Privacy policy

The key points at a glance

On the public pages we use no cookies. Only if you choose a language yourself or save your cookie settings does your browser remember that choice locally.
We use no analytics, tracking or advertising services.
The font, images and the map preview come from our own server.
WhatsApp, Google Maps, Instagram and TikTok are only accessed when you click a link to them.
We only use the details from our contact and price request form to handle your enquiry. There is no online registration – you register in person at the driving school.

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Fahrschule DEVAM
Ulmenstr. 2
90443 Nürnberg

Phone: 0176 41693949
Email: info@fahrschule-devam.de

You will find further information in our legal notice.

2. Hosting and server log files

When you open a page, your browser automatically transmits technical information to our web server. This includes in particular:

IP address
Date and time of access
page or file requested
HTTP status code and amount of data transferred
previously visited page (referrer), if your browser transmits it
browser type, browser version and operating system

This data is technically necessary to deliver the website to you. Depending on the server configuration, it is stored in log files so that errors can be detected and attacks averted. It is not combined with other data sources or analysed for advertising purposes.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website securely, stably and without errors.

3. Cookies and storage in your browser

Under § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG), information may generally only be stored on or read from your device with your consent – unless this is strictly necessary for a service you have expressly requested.

Public pages: We do not set any cookies when you visit the public pages of this website. We only use your browser's local storage (localStorage) for two settings that you make yourself: the language you have chosen and – if you save it – your choice in the cookie settings. Both are strictly necessary for the function you requested (§ 25(2) no. 2 TDDDG), are not transmitted to us and are not used to recognise you. We do not use any techniques that require consent, such as analytics, marketing or tracking services; that is why no consent banner appears when you visit. You can open this overview at any time via “Cookie settings” in the footer.

Independently of this, your browser keeps files it has already loaded, such as images or the font, in its cache so that pages load faster. You can clear this cache at any time in your browser settings.

Admin area: Only people who log in to the driving school's protected admin area receive technically necessary cookies: a session cookie and a cookie that identifies the browser as a known device, so that attacks on the login can be slowed down without locking out authorised people. Visitors to the website are not affected.

Overview of the cookies and browser storage used
Name	Purpose	Type and storage period	Provider	Legal basis
`devam_lang`	Stores the language you have chosen yourself using the language selector, so that the website appears in that language on your next visit.	Browser local storage (localStorage), only after your choice; remains until you delete it.	This website (first party)	§ 25(2) no. 2 TDDDG
`devam_consent`	Stores your choice in the cookie settings (version of the settings, selected categories, time) – without any identifier of your person.	Browser local storage (localStorage), only if you save a choice; 12 months.	This website (first party)	§ 25(2) no. 2 TDDDG
`__Host-devam_admin`	Keeps the admin area login active and protects actions there against misuse. Only for logged-in staff.	Session cookie (Secure, HttpOnly, SameSite=Strict). Deleted when you log out or close your browser; the session also expires on the server after a longer period of inactivity.	This website (first party)	§ 25(2) no. 2 TDDDG; Art. 6(1)(f) GDPR
`devam_device`	Identifies a browser in which an authorised person has already logged in successfully as a known device. This allows login attempts by unknown parties to be slowed down without locking the account. Only for logged-in staff.	Cookie (Secure, HttpOnly, SameSite=Strict), 180 days; only a hash value is stored on the server.	This website (first party)	§ 25(2) no. 2 TDDDG; Art. 6(1)(f) GDPR

We do not use any other cookies, tracking pixels or analytics and marketing services. Should this change, we will ask for your consent beforehand and update this policy.

“Open today” indicator: Whether we are currently open is calculated by your browser directly on the page, based on your device's time and the published opening hours. Nothing is stored and nothing is transmitted to us or third parties.

4. Contact form and handling of your enquiry

When you write to us using the contact or price request form, we process the details you enter there. Only the details without which we cannot assign and answer your enquiry are required:

Type of enquiry (for example price / cost request, general question or callback)
First and last name
Email address or phone number (at least one of them; for a callback, the phone number)
desired licence class or topic of the enquiry
Message – optional for price requests, registration enquiries and callbacks
Confirmation that you have read this privacy notice (with time stamp)

You can also optionally state when you would like to start your training and add a subject. We also store the language in which you used the website so that we can reply appropriately. The form does not involve any consent to advertising or a newsletter.

Purpose and legal basis: We use the details exclusively to handle your enquiry. If your enquiry concerns training with us, the legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). In all other cases we base the processing on Art. 6(1)(f) GDPR; our legitimate interest is answering enquiries addressed to us. The confirmation box merely documents that you have read this notice; it is not consent within the meaning of Art. 6(1)(a) GDPR.

Process: Your details are transmitted to our web server in encrypted form and stored there as a contact enquiry in a database outside the publicly accessible web directory. We also send a notification to the driving school's mailbox.

Further handling in the admin area: Authorised staff of the driving school can see your enquiry in the internal admin area, record its status there (for example “new”, “contacted”, “appointment arranged”) and add internal notes and a consultation appointment. If your enquiry leads to training, we create a customer record for it. Access and changes are logged (see section 10).

Storage period: We delete your enquiry as soon as it has been dealt with conclusively, provided no statutory retention obligations apply. If your enquiry results in a training relationship, we keep the details for as long as is necessary to carry it out and to meet legal obligations.

To protect against spam, the form contains a field that is invisible to people and a short-lived technical check token; we also limit the number of enquiries (see Protection against misuse).

5. Contact by email, phone or WhatsApp

If you contact us by email or phone, we process the data you give us (for example name, phone number, email address and the content of your message) in order to deal with your request. The legal basis is Art. 6(1)(b) GDPR where training is concerned, otherwise Art. 6(1)(f) GDPR (answering enquiries). The storage period is the same as for the contact form.

WhatsApp: No WhatsApp function is embedded in our website; there are only links to WhatsApp. Only when you click such a link does WhatsApp or the WhatsApp (Meta) website open, and WhatsApp's privacy terms apply. If you write to us via WhatsApp, WhatsApp also processes your data under its own responsibility, possibly also outside the EU. If you do not want this, you can reach us by phone, by email, via the contact form or in person at the driving school.

6. Google reviews

On the home page we can display reviews from our Google Business Profile. If this function has not been set up, you will only see a link to Google there.

Retrieval via our server: Our web server retrieves the reviews via the Google Places API when you open that section. In doing so, our server only transmits a technical access key, the ID of our Google listing and the language of the page you are viewing to Google – no data about you. Your browser does not connect to Google for this; the authors' profile pictures are also loaded via our server.
No permanent storage: The content of the reviews is not stored on our server. We only store an identifier (hash value) of reviews that have been hidden in the admin area.
Authors' data: We display the name, profile picture, star rating, text and time information that the authors have published themselves on Google (source: Google). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to make other learner drivers' experiences available to interested people. If an author edits or deletes their review on Google, it is updated here accordingly or no longer shown.
Links to Google: If you click on a name, on “View on Google Maps” or on “All reviews”, Google opens in a new tab. Google's privacy terms apply there.

Authenticity of the reviews: We display the reviews as Google provides them via its interface (a maximum of five, selected by Google). We do not check whether the authors actually trained with us. Individual reviews can be hidden on this website in the admin area.

7. Map preview and route planning

The map on the contact page is an image stored on our server (map data © OpenStreetMap contributors). No connection to a map service is established when it is displayed.

You can open Google Maps in a new tab via “Route in Google Maps” or our linked address. Only then is data – in particular your IP address – transmitted to Google, and Google's privacy terms apply.

We do not embed any content, plug-ins or tracking pixels of social networks. “Instagram” and “TikTok” are simple links on our website. Only when you click them does the respective platform open, and its privacy terms apply.

The photos of passed tests on our website are locally stored images; no connection to Instagram is established when they are displayed.

9. Fonts, icons and images

The font used (Archivo), the icons and all images are loaded from our own server. No data is transmitted to external providers such as Google Fonts or content delivery networks.

10. Internal admin area

The admin area of this website is not public and can only be accessed after logging in. It is used exclusively by the driving school to maintain the website and to handle enquiries, customer data and appointments.

User accounts: For each authorised person we store a user name, display name, role, permissions and a password hash, and – if two-factor login is enabled – an encrypted key for the authenticator app. Passwords are never stored in plain text.
Log: Logins, changes to content and business data, and changes to enquiries, customer data and appointments are logged with the time, the person acting and the record concerned. The log serves traceability and IT security (Art. 6(1)(f) GDPR, supplemented by § 26 BDSG in the employment context). Passwords, PINs and session IDs are not logged; the IP address is only stored as a hash value.
Deletion approval: Important records can only be deleted permanently after approval by an authorised person and entry of an approval PIN. Until then, deleted records are only visible in the recycle bin.

11. Protection against misuse

To protect the contact form and the admin area against automated attacks and spam, we limit the number of requests per sender. For this purpose we store on the web server, for a maximum of 24 hours, a hash value calculated from your IP address and a secret key, which does not contain the IP address in plain text, together with the times of the requests. Failed login and confirmation attempts in the admin area are counted for a maximum of 48 hours. If identical enquiries are sent several times within a few minutes, we store them only once. In addition, the form only accepts requests that originate from this website itself.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the security and proper functioning of the website.

12. Recipients and service providers

Google does not receive any data about you in connection with displaying the reviews (see section 6).

13. Transfers to third countries

When you visit our website, we ourselves do not transfer any personal data to countries outside the European Union or the European Economic Area.

If you click on links to WhatsApp, Google, Instagram or TikTok, these providers may process data under their own responsibility, including outside the EU.

14. Storage periods at a glance

Storage periods of the data processed
Data	Storage period
Contact enquiries	Until dealt with conclusively, then deleted, provided there are no statutory retention obligations.
Customer records	For the duration of the training relationship and beyond, as long as statutory retention obligations apply
Appointments in the internal calendar	Until deleted by the driving school, at most within the statutory retention obligations
Admin area log	Up to 12 months, unless needed for longer to investigate an incident
Hash values for protection against misuse	A maximum of 24 hours; failed login and confirmation attempts a maximum of 48 hours
Session cookie in the admin area	Until you log out or close your browser
Device cookie in the admin area	180 days; invalid after a password change
Language selection and cookie settings (in your browser)	Language selection until you delete it; cookie settings 12 months
Identifiers of hidden Google reviews	As long as the review is hidden
Content of the Google reviews	Not stored on our server

There is no automated decision-making, including profiling (Art. 22 GDPR).

15. Your rights

Under the GDPR you have the following rights with regard to us:

Access to the data we process (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to the processing (Art. 21 GDPR, see next section)
Withdrawal of consent with effect for the future (Art. 7(3) GDPR). At present, no processing on this website is based on consent.

Simply contact us by email at info@fahrschule-devam.de or via the contact details given above.

16. Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR).

We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

17. Complaint to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The competent authority for companies in Bavaria is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Postfach 1349
91504 Ansbach
www.lda.bayern.de (opens in a new tab)

18. Currency of this privacy policy

Last updated: September 2026. We adapt this privacy policy when the website, the services used or the legal requirements change.