Last updated: 1 November 2026
1. Controller
PrimaFahrten GmbH, Freienwalder Str. 37, 13359 Berlin, Germany; email: kontakt@primafahrten.de; phone: +49 30 526 556 19.
2. Visiting this website
This website is hosted by Hetzner. When you visit it, the server processes technically necessary log data, including IP address, date and time, requested page, referrer, browser and operating-system information. This is necessary to deliver, secure and troubleshoot the website (Art. 6(1)(f) GDPR). We generally retain server log data for no more than 30 days. Logs relevant to a specific security incident may be retained separately until analysis, defence or legal enforcement has concluded.
3. Contact and contact form
When you contact us by email, phone or contact form, we process the information you provide to handle your message and communicate with you (Art. 6(1)(b) or (f) GDPR). The contact form uses FormSubmit as a technical transmission service. We do not operate a newsletter or email-marketing service.
The contact and message data entered in the contact form are transmitted to FormSubmit and then to our email address. FormSubmit is associated with Devro LABS. According to the provider's publicly available product documentation, form submissions may be retained in its Submission Archive for up to 30 days.
4. Ride requests and ride operations
For a ride request, we process contact, journey, appointment, pickup/destination, mobility-aid and access information where necessary to review and plan the request. This is processed for pre-contractual communication, contract performance and ride organisation (Art. 6(1)(b) GDPR). Please provide health or mobility information only where it is necessary for safe planning. Required form fields are necessary for us to review and handle the request; the field for special requests or notes is optional.
We use GSMtasks, provided by GSMvalve OÜ, Tallinn, Estonia, for operational journey and task management. Estonia is in the European Economic Area. Depending on the process, data may also be processed in our Namecheap Private Email environment and in Google Drive for communication, planning and operational document storage. Access is limited to authorised people.
Mobility or health information that you provide voluntarily may in an individual case be special-category personal data. Where this applies, we process it only on the basis of your explicit consent under Art. 9(2)(a) GDPR. Consent may be withdrawn at any time by email to kontakt@primafahrten.de with effect for the future; this does not affect the lawfulness of processing before withdrawal. Where consent is given, we record only the request ID, timestamp, consent-text version and consent status as evidence, not an additional copy of your health or mobility information.
5. Cookies, consent and measurement
We use the self-hosted open-source software Klaro! for
consent management. Klaro! stores your choice for no more
than 180 days in the technically necessary first-party
cookie klaro on your device. Non-essential
technologies are activated only in line with your choice.
You can change or withdraw your consent at any time using
the consent icon.
Google Tag Manager is loaded only after you have consented to Google Analytics or Google Ads. Before your consent this website makes no connection to the Google Tag Manager servers. Google Analytics 4 and Google Ads are used only after your consent (Art. 6(1)(a) GDPR and section 25(1) TDDDG). If you withdraw such a consent, the page reloads. Once a ride request has been processed successfully, a one-time conversion event may be triggered. The contents of the ride request are not sent to Google Ads. Analytics and marketing technologies are used in accordance with the choices you make through our consent management system. The category Security concerns Google reCAPTCHA (see section 7). You can change your choices at any time through the cookie settings.
6. Ride-request success status
After a ride request has been processed successfully, our
server sets the first-party cookie
primafahrten_ride_request_success with value
1. It contains no form content, contact details,
mobility information or health information, lasts no more
than five minutes and is deleted after use or after only a
few minutes. It is used to identify the successful completion
of the request and to prevent duplicate conversion measurement.
7. reCAPTCHA, WhatsApp and social media
We use Google reCAPTCHA v3 on the ride request form to
prevent abusive automated requests. For users in the
European Economic Area the provider is Google Ireland
Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The
reCAPTCHA script is loaded only after your consent, either
in the cookie settings (category Security) or through the
checkbox "I allow Google reCAPTCHA as spam protection for
this form" in the request form. Without this consent the
online form cannot be sent. After that the
_GRECAPTCHA cookie is set on your device for
risk analysis, and data such as your IP address, device and
browser information and information about how you interact
with the page may be transmitted to Google. When the request
is submitted, our server sends the resulting verification
token to Google for evaluation; it does not send the
contents of your request to Google. Google may also process
data in the United States or other third countries (see
section 8). The legal bases are section 25(1) TDDDG for
storing and reading information on your device and Art.
6(1)(a) GDPR for the processing. Consent is voluntary.
Without consent you can reach us by phone at
+49 30 526 556 19 or by email at kontakt@primafahrten.de.
You can withdraw your consent at any time with effect for
the future through the consent icon (cookie settings) or by
unticking the checkbox in the form; the page then
reloads. Withdrawal does not affect the
lawfulness of processing carried out until then. More
information is in
Google's Privacy Policy.
If you use a WhatsApp
link, you leave our website and
communication then takes place through WhatsApp under its own
privacy terms. The current website contains no social-media
plugins or embedded social-media pixels; ordinary outbound
links do not send data to the respective service merely when
a page is opened.
8. Recipients and international transfers
Recipients may include Hetzner (hosting), FormSubmit (contact form), GSMtasks by GSMvalve OÜ in Estonia (ride management), Namecheap Private Email (email communication), Google Drive (planning and document storage) and Google (reCAPTCHA, Google Tag Manager, Google Analytics 4 and Google Ads), where required for the purposes described above. Estonia is in the European Economic Area. We use Namecheap Private Email for email communications. Namecheap processes data as a technical service provider or processor, and processing in the United States may occur. The contractual data-processing agreement provides appropriate safeguards, including EU Standard Contractual Clauses, for relevant third-country transfers. Google may also process data in the United States or other third countries. According to Google, it adheres to the EU-U.S. Data Privacy Framework for data from the EEA (Google's information: policies.google.com/privacy/frameworks).
9. Retention
We delete or anonymise data when it is no longer required for its purpose and no legal retention duty applies. Ordinary contact requests without follow-on business and unsuccessful ride requests are generally retained for no more than 12 months after the communication or request is closed. Ordinary contractual and supporting records are generally retained for no more than three years after the end of the calendar year of the transaction unless a longer legal duty applies. Statutorily retained business and commercial correspondence is generally retained for up to six years, invoices and booking records for up to eight years, and books and annual financial-statement records for up to ten years.
For GSMtasks, ordinary operational ride and CRM data are retained for no more than three years after the relevant customer or ride relationship ends. Sensitive operational mobility, health or handover notes are retained only while required during an active regular ride relationship, reviewed once it ends and, where no longer required, removed where possible within 90 days. For email and Google Drive, the retention period follows the content: general requests no more than 12 months, ordinary contractual records no more than three years and records subject to statutory retention for the periods stated above. Email mailboxes and Google Drive are not used as unlimited archives.
We retain consent evidence for voluntarily provided health and mobility information for the relevant processing and for no more than three years afterwards. After an email is deleted, technical backup copies at Namecheap may persist temporarily. In the event of a specific legal dispute, accident, loss event, outstanding payment claim, regulatory proceeding or complaint, deletion of only the data required for that case may be temporarily suspended. This is not a basis to retain all customer data generally for longer or for up to 30 years.
10. No automated decisions
We do not make automated decisions, including profiling, relating to ride requests that produce legal effects concerning you or similarly significantly affect you.
11. Your rights
Subject to the GDPR, you have rights of access, rectification, erasure, restriction, data portability and objection to processing based on legitimate interests. You may withdraw consent for the future. You may also complain to a data-protection supervisory authority, in particular the Berlin Commissioner for Data Protection and Freedom of Information.