Information on the processing of personal data when using the driveMybox websites and the driveMybox platform

Status: 11.03.2024

1 GENERAL

1.1. In the following, we provide information about the processing of personal data when using our websites and our platform. Personal data is any information relating to an identified or identifiable natural person (hereinafter referred to as “you”), e.g. name, address, e-mail addresses and user behavior.

1.2. The controller pursuant to Art. 4 (7) GDPR is:
driveMybox logistics GmbH
Kurt-Eckelmann-Str. 1
21129 Hamburg
Phone: +49 (0) 40 2999 608 54
E-mail: support@driveMybox.de

1.3. The data protection officer of the controller:
Dipl.-Ing. Jörg Hagen
Jhcon.de
Königstrasse 50a
30175 Hanover
Germany
E-mail: hagen@jhcon.de

2 YOUR RIGHTS

2.1. You have the following rights vis-à-vis us with regard to your personal data:

• Right to information: You can request information about your personal data that we process in accordance with Art. 15 GDPR.
• Right to rectification: If the information concerning you is not (or no longer) accurate, you can request rectification in accordance with Art. 16 GDPR. If your data is incomplete, you can request that it be completed.
• Right to erasure: You can request the erasure of your personal data in accordance with Art. 17 GDPR.
• Right to restriction of processing: In accordance with Art. 18 GDPR, you have the right to request that the processing of your personal data be restricted.
• Right to object to processing: You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on point (f) of Article 6(1) GDPR. The controller will then no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims. The collection of data for the provision of the website and the storage of log files are absolutely necessary for the operation of the website.
• Right to data portability: In the event that the requirements of Art. 20 para. 1 GDPR are met, you have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to third parties. The collection of data for the provision of the website and the storage of log files are absolutely necessary for the operation of the website. They are therefore not based on consent pursuant to Art. 6 para. 1 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR, but are justified pursuant to Art. 6 para. 1 lit. f GDPR. The requirements of Art. 20 para. 1 GDPR are therefore not fulfilled in this respect.
• Right to lodge a complaint: If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a data protection supervisory authority of your choice in accordance with Art. 77 (1) GDPR. This also includes the data protection supervisory authority responsible for the controller: The Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str 22, 20459 Hamburg, 040/428 54 – 4040, mailbox@datenschutz.hamburg.de.

3 PROCESSING OF PERSONAL DATA IN CONTACT WITH DRIVEMYBOX

3.1. If you contact us by e-mail, the data you provide (e.g. your e-mail address, possibly your name and telephone number) will be processed by us and stored in particular in order to answer your questions. We process support requests via the Freshdesk service of Freshworks GmbH, Alte Jakobstraße 85/86, Hof 1, Haus 5, 10179 Berlin.

The legal basis for data processing depends on the reason for and content of the respective contact request. In the case of inquiries relating to an existing contractual relationship or the initiation of such a relationship, the legal basis is Art. 6 para. 1 lit. b GDPR. For all other inquiries, the legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in processing your inquiries.

We delete the data arising in connection with support requests after storage is no longer required, or restrict processing if there are statutory retention obligations. The specific periods depend on the reason for and content of your contact request.

4 PROCESSING OF PERSONAL DATA WHEN VISITING ONE OF THE DRIVEMYBOX WEBSITES

4.1. This declaration applies to the websites:

• drivemybox.de
• drivemybox.nl

4.2. If you use the website for informational purposes only, i.e. if you do not register to use the driveMybox platform, log in or otherwise provide us with information, we collect and process the following data, which is technically necessary for us to display our website to you and to ensure stability and security:

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status / HTTP status code
• Amount of data transferred in each case
• Website from which the request comes
• Browser
• Operating system and its interface
• Language and version of the browser software

We use Amazon Web Services (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855, Luxembourg, “AWS”) for the technical operation of our website. We also use the services of WP Engine, Irongate House, 22-30 Duke’s Place, London, EC3A 7LP, United Kingdom, for this purpose. In each case, these are processors within the meaning of Art. 28 GDPR.

4.3. Use of cookies

4.3.1. When you use our website, cookies are stored on your end device. Cookies are information that we can read, in particular to recognize your device.

4.3.2. You can give your detailed consent to the use of cookies and third-party services via our cookie consent menu. The cookie consent menu contains a cookie declaration with a more detailed description of the cookies used, such as the respective purpose.

4.3.3. For this purpose, we use the Borlabs Cookie service; a technically necessary cookie (borlabs-cookie) to store your cookie consent. Borlabs Cookie does not process any personal data. However, the borlabs cookie stores the consent you gave when you entered the website. If you wish to revoke this consent, simply delete the cookie in your browser or correct your settings in the Consent Manager menu. In some cases, it may be necessary to “reload” the website. When you re-enter/reload the website, you will be asked for your cookie consent again.

4.3.4. However, you can also set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted. If cookies are used by third-party companies or for analysis purposes, we will inform you about this separately in this privacy policy and, if necessary, request your consent.

4.3.5. 4.3.5. Independently of this, you can find more information about cookies at www.allaboutcookies.org. The website www.allaboutcookies.org can give you detailed instructions on how to set and delete cookies, depending on your browser type. At the bottom of this page, where we can name them, we have included links to cookie settings in various browsers.

4.3.6. If you consent, the legal basis for the processing of your data is Section 25 (1) TTDSG and Art. 6 (1) (a) GDPR. In addition, in accordance with Art. 49 para. 1 GDPR, you consent to providers in the USA also processing your data. In this case, it is possible that the transmitted data will be processed by local authorities. Data required for the operation of the website is processed on the basis of Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in enabling the operation of the website.

4.4. Use of Google Analytics

4.4.1. With your consent, our website uses Google Analytics, a web analytics service provided by Google Inc (“Google”). Google Analytics uses cookies that enable your use of our website to be analyzed. The information generated by the cookie about your use of our website is usually transmitted to a Google server in the USA and stored there. However, if IP anonymization is activated on our website, your IP address will be shortened by Google beforehand within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. Google will use this information on our behalf to evaluate your use of the website, to compile reports on website activity and to provide other services relating to website activity and internet usage to the website operator.

4.4.2. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

4.4.3. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of our website. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

4.4.4. We use Google Analytics with your consent in order to analyze and regularly improve the use of our website. We can use the statistics obtained to improve our offer and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US data privacy framework. The actual legal basis for the use of Google Analytics is Art. 6 para. 1 lit. a GDPR. In addition, in accordance with Art. 49 para. 1 GDPR, you consent to Google processing your data in the USA if necessary. In this case, it is possible that the transmitted data will be processed by local authorities.

4.4.5. 4.4.11. Information from the third-party provider: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. Terms of use: http://www.google.com/analytics/terms/de.html, overview of data protection: http://www.google.com/intl/de/analytics/learn/privacy.html, and the privacy policy: http://www.google.de/intl/de/policies/privacy.

4.5. LinkedIn Insight Tag

4.5.1. We use the “LinkedIn Insight Tag” conversion tool from LinkedIn Ireland Unlimited Company (LinkedIn Ireland) on our website. This tool creates a cookie in your web browser, which enables the collection of the following data, among others: IP address, device and browser properties and page events (e.g. page views). LinkedIn Ireland does not transmit any personal data to us, but offers anonymized reports on the website target group and display performance. In addition, LinkedIn Ireland offers the possibility of retargeting via the Insight tag. With the help of this data, we can display targeted advertising outside our website without identifying you as a user of the website.

4.5.2. 4.9.2. Our legal basis for the processing of your data is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. In addition, in accordance with Art. 49 para. 1 GDPR, you consent to LinkedIn processing your data in the USA if necessary. In this case, it is possible that the transmitted data will be processed by local authorities. You give your consent to this via our cookie banner. Please note that LinkedIn Ireland may also process your data outside the EU/EEA. According to a recent ruling by the European Court of Justice (ECJ), there is no adequate level of data protection in the USA and therefore a risk to the protection of your data. For example, under certain circumstances, your data may be processed by US authorities for monitoring and surveillance purposes. If you still wish to consent to the use of this tool, you can select this via the cookie banner.

4.5.3. You can find more information about the LinkedIn Insight tag at the following link. You can find more information on data protection at LinkedIn Ireland in the LinkedIn Ireland privacy policy.

5 PROCESSING OF PERSONAL DATA VIA OUR SUPPORT SERVICE WITH LIVE CHAT “FRESHCHAT”

5.1. We use Freshchat from the provider Freshworks Inc., 1250 Bayhill Drive, Suite 315, San Bruno, CA 94066, USA (“Freshchat”) for our support.

5.2. You can use Freshchat to quickly clarify service issues with us via live chat and tickets.

5.3. By using this offer, the data you provide will be transmitted to Freshchat and stored on their servers. Freshchat also transmits this data to Freshworks companies in the USA and other third countries in order to be able to offer Freshchat.

5.4. We have concluded a contract with Freshchat with so-called EU standard contractual clauses as of October 1, 2021, in which Freshworks undertakes to process user data only in accordance with our instructions and to comply with the EU data protection level.

5.5. The legal basis for the processing of data described above is Art. 6 (1) f) GDPR. The processing is carried out for the purpose of checking and responding to your inquiries. We have a legitimate interest in the data processing described, which lies in being able to offer direct and effective customer communication.

5.6. Your data will be deleted as soon as the respective request has been completed and there are no statutory retention obligations. You can find out more about Freshchat and data protection here: https://www.freshworks.com/privacy/.

6 PROCESSING OF PERSONAL DATA ON THE PLATFORM

If you register or log in to use the closed user area of driveMybox (also referred to as the “platform”), we collect the following data in addition to the data listed in section 3:

6.1. Registration and general user profile

The use of our platform requires a profile for each user. In this context, we process

Data category	Processing purpose
Personal details, e.g. names, contact details (including company addresses, telephone numbers) and passwords	We process this data in particular to identify and manage users and to process the services provided via our platform.

We process this data for the respective carrier on the basis of an order processing agreement in accordance with Art. 28 GDPR. If you are a carrier yourself, we process your personal data on the legal basis of Art. 6 para. 1 lit. b GDPR.

6.2. Further information on clients and carriers

If you register as a client or carrier, we collect and process further data. This includes

Data category	Processing purpose
Company details such as company name and legal form, VAT identification number Only for carriers: trade license/trade license, extract from the commercial register	We require this information in order to be able to provide our services, invoice and make payments.
Additional company details (e.g. website address, second telephone number, voluntary)	We use this information to provide additional services to your company or to use a second method of contact.
Only with regard to carriers: Vehicle and chassis details such as type, model, license plate number, emission class, number of axles, weight	We need this information to operate our platform, in particular to allocate whether a particular freight can be transported by a particular carrier.
Payment information such as bank details, billing address and/or credit card details	We need this information to send and receive payments.
Only with regard to carriers: Insurance documents (e.g. for damage to goods, motor vehicle and commercial liability insurance)	We require this information in order to fulfill our organizational and due diligence obligations and for evidence purposes.
Only with regard to carriers: Date of birth and identity card (for carriers with several drivers, the key user’s date of birth, identity card and role and position in the company)	We need this information to send and receive payments.
Only with regard to clients: Type of company (e.g. shipper, freight forwarder, shipping company, wholesaler)	We need this information in order to be able to manage a customized booking process with regard to insurance.

We only photocopy data from your ID card with your consent in accordance with Section 20 (2) PAuswG. From this, we produce a verification note on the legal basis of Art. 6 Para. 1 lit. f GDPR and then delete the photocopy. We only process the vehicle and chassis details, as does the company, for the respective carrier on the basis of an order processing agreement in accordance with Art. 28 GDPR. Otherwise, the following applies: If you yourself are a client or a carrier, the legal basis for data processing is Art. 6 para. 1 lit. b GDPR. If you are working for a client or carrier (e.g. as an employee or driver) and you provide this additional information via your user profile, the legal basis for processing is Article 6(1)(f) GDPR. Our legitimate interest lies in providing our services to your employer or client.

We validate the VAT identification number on a website of the European Commission (VAT Information Exchange System (VIES)), https://ec.europa.eu/taxation_customs/vies.

6.3. Further information on drivers

We also process further information on the drivers used. These are collected from you as a driver or independent carrier, or, in the case of carriers with several drivers, they are collected from the respective key user of the carrier. This includes

Data category	Processing purpose
Driver skills, e.g. whether the driver is authorized to transport dangerous goods	We need this information to operate our platform, in particular to allocate whether a particular freight can be transported by a particular carrier.
Driving license and identity card	We need this information to fulfill our organizational and due diligence obligations towards our clients and insurers as well as for evidence purposes. For example, we compare the picture on the ID card and the picture on the driver’s license.
Area of Service (geographical area in which the driver wishes to work)	We need this information to operate our platform, in particular to allocate whether a particular freight can be transported by a particular carrier.
E-mail address (optional)	We use this information to contact you.
Information on working hours available to dMb	We need this information to operate our platform, in particular to allocate whether a particular freight can be transported by a particular carrier.
Proof of Delivery	We require this information (e.g. name of the driver, license plate number of the vehicle and chassis) in order to process transports, i.e. to provide our services to the client.

We will only photocopy data from your ID card with your consent in accordance with Section 20 (2) PAuswG. From this, we produce a verification note on the legal basis of Art. 6 para. 1 lit. f GDPR and then delete the photocopy. We collect information on the driver’s skills for the respective carrier on the basis of an order processing agreement in accordance with Art. 28 GDPR. Otherwise, the following applies: If you as the carrier are also the driver, the legal basis for data processing is Art. 6 para. 1 lit. b GDPR. If you act as a driver for a carrier, the legal basis for the processing is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in providing our services to your employer or client.

6.4. Further information on transportation

We also process the following data in connection with transportation processing:

Data category	Processing purpose
Load specification, loading point information	We require this information in order to handle transportation, i.e. to provide our services to the client.
Transport-specific contact information	We require this information in order to handle transportation, i.e. to provide our services to the client.
Proof of Delivery	We require this information (e.g. name of the driver, signature of a person responsible for the consignee) in order to process transports, i.e. to provide our services to the client.

If you yourself are the client, the legal basis is Art. 6 para. 1 lit. b GDPR. If you are working for a client or a delivery recipient, the legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in being able to provide our services to the client.

6.5. Location data and integration of map services

6.5.1. As long as you as the driver have started the app, your GPS coordinates will be sent to us and passed on to the respective client and the authorized person at the client. This serves the purpose of being able to track the current location of the container. We will not transmit your location data to third parties beyond the processing described here – with the exception of the “Track & Trace” function described in the driveMybox terms of use.

6.5.2. We use the services of HERE Global B.V., Kennedyplein 222-226, 5611 ZT Eindhoven, Netherlands e-mail: privacy@HERE.com. This enables us to show you interactive maps directly on the website and/or our app and allows you to use the map function conveniently. This makes it possible to display the start and destination of a freight and to track the respective container.

HERE acts as a service provider for us in accordance with Art. 28 GDPR.

Information on HERE’s data protection can be found on their website at https://legal.here.com/en-gb/privacy/here-application-and-here-maps-privacy-supplement.

6.5.3. 6.5.3. We process this data for the respective carrier on the basis of an order processing agreement in accordance with Art. 28 GDPR. If you are a carrier yourself, we process your personal data on the legal basis of Art. 6 para. 1 lit. b GDPR.

If you are a driver for a carrier, you can also optionally share your location on the platform with the carrier.

6.6. Google Firebase

6.6.1. We use push notifications to send you instant messages to your device. For this purpose, we use the Firebase Cloud Messaging service from Google (Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001). Firebase generates a key that is made up of the driveMybox app identifier and your device identifier. This key is used to transmit the respective contents of the push messages to your device.

Google acts for us as a service provider in accordance with Art. 28 GDPR in conjunction with Art. 44 et seq. GDPR.

If you yourself are a carrier or a client, the legal basis for data processing is Art. 6 para. 1 lit. b GDPR. If you work for a client or carrier, the legal basis for the processing is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in providing our services to your employer or client.

6.6.2. We also collect data about the device used and the use of the app (e.g. the time the app was launched and any crashes) and send crash reports to Google. This enables us to diagnose and solve problems with the app. We process this data exclusively to improve the app. The data is stored anonymously.

The legal basis for the processing is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in improving the stability and security of our app and in diagnosing and solving problems.

6.6.3. Firebase requires the transfer of your personal data to the USA. To ensure an adequate level of data protection, Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. You can find more information about Google Firebase at https://firebase.google.com/support/privacy/.

6.7. Payment processing

We work together with the payment service provider Stripe (Stripe Inc. 510 Townsend Street, San Franciso, CA 94103 USA) to process payments.

Stripe processes all data for us that we process in the context of payment processing. This includes company details, billing address, e-mail address, invoice amounts, credit card numbers, account details or bank details and dates of birth (see details above). The purpose of transferring the data is to process payments between clients, carriers and us. If Stripe transfers your data to the USA, this is done on the basis of the EU-US Privacy Shield.

You can find more information on data processing at Stripe under the following link:

https://stripe.com/en-de/privacy

Stripe acts for us as an independent service provider in accordance with Art. 26 GDPR in conjunction with Art. 44 et seq. GDPR.

6.8. Digital signature

We use the provider DocuSign (DocuSign, Inc., 221 Main Street, Suite 1550, San Francisco, CA 94105, USA) to process digital signatures in connection with the Proof of Delivery (PoD).

DocuSign processes all data for us that we process as part of the Proof of Delivery. This includes the name of the driver and the signature of a person responsible for the consignee (see details above). The purpose of forwarding the data is the digital signature as proof. If DocuSign transfers your data to the USA, this is done on the basis of Binding Corporate Rules. You can find more information on this under the following link: https://www.docusign.com/trust/privacy/bcrp-privacy-code

Further information on data processing at DocuSign can be found under the following link: https://www.docusign.de/unternehmen/datenschutz

DocuSign acts for us as a processor in accordance with Art. 28 GDPR in conjunction with Art. 44 et seq. GDPR.

7 USE OF SOCIAL MEDIA

7.1. Use of our Facebook and Instagram offers.

7.1.1. We are jointly responsible for the use of our Facebook and Instagram services with Meta Platforms Ireland Limited (Facebook Ireland Limited) – hereinafter referred to as Meta – , 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, https://www.facebook.com/help/contact/540977946302970, as joint controllers pursuant to Art. 26 GDPR and the Facebook Page Insights Supplement (https://www.facebook.com/legal/terms/page_controller_addendum).

7.1.2. Meta. processes (personal) data when you use Facebook products – including when you visit our Facebook or Instagram page – even if you are not registered with any Facebook service. Facebook describes what (personal) data this is in detail, how, for what purposes and on what legal basis it is processed in its data policy (https://www.facebook.com/privacy/policy/?section_id=13-HowToContactMeta), which applies to all Facebook products. There you will also find information on how to contact Meat and on the settings options for advertisements, cookies, etc. The data may be transferred to countries outside the European Union.

7.1.3. For more information about the cookies Meta uses when you have a Facebook account, use Facebook products (including the website and apps) or visit other websites and apps that use the Meat products (including the “Like” button or other Facebook technologies), Facebook provides the cookie policy (https://www.facebook.com/policies/cookies/). Information on how you can manage information about you can also be found at this link: https://www.facebook.com/policies/cookies/.

7.1.4. When you visit our Facebook or Instagram page, Meta collects your IP address, among other things. Together with other information that Meta receives through cookies, Meta provides us, as the operator of the Meta service, with statistical information about the use of the respective service (so-called page insights). This is summarized data that shows how users interact with the site. These Page Insights may be based on personal data collected by Meta in connection with a visit or interaction of Users on or with our respective Meta Service and its content. Meta provides more information on this here: https://www.facebook.com/about/privacy.

7.1.5. We can use Page Insights to anonymously analyze reach, page views, time spent on video posts, actions (likes, comments, sharing posts) and by age, gender and location (as specified by users in their respective Facebook (meta) profiles). Settings can be made for the evaluation of the reach or corresponding filters can be set with regard to the selection of a time period, the viewing of a specific post and demographic groupings (e.g. female, 20-30 years old). This data is anonymized, aggregated and abstracted. These settings therefore do not allow us to draw any conclusions about individuals. The evaluation serves to optimize the offer on our pages for the purpose of public relations. The legal basis for this data processing is Art. 6 para. 1 lit. a and f GDPR.

7.1.6. As the provider of the information service, we do not collect or process any other data from the use of the pages.

7.1.7. Irrespective of your rights against us, you have the right to lodge a complaint with the Irish Data Protection Commission (responsible for Meta Platforms Ireland Limited (Facebook Ireland Limited)) (Art. 77 GDPR).

7.1.8. If you have specific questions about the protection of your data, please contact our data protection officer or the data protection officer of Meta Platforms Ireland Limited (Facebook Ireland Limited)) https://www.facebook.com/help/contact/540977946302970.

7.2. LinkedIn

7.2.1. As the operator of a LinkedIn page, we, driveMybox GmbH, together with the operator of the social network, LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, hereinafter referred to as “LinkedIn”: LinkedIn, controller within the meaning of Art. 26 of the General Data Protection Regulation (GDPR). When you visit our LinkedIn page, personal data is processed by the controller. In the following, we will inform you about what data is involved, how it is processed and what rights you have in this regard.

7.2.2. The use of the LinkedIn portal is governed by LinkedIn’s terms of use at https://www.linkedin.com/legal/user-agreement and the other terms and guidelines listed there. In particular, the privacy policy can be found at: https://www.linkedin.com/legal/privacy-policy and the cookie policy can be found at https://www.linkedin.com/legal/cookie-policy.

7.2.3. 7.2.4. If you have any questions regarding the processing of your personal data, information, blocking, deletion or correction of data, as well as the revocation of consents granted and objections, please contact the persons responsible. Information on the handling of personal data by LinkedIn on the LinkedIn portal can be found in their privacy policy at https://www.linkedin.com/legal/privacy-policy, in their cookie policy at https://www.linkedin.com/legal/cookie-policy and from their help pages at https://www.linkedin.com/help/linkedin?trk=microsites-frontend_legal_privacy-policy&lang=en or https://www.linkedin.com/help/linkedin?trk=microsites-frontend_legal_user-agreement&lang=en.

7.2.4. LinkedIn shows you customized ads both inside and outside its services. You can choose to be shown personalized ads, but you cannot opt out of other ads.

7.2.5. LinkedIn targets ads (and measures their performance) both inside and outside LinkedIn to members, visitors and other people, directly or through various partners. For this purpose, LinkedIn uses the following data, either in combination or separately (in some cases, your consent is required, which is requested separately):

• Data from advertising technologies both inside and outside our services, pixels, tags, cookies and device identifiers;
• Information provided by members (e.g. contact details, job title and sector);
• Data from your use of our services (for example, search history, feed, content you read, who you follow or who follows you, contacts, participation in groups, page visits, videos you watch, clicks on an ad, etc.), including as described in section 1.3;
• Information from advertising partners, providers and publishers; and
• Information that can be derived from the data listed above (e.g. use of a profile’s job titles to infer an industry, career level and pay grade; use of graduation dates to infer age or use of first names or pronoun usage to infer gender; use of your feed activity to infer your interests or use of device data to recognize you as a member).

7.2.6. LinkedIn shows you ads labeled Sponsored Content that look like similar, non-sponsored content, except that they are labeled as advertising (e.g., “ad” or “sponsored”). If you perform a social action on these ads (such as “liking”, commenting or sharing), your action will be associated with your name and may be seen by third parties. This includes the provider (driveMybox GmbH) of the advertisement. If you perform a social action on LinkedIn services, this action may (depending on your settings) be mentioned in the context of associated advertisements.

7.3. Xing

7.3.1. driveMybox GmbH is represented on Xing. If you click on the corresponding link, you will be forwarded to our posts on Xing.

7.3.2. Information on the purpose and scope of data collection and its processing by Xing can be found in the privacy policy. There you will also find further information on your rights and setting options to protect your privacy: https://privacy.xing.com/de/datenschutzerklaerung.

7.4. Use of our X-channel

We use the technical platform and services of XX Corp, 1355 Market Street, Suite 900, San Francisco, CA 94103 U.S.A. for the short message service offered here. XX International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland, is responsible for the data processing of persons living outside the United States.

We would like to point out that you use the X-short messaging service offered here and its functions at your own risk. This applies in particular to the use of the interactive functions (e.g. sharing, rating).

7.4.1. Data processed by X:

Information on what data is processed by X and for what purposes it is used can be found in X’s privacy policy: https://X.com/de/privacy

We have no influence on the type and scope of the data processed by X, the type of processing and use or the disclosure of this data to third parties. We also have no effective control options in this respect.

By using X, your personal data will be processed by X Inc. in the United States, Ireland and any other country in which X Inc. does business, regardless of your country of residence.

X processes your voluntarily entered data such as name and user name, e-mail address, telephone number or the contacts in your address book when you upload or synchronize it.

On the other hand, X also evaluates the content you share to determine which topics you are interested in. Stores and processes confidential messages that you send directly to other users and can determine your location based on location data, wireless network information or your IP address in order to send you advertising or other content.

X Inc. may use analysis tools such as X- or Google Analytics for evaluation purposes. We have no influence on the use of such tools by X Inc. If tools of this kind are used by X Inc., we have neither commissioned, approved nor supported this in any other way. The data obtained from this analysis is also not made available to us. Only certain non-personal information about tweet activity, such as the number of profile or link clicks from a particular tweet, can be viewed in our account. We have no way of preventing or disabling the use of such tools on your X account.

Due to the fact that X Inc. is a non-European provider with a European branch only in Ireland, it is bound by European data protection regulations. This applies, for example, to your rights to information, blocking or deletion of data or the possibility of objecting to the use of usage data for advertising purposes.

You have the option of restricting the processing of your data in the general settings of your X account and under “Privacy and security”. On mobile devices (smartphones, tablet computers), you can also restrict X’s access to contact and calendar data, photos, location data, etc. in the settings options there. However, this depends on the operating system used.

Further information on these points is available on the following X support pages:

• https://support.X.com/articles/105576#
• https://help.X.com/de/search?q=datenschutz

You can find out more about the possibility of viewing your own data at X here: https://support.X.com/articles/20172711#.

Information about the conclusions drawn by X about you can be found here: https://X.com/your_X_data.

Information on the available personalization and data protection setting options can be found here (with further links):

• https://X.com/personalization

You also have the option of requesting information via the X data protection form or the archive requests:

• https://support.X.com/forms/privacy
• https://support.X.com/articles/20170320#

We do not collect any data about your X account ourselves. However, the data you enter on X, in particular your user name and the content published under your account, will be processed by us to the extent that we may retweet your tweets or reply to them or also post tweets from us that refer to your account. The data you freely publish and disseminate on X is thus included by us in our offer and made accessible to our followers.

Further information on X and other social networks and how you can protect your data can also be found at www.youngdata.de.

7.4.2. X utilization concept:

Our public relations work also takes place on X. With this usage concept, we assume responsibility for the use of social media as a non-public body. Please also note our privacy policy.

X is a social network for short messages, photos and videos. Registered users can publish short messages free of charge via this service. These tweets have a limited length and are usually visible to everyone.

Users can “follow” other users so that they can read their messages in their own X-Feed.
The advantages of X are its wide reach and – in contrast to some other social networks – its legibility without the need for the user to register, as well as its usability without the use of a real name.
You can find more information about X here: https://about.X.com/de.html

7.4.3. Purpose of the use of X

The X-channels are a useful addition to the existing communication channels, such as the website, press releases, print products and events. The X-channels primarily inform users about the latest news from our business operations.

For some target groups, the “classic” instruments alone (print, website, mailing) were no longer sufficient. We realized that with X we can reach a wide circle of interested parties much more directly, quickly and on a daily basis, especially as interested recipients can subscribe to corresponding tweets. The X channel enables us to disseminate our messages far and wide, to network better with other institutions and sources of information and to react immediately to what is happening.

Furthermore, direct dialogue with readers enables us to obtain opinions and feedback in order to optimize our business activities.

7.4.4. Type and scope of use of X

We use our X-Account to inform users about news from our business operations.

7.4.5. Responsibilities for editorial/technical support:

Responsibility for editorial support lies with our management and the associated communications and media team.

7.4.6. Alternative information and contact options:

We would like to point out to users that the X channel is merely an additional option for contacting us or receiving information from us. Alternatively, the information offered via X can also be accessed via the corresponding links on our website or on the other linked websites.
You can contact us with all inquiries. Please use the information provided above.

7.4.7. Commitment

We evaluate this usage concept once a year with regard to whether and how it is used. This evaluation of the usage concept takes into account the usage figures and reach as well as the target group structure of the networks.

7.5. Use of YouTube videos

7.5.1. We have integrated YouTube videos into our online offering, which are stored on http://www.YouTube.com and can be played directly from our website.

7.5.2. With your consent, YouTube receives the information that you have accessed the corresponding subpage of our website when you visit the website. In addition, the data mentioned under No. 4.2 of this declaration will be transmitted. This occurs regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish your data to be associated with your YouTube profile, you must log out before activating the button. YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the needs-based design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right.

7.5.3. We use YouTube with your consent in order to analyze and regularly improve the use of our website. We can use the statistics obtained to improve our offer and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US data privacy framework. The actual legal basis for the use of Google Analytics is Art. 6 para. 1 lit. a GDPR. In addition, in accordance with Art. 49 para. 1 GDPR, you consent to Google processing your data in the USA if necessary. In this case, it is possible that the transmitted data will be processed by local authorities.

7.5.4. 7.4.4. For more information on the purpose and scope of data collection and processing by YouTube when you visit our YouTube channel directly, please refer to the privacy policy https://www.youtube.com/intl/ALL_de/howyoutubeworks/user-settings/privacy/. There you will also find further information on your rights and setting options to protect your privacy.

7.6. Privacy Policy TikTok Page.

7.6.1. This TikTok Page is the responsibility of driveMybox GmbH, Gasstraße 18, Haus 6b, 22761 Hamburg (hereinafter referred to as “dMb”).

7.6.2. When you visit our TikTok page, the controller TikTok collects personal user data, for example through the use of cookies. TikTok may also collect such data from visitors to the TikTok dMb page, even if you are not logged in or registered with TikTok. Information about data collection and further processing by TikTok can be found in TikTok‘s privacy policy.

7.6.3. dMb cannot influence which user data TikTok collects in detail and we are essentially unaware of this. Nor does dMb have full access to the data collected or your profile data. dMb can only see the public information of your profile that you have released in your TikTok settings. You also have the option of actively hiding your “likes” or unfollowing the page in your TikTok settings. Your profile will then no longer appear in the list of fans of this page.

7.6.4. dMb only receives anonymous statistics from TikTok about the use and utilization of the dMb page. The following information is provided here, for example:

• Followers: Number of people who follow dMb – including growth and development over a defined time frame.
• Reach: Number of people who see a specific post. Number of interactions with a post. This can be used, for example, to determine which content is better received by the community than others.
• Ad performance: What does a click cost dMb? How many people have seen an ad?
• Demographics: Average age of visitors, gender, place of residence, language.

We use these statistics, from which we cannot draw any conclusions about individual users, to constantly improve our online offering on TikTok and to better respond to the interests of our users. We cannot link the statistical data with the profile data of our fans. You can use your TikTok settings to decide how targeted advertising is displayed to you.

7.6.5. dMb receives personal data via TikTok if you actively communicate this to us via a personal message on TikTok. We use your data (e.g. first name, surname, etc.) to respond to your request in our customer service. dMb also receives personal data via TikTok if you use a form with pre-filled fields with data from your profile to transmit the data to us and actively send the data to us by clicking on a button.

7.6.6. dMb uses your data when you use the chat function in order to respond to your inquiry. The sales and customer service information collected in this way is used to contact you in order to provide you with the requested information and offers.

7.6.7. Further information on the processing of personal data by dMb and your rights can be found in our data protection information.

8 Map service Google Maps

8.1. With your consent, we use Google Maps on this website. This allows us to show you interactive maps directly on the website and enables you to use the map function conveniently.

8.2. If you have given your consent, Google will receive the information that you have accessed the corresponding subpage of our website when you visit the website. In addition, the data mentioned under No. 4.2 of this declaration will be transmitted. This takes place regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be assigned directly to your account. If you do not wish your data to be associated with your Google profile, you must log out before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the needs-based design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right.

8.3. Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the provider’s privacy policy. There you will also find further information on your rights in this regard and setting options to protect your privacy: http://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA.

8.4. We use Google Maps with your consent in accordance with Section 25 (1) TTDSG and Art. 6 (1) (a) GDPR. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US data privacy framework. In addition, in accordance with Art. 49 para. 1 GDPR, you consent to Google processing your data in the USA if necessary. In this case, it is possible that the transmitted data will be processed by local authorities.

9 NEWSLETTER

9.1. With your consent, you can subscribe to our newsletter with the support of our service provider CleverReach, with which we inform you about our current interesting offers from driveMybox.

9.2. We use the so-called double opt-in procedure to subscribe to our newsletter. This means that after you have registered, we will send you an e-mail to the e-mail address you have provided in which we ask you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 7 days, your information will be deleted. In addition, we store the IP addresses used and the times of registration and confirmation. The purpose of this procedure is to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data.

9.3. Depending on the communication channel, your first name, surname, company, address, telephone number and e-mail address are mandatory for sending the personalized newsletter. After your confirmation, we will store your e-mail address for the purpose of sending you the newsletter. The legal basis is Art. 6 para. 1 lit. a GDPR.

9.4. You can revoke your consent to the sending of the newsletter at any time and unsubscribe from the newsletter. You can declare your revocation by clicking on the link provided in every newsletter e-mail.

9.5. We would like to point out that we evaluate your user behavior when sending the newsletter. For this analysis, the emails sent contain so-called web beacons or tracking pixels, which are one-pixel image files stored on our website. For the evaluations, we link the data received from you and the web beacons with your e-mail address and an individual ID. Links received in the newsletter also contain this ID. We use the data obtained in this way to create a user profile in order to tailor the newsletter to your individual interests. We record when you read our newsletters, which links you click on in them and deduce your personal interests from this. We link this data to actions you have taken on our website. After you unsubscribe, we store the data purely statistically and anonymously. Tracking is not possible if you have deactivated the display of images in your e-mail program by default. In this case, the newsletter will not be displayed in full and you may not be able to use all the functions. If you display the images manually, the above-mentioned tracking will take place.

10 DURATION OF PROCESSING

10.1. Your personal data will be deleted after expiry of the statutory retention periods, which result, for example, from the German Civil Code (BGB), the German Commercial Code (HGB) and the German Fiscal Code (AO). If data is not affected by this, it will be deleted when the respective processing purpose has been achieved.

***