Legal & privacy

Website privacy

We process as little personal data as possible, and we run our analytics on our own infrastructure. This page explains what data is collected when you visit this website, who receives it, and the rights you have under the EU GDPR.

This policy is governed by the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Last updated: October 2026.

Privacy for RoadReview App and Family

Using one of our apps? The RoadReview app privacy policy (German) covers app accounts, lesson data, GPS, media, analytics services and your rights. For RoadReview Family, see its section on parent access, sharing and withdrawal (German). The sections below cover visits to this website.

1. Controller

The controller within the meaning of the GDPR and other national data protection laws is:

RoadReview GmbH
Managing Director: Aleksandar Vuk Jovanović
Frechen, Germany
Email: aleks@roadreview.de
Full postal address, commercial register entry, and representation details: Legal Notice.

2. Data Protection Officer

RoadReview GmbH is not required to appoint a Data Protection Officer (DPO). German law (§ 38 (1) BDSG) only mandates a DPO once at least 20 people are continuously involved in automated processing of personal data, or once a processing activity requires a Data Protection Impact Assessment under Art. 35 GDPR — neither applies to us today.

For privacy enquiries, please write to aleks@roadreview.de. As soon as we cross the threshold or start a corresponding processing activity, we will appoint a DPO and add their contact details here.

3. Hosting

This website is operated with Railway Corp. (USA). The server and private enquiry storage are configured for the EU region Amsterdam. Technically necessary connection data, such as IP address, request time, path and browser identification, is transmitted to the hosting infrastructure when you load a page. Our website server does not log contact details, IP addresses or message contents.

Processing arrangements and transfers: Railway describes processing and standard contractual clauses in its Data Processing Addendum. You can ask our privacy contact about the applicable contractual arrangements and connection-log retention for our service. An EU runtime region does not mean that all administration, support or connection data is processed exclusively in the EU.

Legal basis: Art. 6 (1)(f) GDPR, our legitimate interest in securely and reliably operating this website.

4. Web analytics with Rybbit (self-hosted)

We use the open-source analytics software Rybbit at rybbit.internal.thecodecave.de to evaluate website usage. Each page records one pageview. Our website sets no Rybbit cookies and stores no persistent Rybbit visitor identifier in the browser. User identification, session replay and automatic capture of form contents are disabled.

We also measure navigation, product, feature and enquiry clicks, external links and stores, downloads, language changes, menu and FAQ openings, form starts, the predefined enquiry type, validation failures and confirmed form outcomes. On the anonymous regional map we record only state categories and interaction types, without city names, location points or search terms.

Event data includes page paths without query strings, language and fixed product, destination or interaction categories. External links are represented by their hostname. Email and phone links record only the contact channel, without the address or number. Names, email addresses, phone numbers, free-text messages and other entered values are not sent as event data. Enquiry types come exclusively from a fixed option list. Referrers are limited to the origin without paths, query strings or fragments.

Connections to our self-hosted analytics service necessarily involve technical connection data such as IP addresses and browser information. Rybbit describes visitor attribution as a server-side hash of the IP address and user agent. This technical description does not guarantee that all connection data or server logs are anonymous.

Legal basis: We rely on Art. 6 (1)(f) GDPR, our interest in improving the website. The existing decision to operate without an analytics consent banner relates to this limited configuration. Cookieless operation alone does not guarantee that consent is unnecessary.

Processing and retention: The analytics service is self-hosted. You can request details of the actual server retention settings and processing of connection data from our privacy contact.

Right to object: Setting a disable-rybbit LocalStorage entry for this website prevents pageviews and events from being transmitted. You can also contact aleks@roadreview.de. This opt-out entry stays in the current browser until you remove it.

Marketing attribution (UTM capture): When you reach our website via a marketing link with UTM parameters (?utm_source=…&utm_medium=…&utm_campaign=…), we store these values together with the requested path and the host of the referring page in your browser's sessionStorage under the key rr_attribution for the duration of the browsing session. These values are not submitted with the contact form; enquiry storage does not process marketing attribution.

Data captured: utm_source, utm_medium, utm_campaign, utm_content, utm_term, optionally the click identifiers gclid (Google Ads) and fbclid (Meta), plus the path of the landing page and the host of the referrer. We capture only marketing parameters that cannot identify a specific person. Values that don't match the allow-list [a-zA-Z0-9._-] or are longer than 200 characters are discarded — both as an XSS safeguard and to keep the data set minimal.

First-touch policy: If an entry already exists in sessionStorage, it is not overwritten by subsequent internal clicks or different UTM parameters. Retention: only for the duration of the browser session. Closing the tab or browser window deletes the data automatically. Cookies: no cookie is set — sessionStorage is a browser-native API restricted to our origin. Recipients: Contact storage does not collect marketing attribution. Newsletter registration is disabled; these values are not currently forwarded to a delivery provider through that form.

Legal basis: Art. 6 (1)(f) GDPR — our legitimate interest in evaluating the effectiveness of our marketing channels. § 25 TTDSG generally treats same-origin sessionStorage with no cross-session device recognition as "technically required"; as a precaution, we additionally rely on legitimate interest as the legal basis. Right to object: You can prevent UTM capture by visiting our site without UTM parameters, or by blocking or clearing your browser's sessionStorage for this domain.

5. Fonts

We embed the typefaces Inter, Inter Tight, and JetBrains Mono locally from our own domain only (directory /fonts/). There is no connection to Google Fonts or any other third-party CDN, so no IP address is transmitted to a font provider when this site is loaded.

Legal basis: Art. 6 (1)(f) GDPR — our legitimate interest in a consistent, fast-loading and data-minimising presentation.

6. Contact form

You can send an enquiry using our contact form. After successful validation, we save it in private enquiry storage hosted by Railway (see section 3). Confirmation means that the enquiry has been saved; no automatic notification or confirmation email is sent. Authorised RoadReview operators can retrieve it through protected access and handle it personally.

Data processed: name, email address, optional driving school/organisation, enquiry category, language, message, acknowledgement of the privacy notice, receipt time and deletion date. This storage does not contain IP addresses, browser identification, campaign parameters or advertising click IDs. The short-lived acceptance receipt is separate from these details; only its hash is stored in the record.

Legal basis: Art. 6 (1)(b) GDPR for pre-contractual enquiries or Art. 6 (1)(f) GDPR for responding to general enquiries.

Retention: enquiries are removed from this storage after 90 days. Cleanup checks for expired records on service startup and hourly. Earlier deletion is possible. Business documents resulting from an enquiry may be kept separately under applicable retention requirements. To request erasure, email aleks@roadreview.de.

Confirmation cookie: once saved, a technically necessary cookie restricted to this website protects the acceptance confirmation. It contains no contact details and expires after 15 minutes. Saving an enquiry is independent of analytics. An optional analytics success event confirms only a saved enquiry, not email delivery or activation of access, and uses only fixed product/enquiry categories.

6a. Bot protection with Cloudflare Turnstile

The contact form uses Cloudflare Turnstile (Cloudflare, Inc., USA). When the security check loads, Cloudflare processes technical signals such as IP address, browser identification, TLS fingerprint and page origin to distinguish human visitors from automated requests.

Our server verifies the short-lived, single-use token before storage and mail processing. Form contents are not sent to Cloudflare during verification. Tokens enter neither enquiry storage nor analytics or our server logs. Failed checks prevent form acceptance; email remains available. The widget does not grant general clearance through a cf_clearance cookie.

Legal basis: Art. 6 (1)(f) GDPR, our interest in preventing spam and abuse. Processing and possible international transfers are governed by the applicable Cloudflare agreements. Details, including Cloudflare's own improvement of detection: Turnstile Privacy Addendum and Cloudflare DPA.

7. Newsletter

Newsletter registration is disabled on this website. No subscription or confirmation email is created, and no registration attempt is sent to a delivery provider. The newsletter page shows the current status.

Future activation requires an approved delivery provider and verified consent, confirmation and unsubscribe workflows. Provider and retention information will be updated before activation. Earlier provider plans do not establish active data transfers. Service provider information.

For questions or to exercise your rights, contact aleks@roadreview.de. Unsubscribe help.

8. Recipients and sub-processors

We only share personal data with the processors listed in this policy. A complete, up-to-date list of all sub-processors — including purpose, location and the legal basis for any third-country transfer — is published at /en/subprocessors.

We update this list whenever something material changes (new sub-processor, change of hosting region, new tracking components) and adjust the „last updated" date of this policy accordingly.

8a. Driving-school logos and business addresses

On /en/map and on some location pages we display the business addresses and logos of driving schools that have a contract with us (pilot partners and active RoadReview driving schools). Logo use is contractually agreed in writing for each entry.

Local hosting: Logos are imported once, optimised by us (AVIF/WebP) and served from our own domain. There is no hotlinking to third-party CDNs — the schools' logo servers (Jimdo, WordPress, Trustoo, EasyWeek and similar) are not contacted when the map is loaded, so no additional third-country transfer takes place.

Data we store: name, business address, postal code, city, geo coordinates (for the map pin) and the approved logo. This is business data, not personal data within the meaning of the GDPR; where an individual is identifiable (sole proprietors), processing is based on the contract.

Legal basis: Art. 6 (1)(b) GDPR (performance of the contract) and Art. 6 (1)(f) GDPR (legitimate interest in publicly representing our active contract partners).

Removal: If you operate a listed driving school and want to end the listing, send a brief email to aleks@roadreview.de. We will remove the entry (JSON record + local logo asset) and publish the update on the live site within 7 days.

9. Cookies and similar technologies

roadreview.de uses no tracking cookies, no marketing cookies, and no third-party pixels. After acceptance of a contact enquiry, a necessary confirmation cookie is set for at most 15 minutes. It supports acceptance confirmation, not analytics. For details, see /en/cookies.

10. Your rights as a data subject

Under the GDPR, you have the following rights vis-à-vis us, to the extent the respective conditions are met:

  • Access to the personal data we process about you (Art. 15 GDPR)
  • Rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR)
  • Erasure of personal data we hold about you („right to be forgotten", Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability in a structured, commonly used, machine-readable format (Art. 20 GDPR)
  • Objection to any processing based on Art. 6 (1)(f) GDPR (Art. 21 GDPR) — this applies in particular to web analytics with Rybbit and to hosting logs
  • Withdrawal of consent, with effect for the future (Art. 7 (3) GDPR)

To exercise these rights, please email aleks@roadreview.de. We respond within one month of receipt at the latest (Art. 12 (3) GDPR).

11. Right to lodge a complaint

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). For RoadReview GmbH (registered office in Frechen, North Rhine-Westphalia) the competent authority is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Web: www.ldi.nrw.de

You may also contact any other supervisory authority in the EU member state of your residence, place of work, or place of the alleged infringement.

12. Currency of this policy

This privacy policy is current as of October 2026. We will update it whenever our processing changes (e.g. new sub-processors, new features). The latest version is always available at roadreview.de/en/privacy.