Privacy notice

1. Controller

Technopolis GmbH
Trading under the brand Zulago.de
Nobelstr. 3-5
41189 Mönchengladbach
Germany

Represented by: Karim Hajou (Managing Director)

Email: info@zulago.de
Privacy: datenschutz@zulago.de
Website: https://zulago.de

2. Privacy contact

No company data protection officer has currently been appointed. For all privacy enquiries, contact datenschutz@zulago.de.

3. Principles of processing

We process personal data only to the extent necessary to operate the website, perform contracts, particularly vehicle registration orders, comply with legal obligations or pursue narrowly defined legitimate interests.

Legal bases under Article 6(1) GDPR:

• point (b) - contract or pre-contractual measures (registration order, payment, signature and status communication)
• point (c) - legal obligation (including FZV requirements, commercial and tax retention duties and GKS requirements)
• point (f) - legitimate interests (IT security, prevention of misuse and fraud, and technical logs)
• point (a) - consent where requested separately, for example for optional processing

Retention periods (summary): Registration-related documents are generally kept for at least two years in the FZV/SDÜ context; invoices and accounting records for up to eight or ten years under AO/HGB; and technical logs usually for a few months unless security or evidentiary requirements justify longer retention. Data is then deleted or anonymised unless statutory reasons prevent this.

4. Website and technical data

When the website is accessed, technically necessary connection data is processed, such as the IP address, timestamp, requested resource and user agent, to deliver the website and ensure security under Article 6(1)(f) GDPR. IP addresses are retained only as long as necessary for operations and security.

Cookies: We use technically necessary cookies or similar storage technologies for sessions, authentication and security. Optional marketing or tracking cookies are not currently used. If this changes, we will obtain consent in advance where required.

If you contact us by email or through a form, we process the information you provide to handle the enquiry under Article 6(1)(b) or (f) GDPR.

5. Vehicle registration (core service)

When you place a registration order, we process the data required for the relevant transaction, in particular:

• Holder and contact data such as name, address, date of birth, email and phone
• Vehicle data including VIN, HSN/TSN, registration number, eVB and registration certificate information
• Payment and invoice data including payment status; IBAN only where required for SEPA or vehicle tax direct debit; access is restricted to required server-side processes
• Power of attorney and QES data including signature process, status and signed documents
• Documents uploaded by you or created during the process, such as ID, registration certificates and CoC, in each case only for the relevant purpose

Purposes: Performing the registration order, transmitting data to the KBA through GKS, communicating with you, payment and invoicing, support, and compliance with statutory and supervisory obligations.

Recipients where required:

• Federal Motor Transport Authority (KBA) and the competent registration authority through the GKS/SABRINA channel
• Yousign for identity verification and qualified electronic signatures in Germany
• Stripe for payment processing (PCI DSS; third-country transfers only with appropriate safeguards, in particular Standard Contractual Clauses)
• Resend for transactional email, with appropriate safeguards where a third-country transfer is involved
• License plate and shipping partners for stamping and dispatch where you order license plates

We do not disclose personal data to third parties for advertising purposes.

6. Hosting and infrastructure

The production application, database, authentication and file storage run on servers operated by Hetzner Online GmbH in Germany. The Supabase components in use (PostgreSQL, Auth and Storage) are operated by us as an open-source stack on this infrastructure and not as a Supabase Cloud tenant in a third country.

Backups are encrypted and retained on controlled infrastructure. Legal basis: Article 6(1)(b), (c) and (f) GDPR.

7. Processors and third countries

Where service providers process data on our behalf, this is based on data processing agreements under Article 28 GDPR where required. For transfers to countries outside the EEA, we use appropriate safeguards, in particular EU Standard Contractual Clauses under Article 46 GDPR, and limit access to what is necessary.

8. Security

We implement appropriate technical and organisational measures, including TLS transport, access restrictions, role-based permissions, logging of security-relevant events, additional access protection for sensitive fields such as IBAN, and separate production and test environments.

9. Your rights under Articles 15-21 and 77 GDPR

Within the statutory framework, you have the right to:

• access personal data stored about you
• rectification of inaccurate data
• erasure where no statutory retention obligation applies
• restriction of processing
• data portability
• object to processing based on legitimate interests
• withdraw consent with effect for the future
• lodge a complaint with a supervisory authority, in particular the competent data protection authority in North Rhine-Westphalia

To exercise your rights, send an informal request to datenschutz@zulago.de.

10. No automated decision-making

We do not use solely automated decision-making within the meaning of Article 22 GDPR that produces legal effects concerning you or similarly significantly affects you. Registration decisions are made by the competent authorities under the statutory process.

11. Changes to this notice

We update this privacy notice when the law, our services or the processing activities in use change. The version published on this page with the stated date applies.

12. Contact

Technopolis GmbH
Nobelstr. 3-5, 41189 Mönchengladbach
Privacy: datenschutz@zulago.de
General: info@zulago.de

Further provider information: Imprint