Privacy Policy MAHLE Workshop Portal

We at MAHLE Aftermarket GmbH ("MAHLE", "we") take the protection of our users' ("you") personal data very seriously. We process your personal data in accordance with the applicable legal provisions for the protection of personal data, particularly the EU General Data Protection Regulation ("GDPR") and any country-specific implementing laws that apply to us. This Privacy Policy provides comprehensive information about how we process your personal data when providing the MAHLE Workshop Portal ("Workshop Portal") and about your rights regarding the processing of your personal data.

1. NAME AND CONTACT DETAILS OF THE CONTROLLER

As the controller, we are responsible for the processing of your personal data:

MAHLE Aftermarket GmbH
Pragstraße 26 - 46
70376 Stuttgart, Germany
Tel.: +49 711 501-0
Mail: aftermarket.support@mahle.com

For further information about us, please refer to the imprint on our website https://www.mahle-aftermarket.com/eu/en/imprint/.

2. CONTACT DETAILS OF OUR DATA PROCESSING OFFICER

If you have any questions or require further information on data protection, please contact our corporate Data Protection Officer at any time at the following email address: cdpo@mahle.com.

3. PURPOSES OF AND LEGAL BASES FOR THE PROCESSING OF PERSONAL DATA

3.1 Registration for the Workshop Portal

Our Workshop Portal is aimed at three different user groups: Workshop Technicians, Workshop Owners and Workshop Managers / Administrators. Members of each user group are encouraged to register on our Workshop Portal. As part of the registration of each user, we process the following personal data: name, email address, job role, city, country and optional telephone number.

Before your account is fully enabled, you must confirm your registration via email 2FA process.

For password recovery, we also use a 2FA-process via email. For this purpose, we process your email address. The provision of your telephone number is not mandatory for enabling all features.

Insofar as processing is necessary for the registration for and use of the Workshop Portal, processing of data is necessary for the performance of our contractual relationship, Art. 6 para. 1 lit. b GDPR. If you voluntarily provide optional information, the processing of your personal data corresponding to this information is based on our legitimate interest in processing the data you provide, Art. 6 para. 1 lit. f GDPR.

3.2 Marketing communications

If you give us consent in your profile settings to send you marketing emails, we will process your email address for this purpose. Therefore, the processing of your email address is based on your consent, in accordance with Art. 6 para. 1 lit. a GDPR.

The Workshop Portal can also be used without consenting to the sending of marketing emails. Also, your consent is not linked to your Workshop Portal profile. If we deactivate or delete your profile due to inactivity, this does not result in the cancellation of our marketing communications.

In any case, you can withdraw your consent at any time either through your Workshop Portal profile or by clicking the "unsubscribe"-link contained in every e-mail. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

3.3 Usage of the Workshop Portal

The aforementioned features are an integral part of our Workshop Portal, therefore, processing of this data is necessary for the performance of our contractual obligations under the usage agreement with you, Art. 6 para. 1 lit. b GDPR.

3.4 Support

Registered users can submit support requests. In this context, we process the contents of your support request in order to provide a response to you. In addition, we process your profile data, if you are a registered user.

If your request relates to an existing contractual relationship with us or if you are interested in concluding a contract with us, the processing of this data is necessary for the performance of our contractual obligation to you or in order to take steps at your request prior to entering into a contract with us, Art. 6 para. 1 lit. b GDPR. Otherwise, the processing of this data is necessary in accordance with Art. 6 para. 1 lit. f GDPR to safeguard our legitimate interest in responding to your request with the information relevant to you.

Support requests and related correspondence are retained only for as long as necessary to process the request, provide follow-up support, comply with legal obligations or establish, exercise or defend legal claims.

3.5 News & Media

With our feature "News & Media", we offer you engaging content which fits your interests such as our social media content or our PIMcore content. In this context, we process the region in which you are located.

In order to provide you with content that is relevant to your geographic region, we process information regarding the country or region associated with your account. This processing is carried out on the basis of our legitimate interest in providing users with regionally relevant content and information about products, services, training opportunities and events, pursuant to Art. 6 para. 1 lit. f GDPR.

3.6 Loyalty Program

Our Workshop Portal offers a "Loyalty Program" that rewards you with various benefits for carrying out different activities on the Workshop Portal, such as regular logins, reading articles, completing online trainings, etc.

For the purpose of operating the Loyalty Program and allocating rewards, we process the following categories of personal data, to the extent relevant to the respective activity:

a) Account data (e.g. name, email address, country and user identification information);

b) Company-related information (e.g. company name and business website);

c) Loyalty Program activity data (e.g. logins, completed trainings, viewed content and other reward-eligible activities);

d) Purchase-related information submitted by you for reward purposes (e.g. products purchased, quantities, purchase location and purchase date);

e) Contact information voluntarily provided by you (e.g. telephone number and address details).

Personal data is processed only to the extent necessary for the administration of the Loyalty Program, the allocation and redemption of rewards, fraud prevention, customer support and programme reporting.

For the purpose of operating the Loyalty Program, we use the service provider TrueLoyal, Inc. Certain personal data is transferred to TrueLoyal where necessary for the administration of user accounts, reward allocation, points calculation and programme management. The categories of data transferred may include email address, country information and activity-related Loyalty Program data.

The Loyalty Program is an integral feature of the Workshop Portal. The processing of this data is necessary for the performance of our contractual obligation to you pursuant to Art. 6 para. 1 lit. b GDPR.

3.7 Operation of the Workshop Portal

We also process personal data to operate the Workshop Portal, to store your preferences and your consent and to provide you a smooth user experience.

If you have given us your consent to the use of non-essential cookies and similar technologies, we process and store information relating to your consent and your cookie preferences. The processing of this data is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR. We also process information regarding the granting, withdrawal and documentation of consent in order to demonstrate compliance with applicable legal obligations relating to the use of cookies and similar technologies.

3.8 No intentional processing of special categories of personal data

We kindly ask that you do not provide us with any special categories of personal data, as defined in Art. 9 para. 1 GDPR. We do not intentionally process special categories of personal data. If such data is provided to us, we will only process it where permitted under Art. 9 para. 2 GDPR and where necessary for the relevant purpose.

4. COOKIES

4.1. What are cookies?

We use cookies in the context of providing the Workshop Portal. Cookies are small text files stored on the device you are using by your web-browser (locally on your hard drive).

Our website uses "essential" or "technical" cookies (see section 4.3 below) and "non-essential" cookies (see section 4.2 below).

We only use non-essential cookies with your express consent (see section 4.3 below), You can withdraw your consent at any time.

4.2. Consent to the use of cookies

When non-essential cookies are in use and you first visit the Workshop Portal, or when you click on the respective link in the cookie banner, a cookie notice is displayed.

By clicking the respective buttons in the cookie notice, you can give your consent so we can use and store non-essential cookies on your computer in accordance with the terms of this Cookie Policy; alternatively, you can choose to limit our use of cookies to what is technically necessary for the Workshop Portal to function properly.

You can adjust your cookie preferences regarding non-essential cookies at any time by selecting "Edit cookie settings" in the available cookie banner.

4.3. How we use cookies

Cookie Retention Period

From a temporal perspective, we clarify that there are two types of cookies that may be used on our Workshop Portal: “Session Cookies” and “Persistent Cookies.”

  • Session Cookies are temporary, meaning they remain on your device only until you end your browsing session or stop using the Portal.
  • Persistent Cookies remain on your device until they are deleted (the length of time a cookie stays on your device depends on the duration of the specific cookie’s “lifetime” and on the settings of the browser used).

The typical retention period for permanent cookies stored by us on your computer or device is 12 months unless a different retention period is set out below. The storage period begins when the cookie is initially stored and starts anew when it is updated.

Technical cookies

Technical cookies are essential for the basic functioning of the Workshop Portal and do not require your consent. They store information about basic functions, such as language selection, and thus enable the desired user experience. These also include cookies that store your cookie settings. Please note that we can only influence whether we use cookies in the tools of other providers. If you object to the use of cookies, we cannot remove the relevant cookies from your computer.

Cookie Purpose Retention Period
Consent Management Cookie Storage of your cookie preferences and consent to our use of non-essential cookies Up to 12 months
Language Cookie Stores the user’s language selection to display the Workshop Portal in the preferred language. Session or up to 12 months
Session Cookie
 Ensures the basic technical operation of the Workshop Portal, including session management and security.
 Session

In particular we inform you about the following services and cookies:

4.4. Use of Matomo

We use the Matomo analysis tool. With the help of Matomo, we are able to collect and analyze data about the use of our website-by-website visitors. This enables us to find out, for example, when which pages were accessed and from which region. We collect the following data for this purpose:

  • IP address (anonymized)
  • Referrer
  • Browser used
  • Operating system used
  • Page views
  • Interaction with interactive elements
  • Form usage (typing, sending)
  • Scrolling width

The legal basis for data processing is our legitimate interest in analyzing user behavior in accordance with Art. 6 para. 1 lit. f) GDPR.

The software is configured in such a way that IP addresses are not stored in full. The IP address is shortened to its first two bytes (e.g.: 192.168.XXX.XXX) so that it can no longer be clearly assigned.

Further information on Matomo's terms of use and data protection regulations can be found at: https://matomo.org/privacy/

We have commissioned agorate GmbH, Berliner Allee 47, 64295 Darmstadt, Germany (www. https://www.agorate.de/) to provide Matomo for our websites as a Processor in ac-cordance with Art. 28 I GDPR. In this respect, we pass on your data to this Processor.

Non-essential cookies

We integrate third-party content, such as videos, into the Workshop Portal. Some of these providers set their own cookies. Third-party content will only be displayed if you accept these cookies. For information on how these providers use your personal data, please refer to their respective privacy policies.

We also use cookies to enable you to share content on social media, as well as to analyse the links between our Workshop Portal and social media platforms. If you would like to find out more, please refer to the relevant section of this Privacy Policy.

Cookie Purpose Retention Period
YSC Used by YouTube to enable the playback of embedded videos and maintain session state. Session
VISITOR_INFO1_LIVE Used by YouTube to estimate bandwidth and improve video playback performance. Up to 6 months
_fbp v Up to 3 months
fr Used by Meta to deliver, measure and improve advertisements and analyse interactions with Meta platforms. Up to 3 months
datr Used by Meta for security purposes, such as identifying browsers and preventing fraudulent use. Up to 2 years

4.5 Use of Microsoft Clarity

If you consent, this website uses the web analytics service Microsoft Clarity. Microsoft Clarity is a service provided by Microsoft Corporation, with its EU contracting entity Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Website: https://clarity.microsoft.com.

With Microsoft Clarity, user interactions on the websites on which Clarity is used can be tracked (so‑called heatmaps and session analytics). For example, it is possible to see how far users scroll, which buttons are clicked and how often, how much time users spend on individual pages, how they navigate through the website, and which elements cause difficulties or interruptions in usage. Microsoft Clarity also makes it possible to analyze user journeys and points at which users leave the website or abandon a process.

We use Microsoft Clarity to better understand the needs of our users and to optimize the content, structure and user experience of our website.

For example, in this context, we process the following data:

  • which buttons are clicked,
  • mouse movement patterns,
  • scroll behaviour,
  • interactions with website elements,
  • IP address of the device (processed in anonymised or truncated form),
  • screen size of the device,
  • device type, operating system and browser information,
  • approximate geographic location (country only),
  • preferred language of the website, and
  • date and time of the website visit.

We take special care to protect personal data when using Microsoft Clarity. Microsoft Clarity analyses the use of our website in a pseudonymised manner. Personal data entered form fields or other sensitive content is automatically masked or excluded from recording and is not processed in session recordings. This ensures that no directly identifiable personal data is captured. IP addresses are processed only in anonymised form to prevent direct personal reference.

For this purpose, Microsoft Clarity uses cookies and similar technologies to collect information about the behaviour of users and their end devices. The collected information is stored on our behalf in a pseudonymised user profile. Microsoft is contractually prohibited from using the data for its own purposes or selling the data collected on our behalf.

The legal basis for the processing of personal data is Art. 6 (1) lit. a GDPR (consent).

You can prevent the processing of your data by Microsoft Clarity at any time by not giving your consent to the use of behavioural or analytical cookies on this website or by withdrawing your consent via the cookie settings.

Further information about Microsoft Clarity is available at: https://clarity.microsoft.com

Further information about Microsoft’s data protection practices can be found in Microsoft’s Privacy Statement: https://www.microsoft.com/privacy

How do we make changes to this cookie policy? POLICY?

We reserve the right to amend this Cookie Policy as necessary. Any updates will be published on our Workshop Portal. Please check this Cookie Policy regularly. Subject to applicable law, all changes will take effect as soon as the new Cookie Policy is published.

Managing cookies

You can manage your cookie preferences at any time and object to the use of non essential cookies. This can be done, for example, by changing the corresponding settings in your internet browser or by adjusting your preferences via the cookie settings available on our website.

Please note that disabling cookies may result in certain functions of the Workshop Portal no longer being available or working properly.

If you wish to deactivate individual cookies or specific services used on this website, detailed information about the respective services can be found in the relevant sections of this Cookie Policy.

For further information on how to manage cookies in commonly used browsers, please refer to the links below:

  • Internet Explorer
  • Mozilla Firefox
  • Google Chrome
  • Safari

In addition, you may find further information on opting out of certain third party cookies on the following websites:

Network Advertising Initiative: http://www.networkadvertising.org/managing/opt_out.asp

Digital Advertising Alliance: http://www.aboutads.info/choices

If you have any questions regarding this Cookie Policy, please contact: cdpo@mahle.com.

5. SOCIAL MEDIA

5.1 General information

We have publicly accessible accounts on various social media platforms so that you can contact us or receive information from us in a variety of ways. You can find these accounts in our Workshop Portal. Visiting these accounts triggers a variety of data processing operations.

Below, we provide an overview of the personal data that we collect, use and store when you visit our social media accounts. You are not obliged to provide us with your personal data. However, the provision of personal data may be necessary to use certain functions of our social media accounts. If you do not provide us with your personal data, these functions will either not be available to you or will only be available to a limited extent.

When you visit our social media accounts, your personal data is collected, used and stored not only by us but also by the operators of the respective social network. This also happens if you do not have a profile on the social network in question. The specific data processing operations and their scope vary depending on the operator of the social network in question and may not necessarily be traceable by us. Please refer to the privacy policies of the respective operator for details on the collection and storage of your personal data, and the nature, scope and purpose of its use:

5.2 Additional information about the collection of personal data

When you visit our social media accounts, we process the personal data of both registered and unregistered visitors as described in the next paragraph. Using the respective social network and its functions is at your own risk. This applies in particular to the use of interactive functions, such as sharing and rating.

We process the following data from registered visitors to our social media pages:

  • User ID or username under which you registered;
  • Profile data that you have made available, such as name, job details, addresses, contact details;
  • Data generated when sharing content, exchanging messages and communicating.

Otherwise, we only process pseudonymised data such as statistics and insights into how you interact with our social media page and the content provided on it, as well as evaluations of the success and background of our advertisements. We cannot merge the pseudonymised data with the corresponding identifying feature (e.g. name details). This means that we are unable to identify individual visitors, who therefore remain anonymous to us.

We process this data on the following legal bases:

  • If you contact us via our social media accounts, we will only use the data you provide for the purpose of responding to you. This processing is based on our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR:
    • Simplifying communication and data exchange by supplementing existing channels with a social media presence;
    • Optimising our social media presence.

Only our employees and service providers who manage our social media accounts and require the data for the aforementioned purposes have access to it. If data subjects post their data publicly on our social media accounts, it can also be accessed by other registered users and, where applicable, non-registered visitors, including those from third countries.

5.3 Joint controllers

When you visit our social media pages, we are jointly responsible with the respective platform operators for processing your data, in accordance with Art. 26 GDPR. In order to guarantee your rights and comply with GDPR provisions, we have concluded an agreement setting out the rules for processing your personal data, provided that the relevant social network provides such an agreement.

You can contact any of the companies involved individually regarding the processing of your data and assert your rights. More detailed information about your rights can be found in No. 5 of this Privacy Policy.

For further information on our joint controllership, please refer to the relevant agreements under Art. 26 para. 1 GDPR provided by the following links:

6. DATA TRANSFER TO THIRD PARTIES / CATEGORIES OF RECIPIENTS

We will only transfer your data to third parties (1) if we are required to do so for the performance of our contractual obligation to you, (2) if you have given us your consent, or (3) if we have a legitimate interest in doing so (see the detailed description in No. 3 above). Otherwise, no data will be passed on to third parties, unless we are legally obliged to do so by mandatory legal provisions, particularly to supervisory authorities or law enforcement agencies.

Within our company, we ensure that only those persons who require certain personal data for the purpose of performing their tasks receive the required personal data ("need-to-know"-principle).

In many cases, this involves service providers whom we have carefully selected and commissioned in accordance with Art. 28 GDPR, in particular TrueLoyal, Inc. (for further information on how TrueLoyal, Inc. is processing your data, please refer to its privacy policy: https://www.trueloyal.com/privacy-policy/). These service providers are bound by our instructions and are regularly monitored by us.

7. DATA TRANSFER TO A THIRD COUNTRY

We transfer certain personal data to our service provider TrueLoyal which is located in the United States of America. See section 6 above for details. The United States of America are a third country outside the European Union which, absent additional safeguards, does not provide a level of data protection comparable to that of the European Union.

Therefore, the processing agreement we concluded with TrueLoyal includes the EU Standard Contractual Clauses for the international transfer of personal data from controllers to processors ("Module 2). A copy of the terms concluded between us and TrueLoyal can be found under https://www.trueloyal.com/dpa/.

8. DATA RETENTION PERIOD

We process your personal data only for the period necessary to achieve the purpose of processing or if this has been provided by the European directive and regulation issuer or another legislator in laws or regulations to which we are subject. Therefore, data stored in relation to your user account is stored as long as your account is active.

Inactive user accounts will be deactivated after a 12 month period of inactivity. Deletion classes are defined per data category and purpose. In particular, (i) usage and analytics data (e.g. IP address, website history, cookie information) is retained for 6 or 12 months depending on the data element and then deleted automatically, and (ii) user account and contact data (e.g. name, email address, phone number, job title, language) is retained for 12 months after the user’s last login or deleted earlier if the data subject actively requests account deletion. Personal data associated with deactivated accounts will be retained only for as long as necessary to fulfil legal obligations, resolve disputes, maintain security, prevent fraud or establish, exercise or defend legal claims, after which the data will be deleted or anonymised.

If the personal data concerned could be required for the assertion or defence of legal claims, the storage period shall be determined by the statutory limitation periods for the respective claim, which are typically 3 years, unless court proceedings are initiated, in which case the data will be retained for the duration of the court proceedings. If the purpose of processing no longer applies or if a storage period prescribed by European directives and regulations or other competent legislators expires, the personal data will be routinely blocked or deleted in accordance with the statutory provisions.

9. AUTOMATED DECISION-MAKING

We do not use automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

Certain features of the Workshop Portal may involve the automated processing of user activity data, for example for the allocation of loyalty rewards or the presentation of content relevant to your interests. Such processing does not result in decisions that have legal or similarly significant effects on users.

10. YOUR RIGHTS AS A DATA SUBJECT

You have the following rights under Art. 15–22 GDPR which you may exercise if their respective legal requirements are met:

  • Right to access (Art. 15 GDPR);
  • Right to erasure ("right to be forgotten") (Art. 17 GDPR);
  • Right to rectification (Art. 16 GDPR);
  • Right to data portability (Art. 20 GDPR);
  • Right to restriction of processing (Art. 18 GDPR);
  • Right to object (Art. 21 GDPR)

Insofar as we process your personal data based on our legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR (see the detailed description in Section 3 above) regarding direct marketing purposes, you have the right to object to such processing at any time. This also applies to profiling insofar as it is related to such direct marketing. We will then no longer process your personal data for these purposes.

If we process your data for other purposes based on our legitimate interests pursuant to Art. 6 para. 1 s. 1 lit. f GDPR, you have the right to object on grounds relating to your particular situation. We will then no longer process the personal data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to the establishment, exercise or defence of legal claims.

Right to withdraw consent (Art. 7 para. 3 GDPR):

If you have given us consent to process your personal data (see the detailed description in Section 3 above), you have the right to withdraw this consent at any time. However, withdrawing your consent does not affect the lawfulness of any processing carried out on the basis of your consent prior to its withdrawal.

To exercise these rights, please contact us at the following email address: cdpo@mahle.com. The same applies if you have any questions about data processing within our company. If you wish to withdraw your consent, please send an email to the above address stating which declaration you wish to withdraw.

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority for data protection, without prejudice to any other administrative or judicial remedy (Art. 77 GDPR).

You may contact any supervisory authority.

The supervisory authority responsible for Austrian data subjects is:

Österreichische Datenschutzbehörde (DSB)
Barichgasse 40-42
1030 Wien
Österreich
+43 1 52 152-0
dsb@dsb.gv.at

The contact details of the supervisory authority responsible for MAHLE are:

State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Dr. Tobias Keber
Postfach 10 29 32
70025 Stuttgart, Germany

or

Lautenschlagerstraße 20
70173 Stuttgart, Germany

11. CHANGES TO THIS PRIVACY POLICY

We reserve the right to amend this Privacy Policy as necessary. Any updates will be published on our Workshop Portal. Please check this Privacy Policy regularly. Subject to applicable law, all changes will take effect as soon as the new Privacy Policy is published. If we have collected data about you and/or are legally obliged to provide information, we will notify you of any significant changes to the Privacy Policy and request your consent.

Status: August 2026