Privacy Policy – Autonaut

Introduction
For Autonaut the protection of your personal data is very important. With this privacy policy, we inform you about the nature, scope and purpose of the processing of personal data (hereinafter referred to as „data“) concerning you within our services (hereinafter referred to as „online services“).

I. Section: Information on the responsible party as well as an overview of our processing operations.
II. Section: Your rights, relevant legal standards and general information on the processing of data.
III. section: information on the individual processing operations/modules. The section is divided into areas, such as the description of processing within core services, reach measurement or marketing.
IV. Section: concluding remarks.
All terminology used is kept neutral for better clarity.
Section I:
Responsible party and overview of data processing operations
The responsible party within the meaning of Art. 4 No. 7 DS-GVO is
Autonaut UG (limited liability)
Gyßlingstr. 72
80805 Munich
Germany
Managing Director: Stephan Augustin
Registry Court: Munich Local Court HRB 253291
Registered office of the company: Munich
Imprint: https://autonaut.de/imprint
The person responsible is also referred to below as „Autonaut“, „we“ or „us“.
Contact details of the data protection officer: E-mail: mail@autonaut.de
Description of our core services:
Autonaut operates an intermediary portal for car trips.
Types of data to be processed:
Inventory data (e.g. name, address).
Contact data (e.g. e-mail address, telephone number)
Contract data (e.g. usage and billing data, forwarding of billing data, details of completed journeys, etc.)
Usage data (e.g. websites visited, interest in content, access times)
Meta/communication data (e.g., device information, IP addresses).
Categories of recipients:
Processors
Processing of special categories of data (Art. 9(1) DS-GVO):
No special categories of data pursuant to Art. 9 DS-GVO are processed.
Categories of data subjects whose data are processed:
Interested parties
Users of the offers of Autonaut
Visitors and users of the online offer
In the following, we also refer to the data subjects collectively as „users“.
Purpose of processing:
Arranging rides via the platform of Autonaut.
Provision of the online offer, its contents and functions
Provision of contractual services, service and customer care
Answering contact requests and communication with users
Marketing, advertising and market research
Security measures 
Automated decision in individual cases (Art. 22 DS-GVO):
We do not make automated decisions in individual cases. Section II:
Data subjects‘ rights, legal bases and general information
Rights of the data subjects
Your data protection rights are regulated in Chapter III (Art. 12 et seq.) of the GDPR. According to these provisions, you have a right to information about the personal data stored about you, about the purposes of processing, about any transfers to other bodies and about the duration of storage.
To exercise your right to information, you may also receive extracts or copies. If data is inaccurate or no longer necessary for the purposes for which it was collected, you may request that it be corrected, erased or restricted from processing. Where provided for in the processing procedures, you may also inspect your data yourself and correct it if necessary.
If reasons against the processing of your personal data arise from your particular personal situation, you may object to processing insofar as the processing is based on a legitimate interest. In such a case, we will only process your data if there are special compelling interests for this.
If you have any questions about your rights and how to exercise them, please feel free to contact us via
E-mail: info@autonaut.de
You also have the right, pursuant to Art. 77 DS-GVO, to lodge a complaint with the competent supervisory authority.

Bavarian State Office for Data Protection Supervision
Promenade 18
91522 Ansbach
Phone: +49 (0) 981 180093-0
Fax: +49 (0) 981 180093-800
E-mail: poststelle@lda.bayern.de
to be submitted.
Right of revocation
You have the right to revoke any consent you have given at any time with effect for the future in accordance with Art. 7 (3) DS-GVO.
Right of objection
You may object to the future processing of data relating to you in accordance with Art. 21 DS-GVO at any time. The objection can be made in particular against processing for direct marketing purposes.
Cookies and right of objection in direct marketing
We use temporary and permanent cookies, i.e. small files that are stored on users‘ devices (for an explanation of the term and its function, see the „Definitions of terms“ section of this Privacy Policy). In part, the cookies serve the purpose of security or are necessary for the operation of our online offer (e.g., for the display of the website) or to store the user decision, for example, in the case of consent. In addition, we or our technology partners use cookies for range measurement and marketing purposes, as described in the following.

If you do not want cookies to be stored on your computer, you will be asked to deactivate the corresponding option in the system settings of your browser. Stored cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional restrictions.
The storage of cookies can be achieved by means of their deactivation in the settings of the browser. Please note that not all functions of this online offer can then be used.
Exclusively automated data processing
We do not carry out any exclusively automated data processing.
Deletion of data and archiving obligations
The data processed by us will be deleted or restricted in its processing in accordance with Articles 17 and 18 DS-GVO. Unless expressly stated within the scope of this data protection declaration, the data stored by us will be deleted as soon as they are no longer required for their intended purpose and the deletion does not conflict with any statutory retention obligations. If the data is not deleted because it is required for other permissible purposes, its processing will be restricted. This applies, for example, to data that must be retained for reasons of commercial or tax law.

In accordance with legal requirements, records are retained for six years pursuant to Section 257 (1) HGB (commercial books, inventories, opening balances, annual financial statements, commercial letters, accounting vouchers, etc.) and for ten years pursuant to Section 147 (1) AO (books, records, management reports, accounting vouchers, commercial and business letters, documents relevant for taxation, etc.).
Changes and updates to the privacy policy
We reserve the right to adapt this data protection declaration. Should changes require an act of cooperation on your part (e.g. consent) or other individual notification, we will inform you additionally.
Relevant legal basis
In accordance with Art. 13 DS-GVO, we inform you about the legal basis for our data processing. Unless the legal basis is explicitly stated for a particular processing, the following applies: The legal basis for processing based on consent is Art. 6(1)(a) and Art. 7 DS-GVO, the legal basis for processing for the performance of our services and implementation of contractual measures as well as answering inquiries is Art. 6(1)(b) DS-GVO, the legal basis for processing for the performance of our legal obligations is Art. 6(1)(c) DS-GVO and the legal basis for processing for the protection of our legitimate interests is Art. 6(1)(f) DS-GVO.

Security of data processing
We take appropriate technical and organizational measures in accordance with Art. 32 DS-GVO, taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk; the measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical access to the data, as well as access concerning them, input, disclosure, ensuring availability and their separation. Furthermore, we have established procedures to ensure the exercise of data subjects‘ rights, deletion of data, and response to data compromise. Furthermore, we already take the protection of personal data into account during the development or selection of hardware, software and procedures, in accordance with the principle of data protection through technology design and through data protection-friendly default settings (Art. 25 DS-GVO).
The security measures include in particular the encrypted transmission of data between your browser and our server.
Employees are bound to secrecy with regard to data protection, instructed and briefed, as well as made aware of possible liability consequences.

Disclosure and transmission of data
If, in the course of our processing, we disclose data to other persons or companies (processors or third parties), transmit it to them or otherwise grant them access to the data, this is always done on the basis of a legal permission (e.g. if a transmission of the data to third parties, such as to payment service providers, is required for the performance of the contract pursuant to Art. 6 (1) lit b DS-GVO), you have consented, a legal obligation provides for this or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).
If we commission third parties to process data on the basis of a so-called „order processing agreement“, this is done on the basis of Art. 28 DS-GVO.
Transfers to third countries
A transfer of data to third countries only takes place if there is sufficient security for the data within the meaning of Art. 44 et seq. DS-GVO exists.
Section III:
Processing Procedures
The following presentation provides you with an overview of the processing activities we undertake, which we have subdivided into further areas of activity. Please note that the areas of activity are for guidance only and that processing activities may overlap (e.g., the same data may be processed in multiple processes).

Core area of data processing
In this section you will find information about our core services and tasks, in particular the provision of our contractual services and the ancillary tasks associated with them.
Autonaut mediation services
We process the data provided by users as part of the Autonaut mediation services for the purposes of offering, establishing, implementing and, if necessary, terminating contracts.
We log your entries in order to record the contractual relationship and any required consents in accordance with the legal accountability (Article 5 (2) DS-GVO).

Processed data: Inventory data, communication data, contract data, content data, usage/metadata, as well as the time of actuation and the IP address stored.
Data subjects: interested parties, online users or website visits.
Purpose of processing: provision of contractual services, customer service, logging
Basis for processing: Art. 6 para. 1 lit. b (contract for arranging rides) and c (legal logging/archiving) DS-GVO.
Necessity/interest in processing: The data are necessary for the justification and fulfillment of the contractual services as well as fulfillment of legal obligations to provide evidence
Disclosure external and purpose: [INSURANCE].
Processing in third countries: No
Deletion of the data: The data will be retained in accordance with legal requirements and contractual agreements (Art. 18 DS-GVO). Initially, the data will only be kept for as long as it is required for the fulfillment of the contractual purposes. In particular, the data is required to process customary and regularly occurring service requests or information on the status of the contract within the scope of business activities, for the purposes of which the data is stored in the active system for up to six months. In addition, the data is stored within the regular statutory period of limitation (§§ 195, 199 BGB) for a period of three years from the end of the contractual relationship, insofar as this data could become necessary on the basis of previous business experience and business processes customary in the industry, in order to process any warranty and damage claims or comparable complaints as well as queries and to be able to provide the necessary evidence, in particular also with regard to the permissibility of the processing of the data under data protection law. In this case, the processing of the data will be restricted solely to the aforementioned purposes in accordance with Art. 18 DS-GVO.

In addition, the data is stored in accordance with the statutory archiving requirements pursuant to Art. 6 Para. 1 lit. c. DS-GVO, i.e. for 10 years according to §§ 147 para. 1 AO, 257 para. 1 no. 1 and 4, para. 4 HGB (books, records, management reports, accounting vouchers, commercial books, documents relevant for taxation, etc.) and 6 years according to § 257 para. 1 no. 2 and 3, para. 4 HGB (commercial letters). Even in the case of legally required archiving, processing is limited to this purpose alone. The necessity of storing the data is implemented in ongoing processes and is reviewed regularly.
Registration area (customer area)
Prior registration is required for arranging rides, currently exclusively via the mobile app.

Processed data: Inventory data, communication data, contract data, content data, usage data, metadata.
Data subjects: prospective customers, existing customers.
Purpose of processing: provision of contractual services, customer service, use of contractual services.
Basis for processing: Art. 6 para. 1 lit a, Art. 6 para. 1 lit b. DS-GVO
Necessity/interest in processing: The data is required for the justification and fulfillment of the contractual services
- Disclosure external and purpose: [insurance].
Processing in third countries: No
Deletion of data: We keep the data until the user objects to the use of his data; in the case of legal archiving obligations, deletion takes place after their expiration
Replying to requests
We process the information in the inquiries we receive via our contact form and in other ways, e.g. via e-mail, in order to respond to the inquiries. For these purposes, the inquiries may be stored in our customer relationship management system (CRM system) or in similar procedures that serve us to manage inquiries.
Processed data: Inventory data, communication data, contract data, content data, usage data, metadata.
Data subjects: interested parties, online users, website visitors, business partners
Purpose of processing: answering inquiries
Basis for processing: Art. 6 para. 1 lit. b. DS-GVO
Necessity/interest in processing: Necessary to respond to inquiries.
Disclosure external and purpose: No
- Processing in third countries: No
Deletion of data: The retention of data of the interested parties corresponds to the information on the deletion of data within the framework of the above-mentioned processing activity „Comparison and mediation services“; otherwise, we delete the inquiries if their retention is no longer necessary, which is usually the case 6 months after the last contact; in the case of legal archiving obligations, the deletion takes place after their expiration
Business analyses and market research
In order to run our business economically and to be able to recognize market trends, interested parties and user wishes, we analyze the data we have on business transactions, contracts, inquiries, etc..
For this purpose, we merge the personal data of prospective customers from registrations and comparison inquiries with the usage data of customers.
Processed data: Inventory data, communication data, contract data, content data, usage data, metadata.
Basis for processing: Art. 6 para. 1 lit. f DS-GVO
Data subjects: Interested parties, users, business partners, visitors to the online offer.
Purpose of processing: business analysis, marketing, advertising, market research.
- Type, scope, mode of operation of the processing: profiling, first-party cookies.
Necessity/interest in processing: increase user-friendliness, optimization of the offer, business economics
External disclosure and purpose: The analyses are performed by Autonaut and are not disclosed externally, unless they are anonymous analyses with aggregated values
Processing in third countries: No
Deletion of data: The retention of data of the interested parties is in accordance with the information on the deletion of data in the context of the above-mentioned processing activity „comparison and mediation services“; otherwise, the business analyses and general tendency determinations are made anonymously

External online presence
In this section you will find information on our data processing in the context of operating external online presences, e.g. in social media.
Online presences in social media
We maintain online presences within social networks and platforms in order to be able to communicate with customers, interested parties and users active there and to inform them about our services there. When calling up the respective networks and platforms, the terms and conditions and data processing policies of the respective operators apply. Unless otherwise stated in our privacy policy, we process the data of users if they communicate with us within the social networks and platforms, e.g. write posts on our online presences or send us messages.
The links/buttons to social networks and platforms (hereinafter referred to as „social media“) used within our online offer generally only establish contact between social networks and users when users click on the links/buttons and the respective networks or their websites are called up. This function corresponds to the mode of operation of a regular online link. We would like to point out that user data may be processed outside the European Union. This may result in risks for users, for example because it may make it more difficult to enforce users‘ rights. With regard to U.S. providers that are certified under the Privacy Shield, we point out that they thereby undertake to comply with the data protection standards of the EU.
Furthermore, user data is usually processed for market research and advertising purposes. For example, usage profiles can be created from the usage behavior and resulting interests of the users. The usage profiles can in turn be used, for example, to place advertisements within and outside the platforms that presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the users‘ computers, in which the usage behavior and interests of the users are stored. Furthermore, data independent of the devices used by the users may also be stored in the usage profiles (especially if the users are members of the respective platforms and are logged in to them).
The processing of the users‘ personal data is based on our legitimate interests in effectively informing users and communicating with users pursuant to Art. 6 (1) lit. f DS-GVO. If the users are asked by the respective providers for consent to data processing (i.e. declare their consent, e.g. by ticking a checkbox or confirming a button), the legal basis of the processing is Art. 6 (1) lit. a, Art. 7 DS-GVO.
For a detailed description of the respective processing and the opt-out options, please refer to the information of the providers linked below. point out that these can be asserted most effectively with the providers. Only the providers have access to the users‘ data and can take appropriate measures and provide information directly. If you still need help, you can contact us.
Social networks/platforms used by us:

Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) – Privacy Policy: https://www.facebook.com/about/privacy/, Opt-Out: https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com.
Google/ YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) – Privacy Policy: https://policies.google.com/privacy, Opt-Out: https://adssettings.google.com/authenticated.
Instagram (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) – Privacy Policy/ Opt-Out: http://instagram.com/about/legal/privacy/
Twitter (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Ireland) – Privacy Policy: https://twitter.com/de/privacy, Opt-Out: https://twitter.com/personalization.
Pinterest (Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland) – Privacy Policy/ Opt-Out: https://about.pinterest.com/de/privacy-policy
- LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland) – Privacy Policy https://www.linkedin.com/legal/privacy-policy , Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.
Xing (XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany) – privacy policy/opt-out: https://privacy.xing.com/de/datenschutzerklaerung.
Necessity/interest in processing: expectations of users who are active on the platforms, economic interests.
Processed data: Inventory data, communication data, content data, usage data, metadata.
Special categories of personal data: Basically no, unless specified by users.
Basis for processing: Art. 6 para. 1 lit. f DS-GVO.
Data subjects: Users of the social media presences.
Purpose of processing: information and communication.
Type, scope, mode of processing: under the own responsibility of the operators of the respective platforms usually: permanent cookies, tracking, targeting, remarketing, content and behavioral advertising.
Necessity/interest in processing: expectations of users who are active on the platforms, business interests.
- Disclosure external and purpose: To social networks/platforms.
Processing in third countries: No
Deletion of data: The deletion rules of the respective platforms apply.
Web server and security
Hosting
The hosting services we use serve to provide the following services: Infrastructure and platform services, computing capacity, storage space and database services, security services, technical maintenance services.
Processed data: Inventory data, contact data, content data, contract data, usage data, meta/communication data.
Special categories of personal data: no.
Basis for processing: Art. 6 para. 1 lit. f DS-GVO; Art. 28 DS-GVO.
Data subjects: customers, interested parties, visitors to the online offer.
Special protective measures: Order processing contract
Processing in third countries: no
Disclosure external and purpose: yes (web host); name, address, web hosting.
Necessity/interest in processing: security, business interests, provision of contractual services
Deletion of data: The retention of data of the interested parties complies with the general time limits for the deletion of data in the context of the above-mentioned processing activity.
 Server logs
The server on which this online offer is located collects so-called log files each time the online offer is accessed, in which user data is stored. The data is used for statistical analysis to maintain and optimize server operation as well as for security purposes, e.g. to detect potential unauthorized access attempts.
Processed data: Usage data and metadata (name of the website accessed, file, date and time of access, amount of data transferred, notification of successful access, browser type along with version, the user’s operating system, referrer URL (the previously visited page), IP address and the requesting provider).
Special categories of personal data: no
Basis for processing: Art. 6 para. 1 lit. f DS-GVO.
Data subjects: interested parties, users, visitors to the online offer.
Purpose of processing: optimization server operation and security monitoring.
Necessity/interest in processing: security, business interests.
Processing in third countries: no
Deletion of data: seven days  Embedded content and functions
In this section we inform you which content, software or functions (in short „content“) of other providers we embed within our online offer on the basis of Art. 6 para. 1 lit. f DS-GVO (so-called „embedding“). Embedding is done to make our online offer more interesting for our users or for legal reasons, e.g. to be able to present videos or social media posts within our online offer at all. The embedding may also serve to improve the speed or security of the online offer, for example, when software elements or fonts are obtained from other sources. In all cases, the processed data includes the usage data and the metadata of the users and also the IP address necessarily transmitted to the provider for embedding the content, and the data subjects include the visitors to our online offering. The categories of data subjects include the users of our online offer, customers and interested parties. Further explanations can be found in the definitions of terms, in particular the modes of operation and protective measures, are at the end of this privacy policy. The deletion of data is determined by the data protection conditions of the providers of the embedded content. 
Services and content from Google
We use the following services and content of the provider Google: YouTube – videos; Google Maps – maps; Google Fonts – fonts; Google – Recaptcha (recognition of bots in form entries).
Processed data: Usage data, metadata.
Type, scope, mode of processing: permanent cookies, third-party cookies, interest-based marketing, tracking.
Special safeguards: Pseudonymization, opt-out.
Opt-out: http://tools.google.com/dlpage/gaoptout?hl=de, https://adssettings.google.com/authenticated.
Disclosure external: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Privacy policy: https://www.google.com/policies/privacy/.
Processing in third countries: No.
Deletion of data: in accordance with Google’s provisions. 
Functions and contents of Facebook
Within our online offer, functions and content of the service Facebook may be integrated. This may include, for example, content such as images, videos or texts and buttons with which users can communicate their likes, subscribe to the content authors or posts.
Processed data: Usage data, metadata; if users are registered with the service, the above data may be linked to their profiles and to such data stored by the service (in particular inventory data).
Type, scope, mode of processing: social plugins, permanent cookies, third-party cookies, interest-based marketing, tracking, remarketing.
Opt-out: https://www.facebook.com/settings?tab=ads, http://www.youronlinechoices.com/uk/your-ad-choices/ (EU), http://www.aboutads.info/choices (US).
Disclosure external: Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Privacy policy: https://www.facebook.com/policy.php.
Processing in third countries: No.
Deletion of data: The data will be deleted in accordance with Facebook’s regulations.  Functions and contents of Instagram
Within our online offer, functions and content of the service Instagram may be integrated. This may include, for example, content such as images, videos or texts and buttons with which users can announce their like regarding the content, subscribe to the authors of the content or our posts.
Processed data: Usage data, metadata; if users are registered with the service, the above data may be linked to their profiles and to such data stored by the service (in particular inventory data).
Nature, scope, functioning of processing: social plugins, permanent cookies, third-party cookies, interest-based marketing, tracking, remarketing.
Disclosure external: Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland.
Privacy policy: http://instagram.com/about/legal/privacy/.
Processing in third countries: No.
Data deletion: The data will be deleted in accordance with Instagram’s terms.  Functions and contents of Pinterest
Within our online offer, functions and content of the service Pinterest may be integrated. This may include, for example, content such as images, videos or texts and buttons with which users can announce their liking regarding the content, the authors of the content or subscribe to our posts.
Processed Data: Processed Data: Usage data, metadata; if users are registered with the service, the above data may be linked to their profiles and to such data stored by the service (in particular inventory data).
Type, scope, mode of processing: social plugins, permanent cookies, third-party cookies, interest-based marketing, tracking, remarketing.
Disclosure external: Pinterest Europe Ltd, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.
Privacy policy: https://about.pinterest.com/de/privacy-policy.
Processing in third countries: No.
Deletion of data: Data will be deleted in accordance with Pinterest’s policy.

Functions and contents of Twitter
Within our online offer, functions and content of the service Twitter can be integrated. This may include, for example, content such as images, videos or texts and buttons with which users can announce their liking of content, subscribe to the authors of the content or our posts.

Processed data: Usage data, metadata; if users are registered with the service, the above data may be linked to their profiles and to such data stored by the service (in particular inventory data).
Type, scope, mode of processing: social plugins, permanent cookies, third-party cookies, interest-based marketing, tracking, remarketing
Opt-out: https://twitter.com/personalization
External disclosure: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Ireland
Privacy Policy:https://twitter.com/de/privacy
Processing in third countries: No
Data deletion: Data will be deleted in accordance with Twitter’s policy.

Functions and contents of Xing
Within our online offer, functions and contents of the service Xing can be integrated. This may include, for example, content such as images, videos or texts and buttons with which users can announce their liking of content, subscribe to the authors of the content or our posts.

Processed data: Usage data, metadata; if users are registered with the service, the above data may be linked to their profiles and to such data stored by the service (in particular inventory data).
Type, scope, mode of processing: social plugins, permanent cookies, third-party cookies, interest-based marketing, tracking, remarketing
Disclosure external: XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany
Privacy policy:https://www.xing.com/app/share?op=data_protection
Processing in third countries: no
Deletion of data: Data will be deleted in accordance with the provisions of Xing.

Functions and contents of LinkedIn
Within our online offer, functions and content of the service LinkedIn can be integrated. This may include, for example, content such as images, videos or texts and buttons with which users can announce their liking of content, subscribe to the authors of the content or our posts.

Processed data: Usage data, metadata; if users are registered with the service, the above data may be linked to their profiles and to such data stored by the service (in particular inventory data).
Type, scope, mode of processing: social plugins, permanent cookies, third-party cookies, interest-based marketing, tracking, remarketing
Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
External disclosure: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland
Privacy policy: https://www.linkedin.com/legal/privacy-policy
Third Party Processing: No
Data deletion: The data will be deleted in accordance with Instagram LinkedIn’s policy.

Marketing
In this section you will find information on the data processing carried out by us for the purposes of optimizing our services of marketing and market research.
Sending information through personalized newsletters
We send newsletters, e-mails and other electronic notifications with promotional information (hereinafter referred to as „newsletter“), provided that we have your consent or legal permission. The subscribers‘ data is logged, as we are obliged to provide evidence of consent. Unless the contents of the Newsletter are expressly described in the registration process, the Newsletters contain information concerning our company and our services and offers, in particular for service areas which the recipient has declared to be of interest to him. Notifications sent within the scope of contractual or business relationships, on the other hand, do not constitute advertising information. This includes, for example, the sending of service e-mails, technical or organizational notices within the scope of our service provision, notices regarding technical and legal changes, queries regarding orders, etc. If we have received your consent to personalized information, we will evaluate your user behavior on our website and within the newsletters we send and assign it to your user profile maintained by us.

We also store information about devices used, opening, clicking and reading behavior in e-mails, as well as subject areas that have been visited within the website. For technical reasons, this information is stored on a per-user basis, but is not used to monitor individual users, but rather to adapt content and offers to the users, for example. Information that we collect in addition to the e-mail address (e.g. name) is used to address the user personally or to adapt the content of the newsletter to the user.

Newsletter content: as specified in the registration form, otherwise information about our services and our company.
Processed data: Inventory data (e-mail address), usage data (registration time, confirmation time double opt-in, IP address, opening of the e-mail, time and place, time and click on a link in the newsletter).
Special categories of personal data: no
Basis for processing: Art. 6 para. 1 lit. a, Art. 7 DS-GVO and § 7 para. 2 no. 3, para. 3 UWG (dispatch & performance measurement), Art. 6 para. 1 lit. c in conjunction with. Art. 7 para. 1 DS-GVO (logging, performance measurement, unless covered by consent).
Data subjects: newsletter recipients, email recipients.
Purpose of processing: newsletter dispatch, optimization, proof of consent.
Type, scope, mode of operation of the processing: Web beacon
Necessity/interest in processing: Only the e-mail information is required for sending, the other information is voluntary and serves to personalize and optimize the content based on the interests of the users; the obligation to provide proof of consent is the reason for logging; performance measurement is based on consent for users whose consent includes performance measurement and otherwise based on legitimate interests in optimizing the content for the users and on business interests.
Opt-out: cancellation link is in every newsletter
For the dispatch of our newsletter we use rapidmail.de
With your registration you agree that the entered data will be transmitted to rapidmail. Please note their terms and conditions and privacy policy.
Processed data: Inventory data (email address), usage data (registration time, confirmation time double opt-in, IP address, opening of the email, time and place, time and click on a link in the newsletter).
Special categories of personal data: no
Basis for processing: Art. 6 para. 1 lit. a, Art. 7 DS-GVO and § 7 para. 2 no. 3, para. 3 UWG (dispatch & performance measurement), Art. 6 para. 1 lit. c in conjunction with. Art. 7 para. 1 DS-GVO (logging, performance measurement, unless covered by consent).
Purpose of processing: Newsletter dispatch, optimization, proof of consent
Affected parties: newsletter recipients, email recipients.
Special safeguards: Pseudonymization, IP masking, conclusion of order processing contract, opt-out.
Opt-out: unsubscribe link is in every newsletter
Communication via mail, e-mail, fax or telephone
Dispatch of information material, telephone contact for contract processing
Processed data: Inventory data, contact data, contract data, content data
Special categories of personal data: no
Basis for processing: Art. 6 para. 1 lit. a, Art. 7 DS-GVO in case of consent, Art. 6 para. 1 lit. b DS-GVO in case of contact in the context of contract processing, Art. 6 para. 1 lit. f DS-GVO in connection with legal requirements for promotional communications.
Data subjects: prospective customers, business partners.
Purpose of processing: Promotional communications.
Type, scope, functioning of processing: Contact is only made with the consent of the contact partners or within the scope of legal permissions.
Necessity/interest in processing: Information and business interests.
Disclosure external and purpose: No
Processing in third countries: No
Deletion of data: With objection/ revocation or discontinuation of the authorization basis for contacting; the retention of data of interested parties corresponds to the information on the deletion of data in the context of the above-mentioned processing activity.
Reach measurement, online marketing and technology partners
In this section, we inform you which services of technology partners we use for reach measurement and online marketing purposes. Their use is based on Art. 6 para. 1 lit. f DS-GVO. Our interest lies in the increase of user-friendliness, optimization of our offer and its profitability. In all cases, the data to be processed includes usage data and metadata. Further explanations can be found in the definitions of terms, in particular the modes of operation and protective measures at the end of this privacy policy. Unless otherwise stated, the deletion of data is determined in accordance with the data protection declarations of the respective providers.

Google Analytics
We use Google Analytics for reach measurement and targeting purposes.

Processed data: Usage data, metadata, customer ID with us (Google receives the customer ID only as a pseudonymous date without the associated inventory data, such as name, address or email of the customer).
Type, scope, mode of processing: permanent cookies, third-party cookies, tracking, interest-based marketing, profiling, custom audiences, remarketing.
Special safeguards: Pseudonymization, IP masking, conclusion of order processing agreement, opt-out.
Opt-out: http://tools.google.com/dlpage/gaoptout?hl=de (browser add-on Google Analytics), https://adssettings.google.com/, https://adssettings.google.com/authenticated (setting for advertisements)
External disclosure: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy policy: https://www.google.com/policies/privacy/
Processing in third countries: No
Deletion of data: 14 months

Google AdWords
We use Google AdWords to measure the success of the advertisements we place on Google.

Data processed: Usage data, metadata, customer ID with us (Google receives the customer ID only as a pseudonymous date without the associated inventory data, such as name, address or email of the customer).
Type, scope, mode of processing: permanent cookies, third-party cookies, tracking, conversion measurement, interest-based marketing, profiling
Special safeguards: Pseudonymization, IP masking, conclusion of order processing agreement, opt-out.
Opt-out: http://tools.google.com/dlpage/gaoptout?hl=de (browser add-on Google Analytics), https://adssettings.google.com/, https://adssettings.google.com/authenticated (setting for advertisements)
External disclosure: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy policy: https://www.google.com/policies/privacy/
Processing in third countries: No
Deletion of data: 14 months

Google Double Click
We use Google Double Click to measure the success of the ads we place on Google.

Data processed: Usage data, metadata, customer ID with us (Google receives the customer ID only as a pseudonymous date without the associated inventory data, such as name, address or email of the customer).
Type, scope, mode of processing: permanent cookies, third-party cookies, tracking, conversion measurement, interest-based marketing, profiling
Special safeguards: Pseudonymization, IP masking, conclusion of order processing agreement, opt-out.
Opt-out: http://tools.google.com/dlpage/gaoptout?hl=de (browser add-on Google Analytics), https://adssettings.google.com/, https://adssettings.google.com/authenticated (setting for advertisements)
External disclosure: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy policy: https://www.google.com/policies/privacy/
Processing in third countries: No
Deletion of data: 14 months

Google Maps API
We use the map service of the Google Maps platform on this site.

Processed data: Usage data, metadata, IP address.
Type, scope, mode of processing: permanent cookies, third-party cookies.
Opt-out: If you do not want Google Maps to collect, process or use data about you via our website, you can deactivate JavaScript in your browser settings. In this case, however, you will not be able to use the map display.
External disclosure: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Privacy policy: https://maps.google.com/help/terms_maps.html
Processing in third countries: No
Deletion of data: Data will be deleted in accordance with Google’s policy

Use of Location Data

Autonaut uses your location in the background to determine that you have arrived at the agreed meeting point for a shared ride, to ensure that you have arrived at the intended destination and to prompt you to rate the person you rode with.

Your location data is never transferred electronically, not shared with third parties and neither stored in a database nor on your device. Location data is solely used for the purpose of determining if you have entered a geofence relevant for the functionality described in the previous paragraph.

Section IV:
Additional Information
This privacy policy applies to the provision of our services by Autonaut. Insofar as we refer to Internet pages of third parties by means of links, our data protection declaration does not apply to these. Please inform yourself on the respective pages about the data protection provisions applicable there.

Due to the further development of our website and offers as well as due to changed legal or regulatory requirements, it may become necessary to change this privacy policy. You can access and print out the currently valid data protection declaration at any time on the app or on our website at https://autonaut.de.
Further information about our company can be found in our imprint: https://autonaut.de/imprint.
If you have any questions, suggestions and/or additions, please do not hesitate to contact us at any time, e.g. by e-mail to mail@autonaut.de.

This is an English translation and only the German version is legally binding.