Privacy Policy

1. Controller

The controller responsible for processing personal data on this website is:

For any question about data protection, please use the contact details above.

2. Data protection officer

We have not appointed a data protection officer, as the legal conditions requiring one (Art. 37 GDPR, § 38 BDSG) do not apply to us. We handle data protection matters ourselves; please address them to the contact details above.

3. What this website does — and does not do

This is a plain information website with two forms. We do not analyse your behaviour, do not build user profiles, and do not pass your data on for advertising purposes.

Specifically:

• We set no cookies for analytics or advertising.
• We embed no fonts, maps, videos or social media elements from third-party servers. All fonts are served from our own server; in particular, there is no connection to Google Fonts.
• We load no advertising or tracking pixels and use no fingerprinting.
• We operate no newsletter and no direct marketing.

That is why you see no cookie banner here: there is nothing we would need your consent for. We process personal data only when you write to us yourself — through one of the two forms, by email or by telephone — and in the form of the technical access data that any website necessarily receives.

4. Provision of the website (hosting and access data)

This website is hosted by Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA). Each time a page is requested, Cloudflare processes technical access data on our behalf:

• IP address of the requesting device
• date and time of access
• address requested (URL) and volume of data transferred
• notification of whether the request succeeded (HTTP status code)
• the page previously visited, where applicable (referrer)
• browser type and version, and operating system

Purpose: delivering the website, keeping it technically operational, and defending against attacks and abusive access. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing this website in a stable, secure and abuse-free manner; without processing the IP address, delivery is technically impossible.

We keep no server log files of our own and do not store this access data permanently. Cloudflare processes it only for the short period required for the purposes stated. A data processing agreement under Art. 28 GDPR is in place with Cloudflare.

5. Contact form

You can send us an enquiry from the “Contact” page. We collect the following details:

• first and last name
• email address
• telephone number
• your message
• the language you filled the form in, so that we reply in the same language

Your entries are not stored in a database. The form only generates an email to our mailbox; from that point on, your details exist solely as an email message there. We use a service provider for the technical sending and Google Workspace for the mailbox itself (see “Recipients of your data”).

Purpose: handling and answering your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns entering into or performing a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

The form contains a field invisible to you that guards against spam. It processes no personal data — only automated submissions fill it in.

6. Driver applications

You can apply to us as a driver using the form on the “Careers” page. We deliberately collect only the minimum:

• first and last name
• the date you are available from
• your place of residence
• telephone number
• the language you filled the form in

We do not collect an email address, a CV or any other documents; there is no upload option. We call you back on the number you give and discuss everything else on the phone. Please do not enter special categories of personal data in the form (such as details of health, origin, religion or trade union membership).

Purpose: conducting the application procedure. The legal basis is Art. 6(1)(b) GDPR in conjunction with § 26(1) sentence 1 BDSG (deciding on the establishment of an employment relationship); where we retain data beyond that in order to defend against potential claims, Art. 6(1)(f) GDPR.

Retention: applications likewise reach us solely as an email and are not stored in a database. If no employment follows, we delete the application no later than six months after the procedure ends. That period follows the time limits in § 15(4) AGG for asserting potential compensation claims. If you are hired, the data is transferred to your personnel file.

7. Contact by email, telephone or post

If you write or call us directly, we process the data you provide in order to deal with your request. The legal basis is Art. 6(1)(b) GDPR for contract-related matters and otherwise Art. 6(1)(f) GDPR. Our email mailbox runs on Google Workspace (Google Ireland Limited).

Please note: an unencrypted email can be read by unauthorised parties in transit. For confidential information we are happy to agree another channel with you.

8. Cookies and access to your device (§ 25 TDDDG)

This website stores no information on your device and accesses no information already stored there: no cookies, no local storage, no fingerprinting. Consent under § 25(1) TDDDG is therefore not required, and you see no cookie banner on this website.

9. Recipients of your data

We do not sell personal data and do not pass it on for advertising purposes. Access is limited to the following service providers we engage, who act for us as processors under Art. 28 GDPR and solely on our instructions:

• Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA — hosting, delivery and protection of this website.
• Sinch Mailjet (Mailjet, 13 rue de l’Aubrac, 75012 Paris, France; part of the Sinch group) — technical sending of the emails generated by the forms to our mailbox.
• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — operation of our email mailbox (Google Workspace), where your enquiry or application arrives and is handled.

Beyond that, we disclose data where we are legally obliged to do so (for example to public authorities and courts) or where it is necessary to establish, exercise or defend legal claims (for example to our legal and tax advisers).

10. Transfers to third countries

Some of the service providers named above are US companies or part of internationally active groups, so processing outside the European Union cannot be ruled out.

Cloudflare, Inc. and Google are certified under the EU-U.S. Data Privacy Framework, for which the European Commission established an adequate level of data protection by decision of 10 July 2023 (Art. 45 GDPR). In addition, we base transfers to third countries on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), which form part of the contracts concluded with those providers.

Despite these safeguards, access by state authorities in third countries cannot be entirely excluded. You can always reach us without using the forms — by telephone or by post.

11. Retention and erasure

We store personal data only for as long as it is necessary for the relevant purpose:

• Contact form enquiries and email correspondence: until your request has been dealt with conclusively and there is no reason for further retention.
• Applications: no later than six months after the application procedure ends.
• Technical access data: only briefly, at our hosting provider; we do not store it ourselves.

Longer periods apply where the law requires them: commercial and business letters and tax-relevant records are retained for six and ten years respectively under § 257 HGB and § 147 AO. During that time, processing is restricted to storage.

12. Links to external services

On the contact page we link our location to Google Maps. No map is embedded, deliberately: your browser connects to Google only once you click the link yourself. Responsibility for processing your data on the destination page then lies with the respective provider, whose privacy notice applies. The same is true of every other external link on this website.

13. Data security

This website is delivered exclusively over encrypted HTTPS (TLS). We also apply technical safeguards, among them a strict Content Security Policy that prevents your browser from loading content from third-party servers when it opens our pages.

Organisationally, the principle of data minimisation applies: we collect as little data as possible, store form entries in no database, and limit access to the email mailbox to the people handling your request.

14. Your rights

You have the following rights in relation to us:

• access to the data we process about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

An informal message to the contact details above is enough to exercise them. Exercising your rights is free of charge; we normally respond within one month. In order to match your request to our records, we may ask for additional details to identify you.

16. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your residence, place of work or the place of the alleged infringement. The authority responsible for us is:

17. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. Your enquiry or application is decided on by people only.

18. Obligation to provide data

You are under no legal or contractual obligation to provide us with personal data. Without the entries marked as mandatory in the forms, however, we cannot handle your enquiry or consider your application.

19. Changes to this privacy policy

We update this privacy policy when the legal situation or the services used on this website change. The version published here is the one that applies; the date at the top of the page shows how current it is.