Datenschutzerklärung

Diese Datenschutzerklärung ist nur in der deutschen Originalfassung rechtsverbindlich.

Openness and transparency are important to us. That is why, with this privacy policy, we would like to inform you about the processing of your personal data (hereinafter „Your Data“) by Muvn Mobility GmbH (hereinafter also „we“ or „Company“) in connection with the visit and use of this website as well as the use of our services, and about the rights to which you are entitled under data protection law pursuant to Articles 15 to 22 of the EU General Data Protection Regulation („DSGVO“).

Information on the processing of your data in connection with the use of our MUVN App can be found in Section 13.

1. Controller

The controller for the processing of your data explained below is Muvn Mobility GmbH, Baakenallee 74, 20457 Hamburg.

2. Visiting our website

In this section, we provide information about the processing of personal data in connection with your visit to our website and its use.

2.1 Which data do we process and for which purposes?

When you visit our website, your browser will contact our web server in order to find the page you wish to visit. In this context, personal data such as your IP address is transmitted to us by your browser
(i.e. HTTP/S requests). The connection data is processed by our web server in order to enable access to our website and its display to you.

Our web server automatically stores a log of the pages you visit (so-called „log files“ or „session logs“). We use these log files to ensure the security of our website, in particular to prevent unauthorized intrusions into our website and so that we can exercise our legal rights and obligations in relation to such unauthorized intrusions. This data consists of:

the page from which the page was requested (so-called referrer URL)
the name and URL of the requested page
the date and time of the access
the description of the type, language and version of the web browser used
the IP address of the requesting computer, which is shortened in such a way that a personal reference can no longer be established
the amount of data transferred
the operating system
the message indicating whether the access was successful (access status/HTTP status code)
the GMT time zone difference

In addition, we analyze session logs in order to optimize our website. The analysis as such is carried out in anonymous form, so that the results do not allow any conclusions to be drawn about your person.

2.2 On what legal basis do we process your data?

The legal basis for the processing of your data when browsing our website regularly depends on the purpose of your visit. Insofar as you wish to inform yourself about our offers on our website and, where applicable, contact us in order to place an order, the legal basis is Art. 6 Abs. 1 lit. b DSGVO (initiation of a contract).

For general information purposes otherwise, the legal basis is our legitimate interest in operating a website for general information and communication purposes as well as for presenting our company, and your legitimate interest in viewing it (Art. 6 Abs. 1 lit. f DSGVO).

The processing of the log files takes place on the basis of our legitimate interests pursuant to Art. 6 Abs. 1 lit. f DSGVO. Our legitimate interest consists in protecting our facilities and systems from attacks and, where applicable, taking legal action against attackers, as well as in further developing our websites for economic purposes.

Insofar as the processing of the data requires the storage of information on your terminal equipment or access to information that is already stored on the terminal equipment, § 25 Abs. 1, 2 of the Act on Data Protection and the Protection of Privacy in Telecommunications and Digital Services („TDDDG“) is the legal basis.

2.3 Is your data transferred to a third country or an international organization?

In connection with your visit to our website, we do not transfer your personal data to a third country or an international organization.

2.4 How long is your data stored?

The log files are stored for 14 days. All other data is deleted immediately after the HTTP/S request has been carried out.

2.5 Are you obliged to provide your data and what happens if you decide not to?

Without the processing of the aforementioned personal data, you can neither display nor visit our website.

3. Amazon CloudFront

3.1 Which data do we process and for which purposes?

We use Amazon CloudFront, a content delivery service of Amazon Web Services, Inc. (AWS), in order to provide the content of our website efficiently and quickly. In this context, the following data is collected and processed:

IP address of the user
date and time of access
URL of the file retrieved
operating system and device type
browser type and version
information on network requests (e.g. referrer URL)

This data is processed for the following purposes:

optimization of the loading times of our website
improvement of the stability and security of our website
analysis of user behavior to improve our services

3.2 On what legal basis do we process your data?

The processing of the above-mentioned data takes place on the basis of Art. 6 Abs. 1 lit. f DSGVO. Our legitimate interest consists in the efficient and secure provision of the website as well as the improvement of the user experience.

3.3 To whom is your data passed on or who is involved in the processing of your data?

The data is passed on to Amazon Web Services, Inc. (AWS), as CloudFront is a service of AWS. In this context, AWS acts as a processor pursuant to Art. 28 DSGVO. AWS processes the data exclusively in accordance with our instructions and has taken appropriate measures to ensure the protection of your data.

3.4 Is your data transferred to a third country or an international organization?

AWS stores and processes data worldwide, including in data centers outside the European Union (e.g. in the USA). Amazon is certified under the EU-US Data Privacy Framework, so that an adequate level of data protection pursuant to Art. 45 DSGVO is ensured.

3.5 How long is your data stored?

The data collected by CloudFront is stored for as long as is necessary to achieve the stated purposes. As a rule, the data is deleted after 30 days, unless statutory retention periods exist.

3.6 Are you obliged to provide your data and what happens if you decide not to?

There is no legal or contractual obligation to provide us with the above-mentioned data. However, if you block the transmission of your data by CloudFront (e.g. by using a suitable browser plug-in), this may impair the loading speed and the functionality of the website. In this case, the website may not be usable at all or only to a limited extent.

4. Google Analytics

4.1 Which data do we process and for which purposes?

We use Google Analytics, a web analytics service of Google LLC ("Google"), in order to analyze the use of our website and to improve it regularly. Google Analytics uses cookies that enable an analysis of your use of the website. The data collected in this context includes, among other things:

IP address
date and time of the request
page/URL accessed
length of time spent on the page
click behavior and scroll depth
origin of the user (i.e. from which website the user comes)
browser type and version
operating system and its interface
language and version of the browser software

The information generated by the cookie about your use of our website is generally transmitted to a Google server in the USA and stored there. Since we have activated IP anonymization on our website, however, your IP address is shortened beforehand by Google within member states of the European Union. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there (you can obtain further information on the purpose and scope of the data collection, for example, at https://policies.google.com/privacy?hl=de&gl=de).

The processing of this data takes place for the purpose of optimizing our website, for reach measurement and for market research.

4.2 On what legal basis do we process your data?

The processing of your data by Google Analytics takes place on the basis of Art. 6 Abs. 1 lit. a DSGVO, based on your consent. You can revoke your consent at any time with effect for the future by adjusting the relevant settings in your browser or by activating the Google Analytics opt-out cookie.

4.3 To whom is your data passed on or who is involved in the processing of your data?

The data collected by Google Analytics is transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and stored there. Google may pass this information on to third parties insofar as this is required by law or insofar as third parties process this data on behalf of Google. Within the scope of the processing described below, data is also regularly transmitted to Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Beyond this, your personal data is not passed on to third parties without your express consent. We have also concluded a data processing agreement with Google pursuant to Art. 28 DSGVO. Google will therefore use all information only in a strictly purpose-bound manner in order to evaluate the use of our websites for us and to compile reports on website activities.

4.4 Is your data transferred to a third country or an international organization?

Yes, the data collected by Google Analytics is generally transmitted to Google servers in the USA and processed there. Google is certified under the EU-US Data Privacy Framework, so that an adequate level of data protection pursuant to Art. 45 DSGVO is ensured.

4.5 How long is your data stored?

The data collected by Google Analytics is stored for a period of 14 months and then automatically deleted. Aggregated and anonymized data may also be stored beyond this without any time limit.

4.6 Are you obliged to provide your data and what happens if you decide not to?

There is no legal obligation to provide your data.

You can revoke any consent you have given at any time. Please use one of the following options for this:

You inform us that you wish to revoke your consent.
You can prevent the storage of cookies by adjusting the settings of your browser software accordingly; however, we point out that in this case you may not be able to use all functions of this website to their full extent.
Furthermore, you can prevent the collection of the data generated by the cookie and relating to your use of our websites (incl. your IP address) by Google as well as the processing of this data by Google by downloading and installing the browser plug-in available under the following link (https://tools.google.com/dlpage/gaoptout?hl=de).

When Google Analytics is deactivated, a cookie is set that prevents the collection of your data during future visits to this website.

5. Google Tag Manager

5.1 Which data do we process and for which purposes?

When integrating the Google Tag Manager, no personal data is collected directly by the Google Tag Manager itself. The Google Tag Manager is a tool that enables us to manage website tags centrally via a single interface. Tags are small code elements on our website that are used, for example, to measure visitor behavior or to integrate marketing services. However, the tags managed by the Google Tag Manager can collect personal data. The type of data collected depends on the tags that are integrated into the Google Tag Manager. This data may include, for example, IP addresses, cookie IDs or other online identifiers.

The purpose of the processing is the efficient management and implementation of website tags that serve to analyze user behavior and to optimize our website as well as to display targeted advertising.

5.2 On what legal basis do we process your data?

The processing of your data takes place on the basis of Art. 6 Abs. 1 lit. f DSGVO. Our legitimate interest consists in analyzing and optimizing our website and advertising in a targeted manner. Insofar as consent pursuant to Art. 6 Abs. 1 lit. a DSGVO is required, the processing takes place on this basis, in particular when it comes to the use of marketing or tracking tags that collect personal data.

5.3 To whom is your data passed on or who is involved in the processing of your data?

The tags deployed by the Google Tag Manager can pass data on to the respective providers of the integrated services. These are providers of web analytics and marketing tools such as Google Analytics. These providers may further process the collected data for their own purposes, insofar as this is provided for within the scope of their own privacy policies.

5.4 Is your data transferred to a third country or an international organization?

The tags deployed by the Google Tag Manager can transmit data to servers of third-party providers in the USA or other third countries. Google LLC, the provider of the Google Tag Manager, is certified under the EU-US Data Privacy Framework, which ensures an adequate level of data protection pursuant to Art. 45 DSGVO. You can find further information in Google’s privacy policy: https://policies.google.com/privacy?hl=de&gl=de

5.5 How long is your data stored?

The Google Tag Manager itself does not store any personal data. The data collected by the integrated tags is processed and stored in accordance with the respective privacy policies of the third-party providers. The storage period therefore depends on the specific services that are integrated via the Google Tag Manager.

5.6 Are you obliged to provide your data and what happens if you decide not to?

There is no legal or contractual obligation to provide your data. If you decide not to allow the processing of your data by certain tags, this may impair the functionality of our website, in particular with regard to the analysis of usage and the display of personalized advertising. However, you can control the use of cookies and similar technologies at any time via the settings of your browser.

6. reCAPTCHA

6.1 Which data do we process and for which purposes?

In order to ensure the security of our website and the integrity of online forms, we use Google reCAPTCHA, a tool for distinguishing between human and automated access. reCAPTCHA collects, among other things, IP addresses, browser information and usage data. This data is processed by Google in order to determine whether the access is from a real user and thus to prevent malicious activities such as spam and abuse.

6.2 On what legal basis do we process your data?

The integration of reCAPTCHA takes place on the basis of our legitimate interest (Art. 6 Abs. 1 lit. f DSGVO), since we have a legitimate interest in protecting our website from abusive automated use and in ensuring the secure use of our forms.

6.3 To whom is your data passed on or who is involved in the processing of your data?

The data collected by reCAPTCHA is transmitted directly to Google and processed by Google. Our employees and other bodies have no access to the raw data collected. In doing so, Google acts as an independent controller for the processing of this data in accordance with Google’s data protection provisions.

6.4 Is your data transferred to a third country or an international organization?

Since Google is a US-American company, the data may be transferred to the USA. Google is certified under the EU-US Data Privacy Framework, which ensures an adequate level of data protection pursuant to Art. 45 DSGVO.

6.5 How long is your data stored?

We do not store any data ourselves that is collected within the scope of the use of reCAPTCHA. The data processing takes place directly by Google, and the storage period is governed by Google’s internal guidelines and privacy policies. You can find further information on the storage period in Google’s privacy policy: https://policies.google.com/privacy?hl=de&gl=de

6.6 Are you obliged to provide your data and what happens if you decide not to?

The provision of your data via reCAPTCHA is not required by law. However, it is necessary in order to enable access to certain functions of our website. If you do not wish to use reCAPTCHA, this may result in certain functions, such as the submission of forms, not being available on our website.

7. Webflow

7.1 Which data do we process and for which purposes?

We use Webflow, a third-party provider for designing and managing our website. When you visit our website, data such as your IP address, device information, location data as well as technical data about your browser or operating system may be processed. This data is used to display the website, to ensure its functionality and to improve user-friendliness.

In addition, Webflow may use cookies and similar technologies in order to analyze interactions with the website and, where applicable, to personalize content or advertising.

7.2 On what legal basis do we process your data?

The processing of your personal data within the scope of the use of Webflow takes place on the basis of Art. 6 Abs. 1 lit. f DSGVO, since we have a legitimate interest in providing a functional and user-friendly website. Insofar as you have consented to the use of cookies or other tracking technologies, the processing takes place on the basis of Art. 6 Abs. 1 lit. a DSGVO.

7.3 To whom is your data passed on or who is involved in the processing of your data?

Your data is transmitted to Webflow, Inc., as the provider is responsible for the hosting and functionality of the website. In this context, Webflow acts as a processor pursuant to Art. 28 DSGVO and is obliged to process your data only in accordance with our instructions and in compliance with the applicable data protection provisions.

7.4 Is your data transferred to a third country or an international organization?

Yes, the transfer of data takes place to the USA, where Webflow is based. Webflow is certified under the EU-US Data Privacy Framework, which ensures an adequate level of data protection pursuant to Art. 45 DSGVO.

7.5 How long is your data stored?

The storage of your personal data takes place only for as long as is necessary to achieve the purposes described. Insofar as cookies or similar technologies are used, the storage period depends on the respective settings that you make and the specific period of use of these technologies by Webflow.

7.6 Are you obliged to provide your data and what happens if you decide not to?

The provision of personal data within the scope of the use of Webflow is not mandatory. You can freely decide whether you wish to allow or reject cookies. However, the decision not to provide any personal data may result in certain functions of the website being restricted or not being displayed correctly.

8. Cookies

8.1 Which data do we process and for which purposes?

On our website, we use cookies and similar technologies in order to improve the user experience, to ensure the functions of the website and to collect statistical data on the use of our website. The data collected by cookies includes in particular information about the pages visited, click behavior, length of stay and the device as well as the browser with which you visit our website. We use this data for the following purposes:

Technically necessary cookies: ensuring the functionality and security of the website.
Preference cookies: storage of your individual settings (e.g. language, location).
Statistics cookies: analysis of the use of our website to improve our content and services.
Marketing cookies: personalization of advertisements in order to show you relevant content.

8.2 On what legal basis do we process your data?

The processing of technically necessary cookies takes place on the basis of Art. 6 Abs. 1 lit. f DSGVO (legitimate interest), since they are essential for the functionality of the website. For all other cookies (preference, statistics and marketing cookies), we obtain your consent pursuant to Art. 6 Abs. 1 lit. a DSGVO, § 25 Abs. 1 TDDDG before they are set. You can revoke your consent at any time via our cookie banner or your browser settings.

8.3 To whom is your data passed on or who is involved in the processing of your data?

Within the scope of the use of cookies, we work together with external service providers and partners (e.g. analytics and marketing service providers) who receive access to the data in order to process it on our behalf. These service providers are contractually obliged to process the data exclusively in accordance with our instructions and to take appropriate technical and organizational measures to protect your data. Data is passed on to third parties exclusively within the scope of the statutory provisions. You can find further details in the privacy policy of the respective provider as well as in our cookie banner.

8.4 Is your data transferred to a third country or an international organization?

A transfer of your data to third countries (outside the European Economic Area - EEA) may take place within the scope of the integration of certain service providers (e.g. Google). In these cases, we ensure an adequate data protection standard through the conclusion of corresponding contracts (e.g. standard contractual clauses of the EU Commission) or through your express consent.

8.5 How long is your data stored?

The storage period of cookies varies depending on the type of cookie. Technically necessary cookies are only stored for the duration of your session and deleted as soon as you close the browser. Other cookies, such as preference or marketing cookies, are stored for a defined period, which you can find in the cookie settings in our cookie banner. After this period has expired, the data is automatically deleted or anonymized.

8.6 Are you obliged to provide your data and what happens if you decide not to?

There is no legal obligation to accept cookies. However, the rejection of certain cookies may result in parts of our website not functioning properly. The technically necessary cookies are required to enable you to use our website. The setting of further cookies takes place only on the basis of your voluntary consent, which you can revoke at any time without this having any negative consequences for the functionality of the website.

9. Contacting us

9.1 Which data do we process and for which purposes?

Within the scope of contacting us via our website, we process the following personal data that you provide to us:

first and last name (mandatory field)
email address (mandatory field)
subject of the inquiry (mandatory field)
message text (mandatory field)
telephone number (voluntary information)

This data is used exclusively to process your inquiry and to contact you. No further processing of your data takes place.

9.2 On what legal basis do we process your data?

The processing of your personal data takes place on the basis of Art. 6 Abs. 1 lit. b DSGVO, since this data is required for the performance of a contract or for the implementation of pre-contractual measures that take place in response to your inquiry.

9.3 To whom is your data passed on or who is involved in the processing of your data?

Your data is processed by our internal departments that are responsible for processing your inquiry. Data is only passed on to third parties insofar as this is necessary to fulfill your inquiry or we are legally obliged to do so. A transfer to external service providers (e.g. hosting providers) only takes place within the scope of order processing pursuant to Art. 28 DSGVO.

9.4 Is your data transferred to a third country or an international organization?

A transfer of your data to a third country (outside the European Union or the European Economic Area) or to an international organization does not generally take place, unless there are legal obligations to do so or you have granted us your express consent.

9.5 How long is your data stored?

Your personal data is stored for the duration of the processing of your inquiry. After the processing has been completed, your data is deleted, provided that no statutory retention obligations exist. If you have granted us consent for the further use of your data, we store it until you revoke your consent.

9.6 Are you obliged to provide your data and what happens if you decide not to?

The provision of the data marked as mandatory fields (first and last name, email address, subject, message text) is required in order to be able to process your inquiry. Without this information, it is not possible to process your inquiry. The provision of your telephone number is voluntary and has no influence on the processing of your inquiry.

10. Newsletter

10.1 Which data do we process and for which purposes?

To register for our newsletter, we process your email address. This data is used exclusively to send you our newsletter, to inform you about current developments and relevant information regarding our services, and to send you targeted marketing and information offers.

10.2 On what legal basis do we process your data?

The processing of your personal data takes place on the basis of your voluntarily granted consent pursuant to Art. 6 Abs. 1 lit. a DSGVO. You can revoke your consent at any time by unsubscribing from the newsletter. This does not affect the lawfulness of the processing carried out on the basis of the consent up to the point of revocation.

Insofar as the requirements of § 7 Abs. 3 UWG are met, we process your data on the basis of our legitimate interests pursuant to Art. 6 Abs. 1 lit. f DSGVO. Our legitimate interest consists in informing you, as our existing customer, about news and offers. You have the right to object to this processing at any time. In that case, we will no longer process your data for the purpose of sending the newsletter.

10.3 To whom is your data passed on or who is involved in the processing of your data?

The management of our email marketing is carried out by the external service provider OneSignal (OneSignal, Inc., San Mateo, California, USA), which is involved in the processing of your data within the scope of a data processing agreement pursuant to Art. 28 DSGVO. OneSignal is contractually obliged to process your data exclusively in accordance with our instructions and to take the necessary technical and organizational measures to protect your data.

10.4 Is your data transferred to a third country or an international organization?

OneSignal, Inc. is based in the USA and is beginning to relocate data centers to the EU. Insofar as a data transfer to the USA takes place, this is carried out on the basis of the EU-US Data Privacy Framework (Art. 45 DSGVO) as well as standard contractual clauses pursuant to Art. 46 Abs. 2 lit. c DSGVO. OneSignal generally stores personal data and automated message data for a maximum of 30 days. Statistics in the dashboard are retained for the lifetime of the app.

10.5 How long is your data stored?

Your email address is stored for the duration of your subscription to the newsletter. After unsubscribing from the newsletter, your data is deleted without delay, provided that no statutory retention obligations stand in the way.

10.6 Are you obliged to provide your data and what happens if you decide not to?

The provision of your email address is required in order to receive the newsletter. If you decide not to provide your email address for the purpose of sending a newsletter, we are unfortunately unable to send you a newsletter.

11. Applications

‍11.1 Which data do we process and for which purposes?

Personal data such as name, contact details, curriculum vitae, education data and information on professional experience („applicant data“) that you provide to us within the scope of your application is treated confidentially and stored and used electronically exclusively for the purpose of processing the application and, where applicable, for the implementation of the subsequent employment relationship. We require the data processed within the scope of the application procedure for the possible conclusion of an employment relationship or for the decision on your employment. We process this personal data in order to assess your suitability for the relevant position, for the purpose of processing the application as well as to contact you.

11.2 Which sources of data do we use?

In general, we receive all applicant data directly from you.

If we carry out pre-employment checks, we also receive data from third parties (e.g. former employers or other references).

11.3 On what legal basis do we process your data?

In general, the processing is based on the fact that we carry out pre-contractual measures at your request as the data subject or fulfill a contract concluded with you (Art. 6 Abs. 1 lit. b DSGVO). Furthermore, the processing takes place on the basis of relevant national provisions on data protection in the employment context (in particular § 26 BDSG).

Some applicant data is processed in order to ensure compliance with certain obligations arising from laws or regulations.

If we have to process special categories of personal data, we will, where necessary, ask for your express consent.

11.4 To whom is your data passed on or who is involved in the processing of your data?

We pass your data on within our company to the body responsible for your application. Beyond this, we only transmit your personal data to further recipients if there is a legal notification obligation for this, for example towards authorities.

For the processing of applications an application portal is used that is hosted by our service provider JOIN Solutions AG. Your data is therefore processed by JOIN Solutions AG, which acts as our processor. JOIN Solutions AG is obliged to protect your data in accordance with the applicable data protection laws and to process it only within the scope of the contractually agreed purposes. You can find our application page at https://join.com/companies/muvn. We have no influence on the processing of personal data on the application page. You can find the privacy policy of the service provider here: https://join.com/de/datenschutz

11.5 Is your data transferred to a third country or an international organization?

In connection with your application, we do not transfer the personal data to a third country or an international organization. JOIN Solutions AG stores and processes your data exclusively within the European Union (EU) or the European Economic Area (EEA).

11.6 How long is your data stored?

We retain personal data for as long as there is a legitimate reason or another legal basis for doing so. We regularly review the existence of a legal basis for storage. If there is no longer any legal basis for the retention of the data, we will securely delete personal data or, in some cases, anonymize it.

Your applicant data is stored for the duration of the review of your application. If your application is not successful or if you withdraw your application, your application data is deleted, unless a longer retention is permitted or required on the basis of another legal basis (e.g. in order to exercise our legal rights or to comply with applicable law).

Furthermore, your personal data may be retained for evidentiary purposes for the period within which there is a possibility that claims may be asserted against us (e.g. on the basis of national anti-discrimination provisions, as a rule 6 months after rejection).

If your application is successful, all data provided within the scope of the application procedure may be further processed for (or in connection with) your future employment with us. For further information about the processing of your personal data in connection with your employment, you will be able to access the internal privacy policy that is available to our staff.

11.7 Are you obliged to provide your data and what happens if you decide not to?

If you do not provide us with the above-mentioned personal data, this has no negative consequences for you. However, incomplete or incorrectly completed applications cannot be considered. Without providing your personal data, the application unfortunately cannot be submitted and is therefore deleted.

12. Social media plug-ins

(1) We currently use the following social media plug-ins: Instagram, LinkedIn, TikTok. These are only loaded if you have previously activated the function through your consent. Via the plug-ins, we offer you the possibility to interact with the social networks and other users. The legal basis for the use of the plug-ins is Art. 6 Abs. 1 lit. a DSGVO, i.e. the integration only takes place after your consent.

(2) The plug-in provider stores the data collected about you as usage profiles and uses these for the purposes of advertising, market research and/or needs-based design of its website. Such an evaluation takes place in particular (also for users who are not logged in) for the display of needs-based advertising and in order to inform other users of the social network about your activities on our website. You have a right to object to the creation of these user profiles, whereby you must contact the respective plug-in provider in order to exercise this. The transfer of data takes place regardless of whether you have an account with the plug-in provider and are logged in there. If you are logged in with the plug-in provider, the data collected from you by us is directly assigned to your existing account with the plug-in provider. If you activate the enabled button and, for example, link the page, the plug-in provider also stores this information in your user account and shares it publicly with your contacts. We recommend that you log out regularly after using a social network, but in particular before activating the button, as this allows you to avoid an assignment to your profile with the plug-in provider.

(3) The information collected is stored on the providers’ servers, and in the case of international providers also outside Europe. For these cases, according to its own information, the provider has imposed on itself a standard that corresponds to the former EU-US Privacy Shield and has undertaken to comply with applicable data protection laws in the case of international data transfer. We have also agreed so-called standard data protection clauses with the providers, the purpose of which is to ensure an adequate level of data protection in the third country.

(4) The revocation of your consent is possible at any time, without this affecting the permissibility of the processing up to the point of revocation. You can most easily carry out the revocation via the functions of the social media providers.

(5) You can obtain further information on the purpose and scope of the data collection and its processing by the plug-in provider in the privacy policies of these providers communicated below. There you will also obtain further information on your rights in this respect and on the setting options for protecting your privacy. Addresses of the respective plug-in providers and URLs of the respective data protection notices:

Instagram: https://privacycenter.instagram.com/policy
LinkedIn: https://de.linkedin.com/legal/privacy-policy
TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/de

13. MUVN Mobility App

In addition to our online offering, we provide you with a mobile app that you can download onto your mobile device.

When using the app, we process personal data about you and our app accesses information on your device. Personal data is to be understood as any information that relates to an identified or identifiable natural person. Because the protection of your privacy when using the app is important to us, we would like to inform you with the following information about which personal data we process and which information on your device we access when you use the app and how we handle this data. In addition, we inform you about the legal basis for the processing of your data and, insofar as the processing is necessary to safeguard our legitimate interests, also about our legitimate interests.

You can access this privacy policy at any time under the menu item Data protection within the app.

13.1 Information on the processing of your data

Certain information is already processed automatically as soon as you use the app. We have listed below for you exactly which personal data and information is processed:

13.1.1 Information collected during download

When downloading the app, certain required information is transmitted to the app store you have selected (e.g. Google Play or Apple App Store); in particular, the username, the email address, the customer number of your account, the time of the download, payment information as well as the individual device identification number may be processed in this context. The processing of this data is carried out exclusively by the respective app store and is outside our sphere of influence.

13.1.2 Information collected automatically

13.1.2.1 Use of the app

Within the scope of your use of the app, we automatically collect certain data that is required for the use of the app. This includes:

IP address
date and time of the request
time zone difference to Greenwich Mean Time (GMT)
content of the request (page visited)
access status/HTTP status code
amount of data transferred in each case
previously visited page
browser
operating system
language and version of the browser software

This data is not stored but automatically transmitted to us, (1) in order to provide you with the service and the associated functions; (2) to improve the functions and performance features of the app and (3) to prevent and eliminate abuse as well as malfunctions. This data processing is justified by the fact that (1) you have consented to the storage as well as access to information that is already stored on your terminal device on the basis of the information provided pursuant to § 25 Abs. 1 TDDDG, or (2) access to the information stored on the terminal equipment is strictly necessary pursuant to § 25 Abs. 2 Nr. 2 TDDDG so that we, as the provider, can provide the app service expressly requested by you, or (3) the processing is necessary for the performance of the contract between you as the data subject and us pursuant to Art. 6 Abs. 1 lit. b DSGVO for the use of the app, or (4) we have a legitimate interest in ensuring the functionality and error-free operation of the app and in being able to offer a service that is appropriate to the market and to interests, which here outweighs your rights and interests in the protection of your personal data within the meaning of Art. 6 Abs. 1 lit. f DSGVO.

13.1.2.2 Hosting of the app

For the operation and provision of our app, we use Amazon Web Services (AWS) as a hosting service provider. In this context, personal data such as user information, usage data and technical logs is processed in order to ensure the functionality of the app, to guarantee security and, where applicable, to respond to support inquiries. The processing of this data is carried out in order to ensure the performance and stability of our app and to identify and rectify errors.

The data processing takes place on the basis of our legitimate interest pursuant to Art. 6 Abs. 1 lit. f DSGVO. Our legitimate interest consists in the secure and efficient provision of our app services. Insofar as we require your consent for the data processing, this takes place pursuant to Art. 6 Abs. 1 lit. a DSGVO.

AWS acts as a processor pursuant to Art. 28 DSGVO and processes the data exclusively on our behalf and in accordance with our instructions. AWS is contractually obliged to protect the confidentiality and integrity of your data and not to arrange for any disclosure to unauthorized third parties.

AWS is certified under the EU-US Data Privacy Framework, which ensures an adequate level of data protection pursuant to Art. 45 DSGVO.

The data is only stored for as long as is necessary to fulfill the respective purposes. Provided that no statutory retention obligations stand in the way, we delete the data immediately as soon as it is no longer required for the intended purpose.

The provision of the data is required for the use of our app and the provision of our services. Without the provision of your personal data, the use of the app or individual functions is restricted or not possible.

13.1.3 Creation of a user account (registration) and login

When you create a user account or log in, we use your access data (email address and password) in order to grant you access to your user account and to manage it („mandatory information“). For this, we require your first and last name as well as your date of birth. If you do not provide this data, you cannot create a user account. In addition, a verification process must be completed, which is carried out by our partner Stripe. We have concluded a corresponding data processing agreement pursuant to Art. 28 Abs. 3 DSGVO with the partner.

We use the mandatory information in order to authenticate you during login and to follow up on requests to reset your password. The data you enter within the scope of registration or a login is processed and used by us (1) in order to verify your authorization to manage the user account; (2) to enforce the terms of use of the app as well as all associated rights and obligations and (3) to contact you in order to be able to send you technical or legal notices, updates, security messages or other communications, for example concerning the management of the user account.

In order to be able to advertise rides, it is necessary that you provide us with further information. This includes information for the reliability check and identity verification. This includes officially issued identification documents such as a driver’s license or identity card. We use these exclusively for the purpose of being able to ensure that you are in possession of a valid identification document. In addition, a telephone number, the type of your vehicle and the specification of a payment method are required.

Furthermore, you can add a profile picture and a description text of yourself on a voluntary basis. We use voluntary information in order to display it within the app in accordance with your settings and, at your request, to make it accessible to other users of the app.

These data processing operations are justified by the fact that (1) you have consented to the storage as well as access to information that is already stored on your terminal device on the basis of the information provided pursuant to § 25 Abs. 1 TDDDG, (2) the storage of information or access to information within the meaning of § 25 Abs. 2 Nr. 2 TDDDG is strictly necessary in order to be able to provide you with the desired app service, (3) the processing is necessary for the performance of the contract between you as the data subject and us pursuant to Art. 6 Abs. 1 lit. b DSGVO for the use of the app, or (4) we have a legitimate interest in ensuring the functionality and error-free operation of the app, which here outweighs your rights and interests in the protection of your personal data within the meaning of Art. 6 Abs. 1 lit. f DSGVO.

13.1.4 Creation of an offer or a request / profile

Within the scope of the app, you can enter, manage and edit various information, tasks and activities. You can advertise rides, i.e. publish your routes, as well as advertise requests. For this, the processing of location data as well as the information surrounding the ride of the delivery is generally required (i.e. departure and arrival location, time of departure, vehicle type, capacity, shipping period, type and size of the delivery, photo of the delivery as well as of the vehicle, remarks on the delivery, price of the ride, inquiries regarding the offers). In the case of corresponding inquiries, you also have the opportunity to exchange information personally with potential interested parties within the scope of a chat. In addition, certain listings and transport requests may be suggested to you by an automated system. In the selection of the recommended listings and transport requests, data about you can play an important role, such as, for example, previous search queries.

Within the scope of your profile, you also receive an overview of your booked and completed rides, the specification of the money earned or the CO₂ emissions as well as your status (e.g. newcomer). After each ride, you can also be rated by other users with 1 to 5 stars and receive corresponding remarks on the ride via a free text field. These ratings and remarks are publicly visible.

Not all information is mandatory. Some information you can provide voluntarily. Other users can access your profile and have insight into the following information: profile picture, description text, number of booked and completed rides, confirmation of driver’s license, identity card and telephone number, offered rides and objects.

The app also requires the following permissions:

Internet access: This is required in order to store your entries on our servers.
Camera access: This is required so that you can take photos and store them in the app as well as on our servers.
Setting of cookies: In order to store your information within the scope of the creation of a request or offer, we set corresponding cookies in order to store this information for the course of the creation.

The processing and use of the data takes place for the provision of the service. This data processing is justified by the fact that the processing within the meaning of § 25 Abs. 2 Nr. 2 TDDDG is strictly necessary in order to be able to provide the app service expressly requested by you, because it is necessary for the performance of the contract between you as the data subject and us pursuant to Art. 6 Abs. 1 lit. b DSGVO for the use of the app and we have a legitimate interest in ensuring the functionality and error-free operation of the app as well as the proper and efficient implementation of the ride, which here outweighs your rights and interests in the protection of your personal data within the meaning of Art. 6 Abs. 1 lit. f DSGVO.

13.1.5 Use of push notifications

You have the possibility to receive corresponding push notifications about your rides. For the delivery of push notifications, we process the following data:

device identification number (Device ID) of your mobile device,
information on the completion of the ride (e.g. time and location),
your preferences and settings for push notifications.

The purpose of the data processing is to inform you, after the completion of your ride, about the possibility of also offering the route for the return journey and placing a corresponding listing. The notifications serve to offer you an additional service and to improve the use of our app.

The processing of your data takes place on the basis of your consent pursuant to Art. 6 Abs. 1 lit. a DSGVO. You have the possibility to revoke the use of push notifications at any time in the settings of your app or on your device.

For the delivery of the push notifications, we use Google Firebase (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as well as OneSignal (OneSignal, Inc., San Mateo, California, USA) as technical service providers. OneSignal is also used by us for sending email marketing communications (see Section 10). Insofar as a transmission to OneSignal takes place to the USA, this is done on the basis of the EU-US Data Privacy Framework as well as standard contractual clauses pursuant to Art. 46 Abs. 2 lit. c DSGVO. Both service providers process the data exclusively on the basis of our instructions within the scope of a data processing agreement pursuant to Art. 28 DSGVO.

A transmission of your data to a third country or an international organization does not generally take place. Should we require this in the future, we will inform you about it in advance and ensure that appropriate safeguards within the meaning of the DSGVO are taken.

The processing of your data for push notifications takes place only for as long as is necessary to achieve the stated purposes. The data is deleted as soon as you deactivate the push notifications or revoke your consent.

The provision of your data for push notifications is voluntary. If you do not grant us your consent or revoke it, we cannot send you any push notifications and you will not receive any information about possible return journeys or the possibility to create a listing. The use of the app and other functions remains unaffected by this.

13.1.6 Payment

The integration of the payment methods in our app serves the secure processing of payments for our offered services and products. The processing of the data takes place on the basis of Art. 6 Abs. 1 lit. b DSGVO (performance of a contract) as well as Art. 6 Abs. 1 lit. f DSGVO (legitimate interest), in order to be able to offer you various payment options.

When using the various payment methods, different data may be passed on to the respective payment service providers depending on the provider. For the secure processing of the payments, we work together with external payment service providers. These service providers act as independent controllers within the meaning of the DSGVO and ensure the protection of your data through their own security measures. A data transmission only takes place insofar as this is necessary for the processing of the payments. The following providers may be used:

PayPal

When using PayPal as a payment method, data such as name, address, email address and, where applicable, IP address is transmitted to PayPal. You can find further information on the data processing by PayPal in the privacy policy of PayPal at https://www.paypal.com/webapps/mpp/ua/privacy-full

Apple Pay

When using Apple Pay, the data processing takes place directly via Apple, without us receiving detailed information about your payment source. Apple processes data in accordance with the privacy guidelines that are available at https://www.apple.com/de/legal/privacy/data/de/apple-pay/.

Klarna

If you choose Klarna, information such as name, address, telephone number and email address is transmitted to Klarna. Depending on the payment type, Klarna may request additional information in order to ensure the payment processing. You can find further information in the privacy policy of Klarna at https://www.klarna.com/de/datenschutz-und-sicherheit/.

Credit card

When paying by credit card, the data of the credit card, including cardholder, card number and expiry date, is processed securely and encrypted via a Payment Service Provider (PSP). This data is used only for the payment processing and is not permanently stored in our app.

Google Pay

If you use Google Pay, certain information, including your name, your billing address, your email address and, where applicable, your IP address, is transmitted to Google for the payment processing. Google processes your data in accordance with the privacy guidelines that are available at https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de.

Stripe Payments Europe

When using Stripe as a payment service provider, personal data such as name, credit card information, billing address, email address and, where applicable, IP address is transmitted to Stripe. Stripe processes this data in accordance with the requirements of the DSGVO and offers extensive security measures in order to protect your data. You can find further information in the privacy policy of Stripe at https://stripe.com/de/privacy.

We store the data processed for the payment processing only for as long as is necessary for the performance of the contract and in accordance with the statutory retention obligations. As soon as the data is no longer required for these purposes, we delete it.

13.1.7 Analysis of usage behavior

We process the following data for statistical and analytical purposes:

Usage behavior: click behavior when using redirects to social media, frequency of accessing certain app areas, selection and use of route suggestions.
Device and log data: IP address (anonymized), device identifiers, operating system, app version, time and date of access.

The purposes of the processing are the creation of anonymized statistics about usage behavior, the optimization and adaptation of the app to the needs of the users as well as the improvement of the functionality and user-friendliness of the route suggestions. Through the analysis and use of user data, we continuously optimize our algorithm in order to generate more precise and intelligent suggestions for drivers and senders. In this way, we not only improve the user experience, but also maximize the number of successful matches.

The processing of your data takes place on the basis of your consent pursuant to Art. 6 Abs. 1 lit. a DSGVO. The consent is obtained upon first use of the app, and you have the possibility at any time to revoke your consent with effect for the future. Without your consent, no analysis of your usage behavior takes place. The processing of your data also takes place on the basis of Art. 6 Abs. 1 lit. f DSGVO, since we have a legitimate interest in continuously improving and optimizing the app as well as in offering security and transparency for our drivers. Our analysis is based on aggregated and anonymized data and serves exclusively to optimize our services.

For the processing of this data, we use Mixpanel Inc. and Adjust Inc. as our processors in the USA. Mixpanel and Adjust will process this data exclusively on our behalf and on the basis of a concluded data processing agreement pursuant to Art. 28 DSGVO. Mixpanel and Adjust are certified under the EU-US Data Privacy Framework, so that an adequate level of data protection pursuant to Art. 45 DSGVO is ensured. Your data is not generally passed on to third parties, unless we are legally obliged to do so.

No transmission of your personal data to third countries or international organizations takes place. All data processing operations take place within the European Union.

The processed data is only stored for as long as is necessary to fulfill the described purposes. Since the data is anonymized, no long-term storage of personal data takes place. Aggregated, anonymized statistics may be retained for the long-term improvement of the app.

13.1.8 Location capture

13.1.8.1 Google Maps

The integration of Google Maps enables us to provide you with interactive maps and a geographical orientation aid in our app, e.g. for displaying your location or for route planning. The use of Google Maps takes place in your interest in a convenient and clear presentation of geographical information. If you do not agree with the data processing by Google Maps, you can deactivate the location services in your device settings or refrain from using Google Maps in the app.

When you access Google Maps in our app, the following data may be collected and processed:

IP address
location data (if you have activated location capture)
usage data of the Google Maps API, such as access frequency and navigation data
data on system usage (e.g. through cookies and similar technologies)

This data is generally transmitted directly to a Google server in the USA and stored there.

The processing of your data in connection with Google Maps takes place on the basis of your consent pursuant to Art. 6 Abs. 1 lit. a DSGVO. You can revoke this consent at any time in the settings of your app.

The data collected by Google Maps is generally transmitted to Google servers in the USA and processed there. Google is certified under the EU-US Data Privacy Framework, so that an adequate level of data protection pursuant to Art. 45 DSGVO is ensured.

You can obtain further information on the purpose and scope of the data collection at https://policies.google.com/privacy?hl=de&gl=de.

13.1.8.2 GPS data capture

We process GPS data of your mobile devices in order to facilitate your use of our app. This data includes the geographical location of your device and enables us to offer you functions and content tailored to your location (e.g. display of optimized routes). In addition, the data serves the analysis of usage patterns in order to continuously improve our services and adapt them to the needs of our users. For this, we store this GPS data in our AWS RDS Managed Database as well as the old GPS data in our database for learning purposes for our machine learning models.

The processing of your GPS data takes place on the basis of your consent pursuant to Art. 6 Abs. 1 lit. a DSGVO, which you can grant us when first starting the app or in the data protection settings of the app. You can revoke this consent at any time, whereby the lawfulness of the data processing carried out up to that point remains unaffected. The processing of your data also takes place on the basis of Art. 6 Abs. 1 lit. b DSGVO (performance of a contract) as well as on the basis of Art. 6 Abs. 1 lit. f DSGVO, since we have a legitimate interest in continuously improving and optimizing the app. Our analysis is based on aggregated and anonymized data and serves exclusively to optimize our services.

For the processing of the GPS data, we use Amazon Web Services (AWS) as our processor. AWS will process this data exclusively on our behalf and on the basis of a concluded data processing agreement pursuant to Art. 28 DSGVO. Your data is not generally passed on to third parties, unless we are legally obliged to do so.

The storage of the GPS data generally takes place on servers in the European Union. Should, in exceptional cases, a transfer to a third country outside the European Economic Area occur, this transfer is carried out on the basis of an adequacy decision of the EU Commission or appropriate safeguards, such as, for example, standard data protection clauses pursuant to Art. 46 DSGVO, in order to ensure an adequate level of data protection.

The GPS data is only stored for as long as it is required for the provision of the services and the stated purposes. As a rule, the data is anonymized or deleted after no later than 12 months, unless a longer storage is required on the basis of statutory provisions.

The provision of your GPS data is voluntary. Without this data, however, certain functions and services of our app that are based on location information cannot be provided. If you decide against the provision, this has no negative consequences, apart from the limited usability of certain functions.

13.1.9 In-app chat (GetStream)

For the provision of the chat function within the app, we use the service Stream (operated by Stream.io, Inc., 440 N Barranca Ave #1439, Covina, CA 91723, USA;"GetStream"). Via the chat, users can exchange information about transport details within the scope of a match. Within the scope of the chat use, the following data is transmitted to GetStream and processed there: user ID, message contents, timestamps as well as technical connection data (e.g. IP address). The processing takes place on the basis of Art. 6 Abs. 1 lit. b DSGVO, since the chat function is a component of the contractually agreed app use. The transmission to the USA takes place on the basis of standard contractual clauses (SCCs) pursuant to Art. 46 Abs. 2 lit. c DSGVO. We have concluded a data processing agreement pursuant to Art. 28 DSGVO with GetStream. Upon deletion of your account, your chat data at GetStream is also deleted. Further information: https://getstream.io/legal/privacy/

13.1.10 Reporting obligations under the Platform Tax Transparency Act (PStTG)

As a platform operator within the meaning of the Platform Tax Transparency Act (PStTG), we are obliged to report certain information about reportable providers to the Federal Central Tax Office. Insofar as you, as a provider on MUVN, perform relevant activities within the meaning of Paragraph 5 PStTG and exceed the reporting thresholds, we process and report the following data: For natural persons: first and last name, address of residence, tax identification number and issuing EU member state (alternatively place of birth), date of birth as well as, where applicable, VAT identification number. For legal entities (companies): registered name, address of the registered office, tax identification number and issuing EU member state, where applicable VAT identification number, commercial register number as well as the existence of a permanent establishment in the EU. In both cases additionally: identifier of the financial account, where applicable the name of a different account holder, fees/commissions/taxes withheld per quarter, total remuneration paid per quarter, number of relevant activities per quarter as well as, where applicable, the identifier of the identification service used. Legal basis: Art. 6 Abs. 1 lit. c DSGVO (fulfillment of a legal obligation) in conjunction with PStTG. The recipient is the Federal Central Tax Office, which may forward the information to tax authorities of other EU member states. Storage period: 10 years. Without the provision of the required data, we are obliged to block your account.

13.2 Disclosure of data

A disclosure of your personal data without your express prior consent takes place, in addition to the cases explicitly mentioned in this privacy policy, only if it is legally permissible or required.

If it is necessary to clarify an unlawful or abusive use of the app or for legal prosecution, personal data is forwarded to the law enforcement authorities or other authorities as well as, where applicable, to injured third parties or legal advisors. However, this only happens if there are indications of unlawful or abusive behavior. A disclosure may also take place if this serves the enforcement of terms of use or other legal claims. We are also legally obliged to provide information to certain public bodies upon request. These include, among others, law enforcement authorities, authorities that prosecute administrative offenses subject to fines, tax authorities and insurers.

Any disclosure of the personal data is justified by the fact that (1) information is to be provided at the order of a competent body, insofar as this is necessary for the fulfillment of information obligations pursuant to § 21 Abs. 1 and 2 TDDDG or in accordance with § 22 TDDDG, (2) the processing is necessary for the fulfillment of a legal obligation to which we are subject pursuant to Art. 6 Abs. 1 lit. c DSGVO in conjunction with national legal provisions on the disclosure of data to law enforcement authorities, or (3) we have a legitimate interest in disclosing the data to the aforementioned third parties in the event of indications of abusive behavior or for the enforcement of our terms of use, other conditions or legal claims, and your rights and interests in the protection of your personal data within the meaning of Art. 6 Abs. 1 lit. f DSGVO do not outweigh this.

A data disclosure also takes place to our payment processors and intermediaries as described under Section 13.1.6.

13.3 Period of data storage

We delete or anonymize your personal data as soon as it is no longer required for the purposes for which we collected or used it in accordance with the foregoing sections, insofar as this data is not required for a longer period for the criminal prosecution or for the securing, assertion or enforcement of legal claims.

As soon as a user deletes their account, the profile information is deleted after 3 months.

Specific information in this privacy policy or legal requirements on the retention and deletion of personal data, in particular such data that we must retain for tax reasons, remain unaffected.

14. Your rights as a data subject

Insofar as we process data relating to your person, you have, within the respective statutory scope under the DSGVO, a right to

information in particular about stored data and processing purposes (Art. 15 DSGVO),
rectification of incorrect data or completion of incomplete data (Art. 16 DSGVO),
erasure in particular of data that is no longer required (Art. 17 DSGVO),
restriction of the processing (Art. 18 DSGVO),
objection to the processing (Art. 21 DSGVO),
data portability, insofar as the processing is based on consent or is carried out for the performance of a contract or with the help of automated procedures (Art. 20 DSGVO), as well as
revocation of a consent granted by you (Art. 7 Abs. 3 S. 1 DSGVO).

Furthermore, you have the possibility to address complaints to the supervisory authority.

15. Contact

To exercise your statutory rights and for questions regarding the data processing, you can contact us in each case via the means most convenient for you:

Muvn Mobility GmbH

Baakenallee 74

20457 Hamburg

Email: katharina@muvn.de

16. Changes to the privacy policy

Within the scope of the further development of data protection law as well as technological or organizational changes, our privacy policy is regularly reviewed for the need for adaptation or supplementation. This privacy policy is dated February 2026.

17. Privacy notice – WhatsApp communication

Controller: MUVN Mobility GmbH, Baakenallee 74, 20457 Hamburg, support@muvn.de

Purpose of processing

We process your mobile phone number as well as the content of our WhatsApp communication in order to inform you about the status of your order, to notify you of driver assignments and to handle order-related queries.

Recipients and third-country transfers

For the technical processing, we use the following service providers:

Meta Platforms Ireland Ltd. (WhatsApp infrastructure) – data processing may take place in third countries, in particular the USA. Basis: EU Standard Contractual Clauses (SCC) pursuant to Art. 46 GDPR as well as the EU-U.S. Data Privacy Framework.

360dialog GmbH, Berlin – authorized WhatsApp Business Solution Provider; processes messages exclusively on behalf of MUVN (a data processing agreement pursuant to Art. 28 GDPR is in place).

Storage period

Message contents are stored by 360dialog for a maximum of 30 days and are then automatically deleted. Order data received via WhatsApp is subject to MUVN's general retention periods (as a rule 3 or 10 years in accordance with commercial and tax law requirements).

Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) as well as data portability (Art. 20 GDPR). Complaints can be addressed to the competent data protection supervisory authority of your federal state.

Revocation of consent

You can revoke your consent at any time without stating reasons – simply send “STOP” to the MUVN WhatsApp number at any time. The lawfulness of the processing carried out up to the revocation remains unaffected.