Privacy policy

Status: November 7, 2026

1. Who is responsible for your data

The controller responsible for processing personal data on this website is:

Thomas Maros · Agrar Tech
Norikerstr. 8
90402 Nuremberg
Email: info@agrar-tech.de
Telephone: +49 1515 249 6866

You can also use these contact details for privacy questions and to exercise your rights.

2. Website operation and hosting

When you visit the website, we process technical data required for the connection. This includes your IP address, access time, requested page or file and connection information supplied by your browser. We need this data to deliver the website, secure connections and identify technical faults or abusive access. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is operating the website securely and reliably.

The website runs on a virtual server managed by us. For server infrastructure and email, we use hosting and email services provided by IONOS . These providers may process data required to deliver or transmit the service. IONOS provides further information in its privacy information .

Our web server does not keep a separate access log of every page visit. Technical diagnostic and error messages arise during operation. These logs are limited; older entries are replaced as technical storage limits are reached. To limit repeated login and form attempts, we also use server-side counters with a pseudonymised identifier derived from the IP address. This processing protects the website and user accounts under Article 6(1)(f) GDPR.

3. Contact, tuning enquiries and B2B partnership enquiries

If you contact us by form, email or telephone, we process the information you provide to handle your enquiry and any necessary follow-up questions. This may include your name, business contact details, company and message. Tuning enquiries also include vehicle or machine details you provide, such as manufacturer, model, year, engine, power, ECU and application.

For B2B partnership enquiries, we additionally process company and address details, any VAT or tax number, business type, existing hardware and proposed cooperation. The enquiry helps us assess and prepare a business relationship. It does not automatically create a user account.

If you are the contracting party and processing is necessary to perform a contract or take pre-contractual steps at your request, the legal basis is Article 6(1)(b) GDPR. For business contacts and other enquiries, Article 6(1)(f) GDPR applies: our legitimate interest is answering business enquiries and organising cooperation.

We need the mandatory information marked in each form for the relevant process. Additional information is voluntary. Without sufficient contact and factual details, we cannot handle an individual enquiry. You may use the public pages and vehicle search without sending an enquiry. Acknowledging the privacy information in a form is not consent to advertising.

4. Hardware selection and requests for quotations

The hardware section is exclusively for businesses. When you request a quotation, we process your selected products, quantities and configurations together with the company and contact details you enter. We need this information to check your selection, clarify prices and delivery options and prepare an offer. The legal bases described in section 3 apply.

Your enquiry is stored on our server and forwarded to our business email inbox for handling using the email provider named above. For enabled direct purchases, we also process billing and delivery addresses, the binding order contents, VAT and delivery costs, the accepted sales terms and payment and dispatch status. This data is needed to fulfil the contract or process business orders; the legal bases described in section 3 apply. Records required under tax and commercial law are also processed under Article 6(1)(c) GDPR.

For PayPal payments, we send the order amount, item details, order reference and supplied delivery address to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. You are redirected to PayPal to approve payment. We receive the transaction identifiers and payment status needed to allocate and process it. PayPal also processes data as an independent controller; information about recipients, possible transfers outside the EEA and safeguards is available in the PayPal privacy policy. Your PayPal login, card and bank-account details are not entered or stored on our website.

Order and dispatch confirmations are sent through our email provider to the customer's supplied address and our business inbox. The appointed carrier receives the address details required for delivery.

5. Protected partner area and user accounts

Dealers can apply through dealer registration. For new email addresses we first create an ordinary customer account for shopping and send a link to verify the address and set a password. We store the submitted business and contact details, language, review status, and the time and administrator responsible for approval. Dealer features are activated only after a confirmed, paid device purchase in the associated customer account and our review. We check the ownership and payment status of the device order on subsequent access as well. For user accounts we also process the role, individual feature permissions, activation status and data required for login and account security. Information in the dealer area is visible only to approved dealers.

For administrative price changes, we also record the acting user's identifier and email address, time and scope of the change to keep adjustments traceable.

Administrators can upload technical PDF collections as ZIP files. For resumable transfers, we store the filename, file size, modification time, an identifier calculated from file samples, transfer progress and user identifier. Uploaded documents and their protocol assignments are available only to signed-in users. File contents are not published in the public vehicle search.

This processing enables the agreed use of the partner area and protects the technical information provided there. Depending on the business relationship, it is based on Article 6(1)(b) GDPR or our legitimate interest in administering and securing business access under Article 6(1)(f) GDPR. Passwords are stored in the account database as secured verification hashes.

For invitations or password resets, we email a single-use link to the stored address. Invitation links are valid for 48 hours and password-reset links for 30 minutes. Changing a password invalidates existing login sessions. These validity periods do not mean that all related account data is deleted at that time.

For earlier device purchases, an administrator can manually confirm that the purchase has already been paid. We store the device, invoice number or sales reference, associated user, confirming administrator ID and time. Revocation is recorded with the time and administrator ID. This confirmation is used solely to manage access and does not create a new order or invoice.

Voluntary two-factor login

You can additionally protect your account with an authenticator app. For this, we store an encrypted TOTP secret, the activation time, and the last used time code step. Recovery codes are stored only as irreversible checksums and are displayed only upon their creation. Short-lived login checks and failure counters secure the second login step. The QR code is generated locally and not sent to an external QR service. Setup is voluntary; you can disable the function after renewed security confirmation.

To ensure the recoverability of your account and order data, we create consistent database backups as well as encrypted incremental backups on the server and in a separate private backup storage. These backups are separated from the publicly accessible web directory and serve recovery after technical failures. They are not provided as publicly accessible archives.

For the AI chat window, the browser saves only your display decision (opened, minimized, or hidden) during the session. Conversation contents are not permanently stored as a result.

Local AI help and Bosch label photos

When you send a question, a locally hosted AI model processes your question and the necessary previous dialogue exclusively on our server. Its knowledge comes from selected information on our own pages and shop and, with approved access, the associated support content. Optional Bosch photo recognition analyses only the selected label photo locally. These functions do not transmit data to OpenAI or another external AI service.

Do not enter passwords, personal contact details or complete VINs in the AI help, and limit photos to the device label. Image metadata is removed before analysis. Chat text and photos are not stored permanently for these functions. The current conversation remains in browser memory until deleted or you leave the page; server processing takes place in the local model’s memory. Manual Bosch lookup uses the local mapping database.

Processing starts when you select “Send question” or “Recognise number”. No additional checkbox is required. Pseudonymised usage counters and time periods are stored to limit abuse; they contain no chat text or photos. The AI has no access to other people’s orders, account data or dealer documents that have not been unlocked.

Training videos and external help sources

In the protected help area we link manufacturer courses and external original articles. Public YouTube previews load only when you select “Load preview.” Before this click neither a YouTube player nor an external preview image is loaded. Loading transmits connection data, especially your IP address, to YouTube/Google; for this we use embedding via youtube-nocookie.com. Further information is in the Google privacy policy. Opening an external original article or manufacturer course directs you to the respective provider’s website.

Registration-document photo analysis in the partner area

Authorised users can submit a crop of a German or Croatian vehicle registration document for technical vehicle identification. The selected crop is analysed exclusively by the local AI model on our server. We need only technical details; cover or crop out names, addresses and registration plates before submission. A VIN may also be personal data.

Photos are processed on our server only in memory for the individual request and are not stored permanently. Recognised technical values are displayed in the browser for review and compared with the local vehicle database. The manufacturer's database is not changed automatically. To protect the service, we store user identifiers, time periods and analysis counts without storing photos or their contents in those counters.

Processing serves the requested technical assistance on the legal bases explained above. No image or vehicle data is sent to an external AI service for this local photo analysis.

For a shop customer account, we store company name, name and email address. You confirm the address through a single-use link and set a password. The account is linked to your orders. Access to MyGenius software and setup is determined by the confirmed payment status of your associated order; a full refund or payment reversal ends that access. Customer registration does not grant access to the separate technical partner database.

Authorised team accounts can be given permanent software access. Existing customers may receive a personal, time-limited and revocable service link. We store an internal label, creation time, expiry time, device scope and the creating administrator's identifier; the secret access identifier is stored server-side only as a verification hash. The link grants access solely to the authorised software files and guides, not to user or order data.

6. Login cookie and local basket

We use the following storage features to provide functions you request:

• Login: After successful login, the cookie __Host-agrar_session is set. It contains a random session identifier, can only be used over an encrypted connection and cannot be read by website scripts. Its lifetime is at most 12 hours. Logging out ends the session and removes the cookie.
• Installable web app (PWA): If you use the website as an app, your browser caches a general offline information page and app icons. Login details, registration-document photos, technical vehicle data, orders and guides are not stored offline by this PWA feature. You can remove this cache through website data in your browser settings.
• Website language: Your chosen language, German, Croatian or English, is stored under agrar-backend-language in local browser storage until you change it or delete the website data.
• Basket: Your selection is stored under agrar-cart-v1 in your browser's local storage. It contains product identifiers, quantities and selected options, keeping your selection available on a later visit. It is changed or removed when you update the basket or delete website data in your browser; no fixed automatic expiry is set.

This storage serves the requested login or basket function. Necessary access to your device is governed by § 25 para. 2 no. 2 TDDDG. Subsequent processing of personal data follows the legal bases described above. You can remove cookies and website data in your browser; an existing login or saved selection will then no longer be available.

For a PayPal purchase in progress, your browser stores related order data and a random access identifier in sessionStorage. This lets it retrieve payment status after returning from PayPal. This technically necessary data is removed when the browser tab or session closes. Server-side order and transaction data is stored separately for the required retention purposes.

Service-link access: After opening a valid personal service link, the cookie __Host-agrar_resources is set for at most 12 hours. It can only be used over HTTPS and cannot be read by website scripts. Expiry and revocation are checked again for every protected file request. The secret part of the link is removed from the browser address after verification. This storage serves the expressly requested service access on the bases described above.

7. Vehicle search, content and downloads

The vehicle database contains technical information about vehicle models and ECUs. Search activity is not combined into a personal interest or advertising profile. If you transfer vehicle details into an enquiry and submit it, we process them with the other enquiry data.

Fonts, product images and news are delivered through our website. The website uses no analytics or advertising trackers, externally loaded web fonts or embedded social-media plugins. This content does not automatically connect your browser with the original image or news providers.

Download files are also delivered through our website. If you subsequently use a downloaded program or open an external link, that provider's privacy information additionally applies to the processing there.

For quotation and invoice processing, we transfer contact details and order items, including a selected MyGenius manufacturer, to our protected internal MAROS Office workspace. This transfer is encrypted between servers and serves enquiry handling or contract performance.

8. Recipients and data protection

Enquiry and account data is accessed by people who need it for processing or technical operation. Technical recipient categories include the hosting and email providers named above. Data is disclosed to authorities or other bodies where legally required or necessary and permitted to assert or defend legal claims. Processing to comply with legal obligations is based on Article 6(1)(c) GDPR; protecting legitimate legal claims is based on Article 6(1)(f) GDPR.

The connection to the website is encrypted using HTTPS. Enquiry and account data is stored in a protected database outside the publicly accessible website directory. We do not sell your contact or account data or use it for third-party advertising.

9. How retention periods are determined

The necessary retention period depends on the purpose: enquiry handling and traceable follow-up questions, and contract performance for business relationships. Account data is needed to provide and manage access. Statutory retention obligations and the need to establish, exercise or defend legal claims may also apply.

When the relevant purposes cease and no other lawful basis for retention exists, the personal data must be deleted. Where statutory retention is required, further processing is limited to that purpose. These criteria also apply to stored messages and backups. The separate periods stated above apply to sessions and password links.

10. Your rights

Subject to legal conditions, you have the right to access your personal data, rectify inaccurate data, erasure, restriction of processing and data portability. Details are set out in Articles 15–20 GDPR. You may withdraw separately granted consent for the future without affecting earlier lawful processing.

Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will then stop processing the data unless the legal requirements for continuing are met. You can send an objection or other privacy enquiry to info@agrar-tech.de .

No solely automated decisions with legal or similarly significant effects, including such profiling, take place.

11. Complaints to a supervisory authority

Under Article 77 GDPR, you may complain to a data-protection supervisory authority, particularly in your habitual place of residence, workplace or the place of the alleged infringement. For private businesses based in Bavaria, the competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA) :

Promenade 18, 91522 Ansbach
Postal address: Postfach 1349, 91504 Ansbach
Submit an online complaint to BayLDA · Authority contact information