Privacy policy

1. PERSON RESPONSIBLE FOR PROCESSING

1.1  Name and address of the responsible person

The responsible party within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is:

Cargonexx GmbH
Hermannstraße 13, c/oWeWork
20095 Hamburg
Website: https://www.cargonexx.com/

represented by the managing director: Trond v. Stern

reachable at the above address or by:phone: +49 40 87407650e-mail: hallo@cargonexx.de

1.2 Name and address of the data protection officer

The data protection officer of the responsible party is:
‍
Mauß Datenschutz GmbH
Neuer Wall 10
20354 Hamburg
Website: https://datenschutzbeauftragter-hamburg.de/

represented by the managing director: Tobias Mauß

reachable at the above address or by:
Telephone: +49 40 999 99 52-0E-mail: datenschutz@datenschutzbeauftragter-hamburg.de

2. PROCESSING OF DATA WHEN USING OUR ONLINE OFFERS

2.1 Data concerned

When calling up our website, accessing our platform or other services offered online, a series of general data and information is collected with each call. This general data and information is stored and processed by us or third parties. The following data may be collected:

• the date and time of an access
• the frequency and duration of visits to our website

• The browser types and versions used
• the operating system used by the accessing system
• an Internet Protocol (IP) address
• the volume of data transferred
• the internet services provider of the accessing system
• Other similar data and information that serve to avert danger in the event of attacks on our information technology systems.
• the internet page from which you accessed our website(referrer URL)
• data that you transmit to us voluntarily

2.2 Porpuse pf processing

We use the information we collect to achieve the following purposes in particular:

• to display texts and fonts correctly on our website
• to distinguish whether a contact request originates from a natural person or is automated by means of a programme
• To draw attention to our attractive offers on external websites
• to provide relevant and interesting ads for our users
• To improve campaign performance reports and achieve a fair calculation of advertising costs
• to provide certain functionalities, e.g. display and calculation of routes and locations
• to be able to show videos to our users
• to organise and analyse the collection of surveys

2.3 Legal basis

Art. 6 para. 1 lit. f GDPR

Our legitimate interest here is in particular

• in the analysis, evaluation, optimisation and the economic and secure operation of our Internet presence
• in the protection of the transmission of forms and information entered therein
• in the user-friendly design of our offers

2.4 Duration of data storage

The duration of data storage depends on the legal retention obligations and is usually 10 years. Some data is automatically deleted as soon as the respective request has been dealt with and there is no other legal reason for further storage.

2.5 Disclosure to third parties and other recipients

In certain cases, Cargonexx passes on data to third parties, who in turn may store data on their servers. Third parties can be subdivided as follows:

• IT service provider;
• External support service providers;
• For public bodies, overriding legal provisions are required, e.g. from the financial or customs authorities within the meaning of Art. 6 (1) lit. c GDPR.

In addition, our employees or the employees of allied companies are recipients of data if this is necessary for the above-mentioned purposes.

In the event that Cargonexx enters into a joint venture with other companies, acquires companies, sells companies to other companies or merges companies, we will also share your data with parties involved (e.g. target companies, owners, consultants, new business partners).

We would like to point out that the headquarters of the third-party providers may be located outside the European Union (EU) and the European Economic Area (EEA). In this regard, Cargonexx takes appropriate measures to comply with the requirements of the GDPR and, in particular, to ensure that the personal data processed is protected in the same way as if it had been processed within the EU or the EEA.

The overview of the third-party providers can be found in Table 1 (section 10.1 of this privacy policy).

2.6 Use of cookies

We use cookies on our website and on the platform. Cookies are small text files that are stored in your browser's cache and allow us to recognise your browser over a period of time. A cookie usually contains information about the website, a unique identifier for recognition, additional data serving the purpose of the cookie and the lifetime of the cookie itself.

Some cookies are technically necessary for the use of our website. Use without analytical cookies may lead to restrictions in the functions and user-friendliness of our offer. We will only use the cookies that are not necessary if you have actively consented to their use. Active consent can be given in the cookie notice displayed when visiting the website. The consent is logged and a corresponding cookie is set. You can change or revoke your previously given consent to the use of unnecessary cookies on our website at any time. You can also restrict or deactivate the use of cookies in your browser settings at any time.

2.6.1 Intended use

Cookies are used to enable certain features (e.g. login), track website usage (e.g. analytics), store your user preferences (e.g. time zone, notification preferences) and personalise your content (e.g. advertising, language).

2.6.2 Types of cookies

Our website may use the following types of cookies, which are either set by us and can only be accessed by us (first-party cookies) or set by third-party providers (third-party cookies), such as analytics providers or content partners. In the case of third-party cookies, the third-party provider also has access to selected information in order to carry out the purposeful data processing on our behalf:

Necessary cookies: These cookies are necessary and are always used so that you can navigate our website comfortably and use special functions, e.g. when accessing areas with password protection. Without these cookies, we cannot provide certain services you have requested. We also use necessary cookies to uniquely identify and log access to our website. This is done to ensure the secure provision of our services.

Statistics cookies: Statistics cookies help us understand how our visitors interact with website by collecting and reporting information anonymously. The use of such cookies is optional and subject to your prior consent.

Marketing cookies: Marketing cookies (also known as "tracking cookies") are used to follow visitors around our website. The intention is to show content and advertising on partner websites based on pseudonymised data that is relevant and appealing to the individual visitor.

2.6.3 Legal basis

We distinguish between technically necessary cookies and analysis and marketing cookies. The legal basis for the processing of personal data using technically necessary cookies is Art. 6 (1) lit. f DSGVO. Our legitimate interest is the operation of our platform, as well as the protection of the platform against unauthorised use. For the use of analysis and marketing cookies, we require your consent pursuant to Art. 6 para. 1 lit. a DSGVO.

2.6.4 Duration of data storage

The duration of data storage depends on the legal retention obligations and is usually 10 years. Some of the cookies we use are deleted again after you close your browser (session cookies). Other cookies remain on your terminal device and are deleted as soon as they are no longer required for processing or the time defined in the respective cookie has expired (persistent cookies).

2.7 Processing of your IP address by the web server

For technical reasons, services on the Internet can only be used if you disclose your IP address. This is processed by the web servers that deliver these web pages. The processing for the delivery of our websites is not anonymised. IP addresses are unique numerical addresses under which your computer retrieves data or sends data to the Internet. As a rule, we do not know which person is behind the respective IP address; we cannot normally assign the data to a person who can be specifically identified to us.

Exception: When using our website, you provide us with your name, an e-mail address or other data that enables us to identify you. This occurs, for example, when you register as a user of our platform. Furthermore, you may be identified if we take legal action against you (e.g. in the event of attacks against our website or server) and we become aware of your identity in the course of the investigation.

The temporary storage of the IP address by the system is necessary to enable delivery of our pages to your computer. For this purpose, your IP address must remain stored for the duration of the session or beyond.

2.7.1 Legal basis

The processing of your IP address is based on Art. 6 para. 1 lit. f DSGVO, our legitimate interest is the operation of our platform, as well as the detection and defence against abuse and technical attacks.

2.7.2 Duration of data storage

The IP addresses are deleted after 60 days at the latest.

2.8 Automatic collection of technical data (server log files)

Each time our platform is called up, our system automatically collects data and information from the computer system of the calling computer. This data is automatically transmitted to our web servers by your browser, we cannot prevent this.

2.8.1 Legal basis

The processing of the server log files is based on Art. 6 para. 1 lit. f DSGVO, our legitimate interest is the operation of our platform, as well as the detection and defence against abuse and technical attacks.

2.8.2 Duration of data storage

The server log files are deleted after 60 days at the latest.

2.9 Encrypted transmission

In the case of online collection and processing of personal data, the information is transmitted in encrypted form (via https) to prevent misuse of the data by third parties. All data entered by you on our pages is transmitted to us in encrypted form so that it is protected from being viewed by third parties. Our website automatically enforces encrypted transmission of all content throughout.

Encryption technologies are used that correspond to the current state of the art. The security measures are continuously revised in accordance with technological developments.

3. PROCESSING OF DATA FROM OUR REGISTERED USERS

This section applies in addition to section 2.

We collect your data when you create a user account with Cargonexx, when you use an online offer or other services offered by us or when you carry out transport orders for Cargonexx.

3.1 Data concerned

The following data may be collected in addition to Section 2 of this Privacy Policy:

• Date and time of registration as a user and your time zone
• Personal data provided for the performance of the contract and, if applicable, additional data for processing on the basis of your express consent (e.g. title, first name, surname, address, telephone number, fax number, email address, position, job title).
• Data on the contractual relationship (e.g. type of contract, product interest, bank data)
• Certificate of registration, transport licence, confirmation of insurance, registration number of your vehicles, transaction information in connection with the use of our services,
• Type, scope and timing of the services requested and provided
• Vehicle details and tour and telematics data including geo-location/GPS data
• Accounting data
• Data that you pass on to our customer support to process a request

3.2 Purpose of processing

3.2.1 Registration

All data entered during registration will be used for the purpose of using the offer and, if you accept orders, also for their execution.

3.2.2 Customer communication

We send e-mails to you as part of our customer communication. We send e-mails during the registration process and to inform you about current transports. In addition to the pure processing of the order, this also includes contract communication with you. In this context, we inform you by e-mail about topics relevant to the offer, such as changes to the scope of the offer or technical circumstances.

You have the option to unsubscribe from the daily information on current transports at any time. Emails with information about our platform are part of the contractual processing and you have no right to object to receiving them. If you no longer wish to receive these emails, you must close your user account.

3.2.3 Execution of orders

If you carry out an order as a carrier through us, we will transmit status information on the consignment and, if applicable, telematics data of your truck to the respective client.

This ensures transport safety, quality assurance measures are carried out and verification of compliance with the legal regulations on driving and rest times is checked. In addition, we transmit your registration number and, if applicable, other personal data to some of our clients. This transmission serves to notify the delivery and the execution of the concluded contracts.

3.2.4 GPS tracking

We use third-party GPS tracking to enable the tracking of tours in a timely and accurate manner based on your vehicles' onboard systems, which serves to optimise both our and your internal processes and operations.

The activation of the third-party provider's services and the associated data storage and processing requires your prior consent on the third-party provider's platform and the establishment of a legal basis with your employees.

You can stop the use of GPS tracking at any time by revoking the upstream consent with the third-party provider.

Please note that in this case you may not be able to use all the functions of our website or all our services to their full extent.

3.2.5 Newsletter

If you register for our e-mail newsletter, the data you provide will be processed for the creation and dispatch of the newsletter as well as for the proof of registration to the newsletter until you revoke your registration.

To receive the newsletter, you must click on the "Send registration" button during registration.

You can revoke your consent to receive the newsletter at any time by unsubscribing from the newsletter. You will find a corresponding link at the end of each newsletter.

3.3 Legal basis

• 6 para. 1 lit. b GDPR, if you are a self-employed entrepreneur
• 6 para. 1 lit. f GDPR if you are an employee of a company for which you process the orders. Our legitimate interest is to fulfil the contract we have concluded with your employer and to send you useful information about our platform and services as well as current transports at the relevant time.
• 6 para. 1 lit. a GDPR by your consent to receive the newsletter.

3.4 Duration of data storage

The duration of the data storage depends on the statutory retention obligations and is usually 10 years.

3.5 Disclosure to third parties and other recipients

In certain cases, Cargonexx passes on data to third parties, who in turn may store data on their servers. Third parties can be subdivided as follows:

• Users or third parties who require data for the performance of contracts relating to our products and services, such as operators of pick-up points or reception facilities;
• Other contractors and external service providers such as hosting, logistics, GPS tracking, order handling and management, customer feedback tools;
• For other recipients for whom disclosure is only permitted in the event of the consent of the data subject or if an overriding interest permits this, e.g. for the digital dispatch of information, creditworthiness information or purposes of quality assurance within the meaning of Art. 6 Para. 1 lit. a and f GDPR;
• For public bodies, overriding legal provisions are required, e.g. from the financial or customs authorities within the meaning of Art. 6 (1) lit. c GDPR.

In addition, our employees or the employees of allied companies are recipients of data if this is necessary for the above-mentioned purposes.

In the event that Cargonexx enters into a joint venture with other companies, acquires companies, sells companies to other companies or merges companies, we will also share your data with parties involved (e.g. target companies, owners, consultants, new business partners).

We would like to point out that the headquarters of the third-party providers may be located outside the European Union (EU) and the European Economic Area (EEA). In this regard, Cargonexx takes appropriate measures to comply with the requirements of the GDPR and, in particular, to ensure that the personal data processed is protected in the same way as if it had been processed within the EU or the EEA.

The overview of the third-party providers can be found in Table 2 (section 10.2 of this privacy policy).

4. PROCESSING OF DATA DURING TELEPHONE CONTACT/VIDEO CONFERENCES

4.1 Data concerned

The following data may be collected for the use of telephone/video conferencing software:

• Data provided (esp. first name, last name, email address)
• optional: sound transmission
• optional: image transmission
• to the extent technically necessary, processing of data from their system to establish the connection with the provider of the conference software.

4.2 Purpose of processing

Conducting telephone/video conferences; using the recorded telephone/video conferences for training and quality assurance purposes (only if prior consent has been given).

4.3 Legal basis

Art. 6 para. 1 lit. a and f DSGVO.

4.4 Duration of data storage

Video conferences are only recorded with the previously documented consent of the participants. The technical data is deleted if it is no longer required. The duration of data storage otherwise depends on the statutory retention obligations and is usually 10 years.

4.5 Disclosure to third parties and other recipients

In certain cases, Cargonexx passes on data to third parties, who in turn may store data on their servers. Third parties can be subdivided as follows:

• Other contractors and external service providers such as hosting, logistics, GPS tracking, order handling and management, customer feedback tools;
• For other recipients for whom disclosure is only permitted in the event of the consent of the data subject or if an overriding interest permits this, e.g. for the digital dispatch of information, creditworthiness information or purposes of quality assurance within the meaning of Art. 6 Para. 1 lit. a and f DSGVO;
• For public bodies, overriding legal provisions are required, e.g. from the financial or customs authorities within the meaning of Art. 6 (1) lit. c DSGVO.

In addition, our employees or the employees of allied companies are recipients of data if this is necessary for the above-mentioned purposes.

In the event that Cargonexx enters into a joint venture with other companies, acquires companies, sells companies to other companies or merges companies, we will also share your data with parties involved (e.g. target companies, owners, consultants, new business partners).

We would like to point out that the headquarters of the third-party providers may be located outside the European Union (EU) and the European Economic Area (EEA). In this regard, Cargonexx takes appropriate measures to comply with the requirements of the GDPR and, in particular, to ensure that the personal data processed is protected in the same way as if it had been processed within the EU or the EEA.

The overview of the third-party providers can be found in Table 3 (section 10.3 of this privacy policy).

5. PROCESSING OF DATA IN THE APPLICATION PROCEDURE

5.1 Data concerned

Personal data that you provide to us as part of the application process. This may include the following data:

• Personal details (name, address, contact details, date and place of birth and nationality)
• Application documents (cover letter, CV, references, certificates, etc.)

IAs part of the application process, you must provide the personal data that is required for the assessment of a possible working relationship or that we are legally obliged to collect. Without this data, we will generally not be able to conclude a contract with you or process your application.

5.2 Purpose of processing

The purpose of the processing is the implementation of the application procedure.

5.3 Legal basis

Art. 6 para. 1 lit. a and f DSGVO

5.4 Duration of data storage

Application data will generally be deleted within four weeks to six months at the latest after notification of the decision, unless consent to longer data storage has been given in the context of inclusion in our applicant pool or another legal basis exists.

5.5 Disclosure to third parties and other recipients

In certain cases, Cargonexx passes on data to third parties, who in turn may store data on their servers. Third parties can be subdivided as follows:

• Other contractors and external service providers such as hosters or recruiting agencies and software;
• For other recipients for whom disclosure is only permitted in the event of the consent of the data subject or if an overriding interest permits this, e.g. for the digital dispatch of information, creditworthiness information or purposes of quality assurance within the meaning of Art. 6 Para. 1 lit. a and f GDPR;
• For public bodies, overriding legal provisions are required, e.g. from the financial or customs authorities within the meaning of Art. 6 (1) lit. c GDPR.

In addition, our employees or the employees of allied companies are recipients of data if this is necessary for the above-mentioned purposes.

In the event that Cargonexx enters into a joint venture with other companies, acquires companies, sells companies to other companies or merges companies, we will also share your data with parties involved (e.g. target companies, owners, consultants, new business partners).

We would like to point out that the headquarters of the third-party providers may be located outside the European Union (EU) and the European Economic Area (EEA). In this regard, Cargonexx takes appropriate measures to comply with the requirements of the GDPR and, in particular, to ensure that the personal data processed is protected in the same way as if it had been processed within the EU or the EEA.

The overview of the third-party providers can be found in Table 4 (section 10.4 of this privacy policy).

6. SOCIAL NETWORKS

We have company accounts from which we link to our online offerings and use social media plugins or other linking options from the following social networks on our website:

• Facebook,
• LinkedIn,
• Xing,
• YouTube,
• Instagram,
• Twitter

6.1 Data concerned

Due to our online presence within social networks, the linking option on our website and in the event that you have a profile on one of the above-mentioned social networks and are not logged out before visiting our website, the following data may be collected and processed:

• Your Internet Protocol (IP) address,
• Your contact details such as email or telephone number,
• Usage data such as last visited websites, product interest.

6.2 Purpose of processing

We use links to social networks on our online offers or have an online presence within the social networks in order to achieve the following purposes in particular:

• to make Cargonexx better known,
• to offer information about us,
• communicate with you,
• To give you the opportunity to comment on our posts and give reviews,
• Measure our reach (e.g. by recognising returning visitors).

6.3 Legal basis

Art. 6 para. 1 lit. f DSGVO

6.4 Duration of data storage

For posts shared with us within the above-mentioned networks, there is no fixed storage period. For further information regarding the duration of data storage within social networks, please refer directly to the privacy policy of the social network provider.

6.5 Disclosure to third parties and other recipients

The purpose and scope of the data collection and the further processing and use of the data by social network providers as well as your rights in this regard and setting options for protecting your privacy can be found directly in the privacy policy of the social network providers, which you can access in Table 1 (section 10.1 of this privacy policy).

We would like to point out that the headquarters of the social network providers may be located outside the European Union (EU) and the European Economic Area (EEA) and that we have no knowledge of the content of the transmitted data or its use by social network providers.

If you do not want the social network providers to be able to associate your visit to our website, please log out of your social network provider user accounts before visiting our website.

7. YOUR RIGHTS

In the following, we would like to inform you about your rights in connection with your personal data:

7.1 Right to information

According to Art. 15 of the GDPR, you have the right to request confirmation from us as to whether personal data concerning you are being processed. If this is the case, you have the right to information about this personal data and to further information mentioned in Art. 15 DSGVO.

7.2 Right of rectification

Pursuant to Art. 16 of the GDPR, you have the right to request that we correct any inaccurate personal data relating to you without undue delay. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete personal data - also by means of a supplementary declaration.

7.3 Right to deletion

You have the right to demand that we delete personal data relating to you without delay. We are obliged to delete personal data without delay if the relevant requirements of Article 17 of the GDPR are met. For details, please refer to Art. 17 of the GDPR.

7.4 Right to restrict processing

In accordance with Art. 18 DSGVO, you have the right under certain conditions to demand that we restrict processing.

7.5 Right of objection

Pursuant to Article 21 of the GDPR, you have the right to object to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions.

If we process your personal data for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing.

7.6 Right to withdraw consent

According to Art. 7 DSGVO, you have the right to revoke your consent at any time and without giving reasons. Please note that a revocation applies exclusively to the future and does not affect the lawfulness of processing carried out in the past.

7.7 Right to data portability

Pursuant to Article 20 of the GDPR, you have the right to receive the personal data concerning you that you have provided to us in a structured, common and machine-readable format, and you have the right to transfer this data to another controller without hindrance from us, provided that the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR and the processing is carried out using automated procedures.

7.8 Existence of a right of complaint to the supervisory authority

In accordance with Art. 77 of the GDPR, you have the right to lodge a complaint with the supervisory authority. This right exists in particular in the Member State of your place of residence, your place of work or the place of the alleged infringement, if you believe that the processing of personal data concerning you violates the GDPR. To do so, please contact a data protection supervisory authority directly.

8. PROVISION OF PERSONAL DATA

There is no legal obligation for you to provide personal data.

9. RESERVATION OF THE RIGHT TO MAKE CHANGES

We reserve the right to change the security and data protection measures at any time, especially if this becomes necessary due to technical developments. In these cases, we may also adapt this data protection notice accordingly. Please therefore note the current version of this data protection declaration.

10. TABLES