Privacy policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Fahrschule DEVAM
Fahrschule Devam GmbH
Ulmenstr. 2
90443 Nürnberg

Phone: 0176 41693949
Email: [email protected]

You will find further information in our legal notice.

2. Hosting and server log files

When you open a page, your browser automatically transmits technical information to our web server. This includes in particular:

• IP address
• Date and time of access
• page or file requested
• HTTP status code and amount of data transferred
• previously visited page (referrer), if your browser transmits it
• browser type, browser version and operating system

This data is technically necessary to deliver the website to you. Depending on the server configuration, it is stored in log files so that errors can be detected and attacks averted. It is not combined with other data sources or analysed for advertising purposes.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website securely, stably and without errors.

Cloudflare: Cloudflare is used in front of the origin server solely for DNS, reverse proxy, Web Application Firewall (WAF), DDoS mitigation, abuse protection and basic rate limiting. For these purposes Cloudflare may process necessary technical data, in particular the IP address, request time, hostname and path, HTTP headers, technical browser/User-Agent data, TLS/security information, and firewall/security-event metadata. We do not claim that no personal data reaches Cloudflare or that processing takes place exclusively in Germany. This website neither requires nor uses Cloudflare Web Analytics, Browser Insights/RUM, Zaraz, Workers, Images or Turnstile. Cloudflare country/city headers are not stored for visitor analytics or visitor profiling.

When you submit a form or other input, the submitted content necessarily passes through the Cloudflare reverse proxy as part of the HTTPS request and may be technically processed there for website delivery and security/WAF purposes.

Date, time and weather: The line showing the date, the time and the current weather in Nuremberg is displayed in your browser. Our server retrieves the weather data from the German Meteorological Service (Deutscher Wetterdienst, DWD, open data service, Nuremberg weather station) and caches it briefly. No data about you is transmitted to the German Meteorological Service in the process.

3. Cookies and storage in your browser

Under § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG), information may generally only be stored on or read from your device with your consent – unless this is strictly necessary for a service you have expressly requested.

Public pages: We store language, appearance and your consent decision locally in your browser as necessary settings. Statistics are off on the first visit, and the consent banner gives equal access to “Accept all”, “Necessary only” and “Settings”. A random session ID is created in sessionStorage for the current browser session only after your explicit statistics consent. You can withdraw consent at any time through “Cookie settings” in the footer; collection then stops immediately and the optional session ID is deleted.

Independently of this, your browser keeps files it has already loaded, such as images or the font, in its cache so that pages load faster. You can clear this cache at any time in your browser settings.

Admin area: Only people who log in to the driving school's protected admin area receive technically necessary cookies: a session cookie and a cookie that identifies the browser as a known device, so that attacks on the login can be slowed down without locking out authorised people. Visitors to the website are not affected.

We do not use tracking pixels or third-party analytics or marketing services. We perform no canvas, audio, font, WebGL or other device fingerprinting. Form and login protection runs solely on our DEVAM server; details are in section 11.

Our own consent-based visitor statistics: After your consent, our own server records visit time and the internal page viewed, website and browser language, approximate country and city (only where the server supplies a local or trusted GeoIP source), the referrer domain alone or a direct visit, only utm_source, utm_medium and utm_campaign, plus device class, browser family and operating-system family. External referrer paths and query strings are not stored. The full IP address and full user agent are not stored in the statistics database or sent to a geolocation service. A random session ID is processed server-side only as a day-bound HMAC and deleted by the next day at the latest. Only aggregated daily values remain. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

“Open today” indicator: Whether we are currently open is calculated by your browser directly on the page, based on your device's time and the published opening hours. Nothing is stored and nothing is transmitted to us or third parties.

4. Contact form and handling of your enquiry

When you write to us using the contact or price request form, we process the details you enter there. Only the details without which we cannot assign and answer your enquiry are required:

• Type of enquiry (for example price / cost request, general question or callback)
• First and last name
• Email address or phone number (at least one of them; for a callback, the phone number)
• desired licence class or topic of the enquiry
• Message – optional for price requests, registration enquiries and callbacks
• Confirmation that you have read this privacy notice (with time stamp)

You can also optionally state when you would like to start your training and add a subject. We also store the language in which you used the website so that we can reply appropriately. The form does not involve any consent to advertising or a newsletter.

Purpose and legal basis: We use the details exclusively to handle your enquiry. If your enquiry concerns training with us, the legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). In all other cases we base the processing on Art. 6(1)(f) GDPR; our legitimate interest is answering enquiries addressed to us. The confirmation box merely documents that you have read this notice; it is not consent within the meaning of Art. 6(1)(a) GDPR.

Process: Your details are transmitted to our web server in encrypted form and stored there as a contact enquiry in a database outside the publicly accessible web directory. We also send a notification to the driving school's mailbox. If you gave an email address, you receive an automatic confirmation of receipt in the language in which you used the website – a pure confirmation, no advertising. If this confirmation cannot be sent, your enquiry is still stored.

Further handling in the admin area: Authorised staff of the driving school can see your enquiry in the internal admin area, record its status there (for example “new”, “contacted”, “appointment arranged”) and add internal notes and a consultation appointment. If your enquiry leads to training, we create a customer record for it. Access and changes are logged (see section 10).

Storage period: We delete your enquiry as soon as it has been dealt with conclusively, provided no statutory retention obligations apply. If your enquiry results in a training relationship, we keep the details for as long as is necessary to carry it out and to meet legal obligations.

To protect against spam, the form contains a field that is invisible to people and a short-lived technical check token; we also limit the number of enquiries (see Protection against misuse).

4a. Appointment notices and acceptance evidence

When we schedule an appointment for a customer, we process the appointment and contact data required to carry it out. This may include the customer number, date and time, meeting point, instructor, vehicle, registration plate, transmission and licence class. The customer receives a transactional email with a random, time-limited confirmation link and one appointment PDF containing German, Turkish, Russian, English and Arabic. The instructor receives only information needed for the appointment; confidential internal notes are not sent.

The confirmation link provides the appointment details, the version of the cancellation terms applicable to that appointment and the associated PDF. Acceptance is recorded only after an explicit choice. As evidence, we store in particular the appointment reference and snapshot, version and text of the terms, document identifier and version, the PDF's SHA-256 digest, language and time. Privacy-preserving one-way request hashes may be stored to prevent abuse. The link itself is stored only as a hash and may expire or be revoked.

An appointment cannot be cancelled or changed through the confirmation link; notice may be given by telephone or in text form, especially by email, as described in the cancellation terms. An attempt to cancel through the link is only recorded. The legal basis for appointment handling, notices and evidence is Article 6(1)(b) GDPR insofar as this is necessary to prepare or perform the training relationship; security records additionally rely on Article 6(1)(f) GDPR. Evidence is protected against later alteration and retained only as long as necessary for contract handling, establishing or defending claims and statutory obligations.

5. Contact by email or phone

If you contact us by email or phone, we process the data you give us (for example name, phone number, email address and the content of your message) in order to deal with your request. The legal basis is Art. 6(1)(b) GDPR where training is concerned, otherwise Art. 6(1)(f) GDPR (answering enquiries). The storage period is the same as for the contact form.

Email correspondence: Our web server fetches emails sent to our mailbox from the email provider over an encrypted connection and stores them – together with our replies – in the protected administration area, separately from the other data. We link an email to your enquiry or customer record if the sender address matches; otherwise it remains unlinked. A new email may be followed by an automatic confirmation of receipt (not for automatically generated messages and at most once within a waiting period). External images contained in emails are not loaded automatically. We do not send newsletters or advertising emails; email communication serves solely to handle your request or your training. The legal basis is Art. 6(1)(b) GDPR where training is concerned, otherwise Art. 6(1)(f) GDPR.

WhatsApp: No WhatsApp function, automatic API or active click-out link is currently enabled on this website.

6. Google reviews

The Google Places/reviews interface and Google review click-out links are currently disabled. Neither our server nor your browser makes an automatic request to Google for this section, and no Google review content is stored by this website.

7. Map preview and route planning

The map on the contact page is an image stored on our server (map data © OpenStreetMap contributors). No connection to a map service is established when it is displayed.

The Google Maps route link and linked external address are currently disabled. The local map image does not contact Google.

8. Links to Instagram and TikTok

We do not embed content, plug-ins or tracking pixels from social networks. Instagram and TikTok links are currently disabled, so the website does not contact those platforms.

9. Fonts, icons and images

The font used (Archivo), the icons and all images are loaded from our own server. No data is transmitted to external providers such as Google Fonts or content delivery networks.

10. Internal admin area

The admin area of this website is not public and can only be accessed after logging in. It is used exclusively by the driving school to maintain the website and to handle enquiries, customer data and appointments.

• User accounts: For each authorised person we store a user name, display name, role, permissions and a password hash, and – if two-factor login is enabled – an encrypted key for the authenticator app. Passwords are never stored in plain text.
• Log: Logins, changes to content and business data, and changes to enquiries, customer data and appointments are logged with the time, the person acting and the record concerned. The log serves traceability and IT security (Art. 6(1)(f) GDPR, supplemented by § 26 BDSG in the employment context). Passwords, PINs and session IDs are not logged; the IP address is only stored as a hash value.
• Deletion approval: Important records can only be deleted permanently after approval by an authorised person and entry of an approval PIN. Until then, deleted records are only visible in the recycle bin.

11. Protection against misuse

To protect the contact form and the admin area against automated attacks and spam, we limit the number of requests per sender. For this purpose we store on the web server, for a maximum of 24 hours, a hash value calculated from your IP address and a secret key, which does not contain the IP address in plain text, together with the times of the requests. Failed login and confirmation attempts in the admin area are counted for a maximum of 48 hours. If identical enquiries are sent several times within a few minutes, we store them only once. In addition, the form only accepts requests that originate from this website itself.

First-party security challenge: The contact form and login use a short-lived, signed and single-use arithmetic challenge generated by our own server. It is combined with honeypot, origin and CSRF checks, one-time tokens, replay prevention, rate limits and temporary blocks. There is no external anti-bot call, browser fingerprinting or persistent device identifier.

The legal bases are section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR. Our legitimate interest is protecting forms and accounts against bots, spam and automated attacks.

Security log: Requests that clearly indicate an attack or automated probing are kept in a separate security log. It stores a privacy-preserving network identifier/range, time, requested path, request method/status and a coarse browser family where needed, but no full User-Agent, proxy chain, Cloudflare country/city/Ray data, form or mail body, password, token, authorization header or cookie. Repeated attacks may trigger a temporary block of at most 24 hours. Ordinary page views are not recorded there.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the security and proper functioning of the website.

12. Recipients and service providers

Google/Meta/social integrations and their click-out links are disabled; the website therefore makes no automatic request to them.

13. Transfers to third countries

Cloudflare's reverse-proxy and security operation may involve processing outside Germany; the application does not make a Germany-only claim or issue a compliance certificate. Hosting, mail, Cloudflare configuration and privacy information are reviewed separately. Provider contracts, transfer safeguards and account-specific settings must be confirmed by the operator where applicable.

Turnstile, Telegram transport, Google Places, WhatsApp API, marketing trackers and social click-out links are disabled. If the operator later enables an external service, this notice must be reviewed before activation.

14. Storage periods at a glance

There is no automated decision-making, including profiling (Art. 22 GDPR).

15. Your rights

Under the GDPR you have the following rights with regard to us:

• Access to the data we process (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to the processing (Art. 21 GDPR, see next section)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR). This concerns the consent-based visitor statistics: you can withdraw your consent at any time via “Cookie settings” in the footer.

Simply contact us by email at [email protected] or via the contact details given above.

16. Right to object

17. Complaint to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The competent authority for companies in Bavaria is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Postfach 1349
91504 Ansbach
www.lda.bayern.de (opens in a new tab)

18. Currency of this privacy policy

Last updated: September 2026. We adapt this privacy policy when the website, the services used or the legal requirements change.