Privacy
This notice explains how Autoglas OLM GmbH processes personal data when you visit this website, contact us or submit a vehicle glass or fleet enquiry.
1. Controller
Autoglas OLM GmbH, Karl-Hohmann-Str. 65, 40597 Düsseldorf, Germany. Managing director: Zekeriya Olmustur. Telephone: +49 211 6686725. Email: info@autoglasolm.com.
Please contact us using these details if you have questions about privacy or wish to exercise your data protection rights.
2. Website access and hosting
When you visit a page, necessary connection data is processed, including IP address, requested address, time, data volume, HTTP status, browser and operating system details and, where available, the referring page. This supports delivery, troubleshooting and protection against unauthorised access. The legal basis is Article 6(1)(f) GDPR, our interest in secure and functional operation.
Hosting and the business email mailbox are provided by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. We use STRATO Webmail. STRATO email archiving is also activated, but complete capture has not yet been verified. The separate archive may store messages, including vehicle details, VINs, insurance information and attachments, independently of the mailbox. Its default retention setting is eleven years. This is not a blanket statutory retention duty for every message; necessary retention and lawful erasure follow section 11. Deleting a mailbox message does not remove an archive copy.
STRATO makes access logs available for download for the preceding six weeks. This availability period does not promise complete physical deletion of all provider data. Security and error logs support secure hosting and specific diagnostics. We retain our own diagnostic copies only while needed for the specific diagnostic or security purpose and any applicable obligations.
3. Vehicle glass enquiries
Depending on the information you provide, we process vehicle category, make, model, year or first registration, vehicle identification number (VIN), optional HSN/TSN codes, glass and equipment details, damage description, insurance and excess information, requested service and location, your name, email address, optional telephone number and any message.
We use these details to identify the vehicle and suitable glass, check availability, ask questions and prepare an individual quotation. Required fields are marked in the form. Submitting an enquiry does not constitute a binding order.
The legal basis is Article 6(1)(b) GDPR for pre-contractual measures at your request, or Article 6(1)(f) GDPR for relevant communications with business contacts.
After successful security and input validation, a random enquiry reference is generated. Your enquiry is transmitted to info@autoglasolm.com through STRATO’s encrypted, authenticated SMTP service. An acknowledgement with the same reference and a reduced summary is sent to the email address you provide. The customer confirmation does not copy a full VIN from the vehicle field or structured insurance information from the corresponding form fields. Optional free text may form part of the summary. This is not a binding order confirmation. This applies to vehicle and fleet enquiries; your details are not used for marketing emails.
You are not legally required to provide us with personal information. However, we cannot process the online form without the required details for the option you choose. You can contact us by telephone or email instead.
4. Fleet enquiries
We process the company name, optional contact person, business contact details, company location, vehicle categories, exact quantities or approximate fleet size, and any optional message.
We use these details to discuss requirements and possible services or conditions. The legal basis is Article 6(1)(b) GDPR where applicable, or Article 6(1)(f) GDPR for communications with business representatives.
5. Optional additional information
This website does not offer photo or document uploads. Please enter only information needed for your enquiry in free-text fields and do not use them to submit document contents. We use optional additional information to handle the relevant enquiry on the legal bases described in section 3.
6. Telephone, email and WhatsApp
When you contact us, we process the details and message you provide to handle and answer your request. The legal basis is Article 6(1)(b) or (f) GDPR, depending on the nature of the request.
The WhatsApp button is an external link. A connection to WhatsApp is made only when you follow that link. The provider for users in the European Economic Area is generally WhatsApp Ireland Limited. Data may be processed outside the EEA. WhatsApp is optional; you can also contact us by telephone or email.
7. Spam protection with Cloudflare Turnstile
We use Cloudflare Turnstile to protect both enquiry forms from automated abuse. The check loads at the final step of the vehicle form and when the fleet form is displayed. Cloudflare receives technical security signals such as the IP address, TLS characteristics, User-Agent, Sitekey and associated origin. Server-side verification sends the verification token to the Siteverify interface, but no enquiry fields such as a VIN or email address. A failed check prevents submission.
The provider is Cloudflare, Inc., USA. Cloudflare processes signals on our behalf to secure our website and also acts as an independent controller when improving its bot detection. We rely on Article 6(1)(f) GDPR for our form protection processing (our interest in a secure contact channel free from abuse). Cloudflare also describes legitimate interests for its own improvements. Section 25(2), point 2 TDDDG is relied on for storage and access strictly necessary to provide the secure form function expressly requested. No pre-clearance cookie is used to grant access to other website areas.
Processing may take place in the USA and other countries. Cloudflare’s DPA forms part of its standard agreement for processing on our behalf. It provides for the EU-US Data Privacy Framework for covered transfers to the USA and, in particular, EU Standard Contractual Clauses for other relevant international transfers. The provider information linked below explains the scope and conditions of these safeguards and Cloudflare’s own processing. We do not claim exclusively EU processing. If you prefer not to use the protected online form, you may contact us by telephone or email instead.
8. Sessions, cookies and browser storage
The form pages use the browser session cookie olm_session for session security and CSRF protection. Server-side session files are cleaned up after more than 30 minutes of inactivity when a form page is next requested; this is not a continuous deletion service guaranteeing removal at that exact minute. The session may temporarily hold a reference and delivery status to prevent repeated submissions. Protected tests are separate and may also contain test previews.
Form drafts are stored in the browser tab’s sessionStorage to preserve entries and language changes. They are removed after successful submission or manual deletion; a 30-minute inactivity check takes place when the form is subsequently opened. If it is not reopened, we do not promise physical deletion by our website at an exact minute.
Acknowledgement of the cookie/privacy notice is stored under olm_cookie_notice_v1 in localStorage, or sessionStorage as a fallback, and is valid for 180 days. The notice appears again on the next visit after that period. The validity check alone does not automatically delete the old entry in the background; a new acknowledgement replaces it. You can remove browser storage yourself.
Hourly abuse-prevention counters use HMAC filenames linked to an IP address or recipient and store only counter values; these are pseudonymous security data. Old counter files are cleaned up after more than one hour when a later regular enquiry is processed. Necessary storage access for the functions expressly requested relies on section 25(2), point 2 TDDDG; subsequent processing relies on Article 6(1)(b) or (f) GDPR according to its purpose. We do not use analytics or marketing cookies.
9. External links and directions
This site may link to Instagram, TikTok, Facebook, Google business profiles and an external map service for directions. These are links to other providers, not embedded social feeds or maps. The external provider processes data under its own privacy rules after you follow the link.
Displaying a link icon alone does not open the external service.
10. Recipients and international transfers
Access is limited to responsible business personnel and necessary hosting, email, archiving and security providers as required. Data processing requirements apply where they act on our behalf. Insurers, suppliers or commissioned service partners receive information only when necessary and lawful for the specific matter; no general disclosure for advertising.
International processing may occur particularly through Cloudflare, optional use of WhatsApp and opening external services. Cloudflare’s standard DPA describes the DPF for covered transfers to the USA and, in particular, EU Standard Contractual Clauses for other relevant transfers. The applicable conditions must be met; we do not claim exclusively EU processing. You can request information about applicable safeguards through our privacy contact. Further provider information is linked in sections 6 and 7.
11. Retention
We retain enquiries and correspondence while needed for handling, follow-up and any resulting order. An enquiry or quotation may be a business letter subject to retention even without an order. For simple enquiries not subject to retention duties, storage ends when the handling purpose and any other specific lawful need cease; no binding blanket three-month period has been adopted.
Depending on the category, applicable records are generally kept for six years for commercial/business correspondence, eight years for accounting vouchers and ten years for relevant books/financial statements under the applicable HGB/AO rules. The period generally starts at the end of the relevant calendar year; exceptions, extensions and ongoing proceedings must be considered. VINs, vehicle and insurance details follow the necessary matter rather than being kept indefinitely as a matter of course.
Specific legal, warranty or insurance matters may justify further necessary preservation. Data no longer required is subject to erasure review, taking account of overriding obligations and restrictions. Mailbox, trash and archive are separate stores. The default eleven-year policy and the specific procedure for lawful earlier archive erasure are currently being clarified with STRATO. We do not claim an already configured automatic deletion process by record category. Short-term technical storage is described in section 8.
12. Your rights
Subject to legal requirements, you may request access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and, where applicable, portability (Article 20). You may withdraw consent at any time for the future where processing is based on consent.
Under Article 21 GDPR, you may object to processing based on Article 6(1)(f) on grounds relating to your particular situation. Contact info@autoglasolm.com.
There is no solely automated decision on whether to accept an order as part of the enquiry process described here.
13. Right to complain
You may lodge a complaint with a data protection supervisory authority if you believe your personal data is being processed unlawfully. The competent authority for our registered location is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).
14. Security and updates
We use appropriate technical and organisational measures and encrypted HTTPS connections to protect the website. Access to internal application files and secrets is restricted. Absolute protection against every risk cannot be guaranteed.
We update this information when the services used or relevant processing activities change.
Last updated: 18 October 2026