Privacy

Controller: CM Christof Maybach AG i.G., Königsallee 27, 40212 Düsseldorf. [Open: Email address for data protection inquiries; indication of whether a data protection officer has been appointed.]

1. Visiting the website: When you visit the website, our hosting service provider processes technically necessary connection data (IP address, time, requested address, browser information) to securely deliver the pages (Art. 6(1)(f) GDPR). Fonts and images are loaded from our own server or our storage service; no Google fonts, no analytics or advertising services, and no tracking cookies are used. Your language selection and—after logging in—your login session are stored in your browser's local storage as technically necessary (§ 25(2) TDDDG).

2. Access request: During registration, we process your name, email address, optional company, position, telephone, country, interests, motivation, a desired club area, for the Owners Club your proof of ownership and your watch model, for the Inner Circle your described contribution, as well as your consents. Your password is only stored hashed by the login service. To protect against abuse, we temporarily store non-reversible checksums (hashes) of your IP and email address. The purpose is the review of your access request as part of pre-contractual steps (Art. 6(1)(b) GDPR) or your consent (lit. a); abuse protection according to lit. f.

3. Admission review and member care: We document your access status, appointment dates and notes, internal review notes (e.g., ownership check, invitation decision), approvals, and a change history. These notes are only accessible to the administration. We store inquiries you make in the members' area for processing. For released documents, we log downloads (Art. 6(1)(b), (f) GDPR). No automated decision-making takes place.

4. Emails: Confirmation and password emails are sent by the email service of our login and database platform. Newsletters or news are only sent with separate consent, which can be revoked at any time.

5. Service providers: Hosting, database, login, file storage, and email dispatch are provided by Lovable Cloud (Lovable with the sub-processors Supabase and Cloudflare) under a data processing agreement (Art. 28 GDPR). [Open: Storage region and basis for any third-country transfers, e.g., EU Standard Contractual Clauses, will be added.]

6. External content only on click: Links to christof-maybach.de, christof-maybach.online, LinkedIn, Instagram, TikTok, Facebook, and YouTube are only accessed when clicked; in the members' area, product videos are only loaded from the shop's video service (Shopify) after you click, whereby your IP address is transmitted to it.

7. Storage period: Data is deleted as soon as it is no longer required for the stated purposes or you request its deletion, provided there is no legal retention obligation. Abuse protection checksums are only needed for a short time.

8. Your rights: You have the right to access, rectification, erasure, restriction of processing, data portability, objection to processing based on lit. f, revocation of given consents with effect for the future, and the right to lodge a complaint with a supervisory authority, e.g., the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

Working draft October 2026. Company name and mandatory details subject to legal confirmation.