Privacy Policy

Centhree Advanced Mobility GmbH · for the cenya platform

Last updated: 2026

We take privacy seriously

Protecting your privacy when processing personal data is an important concern for us. When you visit our website, our web servers store, by default, the IP address of your internet service provider, the website from which you visit us, the pages you access, and the date and duration of your visit. This information is technically required for the secure transmission of the website and the safe operation of the server. No personalised analysis of this data takes place.

If you send us data via the contact form, this data is stored on our servers as part of our data backup. Your data is used by us exclusively to process your request. Your data is treated strictly confidentially. It is not passed on to third parties.

Controller:Centhree Advanced Mobility GmbH
Große Elbstraße 145e
22767 Hamburg
Phone: +49 (0) 40 573 090 175
Email: info@cenya.de

Personal data

Personal data is data about your person. This includes your name, your address and your email address. You do not have to disclose any personal data in order to visit our website. In some cases, we need your name and address as well as further information in order to provide the service you requested.

The same applies if we provide you with information material on request or answer your inquiries. In these cases, we will always inform you accordingly. We also store only the data that you have transmitted to us automatically or voluntarily.

When you use one of our services, we generally only collect the data necessary to provide you with our service. We may ask you for further information, but this is voluntary. Whenever we process personal data, we do so in order to provide you with our service or to pursue our commercial objectives.

Contacting us

When you contact us (e.g. via contact form, email, telephone or social media), the information of the requesting persons is processed insofar as this is necessary to respond to the contact requests and any requested measures.

Contact requests in the context of contractual or pre-contractual relationships are answered to fulfil our contractual obligations or to respond to (pre-)contractual inquiries, and otherwise on the basis of legitimate interests in responding to the inquiries.

Types of data processed:Master data (e.g. names, addresses), contact data (e.g. email, phone numbers), content data (e.g. entries in online forms)
Data subjects:Communication partners
Purposes of processing:Contact requests and communication
Legal bases:Performance of contract and pre-contractual inquiries (Art. 6 (1) lit. b GDPR), legitimate interests (Art. 6 (1) lit. f GDPR)

Automatically stored data — server log files

The provider of these pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

  • Date and time of the request
  • Name of the requested file
  • Page from which the file was requested
  • Access status (file transferred, file not found, etc.)
  • Web browser and operating system used
  • Full IP address of the requesting computer
  • Volume of data transferred

This data is not merged with other data sources. Processing takes place pursuant to Art. 6 (1) lit. f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.

For reasons of technical security, in particular to defend against attempted attacks on our web server, this data is stored by us for a short period. We are unable to draw conclusions about individual persons from this data. After seven days at the latest, the data is anonymised by truncating the IP address at the domain level so that it is no longer possible to establish a connection to the individual user. In anonymised form, the data is also processed for statistical purposes; a comparison with other data sets or transfer to third parties, even in extracts, does not take place.

Cookies

When you visit our website, we may store information on your computer in the form of cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier of the cookie. It consists of a character string by which websites and servers can be assigned to the specific internet browser in which the cookie was stored. This enables the visited websites and servers to distinguish the individual browser of the data subject from other internet browsers that contain other cookies. A specific internet browser can be recognised and identified via the unique cookie ID.

Through the use of session cookies, the controller can provide users of this website with a user-friendly service that would not be possible without the setting of cookies. Without consent, we only use technically necessary cookies on the legal basis of legitimate interest pursuant to Art. 6 (1) lit. f GDPR.

We only use personal cookies to improve our website or for marketing/advertising purposes with your consent. On your first visit, you can voluntarily consent to tracking or analysis via the displayed cookie banner. Where applicable, your data may be passed on to partners or third-party providers. These cookies are only stored if you explicitly consent; the legal basis is then your consent pursuant to Art. 6 (1) lit. a GDPR.

You can change your cookie settings here at any time:

Local storage (sessionStorage): So that you do not have to enter your postal code multiple times when booking, we temporarily store the postal code checked in the hero section in your browser tab session (sessionStorage). This storage is technically necessary, takes place without third-party transmission, and is automatically deleted as soon as you close the tab. The legal basis is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR in a frictionless booking process.

Third-party services

Google Tag Manager

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that we use to integrate tracking or statistics tools and other technologies on our website. Google Tag Manager itself does not create user profiles, store cookies or carry out independent analyses. It only serves to manage and deliver the tools integrated through it. However, Google Tag Manager records your IP address, which may also be transferred to Google's parent company in the United States.

Legal basis: Art. 6 (1) lit. f GDPR.

Google Analytics (4)

Provider: Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. The website operator receives various usage data, such as page views, time spent on the site, operating systems used, and the user's origin. This data is summarised in a user ID and assigned to the respective end device of the website visitor. With Google Analytics, we can also record your mouse and scroll movements and clicks. Furthermore, Google Analytics uses various modelling approaches and machine learning technologies for data analysis.

Google Analytics uses technologies that enable the recognition of the user (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is generally transferred to a Google server in the USA and stored there.

Legal basis: Your consent pursuant to Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. Consent can be revoked at any time.

Data transfer to the USA is based on the EU Commission's standard contractual clauses. Details: privacy.google.com/businesses/controllerterms/mccs/

Google Ads

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

We use Google Ads to display advertisements in search results and on the Google advertising network, and to measure conversions. Cookies are used that enable your browser to be recognised. Google records, among other things, IP address, click behaviour and information about the page accessed. A combination with other data stored by Google is possible.

Legal basis: Your consent pursuant to Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. Consent can be revoked at any time.

Data transfer to the USA is based on the EU Commission's standard contractual clauses. Details: policies.google.com/privacy

Meta Pixel

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

On our website, we use the Meta Pixel (formerly Facebook Pixel). This enables us to analyse the behaviour of website visitors, measure conversions and display targeted advertisements on Facebook and Instagram (remarketing). In doing so, information such as IP address, browser and device data and usage behaviour on our website is transmitted to Meta. This data may be linked to your Facebook account if you are logged in there.

Legal basis: Your consent pursuant to Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. Consent can be revoked at any time.

Data transfer to the USA is based on the EU Commission's standard contractual clauses. Details: facebook.com/privacy/policy/

Hotjar

Provider: Hotjar Ltd, Level 2, St Julian's Business Centre, 3, Elia Zammit Street, St Julian's STJ 3155, Malta.

We use Hotjar to better understand the use of our website and to optimise the user experience. Hotjar records the behaviour of website visitors on an anonymised basis. In particular, mouse movements, scroll behaviour and clicks are recorded (so-called heatmaps and session recordings). In addition, Hotjar may collect information about screen size, device type, browser, geographic location (country only) and the preferred language for displaying the website. Hotjar stores this information in a pseudonymised user profile. The information is neither used by Hotjar nor by us to identify individual users, nor combined with other data about individual users.

Hotjar uses cookies for this purpose (including _hj* cookies) that enable analysis of website use. The information generated by the cookie about your use of this website is stored and processed on Hotjar servers in the EU.

Legal basis: Your consent pursuant to Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. Consent can be revoked at any time.

You can prevent collection by Hotjar by setting an opt-out cookie on the following page: hotjar.com/legal/compliance/opt-out

More information: Hotjar's privacy policy: hotjar.com/legal/policies/privacy/

Google Fonts

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

This website uses Web Fonts from Google for the consistent display of certain fonts. When you call up this website, your browser loads the required fonts directly from Google's servers in order to display them correctly on your end device. In doing so, your browser establishes a connection to Google's servers. Google thereby becomes aware that this website has been accessed via your IP address. According to Google, no cookies are stored when the fonts are provided.

Legal basis: Art. 6 (1) lit. f GDPR. If a corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. Consent can be revoked at any time.

More information: developers.google.com/fonts/faq · Privacy policy: policies.google.com/privacy

Postmark

Provider: Postmark (ActiveCampaign, LLC), 1 N Dearborn St, Chicago, IL 60602, USA.

We use the Postmark service to send transactional emails (e.g. booking confirmations, status notifications, reminders). In doing so, the email address, name and content of the respective message are transmitted to and processed by Postmark. Postmark does not use the data for its own purposes.

Legal basis: Art. 6 (1) lit. b GDPR (performance of contract).

Data transfer to the USA is based on the EU Commission's standard contractual clauses. Privacy policy: postmarkapp.com/privacy-policy

OpenStreetMap

Provider: OpenStreetMap Foundation (OSMF), St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.

On our platform, we integrate map material from the OpenStreetMap service to display locations and routes. When the map view is loaded, your IP address and technical browser information are transferred to the OSMF servers. OpenStreetMap does not set any cookies and does not create user profiles.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in displaying locations).

Privacy policy: wiki.osmfoundation.org/wiki/Privacy_Policy

Processing and disclosure of data within the use of the platform

Within the use of our platform, we process personal data that is required to provide our services and to carry out service and repair work. This includes, in particular, master data (e.g. name and contact details), vehicle-related data (e.g. licence plate, vehicle identification number), order and booking data, and communication data.

Insofar as this is necessary for the performance of the contractual relationship, we transmit this data to selected workshop partners who provide the commissioned services on their own responsibility. The workshop partners process the transmitted data under their own data protection responsibility and are obliged to comply with applicable data protection regulations and to maintain the confidentiality of the data.

Processing takes place on the basis of Art. 6 (1) lit. b GDPR for the performance of the contract and, where applicable, on the basis of Art. 6 (1) lit. f GDPR for ensuring and optimising the operation of our app.

Security

We have taken technical and administrative security measures to protect your personal data against loss, destruction, manipulation and unauthorised access. All our employees as well as service providers working for us are bound by the applicable data protection laws.

Whenever we collect and process personal data, it is encrypted before transmission. This means that your data cannot be misused by third parties. Our security measures are subject to a continuous improvement process and our privacy policies are constantly being revised. Please ensure that you have the most up-to-date version.

Which data is processed and from which sources is this data?

We process the data we have received from you in the course of contract initiation or execution, on the basis of consents, or in the course of your application to us or your employment with us.

Personal data includes:

  • Customers: First and last name, address, contact details (email, phone number, fax), bank details
  • Applicants and employees: First and last name, address, contact details, date of birth, data from CV and references, bank details, religious affiliation, photographs
  • Business partners: Designation of legal representatives, company, commercial register number, VAT ID, business registration number, address, contact person details, bank details

In addition, we also process the following other personal data:

  • Information about the type and content of contract data, order data, sales and receipt data, customer and supplier history, and consultation documents
  • Advertising and sales data
  • Information from your electronic communication with us (e.g. IP address, login data)
  • Other data that we have received from you in the course of our business relationship
  • Data that we generate ourselves from master/contact data (e.g. customer needs and customer potential analyses)
  • Documentation of your declaration of consent for receipt of newsletters, etc.
  • Photographs taken at events

For what purposes and on what legal basis is the data processed?

We process your data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act 2018, as amended:

For the performance of (pre-)contractual obligations (Art. 6 (1) lit. b GDPR)

The processing of your data takes place for the execution of the contract online or in one of our branches, as well as for the execution of the contract for your employment in our company. The data is processed in particular when initiating business and when carrying out contracts with you.

For the fulfilment of legal obligations (Art. 6 (1) lit. c GDPR)

Processing of your data is necessary to fulfil various legal obligations, e.g. from the German Commercial Code or the German Fiscal Code.

To safeguard legitimate interests (Art. 6 (1) lit. f GDPR)

Based on a balancing of interests, data processing may take place beyond the actual fulfilment of the contract, for example for:

  • Advertising or marketing
  • Measures for business management and the further development of services and products
  • Maintaining a group-wide customer database to improve customer service
  • In the context of legal proceedings
  • Sending non-promotional information and press releases

On the basis of your consent (Art. 6 (1) lit. a GDPR)

If you have given us consent to process your data, e.g. for sending our newsletter or for the publication of photos.

Processing of personal data for advertising purposes

You can object to the use of your personal data for advertising purposes at any time, in whole or for individual measures, without incurring any costs other than the basic transmission costs.

Under the legal requirements of § 7 (3) UWG, we are entitled to use the email address you provided when concluding the contract for direct advertising of our own similar goods or services. You will receive these product recommendations from us regardless of whether you have subscribed to a newsletter.

If you do not wish to receive such recommendations from us by email, you can object to the use of your address for this purpose at any time. A notification in text form is sufficient. Of course, every email also always contains an unsubscribe link.

Who receives my data?

If we use a service provider for processing on our behalf, we remain responsible for protecting your data. All processors are contractually obliged to treat your data confidentially and to process it only as part of the provision of services. The processors we commission receive your data insofar as they require it to perform their respective service. These are, for example, IT service providers that we need for the operation and security of our IT system, as well as advertising and address publishers for our own advertising campaigns.

This data is made available to group companies insofar as this is necessary for the performance of the contract. Customer data is stored on a company-specific and separate basis, with our parent group acting as a service provider for the individual participating companies.

Where there is a legal obligation, and within the context of legal proceedings, authorities and courts as well as external auditors may be recipients of your data.

In addition, insurance companies, banks, credit agencies and service providers may be recipients of your data for the purpose of contract initiation and performance.

How long is my data stored?

We process your data until the end of the business relationship or until the expiry of the applicable statutory retention periods (e.g. from the German Commercial Code, the German Fiscal Code or the Working Hours Act); beyond that, until the conclusion of any legal disputes in which the data is required as evidence.

Is personal data transferred to a third country?

In principle, we do not transfer any data to a third country. A transfer takes place in individual cases only on the basis of an adequacy decision of the European Commission, standard contractual clauses, suitable guarantees or your express consent.

What data protection rights do I have?

You have the right at any time to information, correction, deletion or restriction of the processing of your stored data, a right to object to processing, and a right to data portability and to lodge a complaint in accordance with the requirements of data protection law.

Right to information

You can request information from us as to whether and to what extent we process your data.

Right to rectification

If we process your data and it is incomplete or inaccurate, you can request its correction or completion from us at any time.

Right to erasure

You can request the deletion of your data from us if we process it unlawfully or the processing disproportionately interferes with your legitimate protection interests. Please note that there may be reasons that prevent immediate deletion, e.g. in the case of legally regulated retention obligations. Notwithstanding this, we will delete your data promptly and completely insofar as no contractual or legal retention obligation stands in the way.

Right to restriction of processing

You can request that we restrict the processing of your data if:

  • you contest the accuracy of the data, for a period that allows us to verify the accuracy,
  • the processing of the data is unlawful, but you object to deletion and instead request a restriction of data use,
  • we no longer need the data for the intended purpose, but you still need this data to assert or defend legal claims, or
  • you have objected to the processing of the data.

Right to data portability

You can request from us that we provide you with your data in a structured, common and machine-readable format, provided that we process this data on the basis of consent given by you or for the performance of a contract and the processing is carried out by automated means. Where technically feasible, you can request that we transmit your data directly to another controller.

Right to object

If we process your data on the basis of legitimate interest, you can object to this data processing at any time. We will then no longer process your data, unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims. You can object to the processing of your data for the purpose of direct advertising at any time without giving reasons.

Right to lodge a complaint

If you believe that we are violating German or European data protection law in the processing of your data, please contact us. You also have the right, of course, to contact the supervisory authority responsible for you, the respective state office for data protection supervision.

If you wish to assert any of the rights mentioned against us, please contact our data protection officer. In case of doubt, we may request additional information to confirm your identity.

Am I obliged to provide data?

The processing of your data is required for the conclusion or performance of the contract concluded with us. If you do not provide us with this data, we will generally have to refuse to conclude the contract or will no longer be able to perform an existing contract and will therefore have to terminate it. However, you are not obliged to consent to data processing in respect of data that is not relevant for contract performance or not legally required.

Changes to this privacy policy

We reserve the right to change our privacy policies if this should become necessary due to new technologies. Please ensure that you have the most up-to-date version. If fundamental changes are made to this privacy policy, we will announce them on our website.

All interested parties and visitors to our website can reach us with data protection inquiries at:

Data protection officer:Mr Christian Volkmer
Projekt 29 GmbH & Co. KG
Ostengasse 14 · 93047 Regensburg
Phone: +49 941 2986930
Fax: +49 941 29869316
Email: anfragen@projekt29.de
Website: www.projekt29.de