II. Processing of personal data

1. Provision of the website and production of log files

a) Description of the data processing

Every time our website is accessed, our system automatically gathers data and information on computer systems of the accessing computer.

In doing so, the following data are collected:

• Information on the browser type and the version used
• The public IP address of the user
• Date and time of access
• The requested pages and functions on our web presence
   

The data are also saved in the log files of our system. These data are not merged with other personal data of the user’s.

b) Legal basis for the data processing

The legal basis for the temporary storage of the data and the log files is article 6 paragraph 1 lit. f GDPR.

c) Purpose of the data processing

The data are stored in log files in order to guarantee the proper functioning of the website. In addition, we use the data to optimise the website and ensure the security of our IT systems. In this context, the data are not evaluated for marketing purposes. These purposes also include our legitimate interest in data processing in accordance with article 6 paragraph 1 lit. f GDPR.

d) Data storage period

The data are erased as soon as they are no longer necessary for the fulfilment of the purpose they were collected for. In the case of storage of data in log files, this is the case after 30 days at the latest. Storage for longer periods is possible. In this case, the IP addresses of the users will be deleted or disguised, so that they can no longer be attributed to the accessing client. 

e) Possibility of objection and elimination

The collection of data for the provision of the website and the storage of data in log files is absolutely necessary for the operation of the website. Consequently there is no possibility of objection on the part of the user.

2. Contact form / E-mail contact 

a) Description of the data processing

Our website contains a contact form which can be used for making contact electronically. If users seize this opportunity, the data entered into the input form (mandatory fields and optional information) will be conveyed to us and stored. These data are:

• Mandatory fields: Email address, reason for contact
• Optional information: Title, first name, family name, company, telephone number, message
   

Alternatively, we can be contacted via the e-mail address we provide. In this case the personal data of the user conveyed with the e-mail will be stored.

No transfer of data to third party takes place in this regard. The data are used exclusively for the processing of the conversation.

b) Legal basis for the data processing

The legal basis for the processing of the data is article 6 paragraph 1 lit. f GDPR. Of the aim of thee-mail contact is the conclusion of a contract or a quasi-contractual obligation, the legal basis for the processing is also article 6 paragraph 1 lit. b GDPR.

c) Purpose of the data processing

We process the personal data exclusively for the purpose of dealing with the issue you contacted us for. In the event of contact being made, the mandatory legitimate interests in the processing of the data also have a bearing.

d) Duration of the storage period

The data are erased as soon as they are no longer necessary for attaining the purpose they were collected for. For the personal data sent by e-mail, this is the case when the conversation in question with the user is ended and no legal or contractual retention periods are applicable, e.g. in cases of commercial letters. The conversation has ended when the circumstances indicate that the issue concerned has been conclusively clarified.

e) Possibility of objection and elimination

If users contact us by e-mail, they can object to the storage of their personal data at any time. This objection can be addressed to us using the contact information at the end of our data privacy notice. In the event of objection, the conversation with the user cannot be continued and we shall delete all personal data saved in the wake of contact being made. If the data are necessary for fulfilment of a contract, early erasure of the data is only possible if contractual or legal obligations do not present an obstacle for deletion.

3. Price calculator

a) Description of the data processing

In the context of the commissioning or inquiry regarding the use of our price calculator, the following data are requested:

Address data of sender and receiver

• Mandatory fields: title, surname, first name, street, postcode, town, country
• Optional information: company

Contact data of customer

• Mandatory fields: title, surname, postcode, town, telephone number, e-mail
• Optional information: country, first name, company, street, house number

Freight information

• Mandatory fields: total gross weight, number of packages
• Optional information: measure of largest package, freight description

Date and time for collection and delivery

• Mandatory fields: collection from, collection until, delivery from, delivery until

b) Legal basis for the data processing

The legal basis for the processing of the data is also article 6 paragraph 1 lit. b GDPR.

c) Purpose of the data processing

The processing of the personal data from the input form is necessary for the calculation, preparation of an offer, fulfilment and, if applicable, processing and billing of your order.

d) Duration of the storage period

We delete users’ personal data as soon as they are no longer necessary for the fulfilment and processing of the order and no legal or contractual retention periods apply.

e) Possibility of objection and elimination

In principle users can object to the storage of their personal data at any time. If the data are necessary for the fulfilment of a contract, If the data are necessary for fulfilment of a contract, early deletion of the data is only possible if contractual or legal obligations do not present an obstacle for deletion.

4. Employee applications

a) Description of the data processing

If you use our form for direct applications on our webpage to send your application in, the following information is transferred to us:

• Mandatory fields: title, first name, surname, date of birth, telephone, e-mail address, information on the desired post, driving licence?, school-leaving qualification, vocational education
• Optional information: title, street, house number, zip code, city, country, mobile phone, place of birth, civil status, nationality, car available?, school-leaving qualification, vocational training, work experience, knowledge of German, knowledge of English, earliest start date, salary requirements, internet skills, driving licence
• Optional documents: cover letter, photo, curriculum vitae/general documents, last employer’s reference, other employer’s references, last school certificate, other school certificates, further attachments

If you use our application-per-WhatsApp function, the legal basis for the communication is your consent, which can be revoked at any time (Art. 6 para. 1 a DSGVO). The application-per-WhatsApp function is provided to us by an IT service provider (PitchYou), which may access your data as a processor for this purpose. You can find more information here: https://www.pitchyou.de/datenschutz. You can find WhatsApp's data protection information, for example on their processing or on exercising your data protection rights against WhatsApp, here: https://www.whatsapp.com/legal/privacy-policy-eea. 

The data will be used exclusively for the processing of the applications.

b) Legal basis for the data processing

The legal basis for the processing of the data after candidates have sent their applications using the form for this purpose is article 6 paragraph 1 lit. b GDPR, article 26 paragraph 1 BDSG  (initiation of an employment relationship).

c) Purpose of the data processing

The collection of the data is for the processing of the application, for screening for possible acceptance of an employment relationship and in order to make contact with the candidate.

d) Duration of the storage period

The candidate’s data will only be stored until the application procedure is completed and the retention period of 6 months after receipt of cancellation has lapsed.

e) Possibility of objection and elimination

In principle candidates may object to the storage of their personal data at any time. If the data are necessary for fulfilment of a contract, early deletion of the data is only possible if contractual or legal obligations do not present an obstacle for deletion.

5. Registration by transport partners

a) Description of the data processing

If you use our form for transport partners on our webpage to send your registration in, the following information is transferred to us: 

• Mandatory fields: company name, street, house number, country code, postal code, city, function of the contact person, first name, last name, e-mail address, phone number, preferred type of cooperation
• Optional information: VAT number, VAT ID number, title of the contact person, number of  vehicles, licenses, qualifications, message/comment
   

The data are used exclusively for the processing of the applications.

b) Legal basis for the data processing

The legal basis for the processing of the data after applications using the form for this purpose is article 6 paragraph 1 lit. b GDPR (initiation of an contractual relationship).

c) Purpose of the data processing

The collection of the data is for the processing of the application, for screening and preparation for a possible contractual relationship / collaboration and to make contact with the applicant.

d) Duration of the storage period

The applicant’s data will be deleted at the latest by 6 months after receipt of cancellation.

e) Possibility of objection and elimination

In principle applicants may object to the storage of their personal data at any time. If the data are necessary for fulfilment of a contract, early deletion of the data is only possible if contractual or legal obligations do not present an obstacle for deletion.

6. Login forms

In order to enable customers and partners to interact digitally, login forms secure respective closed areas.

a) Description of data processing

The authentication process is carried out by transmitting the following data:

• Customers: Customer number, user name or email address, password
• Transport partners: e-mail address, password

After successful authentication and authorisation, the following data are stored:

• Application on which the login took place, login time, user name

b) Legal basis for data processing

The legal basis for the processing of data is Art. 6 para. 1 lit. b DSGVO.

c) Purpose of data processing

The purpose of collecting the data is to authenticate and authorise the user as a prerequisite for protecting the confidentiality and authenticity of the data and functions used in the subsequent session.

d) Duration of storage

The login data is stored for a period of 14 days. If business-relevant functions are used, personal data linked to the login may also be stored for a longer period, depending on their nature; order-related data, for example, is only deleted when it is no longer required for the execution and processing of the order and there are also no contractual or statutory retention periods.

e) Possibility of objection and removal

The user can object to the storage of his personal data at any time. If the data is required for the fulfilment of a contract, premature deletion of the data is only possible insofar as contractual or legal obligations do not prevent deletion.

IV. Data subject rights

If your personal data are processed, you are a data subject in accordance with the GDPR and have the following rights vis-à-vis the controller:

1. Right to information

You can demand confirmation from the controller as to whether personal data concerning you is being processed by us.

If such processing is taking place, you can demand details of the following information from the controller:

• The purposes for which the personal data are being processed;
• The categories of personal data being processed;
• The recipients or categories of recipients to whom the personal data concerning you have been or are being disclosed;
• The planned duration of the storage of the personal data concerning you or, if specific information is not possible in this regard, the criteria for the establishment of the retention period;
• The existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of the processing by the controllers or a right to object against this processing;
• The existence of a right to complain to a supervisory authority;
• All available information on the origin of the data, if the personal data was not collected from the data subject;
• The existence of automated individual decision-making, including profiling, in accordance with article 22 paragraph 1 and 4 GDPR and – at least in these cases – meaningful information on the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

You are entitled to demand information on whether the personal data on you are transferred to a third country or to an international organisation. In this regard, you can ask to be informed of the appropriate safeguards as per article 46 GDPR in connection with the transfer.

2. Right to rectification

You have a right to rectification and/or completion of data vis-à-vis the controllers, insofar as the processed personal data concerning you are inaccurate or incomplete. The controller must undertake the rectification immediately.

3. Right to restriction of processing

Under the following prerequisites you can demand the restriction of the processing of the personal data concerning you:

• If the accuracy of the data on you is contested for a period enabling the controller to verify the accuracy of the personal data;
• If the processing is unlawful and you oppose the erasure of the data and request the restriction of their use instead;
• If the controller no longer needs the personal data for the purposes of the processing, but they are required for the establishment, exercise or defence of legal claims, or
• If you have objected to the processing pursuant to article 21 paragraph 1 GDPR pending the verification whether the legitimate grounds of the controller override your grounds.
• Where processing of the personal data concerning you has been restricted, such data shall – with the exception of storage – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

Where restriction of the processing has been obtained in accordance with the aforementioned prerequisites, you shall be informed by the controller before the restriction is lifted.

4. Right of erasure

a) Obligation of erasure

You may demand that the controller erase the personal data concerning you without delay and the controller shall have the obligation to erase these data where one of the following grounds applies:

• The personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
• You withdraw your consent on which the processing is based according to article 6 paragraph 1 lit. a or article 9 paragraph s lit. a GDPR, and where there is no other legal ground for the processing.
• You object to the processing pursuant to article 21 paragraph 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to article 21 paragraph 2 GDPR.
• The personal data concerning you have been unlawfully processed.
• The personal data concerning you have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
• The personal data concerning you have been collected in relation to the offer of information society services referred to in article 8 paragraph 1 GDPR.

b) Information to third parties

Where the controller has made the personal data concerning you public and is obliged pursuant to article 17 paragraph 1 GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of those personal data.

c) Exceptions to the obligation of erasure

The right to erasure shall not apply to the extent that processing is necessary:

• For exercising the right of freedom of expression and information;
• For compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise official authority vested in the controller;
• For reasons of public interest in the area of public health in accordance with article 9 paragraph 2 lit. h and I and article 9 paragraph 3 GDPR;
• For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with article 89 paragraph 1 GDPR, in so far as the right referred to in paragraph a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
• For the establishment, exercise or defence of legal claims.

5. Right to information

If you have established the right to rectification, erasure or restriction of processing with the controller, the latter is obliged to inform all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of the processing, unless this proves to be impossible or entails unreasonable effort.

You have the right to be informed by the controller of these recipients.

6. Right to data portability

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly-used and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided

• The processing is based on consent pursuant to article 6 paragraph 1 lit. a GDPR or article 9 paragraph 2 lit. a GDPR or on a contract pursuant to article 6 paragraph 1 lit. b GDPR, and
• The processing is carried out by automated means.

In exercising this right you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. This right shall not adversely affect the rights and freedoms of others.

The right to data portability shall not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on article 6 paragraph 1 lit. e or f GDPR; including profiling based on those provisions.

The controller shall no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you for such marketing, including profiling to the extent that it is related to such direct marketing.

Where you object to processing for direct marketing purposes, the personal data concerning you shall no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

8. Right to revoke data privacy declaration of consent

You have the right to revoke your declaration of data privacy consent at any time. The revoking of the consent shall not affect lawfulness of the processing that has taken place until consent was revoked.

9. Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This shall not apply if the decision:

• Is necessary for entering into, or performance of, a contract between you and the data controller,
• Is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
• Is based on your explicit consent.

In any case these decisions may not be based on special categories of personal data referred to in article 9 paragraph 1 GDPR, unless article 9 paragraph 2 lit. a or g applies and suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place.

In the cases referred to above in (1) and (3), the data controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to article 78 GDPR.

The contact details for the supervisory authority responsible for our company can be found at the end of the data privacy notice.

11. Others

To assert the above rights please contact us (see contact information at the end of the data privacy notice). Inquiries sent to us electronically are generally answered by electronic means, unless no other stipulations have been made in your inquiry.

Data processing companies

The following associated companies and partners process personal data on our behalf:

Direkt-Trans Kft. 
Tibormajori út. 9
H-9027 Györ

inTime Express Logistics Sp. z.o.o.
Jerzmanowska 17
PL-54-530 Wroclaw

inTime Direkt-Kuriere S.R.L. 
Str. Barcelona 8
RO-550018 Sibiu

inTime Express AB
Karbingatan 16
S-25467 Helsingborg

inTime Express Logistics s.r.o.
Valcha 139
CZ-30100 Pilsen

Servicios Empresariales  Ader, S. A.
C/ Ciudad de Elche 6
ES-08027 Barcelona

Trans-Logo-Tech (TLT) GmbH
Hans Grüninger-Weg 11
D-71706 Markgröningen