Data protection

We are very pleased about your interest in our company. Data protection has a particularly high priority for HEERO Motors GmbH (hereinafter referred to as "HEERO Motors GmbH" or "we").By means of this privacy policy, we would like to inform you as a visitor of our website about the nature, scope, and purpose of the personal data we collect, use, and process, as well as to inform you about your rights.  1. Name and Address of the ControllerThe controller within the meaning of the General Data Protection Regulation is:HEERO Motors GmbHKurfürstenstraße 180801 Munichrepresented by Oliver MehlerPhone +49 89 38157085privacy@heero-motors.de‍2. What personal data do we collect when you visit our website?In principle, it is possible to visit the website of HEERO Motors GmbH without providing any personal data, unless you transmit this to us via a contact form on this website or in any other electronic way.We would like to point out that internet-based data transmissions can fundamentally have security vulnerabilities, so that absolute protection of the transmitted data cannot be guaranteed. For this reason, you are fundamentally free to transmit personal data to us in alternative ways, for example by phone or by mail.When you access our website, some data and information are stored in the server log files. The following may be collected: (1) browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrer), (4) the sub-websites accessed via an accessing system on our website, (5) the date and time of an access to the website, (6) an internet protocol address (IP address), (7) the internet service provider of the accessing system, and (8) other similar data and information that serve to prevent danger in the event of attacks on our information technology systems. When processing this general data and information, we generally cannot identify you unless you provide us with further information on a voluntary basis. Rather, the aforementioned information is required to (1) deliver the contents of our website correctly, (2) ensure the permanent functionality of our information technology systems and the technology of our website, and (3) provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack.‍The collected data and information are also statistically evaluated by HEERO Motors GmbH with the aim of increasing data protection and data security in our company, in order to ultimately ensure an optimal level of protection for the personal data processed by us.If you identify yourself to us (e.g., by entering personal data in the contact form), this data will not be combined with the data used for our aforementioned purposes, but the anonymous data of the server log files will be stored separately from all personal data provided by a data subject. No storage of any data together with the IP address or other personal data relating to you takes place.3. CookiesSo-called cookies are used on our website. Cookies serve to make our offer more user-friendly, effective, and secure. Cookies are small text files that are stored on your computer and saved by your browser.Many of the cookies we use are so-called "session cookies". They are automatically deleted after your visit. Other cookies remain stored on your device until you delete them or the storage period of the respective cookies expires. These cookies are only set based on your explicit declaration of consent in accordance with Art. 6 para. 1 lit. a GDPR, which you can grant us via the cookie banner. These cookies make it possible to recognize your browser via our analysis tool Google Analytics on your next visit, but not to identify you. Further information on the use of Google Analytics can be found below.You can set your browser in such a way that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for specific cases or in general, and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be limited.A general objection to the use of cookies used for online marketing purposes can be declared for a large number of services, especially in the case of tracking, via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/. In addition, the storage of cookies can be achieved by deactivating them in the browser settings. Please note that in this case, not all functions of this online offer may be usable.To manage your consent to cookies, our website uses the cookie consent technology of CookieScript, a service of Objectis Ltd., Laisves st. 60, LT-05120 Vilnius, Lithuania, to document your consent or refusal of consent to the storage of certain cookies on your device in a data protection-compliant manner. This processing is necessary to operate our website in compliance with data protection regulations. This processing corresponds to our legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR.In particular, the CookieScript tool stores a cookie in your browser in order to recognize whether you have consented to the setting of cookies or have refused or revoked this consent. This cookie is technically necessary so that you can visit our website.4. Use of Google Services4.a) Use of Google AnalyticsThis website uses functions of the web analysis service Google Analytics of Google LLC., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. For the European region, Google Ireland Limited, Gordon House, Barrow Street 4, Ireland) is responsible.Google Analytics uses so-called "cookies" (see above in this regard). The information generated by the cookie about the use of this website by the site visitor (including the truncated IP address) is usually transmitted to a Google server in the USA and stored there. Google Analytics uses a tracking code to create a random, unique ID that is linked to the cookie in your browser. This is how Google Analytics recognizes you as a new or returning user. The next time you visit our site, you will be recognized as a "returning user". All collected data is stored together with this user ID. On behalf of the site operator, Google will use this information to evaluate the use of the website, to compile reports on website activity, and to provide other services related to website and internet use to the site operator (Art. 6 para. 1 lit. f GDPR).The legitimate interest in data processing lies in the optimization of this website, the analysis of the use of the website, and the adaptation of the contents. The interests of the users are sufficiently protected by the pseudonymization, especially since they consent to the use of Google Analytics by accepting the cookies. If you consent to the setting of cookies, the legal basis for the corresponding processing of personal data is your explicit declaration of consent in accordance with Art. 6 para. 1 a GDPR.The following cookies are used by Google Analytics: Name: _ga_CKS5MND38SPurpose: Storage of the user ID; serves to distinguish website visitors. Storage duration: 1 year 1 month Name: _gaPurpose: Contains a randomly generated user ID. Based on this ID, Google Analytics can recognize returning users on this website and merge the data from previous visits.Storage duration: 1 year 1 month Collection by Google Analytics can be prevented by the site visitor adjusting the cookie settings for this website. The collection and storage of the IP address and the data generated by cookies can also be objected to at any time with effect for the future. The corresponding browser plugin can be downloaded and installed under the following link: https://tools.google.com/dlpage/gaoptout.The site visitor can prevent collection by Google Analytics on this website by clicking on the following link. An opt-out cookie will be set which prevents the future collection of data when visiting this website (https://tools.google.com/dlpage/gaoptout).Further information on data use by Google, settings, and objection options can be found in Google's privacy policy (https://policies.google.com/privacy), as well as in the settings for the display of advertising by Google (https://adssettings.google.com/authenticated). Through Google Analytics, personal data is partly also transferred to the USA. The USA is not a safe third country in the sense of European data protection laws, so personal data transferred to the USA is not subject to the same standard of protection as in Europe. However, Google participates in the so-called Data Privacy Framework to ensure compliance with European data protection standards. You can view the participation of Google LLC. in the EU-US Data Privacy Framework here: https://www.dataprivacyframework.gov/list  Further information on data protection at Google LLC can be found here: https://policies.google.com/privacy?hl=en. 4.b) Use of Google Adwords‍We use the marketing and remarketing services (in short "Google Marketing Services") of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.The Google Marketing Services allow us to display advertisements for and on our website in a more targeted manner in order to present users only with ads that potentially correspond to their interests. If, for example, a user is shown ads for products he has been interested in on other websites, this is referred to as "remarketing". For these purposes, when our website and other websites on which Google Marketing Services are active are accessed, a code is executed directly by Google and so-called (re)marketing tags (invisible graphics or code, also known as "Web Beacons") are integrated into the website. With their help, an individual cookie, i.e., a small file, is stored on the user's device (comparable technologies can also be used instead of cookies). The cookies can be set by different domains, including google.com, doubleclick.net, invitemedia.com, admeld.com, googlesyndication.com, or googleadservices.com.This file records which websites the user has visited, what content he was interested in, and which offers he clicked on, as well as technical information about the browser and operating system, referring websites, visit time, and other details on the use of the online offer.The IP address of the users is also recorded, whereby we inform within the scope of Google Analytics that the IP address is truncated within member states of the European Union or in other contracting states of the Agreement on the European Economic Area and is only in exceptional cases transmitted in full to a Google server in the USA and truncated there. The IP address is not merged with user data within other Google offers. This aforementioned information can also be linked with such information from other sources. If the user subsequently visits other websites, he can be shown ads tailored to his interests.The data of the users is processed pseudonymously within the scope of Google Marketing Services. This means that Google does not store and process, for example, the name or email address of the users, but processes the relevant data in a cookie-related manner within pseudonymous user profiles. This means that, from Google's perspective, the ads are not managed and displayed for a specifically identified person, but for the cookie holder, regardless of who this cookie holder is. This does not apply if a user has explicitly allowed Google to process the data without this pseudonymization.The Google Marketing Services we use include the online advertising program "Google AdWords". In the case of Google AdWords, each AdWords customer receives a different "conversion cookie". These cookies can therefore not be tracked across the websites of AdWords customers. The information obtained with the help of the cookie is used to generate conversion statistics for AdWords customers who have opted for conversion tracking. AdWords customers learn the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users.For this purpose, we have also set up Enhanced Conversions, a function with which the accuracy of conversion tracking can be improved, while protecting the privacy of users, by supplementing existing conversion tags with hashed first-party conversion data from the website. Hashing the first-party data before sending it to Google Ads ensures data protection, as personal information (such as email address here) is converted into a hashed / pseudonymized (SHA256) character string.The legal basis for the processing of your data is Art. 6 para. 1 sentence 1 lit. a GDPR, insofar as the processing of your personal data is based on a cookie. In addition, we have the right to effectively advertise our company, so that we base data processing on Art. 6 para. 1 lit. f GDPR. In doing so, we assume that your interests do not conflict.4.c) Use of "DoubleClick"‍We integrate third-party advertisements on the basis of the Google Marketing Service "DoubleClick". DoubleClick uses cookies that enable Google and its partner websites to serve ads based on users' visits to this website or other websites on the internet.We also integrate third-party advertisements on the basis of the Google Marketing Service "AdSense". AdSense uses cookies that enable Google and its partner websites to serve ads based on users' visits to this website or other websites on the internet. The information collected by "DoubleClick" about users is transmitted to Google and stored on Google's servers in the USA. Further information on data protection at Google can be found above under 4.a).Further information on the use of data for marketing purposes by Google can be found on the overview page: https://www.google.com/policies/technologies/ads/, Google's privacy policy is available at https://www.google.com/policies/privacy/.The legal basis for the processing of your data is Art. 6 para. 1 sentence 1 lit. a GDPR, namely your explicit consent to set the corresponding cookie.Storage duration or deletion of data: If you wish to object to the collection by Google Marketing Services, you can use the settings and opt-out options provided by Google: http://www.google.com/ads/preferences/ ‍The following cookies are used by DoubleClick:Name: Gcl_auPurpose: This cookie is set by DoubleClick and contains information on how the end user uses the website, as well as about advertising that the end user may have seen before visiting this website. Storage duration: 3 months Name: IDEPurpose: This cookie is set by Doubleclick and contains information on how the end user uses the website, as well as about advertising that the end user may have seen before visiting this website.Storage duration: 1 year 4.d) Use of YouTube Services‍Services of YouTube, a service of Google Ireland Limited (address see above), are also integrated on our website. Insofar as cookies are set in this regard, the legal basis for the processing of your data is Art. 6 para. 1 sentence 1 lit. a GDPR, namely your explicit consent to set the corresponding cookie.‍The following cookies are set by YouTube:Name: YSCPurpose: This cookie registers a unique ID to generate statistics of the YouTube videos watched by the user.Storage duration: Session  Name: VISITOR_PRIVACY_METADATAPurpose: YouTube visitor privacy metadata cookieStorage duration: 6 months
5. Use of HotjarWe use Hotjar, a technology tool of Hotjar Ltd, Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian’s STJ 3141, Malta, to better understand our users' needs and to optimize our website and your visit to our website (e.g., how much time they spend on which pages, which links they click on, what users like and dislike, etc.) and this enables us to build and maintain our service with user feedback.Hotjar uses cookies and other technologies to collect data on our users' behavior and their devices. This includes a device's IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf. We have concluded a data processing agreement with Hotjar, which protects compliance with applicable data protection laws.Further information on data protection at Hotjar can be found at: https://www.hotjar.com/legal/policies/privacy/According to Hotjar and our contractual agreement, a transfer of personal data to countries outside the EU does not take place.The following cookies are used by Hotjar: Name: hjSession_3666709Purpose: Contains current session data. Ensures that subsequent requests in the session window are attributed to the same session. Storage duration: 30 minutes Name: _hjSessionUser_3666709Purpose: Set when a user first lands on a page. Ensures that data from subsequent visits to the same website are attributed to the same user ID. User is not tracked across other websites.Storage duration: 1 year6. Use of FramerFramer is a tool of Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands (hereinafter Framer).
When you visit our website, Framer collects various log files including your IP addresses.
Framer is a tool for creating and hosting websites. Framer stores cookies or other recognition technologies that are necessary for the display of the site, to provide certain website functions, and to ensure security (necessary cookies).
The use of Framer is based on Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in the most reliable presentation of our website and assume that you as a visitor to our website also have an interest in this presentation and that your data protection interests do not outweigh this.
Through Framer, personal data is partly also transferred to the USA. The USA is not a safe third country in the sense of European data protection laws, so personal data transferred to the USA is not subject to the same standard of protection as in Europe. As a legal basis for data transfers to third countries, Framer uses standard contractual clauses approved by the EU Commission in accordance with Art. 46 para. 2 and 3 GDPR, in order to comply with the European data protection level even outside the EU.
Further information on data protection at Framer can be found here: https://www.framer.com/privacy/
7. Contact Opportunity via the WebsiteWe are pleased if you contact us via email or telephone using the contact details mentioned in the imprint. In addition, you also have the opportunity to contact us via our contact form on the website. The data transmitted to us in this regard is automatically stored and forwarded to the responsible employees at our company for answering, who will then contact you directly.The processing of personal data takes place in this respect for the preparation of a contractual relationship as well as, if applicable, the fulfillment of our obligations under contracts already concluded, Art. 6 (1) (b) GDPR.As part of the contact via the website, we process your first and last name, email address, telephone number, the company for which you are writing to us, and, if applicable, other personal data that you share with us via the free text fields in the contact form.
7a. Use of NetlifyFor the hosting of our Heero Assistant (chatbot), we use the services of Netlify. The provider is the US company Netlify Inc., based at 101 2nd Street, Suite 575, San Francisco, CA 94105, USA.
Within the scope of use, personal data is partly processed in the United States. Netlify participates in the EU-US Data Privacy Framework, which enables a legally compliant and protected transfer of personal data of European users to the USA. Further details in this regard are available at https://commission.europa.eu/document/download/e5a39b3c-6e7c-4c89-9dc7-016d719e3d12_en?filename=Draft%20adequacy%20decision%20on%20EU-US%20Data%20Privacy%20Framework_0.pdf.
In addition, so-called standard contractual clauses are applied (pursuant to Art. 46 para. 2 and 3 GDPR). These standard contractual clauses are contract templates developed by the European Commission, which are intended to ensure that your data corresponds to the European level of data protection – even when transmitted and stored in third countries such as the USA. Both through participation in the EU-US Data Privacy Framework and through the standard contractual clauses, Netlify undertakes to comply with European data protection standards when processing your data, even if its storage, processing, and management take place in the USA. The clauses are based on an implementing decision of the European Commission. You can view the decision as well as the standard contractual clauses, among other places, here: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX%3A32021D0914&qid=1761055082952.
A data processing agreement pursuant to Art. 28 GDPR exists with Netlify, which forms the data protection basis of our business relationship. This contract refers to the EU standard contractual clauses and is filed with us and available here https://www.netlify.com/pdf/netlify-dpa.pdf. For further information on data processing by Netlify, please refer to the privacy policy at https://www.netlify.com/gdpr-ccpa.8. Integration of Social Media Platforms such as LinkedIn and InstagramSocial media platforms are integrated on our website via a simple link. A data transfer to the following social media platforms only takes place if you click on the corresponding link. We have integrated links to the offers of the following companies on our website:‍A click on the Instagram icon establishes a direct connection to the services of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Please refer to the provider's privacy policy to see which data is collected and how it is used: https://help.instagram.com/A click on the LinkedIn icon establishes a direct connection to the services of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Pl, Grand Canal Dock, Dublin 2, Ireland. Please refer to the provider's privacy policy to see which data is collected and how it is used: www.linkedin.com/legal/privacy-policy‍A click on the YouTube icon or on a video on our website establishes a direct connection to the services of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. Further information about data protection at YouTube can be found in their privacy policy at: https://policies.google.com/privacy?hl=en.  ‍9. Routine Deletion and Blocking of Personal DataWe store personal data in accordance with the respective purpose of storage only for the period necessary to achieve the purpose of storage. This results in particular from the commercial retention and archiving periods applicable to us.‍10. Your Rights as a Data SubjectAs a data subject, you have certain rights in relation to your personal data, which we would like to explain below:‍‍Right of Access (Art. 15 GDPR) – Under the conditions specified in Art. 15 GDPR, you have the right to obtain confirmation from us as to whether personal data concerning you are being processed, and, if that is the case, access to the personal data and certain information about their processing. Please note that this right is subject to certain statutory limitations (in particular pursuant to Section 34 BDSG).‍Right to Rectification (Art. 16 GDPR) – Under the conditions specified in Art. 16 GDPR, you have the right to obtain from us the rectification of inaccurate personal data and the completion of incomplete personal data concerning you.‍Right to Erasure / Right to be Forgotten (Art. 17 GDPR) – Under the conditions specified in Art. 17 GDPR, you have the right to obtain from us the erasure of certain personal data concerning you, e.g., data that are no longer necessary for legitimate purposes (e.g., establishment, exercise, or defense of legal claims).‍Right to Restriction of Processing (Art. 18 GDPR) – Under the conditions specified in Art. 18 GDPR, you have the right to obtain from us the restriction of processing of certain personal data, for example data which you claim is inaccurate.‍Right to Data Portability (Art. 20 GDPR) – Under the conditions specified in Art. 20 GDPR, you have the right to have personal data concerning you, which are processed automatically solely on the basis of your consent, transmitted by us to third parties in a machine-readable format.‍Right to Object (Art. 21 para. 1 GDPR) – Under the conditions specified in Art. 21 GDPR, you have the right to object, on grounds relating to your particular situation, to certain processing operations of your personal data. In such a case, we cannot comply with your objection if compelling legitimate grounds for the processing exist which override your interests, or if the processing is necessary for the establishment, exercise, or defense of legal claims.‍Right to Object to Direct Marketing (Art. 21 para. 2 GDPR) – You can object to the further processing of personal data concerning you for direct marketing purposes at any time, with the result that we will no longer process it for this purpose; this also applies to profiling insofar as it is related to such direct marketing.‍‍Automated Decisions (Art. 22 GDPR) – Without your consent, we will not make any decisions that produce legal effects concerning you or similarly significantly affect you and that are based solely on automated processing (including profiling).‍‍Right to Lodge a Complaint‍You have the right to lodge a complaint with a supervisory authority. This can be, among others, the supervisory authority responsible for your place of residence or the supervisory authority generally responsible for us (Section 1.3.).The data protection supervisory authority responsible for us is:Bayerisches Landesamt für DatenschutzaufsichtStreet address: Promenade 27 (Schloss)P.O. Box: 60691522 AnsbachGermany‍Contact details of the data protection supervisory authority:T +49 981 53 1300F +49 981 53 98 1300poststelle@lda.bayern.deIf you wish to submit a complaint, you can also use the complaint form provided at https://www.lda.bayern.de/de/beschwerde.html.You can contact us in any form to exercise your rights, in particular to withdraw any consent you may have given, including via the contact details mentioned in the imprint. To exercise your rights, it may be necessary for you to identify yourself to us as the data subject.‍11. Confidentiality and Security of Your Personal Data‍We are obliged to keep the personal data provided to us secure, and we have implemented appropriate information security policies, rules, and technical measures to protect the personal data under our responsibility from unauthorized access, improper use or disclosure, unauthorized modification, and unlawful destruction or accidental loss. All of our partners, employees, consultants, workers, and data processors (i.e., those who process your personal data on our behalf for the aforementioned purposes) with access to personal data and responsibility for its processing are obliged to respect the confidentiality of this personal data.‍12. Questions about Data Protection‍If you have any questions about data protection at HEERO Motors GmbH, you are welcome to address these questions to privacy@heero-motors.de.