Privacy Policy.(Datenschutzerklärung)

Two companies are controllers (Verantwortliche) under GDPR Art. 4 (7), each for its own processing:

Controller for the operation of this website — hosting, server logs, the consent banner and analytics (§ 3, § 7):

Medikant GmbH i.G.
Hausweinberg 127
71334 Waiblingen
Germany

Phone: +49 152 2929 8484
Email: info@stuttgart-airport-transfer.com
Managing Director: Furkan Bakir

Controller for quotes, bookings, payment, e-mails, cancellation, invoicing, dispatch and enquiries — your contractual partner (see § 1 of the Terms & Conditions):

Stuttgart Taxi FB GmbH
Austraße 107
70376 Stuttgart
Germany

Phone: +49 152 2929 8484
Email: info@stuttgart-airport-transfer.com
Managing Director: Furkan Bakir

The two companies are separate controllers. Where they process data jointly, the essence of their arrangement is available on request via the contact details above. “We” in this notice refers to the controller responsible for the respective processing.

Data Protection Officer (DPO). A statutory DPO under Art. 37 GDPR / § 38 BDSG is not currently required: each of the two companies employs fewer than 20 persons engaged in automated processing of personal data on a permanent basis, and our core activities do not consist of large-scale, regular monitoring or large-scale processing of special categories of data. For all data-protection enquiries, please contact us at info@stuttgart-airport-transfer.com with the subject line “Datenschutzanfrage / GDPR request”.

We deliberately collect the minimum data necessary to fulfil a fixed-price transport contract and to comply with German tax-retention obligations. The categories below correspond to the columns of the bookings table held with our database processor (see § 4) and to the access logs of our hosting provider.

• Identity data: first and last name.
• Contact data: email address, mobile phone number.
• Booking data: pickup and drop-off addresses (street + city + post code, plus latitude/longitude for routing), pickup date and time (Europe/Berlin), vehicle class (Standard / Van / Premium), passenger count, luggage count, optional flight number and terminal, optional driver note. Coordinates we obtain from Google Maps Platform are deleted after 29 days; the place identifier is kept so the address can be resolved again.
• B2B / invoicing data (optional): company name, German or EU VAT-ID, postal billing address.
• Customer master data (dispatch, optional): for repeat customers our dispatch may keep default addresses, a phone number, company and billing data (VAT-ID, billing address, cost centre, collective-invoice preference) and a short internal dispatch note, so that a new trip needs fewer entries. This is not a customer account and has no login. The record is deleted together with the anonymisation of the last booking and at the latest three years after the last trip (see § 6).
• Payment data: we do not see or store full card numbers. Stripe (see § 4) processes the card directly; we receive only a non-sensitive snapshot — card brand (e.g. “Visa”) and the last four digits — plus the Stripe PaymentIntent ID, authorised amount, and capture status. This snapshot is PCI-DSS classified as non-sensitive and may be stored under industry standards.
• Booking-status data: internal state machine values (pending, confirmed, in progress, completed, cancelled, no-show), timestamps, internal dispatcher notes (only visible to the dispatcher, never returned to the customer).
• Cancellation token: a 24-byte cryptographically random token (192 bits of entropy) used to authorise guest cancellation without a customer account. The token is bound to a single booking and useless without the corresponding booking ID.
• Hotel attribution (B2B partner): if you arrived via a partner hotel link with a query parameter such as ?hotel=marriott, the partner identifier is stored against the booking for commission accounting. No further hotel-side data is processed.
• Server access logs: IP address (in truncated/hashed form for analytics; full for security monitoring), user-agent, timestamp, requested URL, HTTP status, response size, referer. Retained 7 days for fraud / abuse detection.

We do not process special categories of data (health, religion, ethnicity, biometrics) under Art. 9 GDPR. We do not profile customers or use automated decision-making with legal effect under Art. 22 GDPR.

Each controller named in § 1 engages the following processors (Auftragsverarbeiter) under written agreements per Art. 28 GDPR, on its own instructions; the line “Controller” on each entry says which company that is. Each processor is bound to act only on the controller's instructions, to apply technical and organisational security measures proportionate to the risk, and to delete or return the data on termination.

Two exceptions — WhatsApp and Google Maps Platform: both are listed below for transparency but are not our processors. When our dispatch team writes to you via WhatsApp (only if you gave us a mobile number, and always as an alternative to email), WhatsApp processes your number and the message as an independent controller under its own privacy policy. Google Ireland Ltd processes the address search and the driving distance behind the price as an independent controller under the Google Maps Platform terms; our server sends it only the typed address text, a place identifier and a random session key that is new for every search — never your IP address, cookies or anything else that identifies you (see the entry below and § 5).

Performing partner companies: every ride is performed by a company licensed under the PBefG — a taxi operator (§ 47 PBefG) or a chauffeur/private-hire operator (§ 49 PBefG) — commissioned by the controller for the booking. We transmit the booking data required for the trip (name, phone number, pickup and drop-off address, pickup time, and any flight number) to that company so it can perform the carriage and meet its statutory obligations. Legal basis: Art. 6 (1) (b) GDPR (performance of the transport contract). The performing company processes the data as an independent controller solely to carry out the trip and to meet its statutory obligations (Art. 6 (1) (c) GDPR).

All primary data processing happens in EU/EEA data centres. Structural third-country transfers are limited to three processors plus WhatsApp and only occur on the legal bases set out below:

• Stripe (payment): card processed by Stripe Payments Europe Ltd in Ireland; Stripe Inc. (USA) acts as sub-processor for fraud-prevention signals and support escalations. Necessary for contract performance under Art. 6 (1) (b) GDPR.
• Microsoft Clarity (analytics): anonymised interaction data transferred to Microsoft Corporation (USA) for session-recording and heatmap analysis. Loaded only after your explicit consent under Art. 6 (1) (a) GDPR — see § 7 below for the consent mechanism.
• Google Analytics 4 (analytics): anonymised page-view data transferred to Google LLC (USA) for aggregate website analytics. Loaded only after your explicit consent under Art. 6 (1) (a) GDPR. Until consent is granted, GA4 runs in Google's “Consent Mode v2 default-deny” mode, sending only cookieless ping events with no user identifier.
• WhatsApp (messages from our dispatch team, only if you gave a mobile number): WhatsApp Ireland Limited, with onward transfer to Meta Platforms Inc. (USA). Confirmation of a taxi order and trip details: Art. 6 (1) (b) GDPR. Review request and return-trip offer: Art. 6 (1) (f) GDPR (our interest in feedback and repeat business) — you can object at any time by replying to the message.

These transfers are protected by a layered safeguard:

• Stripe Inc., Microsoft Corporation, Google LLC and Meta Platforms Inc. are all certified under the EU-US Data Privacy Framework (DPF); the European Commission has adopted an adequacy decision for the DPF on 10 July 2023 (Implementing Decision (EU) 2023/1795).
• Each processor additionally maintains Standard Contractual Clauses (SCCs) under Art. 46 (2) (c) GDPR as a backup, in case the DPF were ever invalidated.
• A Data Processing Agreement is in place under Art. 28 GDPR. The full text is available at stripe.com/legal/dpa.

One recipient operates as an independent controller and partly outside the EU/EEA: Google Ireland Ltd (Google Maps Platform — Places API for the address search, Routes API for the driving distance behind the price). Every request originates from our server, not from your browser: your IP address, cookies or any identifier of yours never reach Google — only the typed text, a place identifier and a random session key that is new for every search. Google LLC (USA) may process the data; the transfer is covered by the EU-US Data Privacy Framework (Google LLC is certified) and Google's Standard Contractual Clauses. We keep the place identifier and delete coordinates obtained from Google after 29 days. Should Google Maps Platform be unavailable, our server falls back to Komoot (Photon, Germany) for the address search and to Project OSRM (Zurich, Switzerland — adequate under Commission Decision 2000/518/EC, confirmed in the Commission's review of 15 January 2024) for the distance; both receive only the typed address text or the two coordinate pairs of a route, never your IP address. No other processor transfers data outside the EU/EEA.

• Booking records, invoices, payment trail: 10 years from the end of the calendar year in which the booking was concluded (mandatory under § 147 (1) AO and § 257 HGB), then automatic erasure.
• Cancellation token: deleted on booking completion or after 90 days post-pickup, whichever is later.
• Customer master data (dispatch): until the anonymisation of the last booking, at the latest 3 years after the last trip (§ 195 BGB standard limitation period); checked automatically.
• Server access logs: 7 days, then rotated and overwritten.
• Stripe data: Stripe retains payment records for the period required by EU and US financial-services law (typically 7 years). See Stripe's privacy policy for details.
• Email correspondence: retained as long as the related business matter is open, plus 6 years (correspondence relevant to commerce per § 257 (1) No. 4 HGB).
• Microsoft Clarity / Google Analytics data: only collected if you have consented — Clarity sessions retained for 90 days, GA4 user-level data retained for 14 months (default). Aggregate reports kept indefinitely.

Note on naming: § 25 of the German cookie-consent statute was relocated from the former TTDSG (Telekommunikation-Telemedien-Datenschutz-Gesetz) to the renamed TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz) on 14 May 2024 when the Digital Services Act package took effect. The substantive provision is unchanged.

The consent banner and the analytics tools described below are operated by Medikant GmbH i.G. as controller for the website (§ 1); the booking flow itself needs no consent-based storage.

Cookies and similar device-storage technologies fall into two categories on this site:

1. Strictly necessary — required for the site to function (booking form, payment iframe, language preference). These run without consent under § 25 (2) Nr. 2 TDDDG.
2. Optional analytics — Microsoft Clarity and Google Analytics 4. These set cookies and transfer data to the USA. They load only after you actively accept them in our cookie banner (Art. 6 (1) (a) GDPR + § 25 (1) TDDDG). Until you accept, neither tool reads or writes anything beyond Google's “Consent Mode v2 default-deny” cookieless pings.

Withdrawing consent. You can change your decision any time via the “Cookie settings” link in the page footer. Withdrawal applies prospectively (Art. 7 (3) GDPR) — it does not invalidate processing that took place during the consented period, but it stops further processing and clears the analytics cookies on your device on next page-load.

If you decline analytics in the banner, neither Microsoft Clarity nor Google Analytics are loaded; the site falls back to no behavioural analytics at all. You can use the booking flow end-to-end without any analytics consent.

We do not use automated decision-making with legal effect on you under Art. 22 GDPR. Stripe runs algorithmic fraud detection on the card-authorisation step; if a transaction is declined for fraud signals, we do not capture it but we also do not use that signal for any decision beyond that single attempt. You may always reach a human dispatcher on +49 152 2929 8484 to complete the booking by alternative means.

Our service is intended for adult travellers. We do not knowingly market to or accept bookings from individuals under the age of 16 acting independently of a parent or guardian, in line with Art. 8 (1) GDPR. If you become aware that a minor has provided us with personal data without verifiable parental consent, please contact us so we can erase the record.

You have the following rights, exercisable at no cost:

• Right of access — Art. 15 GDPR.
• Right to rectification — Art. 16 GDPR.
• Right to erasure (“right to be forgotten”) — Art. 17 GDPR, subject to statutory retention obligations under §§ 147 AO, 257 HGB.
• Right to restriction of processing — Art. 18 GDPR.
• Right to data portability — Art. 20 GDPR (machine-readable export of the data you provided to us).
• Right to object — Art. 21 GDPR (in particular to processing based on legitimate interests).
• Right to withdraw consent — Art. 7 (3) GDPR, where processing is based on consent (in our setup, this only applies if you separately consent to a marketing channel; default booking flows are based on contract performance and do not require consent).
• Right to lodge a complaint with a supervisory authority — Art. 77 GDPR.

Send any rights request to info@stuttgart-airport-transfer.com with subject “Datenschutzanfrage / GDPR request”. We respond within one month under Art. 12 (3) GDPR; for complex or numerous requests we may extend by a further two months and will notify you within the original month.

You may lodge a complaint with any data-protection supervisory authority in the EU/EEA, in particular at your habitual residence, place of work, or place of the alleged infringement (Art. 77 GDPR). The competent authority for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW)
Königstraße 10a
70173 Stuttgart, Germany

Phone: +49 711 615541-0
Email: poststelle@lfdi.bwl.de
Web: www.baden-wuerttemberg.datenschutz.de

We apply technical and organisational measures (TOMs) commensurate with the risk per Art. 32 GDPR:

• TLS 1.3 encryption for all data transmissions (HTTPS only, HSTS-enabled).
• Encrypted database with AES-256 at-rest encryption (Supabase managed Postgres).
• Cancellation tokens generated with gen_random_bytes(24) (192 bits of entropy) — cryptographically infeasible to guess.
• Secrets (Supabase service role, Stripe keys, SMTP credentials) stored as environment variables on the server only, never in the source repository.
• Servers located in Frankfurt am Main (eu-central-1) and Karlsruhe / Nuremberg (Netcup), in ISO-27001-certified facilities.
• HTTP basic auth on the dispatcher panel (/dispo) before any business logic runs; no public path leaks.
• Continuous dependency monitoring and security patching of the Node.js, Next.js, and Postgres versions in use.
• Principle of least privilege for backend access — only authorised employees hold dispatcher credentials.

We may amend this notice to reflect changes to our processing or to legal requirements. The current version is always available at https://www.stuttgart-airport-transfer.com/datenschutz. The “Last reviewed” date at the top of the page reflects the latest substantive amendment. Where amendments affect data subjects materially, we will notify customers with active bookings by email.