Last updated: 19 September 2026
1. Controller
PrimaFahrten GmbH, Freienwalder Str. 37, 13359 Berlin, Germany; email: kontakt@primafahrten.de; phone: +49 30 526 556 19.
2. Visiting this website
This website is hosted by Hetzner. When you visit it, the server processes technically necessary log data, including IP address, date and time, requested page, referrer, browser and operating-system information. This is necessary to deliver, secure and troubleshoot the website (Art. 6(1)(f) GDPR). We generally retain server log data for no more than 30 days. Logs relevant to a specific security incident may be retained separately until analysis, defence or legal enforcement has concluded.
3. Contact and contact form
When you contact us by email, phone or contact form, we process the information you provide to handle your message and communicate with you (Art. 6(1)(b) or (f) GDPR). The contact form uses FormSubmit as a technical transmission service. We do not operate a newsletter or email-marketing service.
The contact and message data entered in the contact form are transmitted to FormSubmit and then to our email address. FormSubmit is associated with Devro LABS. According to the provider's publicly available product documentation, form submissions may be retained in its Submission Archive for up to 30 days.
4. Ride requests and ride operations
For a ride request, we process contact, journey, appointment, pickup/destination, mobility-aid and access information where necessary to review and plan the request. This is processed for pre-contractual communication, contract performance and ride organisation (Art. 6(1)(b) GDPR). Please provide health or mobility information only where it is necessary for safe planning. Required form fields are necessary for us to review and handle the request; the field for special requests or notes is optional.
We use GSMtasks, provided by GSMvalve OÜ, Tallinn, Estonia, for operational journey and task management. Estonia is in the European Economic Area. Depending on the process, data may also be processed in our Namecheap Private Email environment and in Google Drive for communication, planning and operational document storage. Access is limited to authorised people.
Mobility or health information that you provide voluntarily may in an individual case be special-category personal data. Where this applies, we process it only on the basis of your explicit consent under Art. 9(2)(a) GDPR. Consent may be withdrawn at any time by email to kontakt@primafahrten.de with effect for the future; this does not affect the lawfulness of processing before withdrawal. Where consent is given, we record only the request ID, timestamp, consent-text version and consent status as evidence, not an additional copy of your health or mobility information.
5. Cookies, consent and measurement
We use the self-hosted open-source software Klaro! for
consent management. Klaro! stores your choice for no more
than 180 days in the technically necessary first-party
cookie klaro on your device. Non-essential
technologies are activated only in line with your choice.
You can change or withdraw your consent at any time using
the consent icon.
Google Tag Manager loads with Consent Mode signals denied by default. At source-code level this follows the Google Advanced Consent Mode pattern. Google Analytics 4 and Google Ads are used only after your consent (Art. 6(1)(a) GDPR and section 25(1) TDDDG). Once a ride request has been processed successfully, a one-time conversion event may be triggered. The contents of the ride request are not sent to Google Ads. Analytics and marketing technologies are used in accordance with the choices you make through our consent management system. You can change your choices at any time through the cookie settings.
6. Ride-request success status
After a ride request has been processed successfully, our
server sets the first-party cookie
primafahrten_ride_request_success with value
1. It contains no form content, contact details,
mobility information or health information, lasts no more
than five minutes and is deleted after use or after only a
few minutes. It is used to identify the successful completion
of the request and to prevent duplicate conversion measurement.
7. reCAPTCHA, WhatsApp and social media
We use Google reCAPTCHA v3 for ride requests to prevent abusive automated submissions. The reCAPTCHA script loads directly from Google when the ride-request page is opened and is used for server-side verification when the form is submitted; technical usage data may be sent to Google. If you use a WhatsApp link, you leave our website and communication then takes place through WhatsApp under its own privacy terms. The current website contains no social-media plugins or embedded social-media pixels; ordinary outbound links do not send data to the respective service merely when a page is opened.
8. Recipients and international transfers
Recipients may include Hetzner (hosting), FormSubmit (contact form), GSMtasks by GSMvalve OÜ in Estonia (ride management), Namecheap Private Email (email communication), Google Drive (planning and document storage) and Google (reCAPTCHA, Google Tag Manager, Google Analytics 4 and Google Ads), where required for the purposes described above. Estonia is in the European Economic Area. We use Namecheap Private Email for email communications. Namecheap processes data as a technical service provider or processor, and processing in the United States may occur. The contractual data-processing agreement provides appropriate safeguards, including EU Standard Contractual Clauses, for relevant third-country transfers. Google may also process data in the United States or other third countries.
9. Retention
We delete or anonymise data when it is no longer required for its purpose and no legal retention duty applies. Ordinary contact requests without follow-on business and unsuccessful ride requests are generally retained for no more than 12 months after the communication or request is closed. Ordinary contractual and supporting records are generally retained for no more than three years after the end of the calendar year of the transaction unless a longer legal duty applies. Statutorily retained business and commercial correspondence is generally retained for up to six years, invoices and booking records for up to eight years, and books and annual financial-statement records for up to ten years.
For GSMtasks, ordinary operational ride and CRM data are retained for no more than three years after the relevant customer or ride relationship ends. Sensitive operational mobility, health or handover notes are retained only while required during an active regular ride relationship, reviewed once it ends and, where no longer required, removed where possible within 90 days. For email and Google Drive, the retention period follows the content: general requests no more than 12 months, ordinary contractual records no more than three years and records subject to statutory retention for the periods stated above. Email mailboxes and Google Drive are not used as unlimited archives.
We retain consent evidence for voluntarily provided health and mobility information for the relevant processing and for no more than three years afterwards. After an email is deleted, technical backup copies at Namecheap may persist temporarily. In the event of a specific legal dispute, accident, loss event, outstanding payment claim, regulatory proceeding or complaint, deletion of only the data required for that case may be temporarily suspended. This is not a basis to retain all customer data generally for longer or for up to 30 years.
10. No automated decisions
We do not make automated decisions, including profiling, relating to ride requests that produce legal effects concerning you or similarly significantly affect you.
11. Your rights
Subject to the GDPR, you have rights of access, rectification, erasure, restriction, data portability and objection to processing based on legitimate interests. You may withdraw consent for the future. You may also complain to a data-protection supervisory authority, in particular the Berlin Commissioner for Data Protection and Freedom of Information.