This policy describes the website’s current technical state. The controller’s name and serviceable address still have to be inserted; provider documentation is maintained separately.
Trading name: HOTIM Vehicle Design & Project Coordination
Email: info.hotim@gmail.com
No data protection officer has been appointed because no statutory appointment requirement is currently apparent. Privacy enquiries can be sent directly to the email address stated above.
This website is provided through ChatGPT Sites. For site operators based in Germany, OpenAI Ireland Ltd. processes personal data generated by the published website as a processor under the Data Processing Addendum incorporated into the ChatGPT Sites terms.
When a page is opened, the IP address, date and time, requested URL, referrer, browser and device information, HTTP status, transferred volume, security data and diagnostics may be processed. The purposes are delivery, stability, fault analysis, abuse and attack detection, and technical administration. The legal basis is Article 6(1)(f) GDPR: the legitimate interest in secure, reliable and efficient operation.
ChatGPT Sites currently offers no guaranteed data residency. OpenAI may use subprocessors for hosting, infrastructure, support and security reviews. Where data is processed outside the EEA, the safeguards described in the Data Processing Addendum apply, including the EU Standard Contractual Clauses where required.
Further information: ChatGPT Sites Data Processing Addendum, OpenAI subprocessor list
Your choice is stored locally in your browser under hotim_consent_v3. It contains the settings version, essential status, analytics choice, decision time and expiry time. It expires after 180 days and normally remains on your device. Earlier consent entries are removed so that a new, specific choice is required.
Google Analytics 4 is technically active but is loaded only after your express consent. You may accept or reject all optional services or set the analytics choice individually.
Remembering the choice prevents the prompt from appearing on every visit under Section 25(2)(2) TDDDG and Article 6(1)(f) GDPR. You can change or delete the choice at any time through Cookie settings. When analytics consent is withdrawn, reachable HOTIM GA cookies are deleted and the page reloads without the Google tag.
Cloudflare may set the strictly necessary __cf_bm cookie to identify automated traffic. It is used for bot and abuse protection, not advertising, and according to the provider typically expires after about 30 minutes.
The contact form sends the data you enter directly to Formspree, Inc., USA. Depending on your input, this includes company, contact person, email, location, vehicle and project data, message, privacy acknowledgement, optional files and technical connection and security data such as IP address, browser, time and source.
The purpose is secure receipt, spam prevention, forwarding and processing of your non-binding project enquiry. Article 6(1)(b) GDPR applies to pre-contractual enquiries; other business communications are processed under Article 6(1)(f) GDPR.
Formspree states that it hosts through Amazon Web Services in the USA and relies on EU Standard Contractual Clauses for third-country transfers as a processor. Use of the form is voluntary; you may contact HOTIM by email instead.
Further information: Formspree Privacy Policy, Formspree Security
You may voluntarily submit a logo or design file and up to four vehicle photos. Each file is limited to 10 MB and only the listed formats are accepted. Upload only necessary, lawful content and obscure number plates, faces and unnecessary third-party data.
Do not submit health data, identity documents, payment data or other special categories of personal data under Article 9 GDPR. Anyone submitting third-party data must be authorised to do so.
Emails to info.hotim@gmail.com and form notifications are processed through Gmail. Sender and recipient details, email address, time, subject, content, attachments and technical connection data may be processed. The provider for EEA users is generally Google Ireland Limited; processing by affiliates and providers in third countries is possible.
The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual communication and Article 6(1)(f) GDPR for other business communication.
Further information: Google Privacy Policy
Form data and files are not automatically forwarded. Transfer occurs only if you request a technical inspection or separate quotation and after the specific contractor, purpose and scope have been disclosed transparently. The legal basis is normally Article 6(1)(b) GDPR; separate consent is obtained where required.
The separately commissioned contractor generally processes transferred data under its own responsibility for its quotations, contracts and technical services and provides its own privacy information.
Where required for the relevant purpose, recipients may include hosting and infrastructure providers, form, email, IT and security providers, the contractor named at your request, and public authorities, courts, tax or legal advisers where legally required or necessary to enforce rights.
Transfers outside the EEA take place only where Articles 44 et seq. GDPR are satisfied, for example through an adequacy decision or suitable safeguards such as the EU Standard Contractual Clauses.
Personal data is retained only as long as required for its purpose. Non-binding enquiries without a subsequent order are normally retained for follow-up questions for up to six months after final handling and are then deleted unless consent, a statutory duty or legal claims justify longer retention.
If a contract is concluded, contractual and accounting documents are stored separately under commercial and tax retention duties. Formspree and Gmail are checked monthly for expired periods; the relevant request, available attachments and complete email thread are deleted, and the Gmail bin is emptied. Copies in Google Drive, downloads or local project folders are reviewed and deleted separately.
Technical logs, recovery data and backups follow each provider’s contractual deletion cycle. Statutory retention duties, documented claims and any Google Workspace retention rules or holds may temporarily prevent deletion.
After your express analytics consent, the website loads Google Analytics 4 from Google Ireland Limited with Measurement ID G-PTXJDE35P9. It measures pages, time, referrer and approximate location and device information. HOTIM additionally records page_view, form_start, quote_request_click, email_click and one generate_lead after successful Formspree submission. Only non-personal categories—form_name, service_category, object_type, content_language and link location—are sent. Names, contact data, free text, locations and files are not sent to GA4.
Consent Mode v2 starts analytics_storage, ad_storage, ad_user_data and ad_personalization as denied. Under the Basic Consent model, the Google tag loads only after consent. Advertising signals and personalisation remain disabled. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG.
After consent, Google Analytics may set _ga and _ga_PTXJDE35P9. HOTIM limits their lifetime to 180 days from first placement and does not renew it on later visits. Withdrawal deletes reachable HOTIM GA cookies and reloads the page without the Google tag.
Google may process data in third countries under its applicable transfer mechanisms. HOTIM uses the shortest selectable GA4 retention period of two months for user- and event-level data; aggregated standard reports may remain unaffected.
Google Tag Manager, advertising trackers, external maps, social plugins and embedded videos are not active. Fonts are served locally, so page views do not connect to Google Fonts.
Further information: Google Privacy Policy
Subject to statutory requirements, you have rights of access under Article 15 GDPR, rectification under Article 16, erasure under Article 17, restriction under Article 18, portability under Article 20 and objection under Article 21. Consent may be withdrawn at any time with future effect under Article 7(3).
Send a message to info.hotim@gmail.com to exercise your rights. Reasonable proof of identity may be required to prevent unauthorised disclosure.
Where personal data is processed on the basis of legitimate interests, you may object at any time for reasons arising from your particular situation. The data will then no longer be processed unless compelling legitimate grounds or the establishment, exercise or defence of legal claims prevail.
You may complain to a data protection supervisory authority, particularly at your place of residence, workplace or the place of the alleged infringement. For the intended business location in Hessen, the competent contact is the Hessian Commissioner for Data Protection and Freedom of Information, Wilhelmstraße 7, 65185 Wiesbaden, Germany, poststelle@datenschutz.hessen.de.
Fields marked as required are needed to allocate and answer your enquiry. Without them, the form cannot be sent; email contact remains possible. Data is encrypted in transit through HTTPS, although entirely risk-free internet transmission cannot be guaranteed.
No solely automated decision with legal or similarly significant effects and no profiling takes place.
This policy is updated when website functions, providers, legal bases or statutory requirements change. The version published on this page applies.
Google Analytics 4: G-PTXJDE35P9