Privacy Policy

Next Point GmbH | As of: 2 September 2026

This Privacy Policy provides information on the processing of personal data in connection with the operation of the Next Point GmbH website and with vehicle, appointment and reservation enquiries.

Next Point GmbH Auf den Geisten 10 40468 Düsseldorf Germany

Telephone: +49 211 16360046 Email: [email protected]

We process personal data only to the extent necessary to provide and securely operate our website, process enquiries, take steps prior to entering into a contract, perform a contract, comply with legal obligations, or on the basis of another statutory permission.

Personal data means any information relating to an identified or identifiable natural person.

No solely automated decision-making, including profiling within the meaning of Article 22 GDPR, currently takes place on this website.

When you access our website, technically necessary connection, log and security data are processed.

The processing is carried out to provide the website technically, ensure the stability and security of the systems, detect or prevent attacks and abusive access, and investigate technical errors.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and reliable operation of our online offering.

Security and log data are stored only for as long as necessary for the respective technical or security-related purpose. Data may be stored for longer if there are specific indications of a security incident, misuse or unlawful access and the data is required for investigation, preservation of evidence or legal enforcement.

IP address

Date and time of access

Page or file accessed

Amount of data transferred

Referrer URL, where transmitted by the browser

Browser type and browser version

Operating system

HTTP status code

Technical security and connection information

We use services of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, for parts of our server and application infrastructure.

According to our current configuration, the application infrastructure we use is operated within the European Union.

As part of the hosting, Hetzner processes in particular technical connection data and data processed through our website and stored on the relevant infrastructure.

Where Hetzner processes personal data on our behalf, this is carried out on the basis of a data processing agreement pursuant to Article 28 GDPR.

The legal basis for using the hosting provider is Article 6(1)(f) GDPR. Our legitimate interest lies in providing our online offering securely, efficiently and reliably.

We use services of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, to provide our website securely and efficiently.

Cloudflare provides in particular network, security, content-delivery, tunnel and, where applicable, media services. In this context, IP addresses and technical connection, device, browser and security information in particular may be processed.

Cloudflare is used in particular to deliver the website, defend against DDoS attacks and other abusive access, improve availability and secure the technical infrastructure.

The legal basis for processing personal data is Article 6(1)(f) GDPR. Our legitimate interest lies in providing our website securely, stably and efficiently.

Cloudflare operates a global infrastructure. It therefore cannot be ruled out that personal data may also be processed outside the European Economic Area.

For transfers of personal data from the European Economic Area to the United States, Cloudflare states that it relies in particular on its certification under the EU-U.S. Data Privacy Framework. In addition, the standard contractual clauses approved by the European Commission and, where applicable, additional safeguards are used.

Processing by Cloudflare on behalf of Next Point GmbH is carried out within the framework of the applicable data-protection agreements.

If you contact us using a form on this website or send an enquiry about a vehicle, we process the data you provide.

The processing is carried out to handle your enquiry and, where your enquiry concerns the possible purchase of a vehicle or another contractual service, to take steps prior to entering into a contract. The legal basis is Article 6(1)(b) GDPR.

Where an enquiry has no specific contractual connection, processing may also be based on Article 6(1)(f) GDPR. Our legitimate interest lies in the proper handling of business enquiries and communications.

Required fields in a form are necessary so that we can process and respond to the respective enquiry. Providing optional fields, in particular an optional telephone number, is not mandatory.

Without the information marked as required, we may be unable to process the respective enquiry.

Name

Email address

Telephone number, where provided

Content of your message

Reference to a specific vehicle

Type of enquiry

Selected language

Technical time and reference information

For appointment or reservation enquiries, we additionally process the information required to handle the enquiry, in particular the requested vehicle, requested date and, where applicable, a requested time window.

Processing is carried out pursuant to Article 6(1)(b) GDPR in order to take steps prior to entering into a contract.

A reservation enquiry submitted through the website is initially non-binding unless expressly agreed and confirmed otherwise.

Submitting such an enquiry does not automatically conclude a purchase contract or automatically trigger a payment.

If you contact us by email or telephone, we process the personal data you provide in order to handle and respond to your enquiry.

Where the communication relates to the initiation or performance of a contract, processing is based on Article 6(1)(b) GDPR.

For other business enquiries, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in efficient and traceable business communication.

Email and IT service providers used by us may be used as recipients or processors for the technical provision of email communications.

Personal data is generally stored only for as long as necessary for the respective processing purpose.

Enquiries that do not result in a contractual relationship are generally deleted once the enquiry has been fully dealt with and there are no legitimate reasons for further storage.

Where temporary further retention is necessary to document communications or to establish, exercise or defend potential legal claims, data may be stored on the basis of Article 6(1)(f) GDPR for the period required for this purpose.

If an enquiry results in a purchase contract or another contractual relationship, contract- and business-related documents are retained in accordance with statutory commercial and tax-law retention obligations.

Depending on the type of document, statutory retention periods may in particular be six, eight or ten years.

The legal basis for this is Article 6(1)(c) GDPR in conjunction with the applicable commercial and tax-law provisions.

After the respective retention period expires, the data is deleted unless another legal basis permits further storage.

If you actively select the language of our website, we store your selection in the technically necessary cookie np_locale so that your chosen language can be retained on later page visits.

The storage is necessary to provide the language function you expressly requested.

Where information is stored on or read from your terminal device for this purpose, this is carried out on the basis of § 25(2) no. 2 TDDDG.

Where personal data is processed in this context, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in technically providing the website presentation you selected.

The light or dark display mode you select for the website may be stored locally in your browser under np_appearance.

According to the current technical implementation, this information is stored exclusively locally on your terminal device and is used to retain the website presentation you selected.

Where information is stored on or read from your terminal device for this purpose, this is carried out on the basis of § 25(2) no. 2 TDDDG because the storage serves to provide a function expressly requested by you.

To secure the website, our technical service providers, in particular Cloudflare, may use technically necessary security information or cookies where required.

This may serve in particular to detect automated or abusive access, protect against attacks or carry out a security check.

Where storing or accessing information on the user's terminal device is strictly necessary for this purpose, this is carried out on the basis of § 25(2) no. 2 TDDDG.

Such technically necessary functions are not used for advertising or marketing purposes.

At present, we do not use enabled web analytics or marketing or tracking cookies for advertising purposes on this website.

Relevant analytics, marketing or tracking technologies will not be activated until the data-protection requirements applicable to them have been met.

Where consent is required under § 25 TDDDG or the GDPR, such technologies will be activated only after the user has given valid prior consent.

Consent that has been given may be withdrawn at any time with effect for the future.

Within Next Point GmbH, personal data is made accessible only to those persons who require the data for the respective purpose.

In addition, personal data may in particular be transferred to the following recipients or categories of recipients:

Where service providers process personal data exclusively on our behalf, they are engaged on the basis of a data processing agreement pursuant to Article 28 GDPR where required by law.

Hosting and infrastructure service providers

Network and security service providers

Email and communication service providers

IT and technical support service providers

Tax advisers, lawyers and other professional advisers, where necessary

Authorities, courts or other public bodies where there is a legal obligation or where this is necessary to establish, exercise or defend legal claims

Personal data is transferred to countries outside the European Economic Area only where the statutory requirements of Articles 44 et seq. GDPR are met.

In connection with the global services provided by Cloudflare, processing may take place in particular in the United States.

Where an adequacy decision of the European Commission exists for a third country, the transfer may be based on Article 45 GDPR.

Where no suitable adequacy decision applies, a transfer takes place only using appropriate safeguards pursuant to Article 46 GDPR, in particular the standard contractual clauses of the European Commission, supplemented by additional safeguards where applicable.

Subject to the statutory requirements, you have in particular the following rights:

Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

pursuant to Article 15 GDPR, to request access to the personal data we process about you

pursuant to Article 16 GDPR, to request rectification of inaccurate data or completion of incomplete data

pursuant to Article 17 GDPR, to request erasure of your personal data

pursuant to Article 18 GDPR, to request restriction of processing

pursuant to Article 20 GDPR, to receive your data in a structured, commonly used and machine-readable format or to request its transmission

pursuant to Article 21 GDPR, to object to certain processing

to withdraw consent at any time with effect for the future pursuant to Article 7(3) GDPR

Where we process personal data on the basis of Article 6(1)(f) GDPR for legitimate interests, you have the right at any time, on grounds relating to your particular situation, to object to such processing.

We will then no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Pursuant to Article 77 GDPR, you have the right to lodge a complaint with a data-protection supervisory authority if you believe that the processing of your personal data infringes data-protection law.

The following supervisory authority is in particular competent for Next Point GmbH:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW) Kavalleriestraße 2-4 40213 Düsseldorf Germany

Telephone: +49 211 38424-0 Email: [email protected]

You may also contact another data-protection supervisory authority competent under the statutory provisions.

We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access, unauthorised disclosure or other unlawful processing.

The security measures are reviewed and adapted in line with technical developments and the respective risk.

Data transmission between your browser and our website is generally encrypted.

We currently do not use any solely automated decision-making processes on this website, including profiling within the meaning of Article 22 GDPR, that produce legal effects concerning you or similarly significantly affect you.

If you have questions about the processing of your personal data or wish to exercise your data-protection rights, you can contact us:

Next Point GmbH Email: [email protected]

We reserve the right to adapt this Privacy Policy if our website, the technical services used or the legal requirements change.

The current version published on this website applies.

As of: 2 September 2026