Mach1 KartDEFind a dealer

Privacy policy

Last updated: October 2026

We keep it short and specific: this is what actually happens on our websites. Our websites set no cookies, use no tracking and embed no third-party content (fonts, images and videos are served from our own site). That is why there is no cookie banner.

1. Controller

Hetschel GmbH & Co. KG Daimlerstr. 18 74336 Brackenheim, Germany Phone: +49 (0)7135 98490 E-mail: team@hetschel.com

Contact for data protection: Dr.-Ing. Martin Hetschel, via the e-mail address above with the subject “Data protection”.

This policy applies to hetschel.de, mach1kart.com, mach1kart.de, kart24.de and kart24.eu unless stated otherwise. Our online shop and our booking platform have their own privacy notices (see sections 9 and 10).

2. Hosting and server log data

Our websites are delivered through the Cloudflare platform (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; in Europe: Cloudflare Germany GmbH, Munich). When you open a page, the server processes technically necessary data: IP address, date and time, requested page, amount of data, browser and operating system, and the previous page (referrer).

This is required to deliver the site, run it securely and fend off attacks. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). The data is stored only briefly and not combined with other data. We have a data processing agreement with Cloudflare. Data may be transferred to the USA; Cloudflare relies on the EU-US Data Privacy Framework and standard contractual clauses.

3. Cookies and similar technologies

We do not set cookies on our websites and do not store information in your browser (no local storage, no tracking pixels). We use no web analytics tool. Fonts and images come from our own site, not from Google or other providers.

4. Contacting us (form and e-mail)

You can reach us by e-mail, phone or through the contact form.

Data: name, e-mail address, optionally phone number, and your message.

How the form works: your browser sends your input to a function we operate in Google Cloud (data centre in Frankfurt am Main, Germany). It checks the input and forwards it as an e-mail to our mailbox (e-mail provider: IONOS SE, Montabaur). The message itself is not stored in the function. To protect against abuse (spam, mass requests) we briefly keep an encrypted counter calculated from your IP address. We do not store the IP address itself, and the counter is deleted automatically after two days.

Further processing: we handle incoming messages in our mailboxes and our ticket system. We do not pass them on to third parties unless needed to deal with your request.

Purpose and legal basis: we process your request and reply to you. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps and performance of a contract), otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries). The abuse protection is based on Art. 6(1)(f) GDPR.

Retention: we delete your enquiry once it is resolved and no statutory retention duty applies. Business correspondence is kept for up to six years (§ 257 HGB, § 147 AO).

5. Job applications

We accept applications by e-mail (job@hetschel.com). Please send only what is needed, for example name, phone number, a short text and a CV as PDF. We do not need information about religion, health, family planning or similar sensitive topics.

Purpose and legal basis: we assess your suitability and run the selection process. The legal basis is § 26(1) BDSG in conjunction with Art. 88 GDPR and Art. 6(1)(b) GDPR. If you are hired, the data goes into your personnel file.

Retention: if we decline your application, we delete your documents six months after the process ends. We need them for that long to defend ourselves against possible claims under the German General Equal Treatment Act (Art. 6(1)(f) GDPR). If you want us to keep your details for future positions, we ask for your consent first (Art. 6(1)(a) GDPR).

Recipients: only the people involved in the selection process see your application. The e-mails are stored with our e-mail provider IONOS.

6. Newsletter

Our newsletter is sent through GetResponse (GetResponse S.A., Arkońska 6, 80-387 Gdańsk, Poland, i.e. within the EU). We have a data processing agreement with GetResponse.

Sign-up through our form: the form sends your details to a cloud function in the EU (Google Cloud, Frankfurt region), which passes them on to GetResponse. We do not store them there ourselves. To prevent abuse, a salted hash of your IP address is kept briefly (two days at most). We pass your IP address on to GetResponse so that your consent can be proven. GetResponse sends the confirmation e-mail (double opt-in). You can pick individual newsletters.

Data: your e-mail address and, if you provide it, your name. At sign-up we also store the time of your consent and confirmation (double opt-in) so that we can prove it.

Purpose and legal basis: we send you news and offers from Mach1 and Hetschel. The legal basis is your consent (Art. 6(1)(a) GDPR). Sending and proof of consent are additionally based on Art. 6(1)(f) GDPR.

Performance measurement: we may evaluate whether and when a newsletter was opened and which links were clicked, to improve our content. You consent to this when you sign up.

Withdrawal: you can unsubscribe at any time, for example through the link at the end of each newsletter or by e-mail to us. We then delete your data unless it must be retained for other reasons.

7. Appointment booking (Calendly)

To book an appointment with us you can use a link to our calendar at Calendly (Calendly LLC, 115 E Main St, Buford, GA 30518, USA). The link leads to Calendly’s site. Only when you book an appointment there does Calendly process your name, e-mail address and appointment details. Simply visiting our website does not transfer any data to Calendly.

The legal basis is Art. 6(1)(b) GDPR (arranging an appointment). Calendly may transfer data to the USA and relies on appropriate safeguards (standard contractual clauses or the EU-US Data Privacy Framework). Calendly’s privacy notice is available on the booking page. If you prefer not to use it, call or e-mail us and we will arrange the appointment that way.

8. Surveys and documents via Google

From time to time we invite you to surveys through Google Forms or link to documents we share through Google Drive. These are also just links: data is only transferred once you click and enter something or open a document. Google is responsible for data processing on those pages (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, USA). We use Google Workspace with a data processing agreement. Surveys are voluntary; privacy information is provided in the respective form.

9. Events and tickets

You book track days, experience days and similar events on our booking platform events.hetschel.eu (open-source software Pretix, operated by us). Separate privacy notices apply there, which you can find on the platform.

10. Online shop

Our online shop is at kart24.eu. Separate privacy notices apply there for orders, payment and shipping.

Our websites contain links to other sites and to our profiles on Instagram, Facebook, LinkedIn, TikTok and YouTube. These are simple links: when you open our pages, no data is transferred to these platforms. Only when you click a link does the respective provider process data under its own privacy notice.

On our profiles and pages, the platforms also process usage data partly for us, for example for statistics about reach and interactions. For Facebook and Instagram (Meta Platforms Ireland Limited) we are jointly responsible with Meta for this. If you message us there or comment on posts, we process this to reply to you (Art. 6(1)(f) GDPR).

Our profiles:

12. Recipients and third countries

We pass on data only if we are obliged to or if it is needed for the respective function: Cloudflare (delivering the website), Google Cloud (contact form function), IONOS (e-mail), GetResponse (newsletter), Calendly (appointment booking, only if you use it) and our ticket system. We have concluded data processing agreements with service providers that process data on our behalf. Transfers to countries outside the EU and EEA (in particular the USA) only take place with appropriate safeguards under Art. 44 et seq. GDPR.

13. Your rights

You have the following rights towards us:

  • access to your stored data (Art. 15 GDPR)
  • rectification of incorrect data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • objection to processing we base on our legitimate interest (Art. 21 GDPR)
  • withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Just write to team@hetschel.com. You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

14. Obligation to provide data, automated decisions

You are not obliged to give us data. Without name, e-mail address and message, however, we cannot answer an enquiry, and without an e-mail address we cannot send a newsletter. There is no automated decision-making, including profiling.

15. Security

Our websites are only available over an encrypted connection (HTTPS). The contact form function accepts only the necessary fields and validates them.

16. Changes

If our websites or the legal situation change, we will update this policy. The version published here applies.

Imprint