Privacy policy

1. Controller

The controller responsible for data processing on this website is:

Email: contact (at) oemseeker.com

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Overview

You can use OEM Seeker without an account and without giving any personal data. We set no advertising cookies and store no visitor data in our database, which holds only catalogue and offer data. Analytics cookies are set, and your browser recognised by a random identifier, only if you agree to them (section 6). Personal data arises when you load pages (technically necessary), through audience measurement (sections 5 and 6), and when you write to us.

3. Hosting, delivery and security (Cloudflare)

The website runs on the platform of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Workers, content delivery network, DNS, and protection against attacks). On every request, Cloudflare processes the data your browser sends for technical reasons: IP address, date and time, requested address, referrer, browser and operating system details (user agent), preferred languages, and the country derived from the IP address.

The purpose is to deliver the pages, keep them stable, and prevent abuse (such as automated attacks). For this, Cloudflare may run a bot detection script and set strictly necessary security cookies such as __cf_bm or cf_clearance. Cloudflare keeps our application's error and request logs for at most 7 days.

The legal basis is our legitimate interest in secure and fast operation (Art. 6(1)(f) GDPR); access to your device for security cookies is strictly necessary (§ 25(2) no. 2 TDDDG). We have a data processing agreement with Cloudflare under Art. 28 GDPR. For transfers to the USA, see section 10. More information: Cloudflare's privacy policy.

4. Fonts

The fonts (IBM Plex) are served through Cloudflare from our own domain. Your browser does not connect to Google or any other font provider for them.

5. Audience measurement (Cloudflare Web Analytics)

To understand which pages are used and how fast they load, we use Cloudflare Web Analytics. A script from static.cloudflareinsights.com sends Cloudflare the page address, referrer, browser and operating system details, country, and loading and interaction timings (Core Web Vitals). According to Cloudflare, it sets no cookies, uses no local storage, does not fingerprint your device, and does not track you across websites. We receive only aggregated statistics, nothing about individual visitors.

The legal basis is our legitimate interest in improving the website and fixing faults (Art. 6(1)(f) GDPR). Nothing is stored on your device; only the technical performance data of the page you load is read. You can object at any time, for example by blocking scripts from static.cloudflareinsights.com with a content blocker; the website works the same without them.

6. Audience measurement with Google Analytics and Microsoft Clarity

To see how visitors find and use the website, we use two services: Google Analytics 4, from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Microsoft Clarity, from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA (in the EU: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). On every page your browser loads a script from www.googletagmanager.com and one from www.clarity.ms. On your first visit we ask whether the two services may set cookies; one answer covers both.

Google receives the addresses and titles of the pages you open, the referrer, and interactions such as scrolling, searches on the site, use of the contact form (not what you enter) and clicks on links to other websites, as well as browser, device and language details and your approximate location. According to Google, the IP address is used only to derive the location and is not stored.

Clarity records how each page is used: the page as it was shown to you, your pointer movements, clicks and scrolling, together with the page address, the referrer, browser, device and language details and the country derived from your IP address. From this we get replays of page views and aggregated heat maps. Text you type into fields is masked in your browser and not transmitted; the contact form is masked as a whole.

Until you accept, and if you decline, neither service sets or reads cookies. Each then works with a random identifier that exists only in the open page: nothing is stored on your device, and your browser is not recognised after the page is reloaded or on a later visit. According to Google, such cookieless signals serve to estimate aggregated statistics.

If you accept, Google sets the cookies _ga and _ga_0T0RHQ9ZEE (kept for up to two years), and Clarity sets the cookies _clck (one year) and _clsk (one day) and keeps an identifier of the browser tab (_cltk) in session storage. They hold random identifiers that tell your browser apart from others, so that the pages of one visit, and later visits, are recognised as belonging together.

Both services are set so that the data is not used for advertising or personalised ads, whatever you answer. Google processes the data on our behalf under a data processing agreement (Art. 28 GDPR), where necessary also in the USA (section 10); data linked to an identifier is deleted after at most 14 months. More information: Google’s privacy policy. Microsoft, according to its own statements, processes the Clarity data as a controller in its own right in its Azure cloud, also in the USA (section 10), and also uses it for its own purposes; recordings are deleted after 30 days, aggregated data and recordings we mark after at most 9 months. More information: Microsoft Privacy Statement.

The legal basis for the cookies and the session storage entry, and for recognising your browser with them, is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time with effect for the future: choose “Cookie settings” at the foot of any page and decline. The cookies are then deleted. The legal basis for the measurement without cookies is our legitimate interest in understanding how the website is used and in improving it (Art. 6(1)(f) GDPR). You can object to it at any time, for example by blocking the two scripts with a content blocker; the website works the same without them.

7. Contact form and email

When you use the contact form, we process your name, email address, the topic you choose, and your message in order to handle your request and reply. The message is not stored in a database; Cloudflare delivers it as an email to our mailbox. The same applies to emails to contact (at) oemseeker.com, which Cloudflare Email Routing forwards to our mailbox.

To prevent spam, the form uses Cloudflare Turnstile. Your IP address and technical characteristics of your browser are sent to Cloudflare to check that a person is sending the form; when you submit it, our server also sends your IP address to Cloudflare for this check. Turnstile privacy information.

The legal basis is Art. 6(1)(b) GDPR where your request aims at a business relationship, and otherwise our legitimate interest in answering enquiries and preventing abuse (Art. 6(1)(f) GDPR). We delete your message once your request has been dealt with, unless statutory retention obligations apply. Providing the data is voluntary, but we cannot reply without an email address.

8. Local storage in your browser

The website keeps a few settings in your browser's local storage. They stay in your browser unless an entry says when it is sent to us:

• oem-seeker:locale: the language you chose in the language menu or the language notice
• oem-seeker:language-declined: the language you declined by closing the language notice, so that it is not offered again
• oem-seeker:location: the delivery country offers are shown for: the one you chose in the header, or else the country your connection comes from, which we ask Cloudflare for once (it derives it from the IP address; we do not store the address). It is sent to us when a page shows offers for another country: your browser then asks our server for the offers for yours
• oem-seeker:theme: light or dark display, if you switch it
• oem-seeker:analytics: your answer to the question about analytics cookies
• your saved vehicle, if you choose one. It is sent to us when you open an OE number's page: your browser asks our server whether the number is listed for that vehicle

This storage is strictly necessary for the functions you ask for (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser's settings. If a page is not in the language you chose or, without a choice, in none of your browser's preferred languages, it offers a link to the matching language version. This happens in your browser; nothing is sent to us and you are never redirected automatically.

9. Offers, partner links and external websites

Our server retrieves the marketplace offers shown; viewing a page sends no data about you to any marketplace. Only when you follow a link to a marketplace or shop do you leave our website. The privacy policy of that provider, which is responsible for its own processing, then applies.

Partner (affiliate) links are marked as such. If you follow one, the shop or its affiliate network may record that you came from OEM Seeker and set cookies on their own domains to attribute a commission. We receive only aggregated reports of purchases and commissions, nothing that identifies you.

The accessory pages (in German only) show product pictures from the shop's product data. Your browser loads them from the image server of the affiliate network Awin (AWIN AG, Otto-Ostrowski-Straße 1A, 10249 Berlin, Germany; images2.productserve.com), which thereby receives your IP address and your browser's details, as any server does from which a browser loads something. We tell your browser not to send the address of the page you are viewing. The legal basis is our legitimate interest in showing the products (Art. 6(1)(f) GDPR). More information: Awin's privacy policy.

10. Transfers to the USA

Cloudflare, Inc., Google LLC, which may process Google Analytics data for Google Ireland Limited, and Microsoft Corporation are certified under the EU-US Data Privacy Framework; transfers rely on the European Commission's adequacy decision (Art. 45 GDPR) and additionally on standard contractual clauses (Art. 46(2)(c) GDPR). The certifications are shown in the list of certified companies.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20). Where processing is based on our legitimate interest, you may object to it at any time on grounds relating to your particular situation (Art. 21 GDPR). To do so, write to contact (at) oemseeker.com.

You may also lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the alleged infringement (Art. 77 GDPR).

There is no automated decision-making, including profiling (Art. 22 GDPR).