A. General information on data processing
The protection of your personal data is important to us. In the following we would like to inform you in which form your data will be processed by us.
1. Personal data
According to Art. 4 para. 1 GDPR, personal data are all information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more special features that are an expression of the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.
Accordingly, personal data is any information relating to your person. This includes information such as your name, address, telephone number and e-mail address, but also data such as your whereabouts, your IP address or bank data.
2. Processing of personal data
We process the personal data of our users only to the extent necessary to provide the information offered on our website, a functional platform, and the provision of our content and services is necessary. Any further processing of your personal data will only take place with your consent.
This does not apply if the storage and processing of the data is permitted by legal regulations or is technically or for operational reasons necessary (e.g. for the fulfilment of contract modalities). Further cases are listed below in the description of the respective processing procedures.
3. Disclosure of personal data to third parties and other recipients
Cargonexx will not pass on your data to third parties unless Cargonexx has a legal or contractual obligation to do so. In no case will data be passed on without your knowledge.
Personal data will only be collected and transmitted to government institutions and authorities entitled to receive such information within the framework of the relevant laws, or if we are obliged to do so by a court decision. Cargonexx also does not pass on your data to private third parties, unless they are external service providers (e.g. when sending e-mails or newsletters) who provide services in the name and on behalf of Cargonexx. Our employees and service providers are obliged by us to maintain confidentiality and to protect the personal and company-related data provided to us.
In some cases, we use extensions from third-party providers. If necessary, personal data can be passed on or transmitted automatically. The type, scope, purpose and duration of this processing of personal data may vary in individual cases. We therefore check in each individual case exactly which services from third parties we use on our platform and whether personal data is passed on in the process. Accordingly, we include data processing in this data protection declaration.
The passing on of personal data by us to third parties takes place in the cases listed by us.
4. Processing of your IP address by the web server
For technical reasons, Internet services can only be used by revealing your IP address. This is processed by the web servers that deliver these Internet pages. The processing for the delivery of our web pages is not anonymous.
IP addresses are unique numerical addresses at which your computer retrieves data or sends it to the Internet. As a rule, we do not know which person is behind the IP address in question; we cannot normally assign the data to a specific person that can be determined by us.
Exception: When using our website, you inform us of your name, an e-mail address or other data which enable us to identify you. This takes place, for example, when you register as a user of our platform (see section B). Your identification may also occur if we take legal action against you (e.g. in the event of an attack on our website) and we become aware of your identity as part of the investigation procedure.
The temporary storage of the IP address by the system is necessary to enable the delivery of our pages to your computer. For this purpose, your IP address must remain stored for the duration of the session or beyond.
In addition, we store your IP address to detect and prevent misuse. The IP addresses are anonymized or deleted after 7 days at the latest.
Your IP address will be processed on the basis of Art. 6 Para. 1 lit. f GDPR; our legitimate interest is the operation of our platform, as well as the recognition and defence against misuse and technical attacks.
5. Automatic acquisition of technical data (server log files)
Each time you access our platform, our system automatically collects data and information from the computer system of the accessing computer. This data is automatically transmitted from your browser to our web server, we cannot prevent this. Many companies also store these data in so-called log files and evaluate them statistically.
We do not carry out this evaluation and therefore do not store this data in our server log files.
6. Encrypted transmission
In the case of online collection and processing of personal data, the information is transmitted in encrypted form (via https) to prevent misuse of the data by third parties. All data entered by you on our pages is transmitted to us in encrypted form so that it is protected from inspection by third parties. Our website automatically forces an encrypted transmission of all contents throughout.
Encryption technologies that correspond to the current state of the art are used. The security measures are continuously revised in line with technological developments.
7. Use of Google Fonts
This page uses fonts provided by Google for the uniform display of fonts. When you access a page, your browser loads the fonts you need to display text and fonts correctly.
For this purpose, your browser connects to Google's servers. This will tell Google that our website has been accessed via your IP address. The use of Google Web Fonts is in the interest of a uniform and appealing presentation of our online services. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.
If your browser does not support web fonts, a standard font will be used by your computer.
When you visit our homepage and the platform, different information is automatically transmitted to us.
Some of the cookies we use are deleted after you close your browser (so-called transient cookies, which also include session cookies). Other cookies remain on your end device (so-called persistent cookies) and enable us to recognise your browser the next time you visit. These cookies contain a characteristic string of characters that enable the browser to be uniquely identified when the website is called up again.
In addition, we save language settings and login information.
We use technically necessary cookies such as session cookies on the platform to manage and secure the login sessions.
The legal basis for the processing of personal data using technically necessary cookies is Art. 6 para. 1 lit. f GDPR. Our legitimate interest is the operation of our platform, as well as the protection of the platform against unauthorized use. These cookies are deleted as soon as they are no longer required for processing.
9. Telephone contact
If you contact us by telephone, your telephone number (if it is transmitted) is stored as the communication date in the call history. This serves to manifest the call history. The deletion takes place automatically after 90 days.
The legal basis for the processing is your consent or our legitimate interest pursuant to Art. 6 Para. 1 lit. a/ f GDPR.
10. Use of Vimeo
We have included Vimeo videos in our online offering, which are stored at http://www.vimeo.com and can be played directly from our website.
By visiting the website, Vimeo receives the information that you have accessed the corresponding subpage of our website. This occurs regardless of whether Vimeo provides a user account that you are logged in to, or whether there is no user account for you. If you do not want your profile to be associated with Vimeo, you must log out of it. Vimeo stores your data as user profiles and uses them for advertising, market research and/or for the design of its website according to your needs. Such evaluation is carried out in particular (even for users who are not logged in) to provide demand-oriented advertising and to inform other users about your activities on our website. You have the right to object to the creation of these user profiles, and you must contact Vimeo to exercise this right.
Our legal basis for the use of Vimeo videos is Art. 6 para. 1 lit. f GDPR, our legitimate interest is the operation of a visually appealing website with relevant information for you.
B. Processing of personal data in our platform app.cargonexx.de
Within the framework of app.cargonexx.de, Cargonexx GmbH provides you with a platform for arranging truck transport orders.
Users can instruct Cargonexx to transport goods. These loads are offered to all registered users. The load offers can be accepted with a click on the corresponding button.
During the registration process, you will be provided with the required mandatory information. All data entered during registration will be used for the purposes of using the offer and, if you accept an order, also for its execution.
In addition to the pure processing of the order, this also includes contract communication with you. In this context, we will inform you by e-mail about topics relevant to the offer or registration, such as changes in the scope of the offer or technical circumstances.
Processing takes place on the basis of Art. 6 Para. 1 lit. b GDPR if you are an independent entrepreneur. If you are an employee of a company for which you process the orders, the legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest in this case is to fulfil the contract which we have concluded with your employer.
We store your data until the termination of your user account. If we are subject to a retention obligation for commercial or tax reasons, we will store the data concerned until the expiry of this statutory period. The longer storage takes place on the basis of Art. 6 para. 1 lit. c GDPR.
In the course of registration you must enter some data, which will be transmitted to us and which will be stored for a longer period of time.
The following data will also be stored at the time of registration:
- Date and time of registration
2. Execution of orders
If you carry out an order for us, we will send status information about the shipment and, if necessary, telematic data of your truck to the respective client. We collect this information from you or your employer. We transmit this information on the basis of Art. 6 para. 1 lit. f GDPR in order to fulfil our legitimate interests as well as those of our clients. This involves ensuring transport safety, implementing quality assurance measures and verifying compliance with statutory regulations on driving times and rest periods. In addition, we transmit to some of our clients your registration number, as well as your name and other data, if applicable. This transmission serves to notify you of the delivery and is also based on Art. 6 para. 1 lit. f GDPR, which is the legitimate interest of our customers to ensure that only authorised drivers have access to the company premises and that the consignments are handed over exclusively to authorised drivers.
We delete the data after expiry of the regular limitation period. If we are obliged by law to store the data for a longer period of time, we will delete the data after expiry of the respective period. We store all data which you can call up in the customer account until the deletion of your customer account.
3. Customer communication
As part of customer communication, we send e-mails to you. We send e-mails during the registration process to make onboarding easier for you. We also send you e-mails to inform you about current transports. If you have registered for our newsletter, you will also receive it by e-mail. For the newsletter, please read the next section.
The sending of e-mails as part of customer communication is based on our legitimate interest (Art. 6 para. 1 lit. f GDPR) in providing you with useful information about our platform and current transports at any given time. You can unsubscribe from the daily information on current transports at any time. E-mails with information on our platform are part of the contractual process and you have no right to object to their receipt. If you no longer wish to receive these e-mails, you must close your user account. For communication, we use the external service provider Mailchimp, The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA, to whom we forward the data within the scope of order processing. The service provider has submitted to the EU-U.S. Privacy Shield.
In this context, there is no storage of personal data beyond the scope of the e-mails sent. We delete the e-mails sent after the regular statute of limitations has expired.
If you subscribe to our e-mail newsletter, the data you provide will be processed for the creation and dispatch of the newsletter and for proof of subscription to the newsletter until your revocation. The legal basis for the processing is Art. 6 para. 1 lit. a GDPR, your consent. For our newsletter we also use the external service provider Mailchimp, The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA, to whom we forward the data within the scope of order processing. The service provider has submitted to the EU-U.S. Privacy Shield.
To receive the newsletter, you must click on the "Register" button during registration. By clicking on the corresponding button, we process the public IP address of the computer from which the link is accessed together with the date and time of the click. We process this data in order to be able to provide proof that you have confirmed receipt of our email newsletter.
The legal basis for this processing is Art. 6 para. 1 lit. f GDPR. Our legitimate interest in this is the fulfilment of our obligation to provide evidence of the subscription you have made.
You can revoke your consent to receive the newsletter at any time by unsubscribing from the newsletter. You will find a corresponding link at the end of each newsletter.
We delete your data by unsubscribing from the newsletter. The data which we require as proof that you have agreed to receive the newsletter will be deleted after the expiry of the limitation period for corresponding obligations to provide evidence.
5. Product development
Cargonexx strives to build the most intelligent and largest transport network in Europe. The basis is a user-friendly platform whose service is optimally adapted to the needs of its users. In order to achieve this goal, continuous optimisation and product expansion are necessary. Cargonexx uses systems that also collect personal data on the app.cargonexx.de platform. Under no circumstances will this data be made available to third parties or sold to them.
Processing takes place on the basis of your consent pursuant to Art. 6 Para. 1 lit. a GDPR. You can revoke this consent at any time with effect for the future. For further details see section E of this data protection declaration. We will delete the data obtained after your objection. The objection is accompanied by the closure of your user account.
6. Use of Google APIs
We use Google's services, called APIs, to provide certain functionality. These are the Google Places API, the Google Distance Matrix API and the Google Directions API. We use these to display and calculate routes and locations.
By using the corresponding functionalities, Google receives the information that you have accessed the corresponding subpage of our website. In addition, Google may associate the data transmitted in this context (e.g. places whose distance is to be determined or between which a route is to be calculated) with you. If you have a Google Account and are logged in to it, Google will assign the data to your user profile. If you do not want your profile to be associated with Google, you will need to log out of it. Google stores your data as user profiles and uses them for advertising, market research and/or for the needs-based design of your website. Such evaluation is carried out in particular (even for users who are not logged in) to provide demand-oriented advertising and to inform other users about your activities on our website. You have the right to object to the creation of these user profiles, and you must contact Google to exercise this right.
Our legal basis for the use of Google APIs is Art. 6 para. 1 lit. f GDPR; our legitimate interest is the operation of a visually appealing and technically advanced platform which provides you with the information relevant to you.
C. Recipient of personal data
Personal data will be passed on to the following recipients:
a. Recipients of personal data are companies with which a contract for order processing has been concluded:
The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA, to whom we forward the data within the scope of order processing. The service provider has submitted to the EU-U.S. Privacy Shield.
Zapier, Inc., 548 Market St #62411, San Francisco, California 94104 USA, here too we have concluded a contract for order processing. The service provider has submitted to the EU-U.S. Privacy Shield.
b. Third parties within the meaning of the GDPR are e.g. companies such as service providers, advertising partners, third party cookies etc.(with which no order processing contract has been concluded):
Mixpanel, Inc. 405 Howard Street, 2nd Floor, San Francisco, CA 94105 USA. The service provider has submitted to the EU-U.S. Privacy Shield.
Vimeo, Inc., 555 west 18th Street, New York, New York 10011 USA. The service provider has submitted to the EU-U.S. Privacy Shield.
Google LLC, 1600 Amphitheatre Pkwy, Mountain View, California 94043 USA. The service provider has submitted to the EU-U.S. Privacy Shield.
D. Receipt and processing of applications, approvals and rejections
In the case of an application, both by post and by e-mail, we process your personal data, for example contact data (e.g. first and last name, address, telephone number and e-mail address) and other applicant data provided by you (e.g. curriculum vitae, training, language skills and, if applicable, work permit). The processing includes checking the application documents, conducting telephone interviews and job interviews as well as deciding on a job offer (acceptance or rejection)
Processing is carried out for the purpose of carrying out the application and recruitment process on the basis of § 26 BDSG.
If you come to us for an interview, we will reimburse your travel expenses. For this purpose we process your personal data, such as contact data (address, e-mail), identification data (name) and your bank details.
The processing of your data is carried out for the purpose of reimbursement of travel expenses and to carry out the application procedure on the basis of § 26 BDSG. We delete the travel expense accounting data after the expiry of the tax retention periods.
If we are unable to offer you the desired position at the time of your application, we may include you in our applicant pool with your consent, in order to actively provide you with a job at a later date.
In this case, your applicant data will continue to be stored on the basis of your consent within the meaning of Art. 6 Para. 1 Sentence 1 lit. a GDPR in conjunction with § 26 BDSG.
In the event of rejection, we will delete your data after expiry of the period pursuant to § 15 Para. 4 of the General Equal Treatment Act (AGG) plus four months, which we estimate as a lump sum for postal delivery times and processing times at the labour courts. The legal basis is Art. 6 Para. 1 lit. f GDPR, which states that we have a legitimate interest in being able to defend ourselves against claims under the AGG.
In the event that you have consented to inclusion in the applicant pool, your data will be stored until you revoke your consent. The legal basis for this is your consent according to Art. 6 para. 1 lit. a GDPR.
In the event of employment, your data will be transferred to our internal HR system.
E. Your rights
As a person concerned, you have the following rights:
Right of access to personal data concerning you
According to Art. 15 GDPR, you have the right to request confirmation from us as to whether personal data concerning you will be processed. If this is the case, you have the right to information about this personal data and to further information, which is specified in Art. 15 GDPR.
Right of rectification
According to Art. 16 GDPR, you have the right to demand that we correct any incorrect personal data concerning you without delay. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete personal data - also by means of a supplementary declaration.
Right to deletion
You have the right to demand that we delete personal data relating to you without delay. We are obliged to delete personal data without delay if the relevant requirements of Art. 17 GDPR are met. For details, please refer to Art. 17 GDPR.
Right to limitation of processing
In accordance with Art. 18 GDPR, you have the right under certain circumstances to demand that we restrict processing.
Right of objection
Pursuant to Art. 21 GDPR, you have the right, for reasons related to your particular situation, to object at any time to the processing of personal data concerning you carried out pursuant to Article 6(1)(e) or (f) GDPR, including profiling based on these provisions.
If you wish to exercise a right to which you are entitled, please contact us at the above contact details as the person responsible. You can make it easier for us to process your enquiry if you already provide proof of your identity so that we can assign your enquiry to a specific data subject. If you have any questions, please do not hesitate to contact us.
You can also completely or partially prevent the use of the aforementioned third-party tools by completely deactivating the acceptance of cookies in your browser or only accepting cookies that originate from the website you have visited. However, this may impair the ability to use our website. Alternatively, you can install a so-called browser addon which prevents the use of the above third-party tools.
Existence of a right of appeal to the supervisory authority
Pursuant to Art. 77 GDPR, you have the right to complain to the supervisory authority. This right exists in particular in the member state of your place of residence, your place of work or the place of suspected infringement if you are of the opinion that the processing of your personal data violates the GDPR. To do so, please contact a data protection supervisory authority directly.
Provision of personal data
There is no legal obligation for you to provide personal data.
Subject to change
We reserve the right to make changes to this data protection declaration at any time. Please inform yourself regularly.