Privacy when extracting German vehicle registration data: processed in Germany, documents not stored
Fahrzeugschein24 is a service of Picsure GmbH in Hamburg, built for the German vehicle registration certificate Part I (Zulassungsbescheinigung Teil I) and the older Fahrzeugschein. The three answers a vendor sign-off turns on are right here: processing in Germany and the EU, uploaded documents processed for the duration of the request only and not stored, the Art. 28 GDPR data processing agreement published in full — no request needed. Written for procurement, privacy and IT security.
The path of a document, from upload to result
- 1. Encrypted transferThe file reaches Fahrzeugschein24 over an encrypted connection. Access runs through keys you create and revoke yourself in your account — you decide who may send documents.
- 2. Processed, not storedJPEG, PNG, HEIC, PDF, TIFF, BMP and WebP are accepted, up to 20 MB; for a PDF only the first page is processed. The file is processed for the duration of the request only and is not stored.
- 3. Prepared and readPhotos taken at an angle, upside down or in poor light are cleaned up automatically; that version too exists only for the duration of the request. Up to 65 entries are read, usually in one to two seconds — fast enough for the counter.
- 4. A result you can verifyYou get the entries back as data, each with a confidence score and the position it was found at. The matching image section can be switched on in your account.
- 5. After the requestWhen the request ends, processing of the image ends with it; it is not stored. What remains is the extracted entries and the log data for your account — both exportable and deletable by you at any time.
Documents are not stored — what that means for your deletion policy
Precisely what that sentence refers to: the uploaded file is processed for that one request only and never written to disk — neither the original nor the version prepared for reading. There is no deletion process for document images, because no stock of them ever builds up. The Art. 28 GDPR data processing agreement says the same: on termination, personal data is deleted or handed back at your choice.
What belongs in your record of processing activities is the extracted entries and the log data for your account — name, address, VIN and registration number are routinely personal data — not the document image. Both remain as long as your account does and can be exported or deleted from the account. How that fits into existing workflows is shown on the page about reading a German registration document.
With fraud detection, a set of check values is added per document so repeat submissions can be recognised. They cannot be turned back into the document, no plain-text entries are stored, and comparison is only against your own earlier submissions. The result is an indication for your own review, not an official determination of authenticity; included from the Business plan upwards.
What your privacy team can tick off
Processing in Germany and the EU
Documents you upload for extracting vehicle data are processed on servers in Germany and within the EU. For data out of customer paperwork, that is often the decisive line in a sign-off.
No filing of documents
With no storage there is no archive of document images to back up, audit and eventually delete — less exposure exactly where it would otherwise be largest.
The DPA is there before you ask
The data processing agreement is readable in full before you register and becomes part of the service agreement when you sign up. A separately signed copy is available on request.
Encrypted transfer
Every transfer to Fahrzeugschein24 is encrypted; internally, access is limited to those who need it for their role. The Art. 32 GDPR measures we commit to are set out in the DPA.
Two-factor sign-in and your own keys
Accounts can be secured with two-factor sign-in. For the API you create your own keys and revoke them again once a system no longer needs them.
Export and account deletion built in
Under Settings → Security you download all your data (Art. 20 GDPR) and delete your account (Art. 17 GDPR) — self-service, without raising a ticket.
Clear roles: you remain the controller
The operator is Picsure GmbH in Hamburg; "Fahrzeugschein24" is the brand the service runs under. Picsure GmbH is your contracting party, invoices you and is the controller for your account data — the name that belongs in your supplier file.
For the contents of the documents you upload the roles are unambiguous: you are the controller, Picsure is the processor and handles that data solely on your instructions, so control over vehicle and keeper data stays with you. Questionnaires from your organisation are answered directly at datenschutz@fahrzeugschein24.de, without a detour through sales; which data is processed for which purpose is set out in the privacy policy and the data processing agreement.
Questions from privacy and procurement reviews
Where are our documents processed?
In Germany and within the EU; that is where documents uploaded for extraction are processed. Purposes and legal bases are set out in the privacy policy.
Do we need a data processing agreement, and do we have to request one?
As soon as the uploaded documents contain personal data — routinely the case with a German registration document — yes. The Art. 28 GDPR agreement is published in full, applies from the moment you sign up and needs no request. A separately signed copy is available on request.
What is stored — and what is not?
Not the uploaded document: the file is processed for the duration of the request only, and no archive of document images is created. Stored are the extracted entries, your account data and log data for the account. Under Settings → Security you export everything (Art. 20 GDPR) and delete the account yourself (Art. 17 GDPR). After the contract ends, personal data is deleted or handed back at your choice, unless a statutory retention obligation applies.
Which documents does the service read?
The German vehicle registration certificate Part I and the older Fahrzeugschein. The service knows that form's field structure, checks the VIN against its check digit and flags entries that contradict each other. One file per request; for a PDF, the first page.
How do we secure access?
With two-factor sign-in for accounts and your own keys for connected systems, which you can revoke whenever you like. The integration is described in the API documentation.
Can we test with a real document before sign-off?
Yes, on the free plan: 15 extractions a month, no credit card, on your own paperwork — use the awkward cases. There too the file is processed for the duration of the request only and not stored. Quotas for the other plans are under plans and pricing.
Your checklist, answered directly
Your own security or privacy questionnaire? A signed copy of the data processing agreement? Write to us — or straight to datenschutz@fahrzeugschein24.de.
Get in touch