Privacy Policy.(Datenschutzerklärung)

The controller (Verantwortlicher) under GDPR Art. 4 (7) is:

Stuttgart Taxi FB GmbH
Austraße 107
70376 Stuttgart
Germany

Phone: +49 152 2929 8484
Email: info@stuttgart-airport-transfer.com
Managing Director: Furkan Bakir

Data Protection Officer (DPO). A statutory DPO under Art. 37 GDPR / § 38 BDSG is not currently required: we employ fewer than 20 persons engaged in automated processing of personal data on a permanent basis, and our core activities do not consist of large-scale, regular monitoring or large-scale processing of special categories of data. For all data-protection enquiries, please contact us at info@stuttgart-airport-transfer.com with the subject line “Datenschutzanfrage / GDPR request”.

We deliberately collect the minimum data necessary to fulfil a fixed-price transport contract and to comply with German tax-retention obligations. The categories below correspond to the columns of the bookings table held with our database processor (see § 4) and to the access logs of our hosting provider.

• Identity data: first and last name.
• Contact data: email address, mobile phone number.
• Booking data: pickup and drop-off addresses (street + city + post code, plus latitude/longitude for routing), pickup date and time (Europe/Berlin), vehicle class (Standard / Van / Premium), passenger count, luggage count, optional flight number, optional driver note.
• B2B / invoicing data (optional): company name, German or EU VAT-ID, postal billing address.
• Payment data: we do not see or store full card numbers. Stripe (see § 4) processes the card directly; we receive only a non-sensitive snapshot — card brand (e.g. “Visa”) and the last four digits — plus the Stripe PaymentIntent ID, authorised amount, and capture status. This snapshot is PCI-DSS classified as non-sensitive and may be stored under industry standards.
• Booking-status data: internal state machine values (pending, confirmed, in progress, completed, cancelled, no-show), timestamps, internal dispatcher notes (only visible to the dispatcher, never returned to the customer).
• Cancellation token: a 24-byte cryptographically random token (192 bits of entropy) used to authorise guest cancellation without a customer account. The token is bound to a single booking and useless without the corresponding booking ID.
• Hotel attribution (B2B partner): if you arrived via a partner hotel link with a query parameter such as ?hotel=marriott, the partner identifier is stored against the booking for commission accounting. No further hotel-side data is processed.
• Server access logs: IP address (in truncated/hashed form for analytics; full for security monitoring), user-agent, timestamp, requested URL, HTTP status, response size, referer. Retained 7 days for fraud / abuse detection.

We do not process special categories of data (health, religion, ethnicity, biometrics) under Art. 9 GDPR. We do not profile customers or use automated decision-making with legal effect under Art. 22 GDPR.

We engage the following processors (Auftragsverarbeiter) under written agreements per Art. 28 GDPR. Each processor is bound to act only on our instructions, to apply technical and organisational security measures proportionate to the risk, and to delete or return the data on termination.

All primary data processing happens in EU/EEA data centres. Structural third-country transfers are limited to three processors and only occur on the legal bases set out below:

• Stripe (payment): card processed by Stripe Payments Europe Ltd in Ireland; Stripe Inc. (USA) acts as sub-processor for fraud-prevention signals and support escalations. Necessary for contract performance under Art. 6 (1) (b) GDPR.
• Microsoft Clarity (analytics): anonymised interaction data transferred to Microsoft Corporation (USA) for session-recording and heatmap analysis. Loaded only after your explicit consent under Art. 6 (1) (a) GDPR — see § 7 below for the consent mechanism.
• Google Analytics 4 (analytics): anonymised page-view data transferred to Google LLC (USA) for aggregate website analytics. Loaded only after your explicit consent under Art. 6 (1) (a) GDPR. Until consent is granted, GA4 runs in Google's “Consent Mode v2 default-deny” mode, sending only cookieless ping events with no user identifier.

All three transfers are protected by a layered safeguard:

• Stripe Inc., Microsoft Corporation, and Google LLC are all certified under the EU-US Data Privacy Framework (DPF); the European Commission has adopted an adequacy decision for the DPF on 10 July 2023 (Implementing Decision (EU) 2023/1795).
• Each processor additionally maintains Standard Contractual Clauses (SCCs) under Art. 46 (2) (c) GDPR as a backup, in case the DPF were ever invalidated.
• A Data Processing Agreement is in place under Art. 28 GDPR. The full text is available at stripe.com/legal/dpa.

No other processor transfers data outside the EU/EEA except Nominatim (OpenStreetMap Foundation), whose UK operations are covered by the European Commission's renewed adequacy decision for the United Kingdom of 17 December 2024 (Implementing Decision (EU) 2024/3300, replacing the original adequacy decision of 28 June 2021 which would otherwise have expired on 27 June 2025).

• Booking records, invoices, payment trail: 10 years from the end of the calendar year in which the booking was concluded (mandatory under § 147 (1) AO and § 257 HGB), then automatic erasure.
• Cancellation token: deleted on booking completion or after 90 days post-pickup, whichever is later.
• Server access logs: 7 days, then rotated and overwritten.
• Stripe data: Stripe retains payment records for the period required by EU and US financial-services law (typically 7 years). See Stripe's privacy policy for details.
• Email correspondence: retained as long as the related business matter is open, plus 6 years (correspondence relevant to commerce per § 257 (1) No. 4 HGB).
• Microsoft Clarity / Google Analytics data: only collected if you have consented — Clarity sessions retained for 90 days, GA4 user-level data retained for 14 months (default). Aggregate reports kept indefinitely.

Note on naming: § 25 of the German cookie-consent statute was relocated from the former TTDSG (Telekommunikation-Telemedien-Datenschutz-Gesetz) to the renamed TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz) on 14 May 2024 when the Digital Services Act package took effect. The substantive provision is unchanged.

Cookies and similar device-storage technologies fall into two categories on this site:

1. Strictly necessary — required for the site to function (booking form, payment iframe, language preference). These run without consent under § 25 (2) Nr. 2 TDDDG.
2. Optional analytics — Microsoft Clarity and Google Analytics 4. These set cookies and transfer data to the USA. They load only after you actively accept them in our cookie banner (Art. 6 (1) (a) GDPR + § 25 (1) TDDDG). Until you accept, neither tool reads or writes anything beyond Google's “Consent Mode v2 default-deny” cookieless pings.

Withdrawing consent. You can change your decision any time via the “Cookie settings” link in the page footer. Withdrawal applies prospectively (Art. 7 (3) GDPR) — it does not invalidate processing that took place during the consented period, but it stops further processing and clears the analytics cookies on your device on next page-load.

If you decline analytics in the banner, neither Microsoft Clarity nor Google Analytics are loaded; the site falls back to no behavioural analytics at all. You can use the booking flow end-to-end without any analytics consent.

We do not use automated decision-making with legal effect on you under Art. 22 GDPR. Stripe runs algorithmic fraud detection on the card-authorisation step; if a transaction is declined for fraud signals, we do not capture it but we also do not use that signal for any decision beyond that single attempt. You may always reach a human dispatcher on +49 152 2929 8484 to complete the booking by alternative means.

Our service is intended for adult travellers. We do not knowingly market to or accept bookings from individuals under the age of 16 acting independently of a parent or guardian, in line with Art. 8 (1) GDPR. If you become aware that a minor has provided us with personal data without verifiable parental consent, please contact us so we can erase the record.

You have the following rights, exercisable at no cost:

• Right of access — Art. 15 GDPR.
• Right to rectification — Art. 16 GDPR.
• Right to erasure (“right to be forgotten”) — Art. 17 GDPR, subject to statutory retention obligations under §§ 147 AO, 257 HGB.
• Right to restriction of processing — Art. 18 GDPR.
• Right to data portability — Art. 20 GDPR (machine-readable export of the data you provided to us).
• Right to object — Art. 21 GDPR (in particular to processing based on legitimate interests).
• Right to withdraw consent — Art. 7 (3) GDPR, where processing is based on consent (in our setup, this only applies if you separately consent to a marketing channel; default booking flows are based on contract performance and do not require consent).
• Right to lodge a complaint with a supervisory authority — Art. 77 GDPR.

Send any rights request to info@stuttgart-airport-transfer.com with subject “Datenschutzanfrage / GDPR request”. We respond within one month under Art. 12 (3) GDPR; for complex or numerous requests we may extend by a further two months and will notify you within the original month.

You may lodge a complaint with any data-protection supervisory authority in the EU/EEA, in particular at your habitual residence, place of work, or place of the alleged infringement (Art. 77 GDPR). The competent authority for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW)
Königstraße 10a
70173 Stuttgart, Germany

Phone: +49 711 615541-0
Email: poststelle@lfdi.bwl.de
Web: www.baden-wuerttemberg.datenschutz.de

We apply technical and organisational measures (TOMs) commensurate with the risk per Art. 32 GDPR:

• TLS 1.3 encryption for all data transmissions (HTTPS only, HSTS-enabled).
• Encrypted database with AES-256 at-rest encryption (Supabase managed Postgres).
• Cancellation tokens generated with gen_random_bytes(24) (192 bits of entropy) — cryptographically infeasible to guess.
• Secrets (Supabase service role, Stripe keys, SMTP credentials) stored as environment variables on the server only, never in the source repository.
• Servers located in Frankfurt am Main (eu-central-1) and Karlsruhe / Nuremberg (Netcup), in ISO-27001-certified facilities.
• HTTP basic auth on the dispatcher panel (/dispo) before any business logic runs; no public path leaks.
• Continuous dependency monitoring and security patching of the Node.js, Next.js, and Postgres versions in use.
• Principle of least privilege for backend access — only authorised employees hold dispatcher credentials.

We may amend this notice to reflect changes to our processing or to legal requirements. The current version is always available at https://stuttgart-airport-transfer.com/datenschutz. The “Last reviewed” date at the top of the page reflects the latest substantive amendment. Where amendments affect data subjects materially, we will notify customers with active bookings by email.