Privacy
1. Responsible party
Iller Mobility GmbH
Schwarzenbergweg 16
89257 Illertissen, Germany
E-Mail: [email protected]
2. Hosting (Cloudflare)
This website is hosted on Cloudflare Pages (Cloudflare, Inc., USA). When you visit the site, Cloudflare processes technically necessary data (IP address, time of access, requested page, browser information) to deliver the website and protect it against attacks. The legal basis is our legitimate interest in secure and performant operation (Art. 6(1)(f) GDPR). Transfers to the USA are based on the EU-US Data Privacy Framework and standard contractual clauses.
3. Address search and route calculation (OpenStreetMap services)
The address search in the booking form uses the Photon geocoding service (komoot GmbH, Germany); route and price calculation uses OSRM routing services based on OpenStreetMap (FOSSGIS e.V., Germany). The map on the booking page uses map tiles from the OpenStreetMap Foundation (United Kingdom). In each case your requests are relayed through our own server (Cloudflare) — your IP address is not transmitted to these services, only the entered locations or coordinates. The legal basis is the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR) and our legitimate interest in providing a working price quote (Art. 6(1)(f) GDPR).
4. Booking and contact via WhatsApp
Booking requests and contact messages can be sent via WhatsApp (Meta Platforms Ireland Ltd.). When you click a WhatsApp button, WhatsApp opens with a pre-filled message containing your booking details (route, date, name, phone number, email, flight number and other details where provided). The data is only transmitted when you send the message in WhatsApp yourself. WhatsApp/Meta's privacy policy applies to their processing. The legal basis is the performance of pre-contractual measures (Art. 6(1)(b) GDPR). Alternatively, you can always reach us by email or phone.
5. Contact by email and phone
If you contact us by email or phone, we process your details to handle the request and possible follow-up questions (Art. 6(1)(b) GDPR). We retain booking-related data within statutory retention periods; beyond that, we delete it as soon as it is no longer required for contract processing.
6. Waitlist
While the site is in its pre-launch phase, you can join a waitlist with your email address. Sign-up uses a double opt-in process: you receive a confirmation email and are only added to the list after confirming. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. Unconfirmed entries are deleted after a short period.
7. Customer account and bookings
To use the customer account and make bookings, we process the data you provide (including name, email address, phone number, password in encrypted form, billing address, booking and trip data). This data is stored in a database operated by our host Cloudflare. For login we set a technically necessary session cookie (see "Cookies"). The legal basis is contract performance or pre-contractual measures (Art. 6(1)(b) GDPR) and compliance with statutory retention obligations (Art. 6(1)(c) GDPR).
8. Payment processing (Stripe)
Card payments are processed via Stripe Payments Europe, Ltd. (Ireland). During a payment, the necessary data (including amount, booking reference, payment method) is transmitted directly to and processed by Stripe; you enter full payment details (e.g. card number) exclusively with Stripe and we do not store them. Stripe acts as an independent controller in this respect. The legal basis is contract performance (Art. 6(1)(b) GDPR).
9. Email dispatch
To send confirmations, invoices and notifications we use our own mail server together with the mail dispatch of our provider (ALL-INKL.COM – Neue Medien Münnich, Germany). This processes your email address and the data required for the respective message. The legal basis is contract performance (Art. 6(1)(b) GDPR).
10. Internal dispatching (Telegram)
To assign trips, we forward incoming bookings to our drivers/dispatch. For this we use the messaging service Telegram (Telegram Messenger Inc.). Booking-related data (including name, phone number, route, date) is transmitted to the internal dispatch chat. Telegram may process data outside the EU on the basis of appropriate safeguards or your consent. The legal basis is our legitimate interest in efficient order handling (Art. 6(1)(f) GDPR) and contract performance (Art. 6(1)(b) GDPR).
11. Google reviews
On our homepage we display selected reviews from our business profile through the Google Places API (Google Ireland Limited, Ireland). Review text, rating, reviewer name and profile image are loaded from Google; your IP address may therefore be transmitted to Google. The selection is clearly identified as a five-star filter and every review links to its source on Google Maps. The legal basis is our legitimate interest in transparently presenting authentic customer feedback (Art. 6(1)(f) GDPR). The Google Privacy Policy also applies.
12. Web analytics with Contentsquare
Only with your voluntary consent, we use Contentsquare (Contentsquare SAS, France) on public pages to understand in aggregate how visitors navigate the website and which areas we can improve. The Contentsquare script is embedded in opt-out mode; analytics and recording remain disabled without consent. Contentsquare is not loaded in customer accounts or driver and admin workspaces. After consent, the tool uses first-party cookies including _cs_id (up to 13 months) and _cs_s (30 minutes). The legal basis is your consent under Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG. You can change your choice at any time using “Cookie settings” at the bottom of the page and withdraw consent with future effect. More information is available in the Contentsquare Privacy Center.
With the same consent, we use Google Analytics 4 (Google Ireland Limited, Ireland; parent company Google LLC, USA) to evaluate page views and use of our public website. Google Analytics uses basic consent mode: storage consent is denied by default and the Google tag is only loaded after you agree. Advertising storage and personalised advertising remain disabled. After consent, the first-party cookies _ga and _ga_<ID> may be set with a default lifetime of up to two years. Google may also process data in the USA, supported in particular by standard contractual clauses and participation in the EU-US Data Privacy Framework. More information is available in the Google Privacy Policy.
13. Cookies and local storage
The technically necessary cookies are a session cookie for logging into the customer account and — during the pre-launch phase — a cookie to unlock the website. They are not evaluated for analytics. We store your analytics choice locally in your browser so that we do not ask again on every visit. Analytics cookies are only set after your consent. Fonts are served locally from our own server.
14. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interests (Art. 21 GDPR). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the Bavarian State Office for Data Protection Supervision (BayLDA), Ansbach.