Legal
What we collect, why, how long we keep it, and how to make us stop. Last updated 12 August 2026.
The controller for the data described here is:
5 Star Cars GmbH
Biberstrasse 10, 1010 Wien, Austria
office@fivestarcars.at
UID ATU76807378 · FN 554608 a
Write to that address for anything in this document, including any of the rights in section 11. We do not have a designated data protection officer, because we are not required to appoint one.
This policy covers fivestarcars.at and the forms and tools on it. We have tried to write it so that it describes what actually happens, rather than every possibility. If something here does not match what you experience on the site, tell us — that is a bug in the policy.
The enquiry, contact and custom-order forms collect your name, your email address or phone number if you give one, and whatever you tell us about the car. When you ask us to confirm a price, the form also sends the vehicle and the estimate that was displayed on your screen, and the address of the page you were on, so that we can reply about the right car and the right figure.
Why: to answer you and to prepare a quote — steps taken at your request before a possible contract (Art. 6(1)(b) GDPR).
Enquiries arrive in our company mailbox and stay there. They are not used for marketing unless you separately subscribe, and they are not passed to third parties except where a quote genuinely requires it — for example asking Aviatax about financing — and then only with your knowledge.
The calculator runs in your browser. The vehicle price, engine power, CO₂ figure and port you enter are used to work out an estimate on your own device and are not sent to us unless you ask for the breakdown by email.
If you do ask for it, we receive those inputs together with your email address, and we use them to send you the breakdown and to follow up on the enquiry.
Why: your request (Art. 6(1)(b)).
If you decode a VIN, the VIN is sent to the free vehicle catalogue operated by the United States National Highway Traffic Safety Administration in order to look up the make, model and engine. A VIN identifies a vehicle rather than a person, and we do not send anything else with it.
If you subscribe, we store your email address and the date you confirmed. We use double opt-in: you will get one email asking you to confirm, and nothing else until you do.
Why: your consent (Art. 6(1)(a)), which you can withdraw at any time using the unsubscribe link in every issue or by emailing us. Withdrawing consent does not affect anything sent before you withdrew it.
Companies that advertise on this site get a login to see how their placements are performing. For those accounts we store the company details, a contact name and email, a password hash, and the campaign and billing records. Advertisers can only ever see their own figures.
Why: performance of the advertising contract (Art. 6(1)(b)).
The advertisements on this site are served by us, from our own server. They are not an ad network, they do not follow you to other websites, and they do not build a profile of you.
To tell an advertiser how their placement performed, we count how often a placement was actually visible on screen and how often it was clicked. We record the placement, the page, a broad device type (desktop, tablet, phone) and the time. We do not use cookies for this and we do not store anything that identifies you.
Why: our legitimate interest in measuring advertising we are paid for (Art. 6(1)(f)). You can object under Art. 21 at any time.
Strictly necessary cookies are set so that the site works and so that your cookie choice is remembered. These do not require consent.
Everything else — analytics and advertising measurement described below — runs only if you agree in the cookie banner. You can change or withdraw that choice at any time through the cookie settings link in the footer. If you decline, the site works normally.
We use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand which pages are used and where visitors come from. It sets cookies and processes an identifier for your browser, a shortened form of your IP address, the pages you view and roughly where in the world you are.
Why: your consent (Art. 6(1)(a)), given in the cookie banner. Analytics does not load before you consent.
You can also block Google Analytics everywhere with Google's own browser add-on at tools.google.com/dlpage/gaoptout.
We advertise this site through Google Ads, also provided by Google Ireland Limited. Two things follow from that, and both need your consent:
If you arrive from one of our advertisements and then send an enquiry, a conversion tag tells Google that an advertisement led to a request. It tells Google that an enquiry happened; it does not send your name, your email address or the details of the car.
We may show advertisements to people who have visited this site before. This uses a cookie to add your browser to an audience list. It is turned off unless you accept advertising cookies, and you can opt out of personalised Google advertising entirely at adssettings.google.com.
Why: your consent (Art. 6(1)(a)) for both.
The site runs on our own server, hosted in the European Union. Like any web server it writes a log entry for each request: IP address, time, the page requested, the referring page and your browser's user agent. Logs are used to keep the site running and to investigate attacks, and are deleted after 14 days.
Why: our legitimate interest in operating and securing the site (Art. 6(1)(f)).
Email is handled by our mail provider on our behalf. Our hosting and email providers act as processors under contract and do not use the data for their own purposes.
Two things in this policy involve data leaving the EU:
| What | How long |
|---|---|
| Enquiries that did not lead to a purchase | 24 months, then deleted |
| Contracts, invoices and customs records | 7 years — required by Austrian tax law |
| Newsletter subscription | Until you unsubscribe |
| Advertiser accounts | Duration of the contract, then 7 years for the billing records |
| Advertising measurement | Detail for 90 days, then monthly totals only |
| Server logs | 14 days |
| Analytics | 14 months |
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or send it to someone else in a portable format. You can object to anything we do on the basis of legitimate interest, and you can withdraw consent at any time.
Email office@fivestarcars.at and we will answer within one month. There is no charge. The one thing we cannot delete is records we are legally required to keep, such as an invoice for a car we sold you.
If you think we have handled your data badly, please tell us first — it is usually something we can fix the same day. You also have the right to complain to the supervisory authority:
Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Wien
dsb@dsb.gv.at ·
dsb.gv.at
When we change this policy we change the date at the top. If a change materially affects how we use your data we will say so on the site rather than relying on you to notice.
