes in publicly available Google reviews about EkoDrive. These are not verbatim individual reviews and not an embedded Google reviews widget. The content is served from our own hosting. Simply displaying the review cards does not establish a connection to Google.

The 'Read genuine Google reviews' button lets you choose to open our business profile and original reviews on Google Maps. A connection to Google is established only when you click the external link. Google may then process your IP address, browser and device details and, where applicable, information about a signed-in Google account and the referring website. Google is responsible for further processing on its page. See Google's Privacy Policy for more information.

10. TÜV SÜD Drivers Club and test arrangements

External link to the Drivers Club

We link to the information page for the TÜV SÜD Drivers Club, a service provided by TÜV SÜD Auto Service GmbH. We do not embed a TÜV SÜD portal, registration form, video or tracking on our website. Simply visiting our website does not transmit data to TÜV SÜD through this link.

You leave our website only when you click the link. When you visit the TÜV SÜD page, it may process your IP address and browser and device information. Registration and use of the Drivers Club are subject to the privacy information provided there. Details of the responsible TÜV SÜD companies, their contact information and further processing are also available in TÜV SÜD's privacy information. Your Drivers Club login details are not collected through our website.

Authorising EkoDrive and use of test data

For theory tests from 1 January 2027, you book your own appointment in the Drivers Club. If you select Fahrschule EkoDrive and authorise it for further test arrangements, TÜV SÜD makes your theory test results and the ability to book your practical test available to us through the designated process. This authorisation determines which driving school can access the relevant test information.

We process the test results assigned to you and provided by TÜV SÜD, together with the information needed for appointment scheduling, to continue your training and arrange your practical test. Before you book your theory test yourself, we confirm completion of your theory training to TÜV SÜD. We do so only after you have completed all legally required theory lessons and achieved the training objectives. The necessary details of attendance, training completion and allocation to your test authorisation are transmitted for this purpose. Information required to book your practical test is also exchanged with TÜV SÜD for that purpose. The legal basis for our processing is Article 6(1)(b) GDPR, insofar as it is necessary to perform your training contract. TÜV SÜD is responsible for its own processing on its pages and portal.

We use the authorised data for training and test arrangements. Access is restricted to people at EkoDrive who need it for those purposes. We retain the data only as long as necessary for these purposes or to meet statutory retention and documentation obligations, and then delete it. Data stored by TÜV SÜD is subject to its own retention periods and privacy information.

Without the necessary allocation and authorisation, the designated process does not allow us to view your theory test results or book your practical test. For questions about allocation or how we handle your data, contact info@ekodrive.de. Your data protection rights are described in 'Your rights under the GDPR'.

11. First aid courses with MSG: external booking link

We link to the course and booking page of MSG Medical Service Germany. The provider is Nico Weinand, MSG Medical Service Germany, Hirschbergstraße 50, 71634 Ludwigsburg, email: info@eh-lb.de.

This is a normal external link. The provider's logo is loaded locally from our hosting. We do not embed any booking form, scripts, tracking or other content from the provider. Simply displaying the link and logo does not establish a connection to MSG.

The provider's page opens only when you click the booking link. It may process your IP address and browser and device information. Course registration details, such as your name and contact information, are entered directly in the provider's booking system. Processing on its pages is governed by MSG's privacy information.

We do not accept first aid course bookings through our website and do not automatically transmit contact or pre-registration data to MSG. If you contact us about a course, we handle your enquiry as described in the sections on the contact form, email and telephone or WhatsApp.

12. Cookies, sessions and technical security measures

Under our current website setup, we use no cookies for advertising, personalised profiling or visitor analytics. In form areas, a technically necessary session cookie named ekodrive_form may be set. It securely associates entries with the form session, particularly for CSRF protection and the arithmetic CAPTCHA. The cookie is configured as Secure, HttpOnly and SameSite=Lax; it is not used for advertising and is generally limited to the browser session.

Appearance: If no preference is saved, the website uses light mode. When you choose “Light”, “Dark” or “Automatic”, we store only that choice in your browser’s local storage (localStorage) so it is remembered on later visits. “Automatic” uses your device’s appearance setting. The choice is not sent to our server or to third parties and is not used for advertising or analytics. You can delete it by clearing this website’s data in your browser. Form entries are not stored as part of this feature.

To prevent automated enquiries, we also use a simple arithmetic question, an invisible control field and a limit on submission attempts. The IP address is assessed technically during the request, and pseudonymised identifiers derived using a secret key are briefly processed to enforce the limit. The limits cover short time windows and a maximum of one hour. We also use shared counters to limit validated submissions. Security files not updated for at least two hours are deleted during the next cleanup. Cleanup takes place on the next form request once at least five minutes have elapsed since the last run. If no further form requests occur, files may remain until the next cleanup.

Access to strictly necessary information on your device may fall within the exemption in section 25(2) TDDDG. Personal security data is processed under Article 6(1)(f) GDPR. As no tracking technologies requiring consent are currently used, no general cookie consent banner is displayed. If such services are added later, the consent and information mechanisms will be adapted beforehand.

13. Locally hosted fonts, images and media

Fonts, website images, logos, icons and other files needed to display the site are generally served from our own STRATO hosting. Simply displaying this content does not trigger automatic requests to Google Fonts, Instagram, TikTok or other external media providers. Some images have been edited with AI assistance. The relevant label concerns the image presentation and does not result in additional processing of visitor data.

14. Data recipients and possible transfers to third countries

Contact and pre-registration data is accessible only to people within our company who need it for processing and, where necessary, technical service providers we use, particularly STRATO for the website and email account. Submitting a non-binding pre-registration does not itself transfer data to authorities, test organisations or other bodies. Any such transfer takes place only later, if necessary to handle a driving licence matter and legally permissible.

Simply displaying external social media links on our website does not transmit visitor data to those platforms. If you choose to use WhatsApp, Instagram, TikTok or Google Maps, including Google reviews, their providers may independently process personal data, including in countries outside the EU/EEA. Information on their safeguards is provided in their privacy notices.

Data exchange with TÜV SÜD for test arrangements is described in section 10. Simply displaying the Drivers Club link or submitting our online pre-registration does not transmit data to TÜV SÜD.

15. Retention and deletion

We retain personal data only as long as necessary to handle your enquiry, prepare a registration or meet legal obligations. Once it is clear that an enquiry or non-binding pre-registration will not result in registration, we delete the related messages immediately unless statutory retention or documentation obligations prevent this. Other general enquiries are deleted when no longer needed and no such obligations apply. Deletion also covers corresponding messages in the business email account unless they must exceptionally be retained. If a training relationship is subsequently established, the necessary data may be retained longer under the applicable legal rules. Tax and commercial law may also require certain documents to be retained longer.

Server log files are subject to STRATO's information described in section 3. Technical sessions normally end when the browser session ends; residual server-side session data is handled by the hosting provider's cleanup mechanisms. In individual cases, statutory documentation obligations or defending specific claims may justify longer retention.

16. Transmission security

Our website uses HTTPS with TLS encryption to protect the connection between browser and web server against interception. The configuration is designed to redirect unencrypted HTTP requests to HTTPS. Form submissions also undergo input validation and technical security checks. Despite careful precautions, completely risk-free data exchange over the internet is not possible.

Please note: HTTPS encrypts the connection to the website. The subsequent transmission of form data to our email account is not an end-to-end encrypted messaging channel. Please therefore do not send identity document numbers or other highly sensitive information through our forms.

17. Your rights under the GDPR

Subject to the statutory requirements, your rights include access to your stored personal data (Article 15 GDPR), rectification of inaccurate data (Article 16), erasure (Article 17), restriction of processing (Article 18) and, where applicable, data portability (Article 20). You may object to processing based on legitimate interests on grounds relating to your particular situation (Article 21 GDPR). You may withdraw consent at any time with effect for the future (Article 7(3) GDPR).

Right to object: If processing is based on Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. We will then assess whether compelling legitimate grounds justify continued processing.

You may also lodge a complaint with a data protection supervisory authority (Article 77 GDPR), particularly the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg. To contact EkoDrive, simply send a message to info@ekodrive.de.

18. No automated decision-making

This website does not make decisions based solely on automated processing, including profiling within the meaning of Article 22 GDPR, about admission to our driving school or entering into a training contract. We decide on training through personal contact.

19. Updates to this privacy policy

We update this privacy policy if the services used, technical processes or legal requirements change. The current version is available at https://ekodrive.de/dsgvo/.