I. Collection of personal data

1. Personal data

This policy explains how personal data is collected when you use our website. Personal data is information relating to you personally, such as your name, address, email addresses and user behaviour.

2. Controller

The controller under Article 4(7) of the EU General Data Protection Regulation (GDPR) is Cargo Movers GmbH, Lise-Meitner-Str. 6, 65428 Rüsselsheim, Germany; telephone 06142 17734-0; email info@cargomovers.de. See also our legal notice. You can reach our data protection officer at datenschutzbeauftragter@cargomovers.de or at our postal address, marked “Datenschutzbeauftragter”.

3. Contacting us

When you contact us by email or contact form, we store the information you provide (your email address and, where applicable, name and telephone number) to answer your questions. We delete it when storage is no longer necessary, or restrict processing where statutory retention obligations apply.

4. External providers

If we engage providers for particular functions or wish to use your data for advertising, we explain the relevant processes and retention criteria below.

5. SSL/TLS encryption

This website uses SSL or TLS encryption for security and to protect confidential content you send us, such as orders or enquiries. An encrypted connection is indicated by “https://” instead of “http://” in the browser address bar and a padlock symbol.

II. General information about processing

1. Scope and legal bases

We generally process personal data only as necessary to provide a functioning website and our content and services. Processing generally requires consent, except where obtaining prior consent is not possible for factual reasons and processing is permitted by law.

The legal bases are Article 6(1)(a) GDPR where we obtain consent; Article 6(1)(b) for processing necessary to perform a contract with the data subject or take pre-contractual steps; Article 6(1)(c) to fulfil our legal obligations; Article 6(1)(d) to protect the vital interests of the data subject or another person; and Article 6(1)(f) for our or a third party’s legitimate interests, provided these are not overridden by the data subject’s interests, fundamental rights and freedoms.

2. Erasure and retention

Personal data is erased or blocked once its storage purpose ceases. Longer retention may be required by applicable EU or national legislation. Data is also blocked or erased when a statutory retention period expires, unless further retention is necessary to conclude or perform a contract.

3. Transfers for contracts for services and digital content

We transfer data to third parties only where necessary for contract performance, for example to the bank processing payment. Further transfers occur only with express consent. We do not disclose data without express consent for purposes such as advertising. The legal basis is Article 6(1)(b) GDPR.

III. Website delivery and log files

1. Description and scope

At every visit, our system automatically collects your IP address, access date and time, the websites from which you reached us, and the websites accessed through our website. This is stored in system log files, separately from other personal data.

2. Legal basis

Temporary storage of the data and log files is based on Article 6(1)(f) GDPR.

3. Purpose

Your IP address must remain stored for the session to deliver the website to your computer. Log files ensure website functionality and help optimise the website and secure our IT systems. They are not evaluated for marketing. These purposes constitute our legitimate interest under Article 6(1)(f) GDPR.

4. Retention

Data is erased when no longer necessary for its purpose. Website delivery data is erased when the session ends; log file data after seven days at the latest. Longer storage is possible if IP addresses are deleted or altered so the accessing client can no longer be identified.

5. Objection and removal

Collecting website delivery data and storing log files is essential to operating the website. Users therefore cannot object to this processing.

IV. Cookies

1. Description and scope

Cookies are text files stored in or by your browser on your computer. A cookie may be stored on your operating system when you visit a website. Its distinctive character string identifies your browser when you return. We use cookies to improve usability; some elements require recognition of your browser after a page change.

2. Legal basis

Processing personal data using cookies is based on Article 6(1)(f) GDPR.

3. Purpose

Technically necessary cookies simplify website use. Some functions need cookies to recognise the browser after a page change. Data collected by these cookies is not used to create user profiles. These purposes constitute our legitimate interest under Article 6(1)(f) GDPR.

4. Retention, objection and removal

Cookies are stored on your computer and sent to our website, so you control their use. You can disable or restrict them in your browser settings and delete stored cookies at any time, including automatically. Disabling cookies may prevent full use of some functions.

We use transient and persistent cookies. Transient cookies are automatically deleted when you close the browser. Session cookies, in particular, store a session ID that links browser requests to the same session and recognises your computer on return. They are deleted when you log out or close the browser. Persistent cookies are automatically deleted after a specified period that varies by cookie; you can also delete them in your browser’s security settings. If you have an account, we use cookies to recognise you on later visits so that you need not log in each time.

V. Contact form and email

1. Description and scope

When you use our electronic contact form, we receive and store the entered name, company, email address and enquiry message. During submission we obtain consent and refer to this policy. Alternatively, we store the personal information sent to our published email address. No data is passed to third parties in this context; it is used exclusively for the conversation.

2. Legal basis

Consent-based processing relies on Article 6(1)(a) GDPR. Processing email information relies on Article 6(1)(f), with Article 6(1)(b) as an additional basis if the contact aims to conclude a contract.

3. Purpose

Form information is used solely to handle your contact. Handling email enquiries also constitutes our necessary legitimate interest. Other information processed during submission prevents misuse and safeguards IT security.

4. Retention

Data is erased when no longer needed. Form and email information is no longer needed once the conversation ends, meaning the circumstances show the matter is conclusively resolved. Additional data collected during submission is erased within seven days.

5. Withdrawal and objection

You may withdraw consent or object to storage at any time by informal email, letter or fax using the details in section I. Withdrawal does not affect the lawfulness of earlier processing. Once permission to store the information is withdrawn, the conversation cannot continue and all personal information stored during that contact is erased.

VI. Data subject rights

If your personal data is processed, you have the following rights against the controller under the GDPR.

1. Access

You may ask whether we process your data and request information about: (1) purposes; (2) data categories; (3) recipients or recipient categories to whom it has been or will be disclosed; (4) planned retention or the criteria determining it; (5) rights to rectification, erasure, restriction and objection; (6) the right to complain to a supervisory authority; (7) all available source information where data was not obtained from you; (8) automated decisions, including profiling under Article 22(1) and (4), with meaningful information about the logic, significance and envisaged consequences, at least in those cases. You may also ask about transfers to a third country or international organisation and the appropriate safeguards under Article 46.

2. Rectification

You may require inaccurate data to be corrected or incomplete data completed without undue delay.

3. Restriction

You may request restriction if: (1) you contest accuracy, for the period needed to verify it; (2) processing is unlawful but you oppose erasure and request restricted use; (3) the controller no longer needs the data but you need it for legal claims; or (4) you objected under Article 21(1), pending verification of whose legitimate grounds prevail. Apart from storage, restricted data may be processed only with consent, for establishing, exercising or defending legal claims, protecting another natural or legal person’s rights, or important EU or Member State public interests. You will be informed before restriction is lifted.

4. Erasure

a) Obligation: You may request erasure without undue delay, and the controller must comply, if: (1) data is no longer necessary for its original purpose; (2) you withdraw consent under Article 6(1)(a) or 9(2)(a) and no other legal basis exists; (3) you object under Article 21(1) without overriding legitimate grounds, or under Article 21(2); (4) processing was unlawful; (5) applicable EU or Member State law requires erasure; or (6) data was collected for information society services offered under Article 8(1).

b) Third parties: If the controller made data public and must erase it under Article 17(1), it takes reasonable measures, including technical measures, considering available technology and implementation costs, to inform other controllers that you requested erasure of links, copies and replications.

c) Exceptions: Erasure does not apply where processing is necessary for: (1) freedom of expression and information; (2) a legal obligation, public-interest task or official authority under applicable EU or Member State law; (3) public-health purposes under Article 9(2)(h) and (i) and 9(3); (4) public-interest archiving, scientific or historical research or statistics under Article 89(1), where erasure would likely make the objectives impossible or seriously impair them; or (5) establishing, exercising or defending legal claims.

5. Notification

The controller must notify recipients of rectification, erasure or restriction unless impossible or disproportionately burdensome. You may ask to be informed about those recipients.

6. Portability

You may receive data you provided in a structured, commonly used, machine-readable format and transmit it to another controller without hindrance if processing is automated and based on consent under Article 6(1)(a) or 9(2)(a) or a contract under Article 6(1)(b). Direct transfer between controllers may be requested where technically feasible. Others’ rights and freedoms must not be adversely affected. This right does not apply to processing necessary for public-interest tasks or official authority.

7. Objection

For reasons relating to your particular situation, you may object at any time to processing under Article 6(1)(e) or (f), including related profiling. Processing stops unless the controller demonstrates compelling legitimate grounds overriding your interests, rights and freedoms, or needs it for legal claims. You may object at any time to direct marketing and related profiling; data will then no longer be used for those purposes. For information society services, notwithstanding Directive 2002/58/EC, you may exercise objection through automated means using technical specifications.

8. Withdrawal of consent

You may withdraw data-protection consent at any time without affecting the lawfulness of processing before withdrawal.

9. Automated individual decisions and profiling

You have the right not to be subject to solely automated decisions, including profiling, with legal or similarly significant effects. Exceptions apply if the decision: (1) is necessary for entering into or performing a contract with the controller; (2) is authorised by applicable EU or Member State law with suitable safeguards; or (3) is based on explicit consent. Such decisions must not use special categories under Article 9(1) unless Article 9(2)(a) or (g) applies with suitable safeguards. In cases (1) and (3), safeguards include human intervention by the controller, expressing your viewpoint and contesting the decision.

10. Complaints

You may complain to a data-protection authority about our processing. The responsible authority is Der Hessische Landesbeauftragte, Gustav-Stresemann-Ring 1; telephone 0611 1408-0; fax 0611 408-900 or -901; email poststelle@datenschutz.hessen.de.

VII. Analysis tools and advertising

Google reCAPTCHA

We use Google reCAPTCHA, provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). It checks whether input, such as contact form entries, comes from a human or automated program. Analysis starts automatically when a visitor enters the website and uses IP address, time on site, mouse movements and other information. The collected data is sent to Google. Analysis runs entirely in the background without notifying visitors. Processing is based on Article 6(1)(f) GDPR and our legitimate interest in protection against abusive automated scraping and spam. Further information: Google privacy policy and reCAPTCHA.

VIII. Plugins and tools

1. Google Web Fonts

For consistent typography, your browser loads Google Web Fonts into its cache and connects to Google’s servers. Google thereby learns that your IP address accessed our website. Consistent and attractive presentation is a legitimate interest under Article 6(1)(f) GDPR. A standard local font is used if your browser does not support web fonts. Further information: Google Fonts FAQ and Google privacy policy.

2. Google Maps

We use Google Maps through an API. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Its functions require storage of your IP address, normally transferred to a Google server in the USA. We have no influence over this transfer. Attractive presentation and making our locations easy to find are legitimate interests under Article 6(1)(f) GDPR. Further information: Google privacy policy.