Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website, within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR), is:

Rea Automotive Systems Corp.
Industriestraße 48
D-70565 Stuttgart, Germany
Email: privacy@rea-automotive.com
Telephone: +49 (0) 711 000 000

Data Protection Officer

Our appointed Data Protection Officer can be reached at dpo@rea-automotive.com, or by post at the address above marked for the attention of the Data Protection Officer.

2. Data We Collect

2.1 Server log files

When you visit this website, our hosting provider automatically records technical information transmitted by your browser:

• Anonymised IP address
• Date and time of the request
• Requested page or file and the volume of data transferred
• Referring URL, browser type and version, and operating system

This data cannot be attributed to a specific individual by us and is not merged with other data sources.

2.2 Enquiry and contact forms

When you submit an enquiry we process the details you provide — typically your name, company, work email address, telephone number, enquiry category and the content of your message, together with any technical documentation you choose to attach.

2.3 Business contact data

In the course of a customer, supplier or prospective relationship we process the contact details of the individuals we deal with, alongside correspondence and contractual records.

3. Legal Basis

We process personal data on the following bases under Art. 6(1) GDPR:

Where processing rests on consent, you may withdraw that consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out beforehand.

4. Purposes Of Processing

• Delivering this website reliably and protecting it against misuse and attack
• Answering enquiries and preparing quotations, manufacturability reviews and offers
• Managing customer, supplier and partner relationships and fulfilling contracts
• Meeting quality, traceability and documentation obligations under IATF 16949
• Complying with commercial, tax and product-liability record-keeping duties
• Assessing applications for employment and apprenticeship places

We do not use personal data collected through this website for automated decision-making or profiling.

5. Recipients & International Transfers

Personal data is disclosed only where necessary. Categories of recipient include our hosting and IT service providers, professional advisers, and — within the Rea Automotive group — the site handling your enquiry or contract.

Service providers acting on our behalf are engaged as processors under Art. 28 GDPR and are bound to process data only on our documented instructions.

Transfers outside the EEA

Our Querétaro site is located in Mexico. Where personal data is transferred there, or to any other third country, the transfer is safeguarded by the European Commission's Standard Contractual Clauses together with supplementary technical measures where a transfer impact assessment indicates they are required.

6. Retention Periods

7. Your Rights

Subject to the conditions in the GDPR, you have the right to:

• Access (Art. 15) — confirmation of whether we process your data, and a copy of it
• Rectification (Art. 16) — correction of inaccurate or incomplete data
• Erasure (Art. 17) — deletion where there is no overriding legal ground to retain it
• Restriction (Art. 18) — limitation of processing in defined circumstances
• Portability (Art. 20) — receipt of your data in a structured, machine-readable format
• Objection (Art. 21) — objection to processing based on legitimate interests

To exercise any of these rights, contact privacy@rea-automotive.com. We respond within one month and will tell you if we need longer.

Right to lodge a complaint

You may complain to a supervisory authority, in particular in the Member State of your residence or place of work. Our lead authority is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

8. Security Measures

We maintain technical and organisational measures appropriate to the risk, assessed under our TISAX-aligned information security framework. These include TLS encryption of this website, encryption of data at rest, role-based access control, network segmentation between office and production systems, logging and monitoring, and staff training.

Customer engineering data — drawings, models and specifications — is held in access- restricted systems available only to the reviewing team, and is never shared outside Rea Automotive without your written instruction.

9. Job Applicants

Application data is processed solely to assess your suitability for the role applied for, on the basis of § 26(1) BDSG and Art. 6(1)(b) GDPR. Access is limited to the recruiting team and the relevant hiring manager.

If your application is unsuccessful, data is deleted six months after the process closes, unless you consent to remain in our talent pool — in which case we retain it for twelve months and you may withdraw at any time.

Please do not include special categories of data (Art. 9 GDPR) such as health information, religious affiliation or trade union membership in your application, as we do not require it to assess your suitability.

10. Changes To This Policy

We review this policy periodically and update it to reflect changes in our processing or in the law. The version in force is always the one published here, with the effective date shown at the top of this page.

Where a change materially affects how we handle your data, we will notify you directly where we hold the contact details to do so.

Questions about this policy are welcome at privacy@rea-automotive.com. See also our Cookie Policy and Legal Notice.