Privacy Policy

Note: The legally binding version of this privacy policy is the German version. This English translation is provided for informational purposes only.

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

CrossLease GmbH
Bajuwarenring 19
82041 Oberhaching, Germany
Managing Directors: Gudars Ahrabian, Tatiana Ahrabian
Phone: +49 89 693781-61
Email: [email protected]

2. Data Protection Officer

Our data protection officer can be reached at:
Email: [email protected]

3. General Information on Data Processing

We process personal data of our users only to the extent necessary to provide a functional website and our content and services. Processing of personal data occurs regularly only with the user's consent, except in cases where prior consent cannot be obtained for practical reasons and processing is permitted by law.

3.1 Legal Bases

  • Art. 6(1)(a) GDPR — Consent
  • Art. 6(1)(b) GDPR — Performance of a contract or pre-contractual measures
  • Art. 6(1)(c) GDPR — Legal obligation
  • Art. 6(1)(f) GDPR — Legitimate interests

3.2 Deletion and Retention

Personal data is deleted or blocked as soon as the purpose of storage no longer applies. Storage may continue where required by European or national legislation.

4. Hosting

Our website is served as a static site via Sevalla (Kinsta Inc.) using a global CDN. Server log files (browser type, operating system, referrer URL, anonymised IP address, time of request) are stored for up to 30 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring website functionality and security).

5. Content Delivery — Contentful

We use the headless CMS Contentful for editorial content (blog posts, job listings). Images are delivered via Contentful's CDN (images.ctfassets.net), during which your IP address is transmitted to Contentful GmbH, Berlin. Legal basis: Art. 6(1)(f) GDPR. See the Contentful Privacy Policy.

6. Consent Management — Cookiebot

We use Cookiebot by Usercentrics A/S to collect and document your cookie consent. When you visit our website, a script is loaded from consent.cookiebot.com, transmitting your IP address and device information to Usercentrics A/S. Legal basis: Art. 6(1)(c) GDPR (legal obligation to obtain and document consent). See the Cookiebot Privacy Policy.

7. Web Analytics — Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited. Google Analytics is only activated after your explicit consent via the cookie banner. Legal basis: Art. 6(1)(a) GDPR (consent). You may withdraw your consent at any time via "Cookie Settings" in the footer.

We have enabled IP anonymisation (anonymize_ip: true), so your IP address is truncated within the EU/EEA before transmission. Google may transfer data to servers in the USA on the basis of the EU-US Data Privacy Framework. See the Google Privacy Policy.

8. Contact Form

When you use our contact form, the following data is collected: name, email address, company (optional), subject, and message. This data is transmitted via Web3Forms for delivery to our inbox. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in processing enquiries).

For spam prevention, we use hCaptcha by Intuition Machines, Inc. (USA). When solving the captcha, your IP address, browser information, and interaction data are transmitted to hCaptcha. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in spam prevention). See the hCaptcha Privacy Policy.

Data submitted via the contact form is retained until you request deletion, revoke your consent, or the purpose for storage no longer applies. Mandatory statutory retention periods remain unaffected.

9. Contact by Email

If you contact us by email, the data you provide (email address, name, phone number if applicable) will be stored to process your enquiry. We delete this data once storage is no longer necessary, or restrict processing if statutory retention obligations apply. Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR.

10. Cookies

For information on cookies used on our website, please refer to our Cookie Policy.

11. Your Rights

As a data subject under the GDPR, you have the following rights:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent (Art. 7(3) GDPR) — withdrawal does not affect the lawfulness of processing carried out prior to withdrawal
  • Right to lodge a complaint (Art. 77 GDPR) — the competent supervisory authority is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA)

12. Changes to This Privacy Policy

This privacy policy is current as of March 2026 and will be updated as necessary.

For the complete and legally binding privacy policy, please refer to the German version.