Privacy Policy

How IntelliTuning GmbH processes personal data on this website, in the dealer portal and in our tools.

Version: October 2026 (translation of the German privacy policy)

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

IntelliTuning GmbH, represented by its managing director Jan Hendrik Horst, Ernst-Befort-Str. 2, 35578 Wetzlar, Germany. Telephone: +49 (0) 175 9732624. Email: info@intellituning.com

For questions about data protection or to exercise your rights, you can contact us at any time using the contact details above.

2. General information

We treat your personal data confidentially and in accordance with the statutory data protection provisions, in particular the GDPR, the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Personal data is any information relating to an identified or identifiable natural person, for example name, address, telephone number, email address or IP address. Data of contact persons at our business customers is also personal data.

We process personal data only insofar as a legal basis permits this: for the initiation or performance of a contract (Art. 6 (1) (b) GDPR), to fulfil legal obligations (Art. 6 (1) (c) GDPR), on the basis of our legitimate interests (Art. 6 (1) (f) GDPR) or with your consent (Art. 6 (1) (a) GDPR).

3. Hosting, content delivery network and security

This website is operated on Elementor Hosting, a service of Elementor Ltd., based in Israel. An adequacy decision of the European Commission exists for Israel. For fast and secure delivery and for protection against attacks, the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, is also used. Cloudflare is certified under the EU-U.S. Data Privacy Framework; EU standard contractual clauses are in place in addition. Both providers process data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR.

When you access this website, the following data is automatically processed and stored in server log files:

• IP address of the requesting device
• date and time of access
• page or file accessed
• referrer URL (previously visited page)
• browser, operating system and device type used
• amount of data transferred and HTTP status code

This processing is necessary to deliver the website, to ensure its stability and security and to ward off attacks. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in secure and trouble-free operation. Log data is deleted or anonymised as soon as it is no longer required for these purposes. Longer storage takes place only if there are specific indications of an attack or misuse, until this has been clarified.

To protect the website, we also use a security plugin that logs in particular failed login attempts and suspicious access with IP address and time and automatically blocks attacks. The legal basis is Art. 6 (1) (f) GDPR. This data is processed exclusively on our server.

Page content is cached to speed up delivery (page and object cache). No user profiles are created in the process.

4. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as enquiries via our contact form, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar.

5. Cookies, local storage and consent management

We use cookies and comparable technologies such as the browser’s local storage. Information is stored on or read from your device in the process.

We use technically strictly necessary storage on the basis of Section 25 (2) no. 2 TDDDG; insofar as personal data is processed in the process, the legal basis is Art. 6 (1) (f) GDPR. We use all other technologies, in particular for statistics and measurement purposes or for loading external content, only with your consent pursuant to Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR.

To manage your choice, we use a self-operated, locally integrated consent tool (“IntelliTuning Cookie Consent”). It stores your choice, the time, the validity period and the version of the consent in the browser’s local storage under the key “horsti_consent_v1”. The choice is valid for a maximum of 180 days. It is not transmitted to external providers. You can change or withdraw your consent at any time with effect for the future via the cookie icon on the website. If new services requiring consent are integrated, we will ask again.

Without consent, we store only the following technically necessary settings in your device’s local browser storage so that the display you have chosen is retained:

• “intellituning-theme” and “hc2-theme”: selected light or dark mode
• “intellituning-language”: selected website language

These entries remain on your device, are not transmitted to us and can be deleted at any time via your browser settings.

6. Audience measurement with Burst Statistics

With your consent, we use the WordPress plugin Burst Statistics to statistically evaluate the use of our website (for example pages accessed, time spent, device types used). Burst Statistics is operated exclusively on our own server; no data is transmitted to the manufacturer or other third parties. For this purpose, a cookie “burst_uid” with a storage period of 30 days is set.

The legal basis is your consent pursuant to Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR, which you can withdraw at any time via the cookie settings.

7. Performance measurement (Elementor Hosting / Cloudflare)

With your consent, loading times and technical usage data (for example URL accessed, browser and device data, loading times) are collected via our hosting or CDN provider in order to monitor and improve the performance of the website. Data may be transmitted to Cloudflare, Inc. in the USA; Cloudflare is certified under the EU-U.S. Data Privacy Framework.

The legal basis is your consent pursuant to Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR. Further information: Cloudflare’s privacy policy.

8. Fonts

Our website predominantly uses fonts stored locally on our server; no connection to third-party servers is established.

Individual page areas may additionally load fonts from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). This only happens if you have agreed to “External Google fonts” in the cookie settings. Your IP address is then transmitted to Google; processing in the USA by Google LLC is possible. Google is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent pursuant to Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR. Without consent, local or system fonts are used.

9. Vehicle configurator and registration document recognition

In our vehicle configurator, you can select vehicles by manufacturer, model and engine or via HSN/TSN (German type codes). The vehicle and image data required for this are loaded from our own server.

Optionally, you can use a photo of your vehicle registration document (registration certificate part I) to read the vehicle data automatically. Text recognition runs entirely locally in your browser on your device. The photo is neither transmitted to our server nor to third parties and is not stored. Only the recognised vehicle characteristics (for example HSN/TSN, manufacturer, type) are used to find the matching vehicle in our database. Please use only images for this function that you are entitled to use; personal details such as the name and address of the keeper are not required.

The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR; our legitimate interest lies in convenient vehicle selection. Use of the recognition function is voluntary.

If the configurator is integrated as a subscription into a customer’s website, we may process the resulting data on behalf of that customer. In that case the respective website operator is the controller; details are governed by a separate data processing agreement.

10. Contact form

If you send us an enquiry via the contact form, we process the data you enter (in particular name, company, email address, telephone number, message and time of submission) in order to handle your enquiry and answer follow-up questions.

The legal basis is Art. 6 (1) (b) GDPR if your enquiry relates to the initiation or performance of a contract, otherwise Art. 6 (1) (f) GDPR; our legitimate interest lies in the effective handling of enquiries.

For reliable sending of emails from the website, we use the “Site Mailer” service of Elementor Ltd. (Israel) as a processor. The data remains with us until the purpose ceases to apply, in particular after your enquiry has been finally dealt with. Statutory retention obligations remain unaffected.

11. Contact by email or telephone

If you contact us by email or telephone, we process your details (for example name, contact details, vehicle and order data and the content of your enquiry) to deal with your request. The legal basis is Art. 6 (1) (b) GDPR insofar as a contract is concerned, otherwise Art. 6 (1) (f) GDPR. Insofar as statutory retention obligations exist, further storage is based on Art. 6 (1) (c) GDPR.

12. Communication via WhatsApp

Our website contains a contact button through which you can voluntarily write to us via WhatsApp. Opening the button does not yet establish a connection to WhatsApp; only when you select “Start chat” is WhatsApp or the WhatsApp website opened.

The provider for users in the European region is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. When you use it, in particular your telephone number, profile name and picture, the content of your messages and attachments, and communication and device data are processed. WhatsApp also processes data on its own responsibility in accordance with its own privacy policy; transmission to Meta Platforms, Inc. in the USA is possible. Meta is certified under the EU-U.S. Data Privacy Framework.

The legal basis is Art. 6 (1) (b) GDPR insofar as the communication serves the initiation or performance of a contract, otherwise Art. 6 (1) (f) GDPR; our legitimate interest lies in fast communication. Use of WhatsApp is voluntary; you can also reach us by email, telephone or contact form. Please do not send particularly confidential information via WhatsApp.

13. Dealer portal, file service and customer account

Registration, login, file service orders, the purchase of credits and the download of edited files take place via our dealer portal at intellituning.com/arbeitsbereich. There we process in particular:

• master and contact data of the company and its contact persons (company, name, address, email, telephone, VAT identification number)
• access data for the customer account
• order data, uploaded control unit files and vehicle details (for example manufacturer, model, engine, control unit, software version and, where applicable, vehicle identification number)
• credit balance, invoicing and payment data
• communication relating to orders

Processing takes place for the performance of the contract (Art. 6 (1) (b) GDPR) and to fulfil tax and commercial law obligations (Art. 6 (1) (c) GDPR). Payments are processed via the payment service providers offered in the ordering process, to whom we transmit the data required for payment; the privacy notices of the respective provider apply in addition to their processing. You will receive supplementary information about the portal when you register.

We store uploaded files and order data for the duration of the business relationship so that rectifications, updates and queries are possible. We retain invoices and accounting-relevant documents for up to ten years in accordance with Section 147 of the German Fiscal Code (AO) and Section 257 HGB.

Files you upload in the dealer portal or in our online tools are stored even if no order results from them (for example with a mere file analysis), together with the file name, time, IP address, approximate country and browser identifier, for 7 days in a non-public area of our server. Only our administration has access to them. This storage serves to handle queries and support cases and to prevent misuse and fraud. For the same purpose we evaluate logins and visits to the dealer portal (time, IP address, country and network operator derived from it, device, areas used). The legal basis is Art. 6 (1) (b) GDPR or Art. 6 (1) (f) GDPR; our legitimate interest lies in secure operation and reliable processing. After the 7 days, these copies are deleted automatically; files relating to orders placed remain stored in accordance with the rules above.

14. Support hub and desktop applications

Customers who use our desktop applications (for example IntelliTuning Master or the customer app) can communicate with us and exchange files through them. In doing so, we process account data, messages, attachments as well as timestamps and technical connection data. Messages and attachments are transmitted in encrypted form and stored on our server in an area that is not publicly accessible. The legal basis is Art. 6 (1) (b) GDPR. The “Delete for me” function only hides content in your own view; we delete data stored on the server as soon as it is no longer required for the performance of the contract and no retention obligations stand in the way.

15. Business customers and prospects

We process data of business customers, suppliers and prospects (in particular contact persons, contact details, contract and billing data) for contract initiation, contract performance, customer support and invoicing in accordance with Art. 6 (1) (b), (c) and (f) GDPR. In the context of implemented projects (for example websites and configurators), we may name our customers’ company names and websites as references unless the customer objects (Art. 6 (1) (f) GDPR).

16. Links to external websites

Our website contains simple links, for example to our customers’ websites in the project overview. Only when you click on such a link is the respective page opened; no data is transmitted to its operator beforehand. The respective operator is responsible for processing on the linked pages.

17. Recipients of personal data

Within our company, only those persons who need your data to perform their tasks have access to it. In addition, data may be transmitted to the following recipients:

• hosting, CDN, email and IT service providers (as processors)
• payment service providers and credit institutions for payment processing
• shipping and logistics service providers for the delivery of hardware
• manufacturers and licensors of tuning hardware and software, insofar as this is necessary for the activation or registration of devices and licences
• tax advisers, auditors and lawyers
• authorities and courts, insofar as there is a legal obligation

Data is not passed on for advertising purposes, and personal data is not sold.

18. Transfers to third countries

Insofar as data is transferred to countries outside the EU or the EEA, this takes place only under the conditions of Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision of the European Commission (for example for Israel or for companies in the USA certified under the EU-U.S. Data Privacy Framework) or appropriate safeguards such as EU standard contractual clauses.

19. Storage period

Unless a more specific storage period is stated in this privacy policy, we store personal data only for as long as is necessary for the respective purpose. The data is then deleted unless statutory retention periods (in particular six or ten years under the HGB and AO) prevent this or the data is required for the establishment, exercise or defence of legal claims. In these cases, processing is restricted.

20. Your rights

Within the statutory requirements, you have the right at any time to:

• access to your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR)
• objection to processing (Art. 21 GDPR)

To exercise your rights, an informal message to the contact details given in section 1 is sufficient.

21. Right to object under Art. 21 GDPR

If we process your data on the basis of Art. 6 (1) (f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. If your data is processed for direct marketing, you can object at any time without giving reasons.

22. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your data infringes data protection law (Art. 77 GDPR). The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information), Wilhelmstraße 7, 65185 Wiesbaden, Germany. Telephone: +49 611 1408-0. Email: poststelle@datenschutz.hessen.de

You can also contact the supervisory authority of your habitual residence or place of work.

23. Obligation to provide data and automated decision-making

You can visit our website without actively providing personal data. For enquiries, registration in the dealer portal and the performance of contracts, we require the information marked as mandatory; without it we cannot provide the service. Exclusively automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

24. Changes to this privacy policy

We adapt this privacy policy when our website, the services used or the legal situation change. The version published on this page at the time applies.