Privacy Policy
Privacy Policy
As of September 20, 2026
This Privacy Policy explains how we process personal data in connection with our website, our online store, our transportation and brokerage services, and our forms and portals. It is intended for visitors, customers, senders and recipients of shipments, job applicants, drivers, and business partners.
1. Data Controller and Contact Information
The entity responsible for the processing described here is:
Darius Alexander Saatkary
SAATKARY CARGO · Sole proprietorship
82 Bessemer Street, 10th Floor, South Wing
12103 Berlin
Germany
Email: info@saatkary.net
You can also contact us at this address if you have any questions regarding data protection or wish to exercise your rights.
2. Operation of the Website, Applications, and File Storage
Technical Access Data
When you visit our websites and portals, technical data is collected. This includes, in particular, your IP address, the time and destination of your visit, browser and device information, the amount of data transferred, the previously visited page (if provided), as well as error and security information. We need this information to deliver content, secure logins, investigate malfunctions, and detect unauthorized access.
Data processing for secure and reliable operation is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing functional and secure online services. To the extent that technical processes directly serve the contractual service you have requested, Article 6(1)(b) of the GDPR applies. Additional analytics and advertising are addressed separately in Sections 12 through 14.
Website and Online Store
Our public website and online store are hosted by Squarespace Ireland Limited (Squarespace). Squarespace processes the access, form, and order data required to deliver the pages and provide the respective website or store features. Some content is retrieved via distributed content delivery networks. For more information, see Squarespace’s Privacy Policy (https://www.squarespace.com/privacy).
Management System and Portals
Our management system, as well as the applications for drivers and customers, are operated by Render Services, Inc. (Render). The application and database services used for this purpose are located in Oregon, USA. There, we process, in particular, master data, order data, communication data, audit data, billing data, payment data, and log data. The specific data processed depends on the respective transaction and the access rights of the individuals involved. Further information: Data Protection at Render (https://render.com/privacy).
Images and Documents
We use Cloudflare R2 from Cloudflare, Inc. to store and make files available. Depending on the process, this may include, for example, application and vehicle images, driver documents, shipment photos, proof of delivery, invoices, or message attachments. For forms, original files may also be stored with Jotform. Therefore, transferring a file into our management system does not automatically mean that the original is deleted from the form provider’s system. For more information: Cloudflare’s Privacy Policy (https://www.cloudflare.com/privacypolicy/).
The storage of contract, job application, and communication data is based on the legal grounds applicable to the respective process, which we explain below. For information on processing outside the European Economic Area, please see Section 16.
3. Orders, Shipping Requests, and Other Inquiries
When you order goods from our online store, arrange for shipping, or request a quote, we process the information necessary to fulfill your request. This includes, in particular, your name, company and contact information, billing address, pickup and delivery addresses, contact person, details about the goods or shipment, desired dates, pricing and payment information, as well as order-related messages and documentation. Depending on the order, this may also include photos of the shipment, as well as necessary details regarding found or lost items and travel or flight information, to the extent that these are required for assignment and processing.
We use this data for preparing quotes, processing contracts, scheduling, delivery, invoicing, and handling inquiries or complaints. The legal basis is Article 6(1)(b) of the GDPR, provided that you are a party to the contract or are entering into a contract. We process information regarding employees of a business customer, pickup contacts, or recipients based on Article 6(1)(f) of the GDPR. Our legitimate interest is to carry out the commissioned process with the necessary contacts. Legally required records are based on Article 6(1)(c) of the GDPR.
Required information is marked accordingly on the forms or is specified in the requested order. For example, we cannot process a shipment without a shipping address. Additional information is optional. Please use the free-text fields and uploads only to provide information that is necessary for the specific transaction.
We receive data not only directly from you, but also, where applicable, from clients, senders, recipients, relevant collection points, contracted drivers, and transportation partners. This may include status updates, delivery information, and supporting documents. If you provide information about other individuals, please inform them of the context of the data transfer and this Privacy Policy.
4. Online Forms
We use Jotform for our online forms, particularly for inquiries, orders, job applications, and collaboration with business partners. In this process, the information entered, uploaded files, and technical information regarding form usage are processed. The information submitted is stored by Jotform and used by us to process the respective request. Depending on the form, it may also be transferred to our administrative system. The specific information required is indicated on the respective form. For more information, see Jotform’s Privacy Policy (https://www.jotform.com/privacy/).
The saved form responses also include your information regarding the consents displayed on the form. To the extent that we base our processing on your consent, we use these records to demonstrate consent in accordance with Article 7(1) of the GDPR.
The purposes and legal bases for processing depend on the specific matter at hand. For orders and shipping inquiries, the information in Section 3 applies; for other contact inquiries, Section 5 applies; and for job applications and health-related information, Sections 7 and 8 also apply.
5. Contact via email, phone, WhatsApp, and website chat
When you contact us, we process your contact information, the content of your message, any attached files, and the communication information necessary to handle your inquiry. Contract-related communication is based on Article 6(1)(b) of the GDPR. We process other inquiries and communications with contacts at our business partners based on Article 6(1)(f) of the GDPR; our interest lies in providing an appropriate and transparent response.
Email and Contact Management
We use Google services and Brevo for email communication and contact management. Depending on the communication channel, this involves the processing of email addresses, names, business phone numbers, messages, attachments, and shipping or delivery information. Contact information may be synchronized with our management system to ensure that authorized individuals can reach the correct contact person. This information is shared for the purpose of the respective communication and its organization. For more information, see Google (https://policies.google.com/privacy?hl=de) and Brevo (https://www.brevo.com/de/legal/privacypolicy/).
For business communications, we use WhatsApp Business from WhatsApp Ireland Limited or the relevant Meta companies. The technical integration is provided by 360dialog. In this context, we process phone numbers, messages, and attachments, as well as message identifiers and delivery information. We may transfer order-related communications to our administrative system as needed to process inquiries, orders, and supporting documents.
The processing carried out by WhatsApp for its own purposes is governed by its privacy policy. Transport encryption does not prevent a message sent to our company from being processed by the systems involved in business operations. Alternatively, you can contact us by email. For more information: WhatsApp Privacy Policy (https://www.whatsapp.com/legal/privacy-policy-eea).
Website Chat
Our website uses a chat service provided by Chatbase. Technical connection data, a chat ID, and the messages you enter may be transmitted to Chatbase, Inc. in the United States and processed to generate responses. Responses may be generated using artificial intelligence. Please do not enter any health information, copies of identification documents, or other highly confidential documents in the chat.
Article 6(1)(b) of the GDPR applies to the response to a contract-related question you have requested; for other matters, Article 6(1)(f) of the GDPR applies, based on our interest in processing your request. To the extent that the integration or recognition is not technically necessary, your consent is required pursuant to Article 6(1)(a) of the GDPR and, where applicable, Section 25(1) of the TDDDG. For more information: Data Protection at Chatbase (https://www.chatbase.co/legal/privacy).
6. Customer Account and Driver Portal
When you use a provided customer account or the driver portal, we process the information required for registration, login, and authorization verification, as well as the contract and transaction data available in your account. Depending on your role, this includes profile and contact information, login credentials, orders, documents, status information, and invoices. Technical session information enables us to identify your login.
The provision of agreed-upon account access is based on Article 6(1)(b) of the GDPR. The security measures for logins and access permissions are based on Article 6(1)(f) of the GDPR. Our interest is to prevent unauthorized access and to make information available only to authorized individuals.
If sign-in with Google is offered and you select this option, Google will transmit the identity and profile data specified in the authorization dialog, such as an account ID and your email address. We use this information to assign your account. The sign-in is initiated by your selection; any additional optional data sharing depends on your consent. Google receives information about this sign-in process.
You may request the closure of your account by contacting us at the address listed above. Data that is still required due to pending orders, legal obligations, or to safeguard legal claims must be considered separately; see Section 17 for more information.
7. Independent Drivers, Subcontractors, and Courier Partners
We work with independent drivers and subcontractors. When you apply for such a partnership and during its implementation, we process, in particular, your name, contact information, address, company information, details about the desired position, availability, language skills, and professional qualifications. Depending on the job and contractual relationship, we process information regarding vehicles as well as required proof of a driver’s license, business license, insurance, or other documentation related to the job. In addition, we may process profile and vehicle photos you have uploaded, as well as the results of our document review. This documentation is used to verify that the necessary requirements for the respective assignment are met.
For self-employed individuals who become our direct contractual partners, the necessary initiation and performance of the contract are based on Article 6(1)(b) of the GDPR. We process personal data regarding contact persons and drivers employed by a subcontractor on the basis of Article 6(1)(f) of the GDPR, to the extent necessary and after balancing the interests involved. Our legitimate interest lies in selecting suitable contractual partners and personnel, as well as in the reliable execution of orders. The processing of legally required documentation may be based on Article 6(1)(c) of the GDPR, to the extent that the respective obligation actually applies to us. Not every document is required for every activity.
During our collaboration, we also process assignment and order data, necessary contact information, delivery receipts, billing and banking information, as well as order-related communications. Factual internal notes may be stored to clarify specific incidents and to organize our collaboration. The legal basis for this is the necessary performance of the contract or Art. 6(1)(f) of the GDPR, based on the interest in transparent order processing and the assertion or defense of legal claims. To the extent that we separately process job applications, the processing required for this purpose is governed by § 26 of the BDSG; this provision does not serve as a blanket legal basis for independent subcontractors.
8. Pharmacy Inquiries and Health Data
We receive your pharmacy request, forward the necessary information to the participating pharmacy, and arrange for pickup and delivery. We do not sell medications ourselves. The pharmacy is responsible for providing pharmaceutical advice, verifying prescriptions, and dispensing medications.
When you submit a request, we process not only your contact, order, and shipping information but also the health information you provide. This information is used to process your specific pharmacy request and to forward it to the participating pharmacy as necessary. Health information regarding another person on whose behalf you are placing an order may also be involved.
The processing of your health data for the purpose of handling the pharmacy request is based on your separate, explicit consent pursuant to Article 6(1)(a) and Article 9(2)(a) of the GDPR. This consent covers the receipt, storage, and necessary processing of your information, as well as its transmission to the participating pharmacy for the purpose of processing your request and organizing pickup and delivery. It also expressly includes the AI-supported product and price determination by OpenAI described in Section 9, to the extent that health data from your medication and product information is processed in this context. We obtain this consent separately in the pharmacy form.
For technical processing, we use the form, hosting, and storage services described in this statement. The information from the separate health fields is imported into our management system according to defined rules and prepared for transmission to the pharmacy. These fields are not transferred to the AI described in Section 9 for product and price determination. Pharmaceutical review and consultation are performed by the pharmacy. Data may also be processed in the United States via the infrastructure and storage services we use; see Sections 2, 4, and 16 for details.
The information is transmitted directly to the pharmacy or, if necessary for processing at the time of pickup, via the contracted courier acting as the bearer of the request. In this case, the courier also receives the information required for this transmission. The courier’s role is limited to transmission and delivery; the pharmaceutical assessment remains the responsibility of the pharmacy. The pharmacy’s own privacy policy applies to its processing of this information. Health information is not required from every driver simply because they are delivering a shipment.
You may revoke any consent you have given at any time for the future by contacting us at the address listed above. This does not affect the processing that took place prior to the revocation. If a request cannot be processed without the relevant health data, further processing may not be possible after the revocation. If you provide information about other individuals, you must have the appropriate authority to act on their behalf or their consent.
9. Automated Analysis of Messages and Documents
We use OpenAI services to automatically analyze selected texts, images, and documents. This applies in particular to driver records, invoices, delivery receipts, order-related emails and WhatsApp attachments, the processing of Lost & found office inquiries, and product and price determination for pharmacy inquiries. The content submitted for this purpose, as well as the information, summaries, or verification results generated from it, are processed. Using a form does not automatically result in all information being transmitted to OpenAI.
For pharmacy inquiries, OpenAI can assist with searching for requested products and determining product prices. Depending on the processing step, the system uses the entered medication name, information on packaging and quantity, the ZIP code, and content from public product pages. Medication information alone may constitute health data. To the extent that health data is processed during this product and price determination, the explicit consent described in Section 8 applies. The separate health fields and uploaded health documents are not part of these AI requests. If you enter health information yourself in the medication name or package description, this information may be processed together with the relevant product text. OpenAI does not provide pharmaceutical advice or evaluate your health information in this context.
For example, the document type, name, driver’s license class, validity information, billing details, or references to an order can be identified and compared with the requirements of the transaction. The results are stored in our management system. Technical logs and selected content excerpts can be used for error analysis and to verify processing quality.
The necessary processing of your request or a separate contract is based on Article 6(1)(b) of the GDPR. For information regarding personnel employed by a subcontractor, the conditions explained in Section 7 apply. Supporting error analysis and quality control may be based on Article 6(1)(f) of the GDPR, provided that your interests do not override ours; our interest is in ensuring reliable and traceable processing. These legal bases do not permit the arbitrary further use of data. In the case of health data, the specific requirements under Article 9 of the GDPR must also be met.
Automatic Initial Screening When Onboarding Courier Partners
The processing of your application and supporting documentation required to initiate and execute a contract with you as a self-employed courier partner is governed by Article 6(1)(b) of the GDPR. The automated decision regarding your approval as a courier partner in the system, which is necessary for the conclusion of this contract, is based on Article 22(2)(a) of the GDPR. This applies to self-employed individuals with whom we are directly entering into a contractual relationship. The rights to a personal review, to present your point of view, and to challenge the decision, as explained below, remain in effect.
The review of your application begins with an automated evaluation of the documents you submitted. This process is designed to verify that you meet the requirements for employment and to process applications promptly. In particular, your driver’s license and business license are checked for completeness, legibility, document type, and validity. The information in the documents—especially your name—is compared with the details provided in your application. The recognized information and review results are saved in your driver profile.
This review results in three processing statuses:
- Approved: If the required documents are complete and are successfully reviewed, you will be automatically approved as a courier partner in the system. This allows us to send you job offers.
- On Hold – Additional Documentation or Clarification Required: If required documents are missing or cannot yet be successfully verified, approval will be withheld for the time being. You can submit any missing documentation and, for example, replace documents that are illegible or no longer valid.
- Alert – Information does not match: If the system detects inconsistencies or other anomalies that require clarification—such as a different name on a document—the transaction is flagged for further review. The transaction will not be automatically approved until the issue is resolved. The flag itself does not constitute a finding of fraud or other misconduct.
We will notify you of the outcome in all three cases. If additional information or clarification is needed, we will inform you of the missing documents or the issue identified. You can correct information, add documents, or re-upload them to allow for a re-evaluation. The processing statuses “On Hold” and “Alert” do not mean that your application has been definitively rejected; however, until they are resolved, they may prevent you from accessing job offers. Automatic evaluations may produce errors, for example, due to documents that are difficult to read or variations in spelling.
Personal Review and Correction
If problems arise, the automatic initial review may be followed by manual processing. Regardless of the status displayed, you can also request a personal review at any time at info@saatkary.net, contest the result, explain your position, and submit additional evidence. The owner of SAATKARY CARGO will then review your case, including your explanations, and may correct the automatic evaluation and the resulting approval decision.
This automated decision is subject to the rights set forth in Article 22(3) of the GDPR. These include, in particular, the right to have a person intervene, to present your own point of view, and to contest the decision. You may exercise these rights by contacting us at the address provided above.
Processing by OpenAI may involve a transfer to the United States. The provider may also implement temporary security and anti-abuse protocols. For more information on processing via the interface used, see “Data Use at OpenAI” (https://developers.openai.com/api/docs/guides/your-data).
10. Disclosure for Delivery, Shipping, and Location Features
For pickup and delivery, we provide the necessary order information to the drivers, courier and transportation companies, and, if applicable, shipping agents and lost-and-found offices. This includes, in particular, names, pickup and delivery addresses, necessary contact information, time windows, shipment details, and special delivery instructions. Status updates and delivery confirmations are reported back to the individuals authorized for the order.
The legal basis is Article 6(1)(b) of the GDPR for the performance of your contract, or Article 6(1)(f) of the GDPR for necessary information regarding other contacts and recipients. Our legitimate interest lies in ensuring reliable delivery and its documentation. For an additional, optional shipping notification offered by a shipping service provider, we use your email address or phone number based on the consent you have provided for this purpose pursuant to Article 6(1)(a) of the GDPR. You may revoke this consent at any time.
We use Google Maps and route planning services to verify addresses and calculate routes. In doing so, we process the addresses or coordinates required for the calculation. To the extent that this is necessary for the requested quote or order, Article 6(1)(b) of the GDPR applies; for address data of other involved individuals, Article 6(1)(f) of the GDPR applies, based on the interest in proper planning and execution. A map additionally embedded in the browser is addressed in Section 13.
If a tracking feature offers voluntary location sharing and you enable it, the browser may transmit your current location for the relevant status message. In this case, coordinates and their association with the event or time are recorded. This is based on your consent pursuant to Article 6(1)(a) of the GDPR and, where necessary, Section 25(1) of the TDDDG. You can prevent further access to your location in your browser or on your device. The feature described here transmits a location for a single report; it is not continuous location tracking.
11. Payments and Billing
When processing payments, we process, in particular, the name, invoice and payment amounts, payment description, transaction ID, and payment status, as well as bank or payment details, if necessary. The additional information required depends on the selected payment method. The data is used for payment processing, linking the payment to the order or invoice, issuing refunds, and complying with legal record-keeping and documentation requirements.
In our online store, we use PayPal and Stripe for payment processing. For payments related to transportation orders, we primarily use SumUp and PayPal. We also use Wise for bank transfers and payments to drivers or business partners.
The payment service provider involved in each transaction depends on the selected payment method. Depending on the selected payment method, the respective provider and the participating banks receive the order, billing, transaction, and payment data required for the transaction. Further information: PayPal’s Privacy Policy (https://www.paypal.com/de/legalhub/paypal/privacy-full), Stripe’s Privacy Policy (https://stripe.com/de/privacy), and SumUp’s Privacy Policy (https://www.sumup.com/de-de/datenschutzbestimmungen/).
The legal basis is Article 6(1)(b) of the GDPR for the performance of a contract and Article 6(1)(c) of the GDPR for compliance with legal obligations. Necessary checks to prevent fraud or to clarify an erroneous payment may be based on Article 6(1)(f) of the GDPR; our interest lies in ensuring legitimate payments and preventing losses. Payment service providers process certain data to fulfill their own legal obligations and for their own purposes as independent data controllers. Your information is provided to the relevant payment provider.
12. Cookies, Similar Technologies, and Your Choices
Our website and portals use cookies and similar technologies, such as local browser storage and pixels. For example, they can store login sessions, a shopping cart, or your privacy settings. Other technologies are used for analyzing usage, measuring performance, or serving ads.
In general, consent pursuant to Section 25(1) of the TDDDG is required to store information on your device or to access it. An exception applies, in particular, if the process is absolutely necessary pursuant to Section 25(2) of the TDDDG to provide a digital service that you have expressly requested. The GDPR also applies to the subsequent processing of personal data. For necessary contractual functions, this is Article 6(1)(b) of the GDPR; for necessary security measures and to document your privacy preferences, Article 6(1)(f) or (c) of the GDPR may apply. For optional analytics and advertising purposes, Article 6(1)(a) of the GDPR applies.
You can access the “Cookie Settings” in the footer of our website to reopen the selection menu and change or revoke your consent for the future. In addition, you can delete or block cookies and local storage in your browser. Doing so may result in the loss of saved logins, shopping carts, and settings. Deleting cookies in your browser does not automatically delete data already stored by the provider.
13. Translations, External Content, and Reviews
Multilingual Content
We use Weglot to provide multilingual content. In doing so, page content and technical connection data may be processed by Weglot. For portal visits routed through the translation service, the technical transmission path also includes the relevant connection to the portal. Translations may be stored in a translation memory. For more information, see Weglot’s Privacy Policy (https://www.weglot.com/privacy).
To the extent that processing is necessary for a language version you have requested and the agreed-upon use, it is based on Article 6(1)(b) of the GDPR. The provision of publicly accessible multilingual information is based on Article 6(1)(f) of the GDPR, in the interest of making our services comprehensible and accessible. Non-essential device identifiers or additional usage analytics require separate consent.
Maps, videos, fonts, and other embedded content
On some pages, we use external content, including Google Maps, YouTube videos, Google Fonts, and Adobe Fonts, as well as Elfsight widgets. When these elements load, your IP address, browser information, the page you are viewing, and interaction data may be transmitted to the respective provider. For registered user accounts, the provider may, in some cases, associate your visit with an existing account.
Your consent serves as the legal basis for optional embeds and the associated data transfers pursuant to Article 6(1)(a) of the GDPR and, in cases where access to the end device is not required, Section 25(1) of the TDDDG. This must be distinguished from content delivery that is strictly necessary for an explicitly requested function, which is subject to the requirements described in Section 12. Further information: Google/YouTube (https://policies.google.com/privacy?hl=de), Adobe (https://www.adobe.com/de/privacy/policy.html), and Elfsight (https://elfsight.com/privacy-policy/).
Reviews and Recommendations
We integrate reviews and recommendation ads through ProvenExpert, Trustpilot, and ProveSource, among others. In doing so, browser and connection data, pages visited, and interactions may be processed in order to display the respective ad or analyze its usage. For optional embeddings and analyses, the consent basis outlined in the previous paragraph applies. If you submit a review on a platform yourself, that platform will additionally process the profile and review data you provide there in accordance with its own privacy policy.
A simple link is different from an actively loaded embed: With a simple link, the connection to the linked page is generally established only when the page is loaded. A resource that has already been embedded, on the other hand, can begin transferring data as soon as the page is loaded.
14. Audience Measurement, Online Advertising, and Direct Marketing
Website Analytics and Advertising
Your consent is required under Article 6(1)(a) of the GDPR and, to the extent that information is stored on or retrieved from your device, under Section 25(1) of the TDDDG for the following optional analytics and advertising purposes. This may include IP addresses, cookie or device identifiers, browser and device information, pages visited, referring pages, timestamps, clicks, and other usage events.
- Google Analytics: Analysis of how our website is used, such as which pages are visited and which features are used.
- Google Ads, including DoubleClick features: Tracking whether ads lead to visits or specific actions, as well as retargeting and interest-based advertising. Identifiers and usage data may be linked to advertising systems for this purpose.
- Hotjar: Analysis of interactions and user behavior on our pages, such as click and scroll behavior. Depending on the feature used, this may include a reconstructed view of a visit.
- LinkedIn Insight: Attributing visits or actions to LinkedIn ads, audience targeting, and campaign analysis. If you have an existing LinkedIn account, LinkedIn can perform this attribution.
- ShareThis, a service provided by Predactiv: Provides sharing functions and collects usage and interaction data. The provider may also link such data with other data to create interest profiles and for advertising purposes, and may share it with business partners.
- Tradedoubler: Attribution of visits or purchases to affiliated advertising partners and billing for the corresponding referrals.
Our website also incorporates TrafficGuard features designed to detect invalid or abusive ad impressions. To the extent that advertising identifiers, cross-device associations, or non-essential device access are used for this purpose, consent is also required. A separate security check, limited to necessary connection data, may be based on Article 6(1)(f) of the GDPR; the legitimate interest lies in preventing specific instances of abuse and avoiding costs caused by fraud.
For more information: Google (https://policies.google.com/privacy?hl=de), Hotjar (https://www.hotjar.com/legal/policies/privacy/), LinkedIn (https://www.linkedin.com/legal/privacy-policy), ShareThis (https://sharethis.com/privacy/), and Tradedoubler (https://www.tradedoubler.com/privacy-policy). These providers may process data outside the European Union; Section 16 explains the applicable requirements in this regard.
Newsletters and Advertising to Existing Customers
If you subscribe to a newsletter we offer, we will use your email address and, if applicable, the information you provide to address you personally in our mailings. The legal basis for this is your consent under Article 6(1)(a) of the GDPR. We process the record of your registration and consent, to the extent necessary, to fulfill our record-keeping obligations. You can unsubscribe from the newsletter at any time by clicking the unsubscribe link or by sending us a message.
Under the conditions set forth in Section 7(3) of the German Unfair Competition Act (UWG), we may also use an email address obtained during a sale for our own similar goods or services. This requires, in particular, that you have not objected and that you are informed of the option to object free of charge at the time of collection and each subsequent use. The legal basis for data processing is Article 6(1)(f) of the GDPR; our legitimate interest is to inform existing customers about relevant offers of our own. You may object at any time without incurring any costs other than the transmission costs according to standard rates.
The newsletter may be sent via the email service provider specified in Section 5. Personalized tracking of opens and clicks must be distinguished from mere delivery and, where necessary, requires separate consent. Subscribing to a newsletter does not constitute blanket consent to any form of performance tracking.
Direct Mail Advertising
To the extent that we use your address to send you product information by mail, we do so on the basis of Article 6(1)(f) of the GDPR. Our interest lies in reaching out to customers and prospective customers regarding our offerings. You may object to this use at any time by contacting us at the address provided above.
15. Our Social Media Presence
Through our website, we provide links to our company profiles on social media platforms, specifically Facebook, Instagram, LinkedIn, X, and YouTube. When you view our content there or communicate with us, we process the profile information, posts, reactions, and messages visible to us for informational and communication purposes. The legal basis is Article 6(1)(f) of the GDPR, based on our interest in presenting our company and engaging with prospective clients; for specific contractual inquiries, the legal basis is Article 6(1)(b) of the GDPR.
In addition, the respective platform processes data for its own purposes, such as to create user profiles or for advertising. For certain statistical analyses of company websites, we may share responsibility with the platform operator. You can find the applicable privacy policies and agreements on the respective platform. This classification does not apply across the board to all of a provider’s services. You can contact us with any concerns regarding our processing and contact the platform operator regarding the platform’s own processing.
16. Recipients and Processing in Other Countries
Within our company, individuals are granted access to the extent that they need the data to perform their duties. Outside our company, depending on the specific process, recipients include, in particular, IT, hosting, form, storage, and communication service providers; the relevant payment and transportation service providers; pharmacies; lost-and-found offices; and, where applicable, tax advisors, legal advisors, and competent government authorities.
Service providers who process personal data in accordance with our instructions must be distinguished from recipients who perform their own contractual or legal obligations. The latter may be responsible in their own right, particularly in the case of payment services, transportation services, pharmaceutical care, and social networks. Data is disclosed on a purpose-specific basis; not every recipient listed receives all data.
With the services described, data may be processed outside the European Union or the European Economic Area. This applies in particular to the United States. Our rendering, application, and database services are based in Oregon, U.S.A. Processing or remote access may also take place in the United States by U.S. providers and their international corporate groups. The fact that a European contractual partner is based in Europe does not, in and of itself, preclude such access.
In addition to the legal basis for processing, a transfer requires a basis under Chapter V of the GDPR. The EU-U.S. Data Privacy Framework permits transfers to appropriately certified U.S. companies, provided that the certification covers the specific data processing in question. Otherwise, the European Commission’s Standard Contractual Clauses—along with the necessary reviews and, where applicable, supplementary safeguards—may be considered. Consent to cookies does not constitute a blanket basis for all transfers of contractual or job application data.
For the central infrastructure and processing services, the published data protection provisions stipulate the following rules for data transfers:
- Render: Render Services, Inc. is certified under the EU-U.S. Data Privacy Framework for data outside the scope of employment relationships. For transfers collected in this manner, the Adequacy Decision pursuant to Article 45 of the GDPR applies. Render’s data protection agreement (https://render.com/dpa) also includes standard contractual clauses for transfers where they are required.
- Squarespace: Transfers to the certified entity Squarespace, Inc. are governed by the Data Privacy Framework. For transfers not covered by this framework, Squarespace’s Privacy Policy (https://www.squarespace.com/dpa) provides for standard contractual clauses.
- Cloudflare: Cloudflare’s Data Protection Agreement (https://www.cloudflare.com/cloudflare-customer-dpa/) provides for the Data Privacy Framework for collected transfers and for Standard Contractual Clauses with supplementary safeguards for other limited transfers to third countries.
- Jotform: In its Privacy Policy (https://www.jotform.com/privacy/), Jotform describes its certification and data processing practices based on the EU-U.S. Data Privacy Framework. It does not guarantee that all form data will be stored exclusively in Europe.
- OpenAI: In accordance with OpenAI’s Data Protection Agreement (https://openai.com/policies/data-processing-addendum/), OpenAI Ireland Limited processes data from the European Economic Area. Transfers to affiliated companies or other recipients outside this area are made in accordance with these terms, based on standard contractual clauses or an applicable adequacy decision.
You may request information regarding the legal basis for the transfer of your data and, if applicable, a copy of the relevant safeguards by contacting us at the address listed above.
17. How Long Data Is Retained
Retention is determined by the specific purpose, the status of the process, and the applicable legal obligations. The following criteria are decisive:
- Inquiries and communication: until the matter has been fully resolved and the documents are no longer needed for a subsequent contract, traceable case processing, or the protection of legal claims.
- Orders, shipping orders, and billing: for the execution and processing of the transaction; thereafter, to comply with the relevant statutory retention requirements, particularly under commercial and tax law, and, where applicable, to assert or defend against claims.
- Applications: for the application process and, thereafter, only to the extent that there is a legitimate need for evidence or a legal obligation. Upon commencement of a working relationship, the necessary information will be transferred to the relevant administrative system. Any inclusion in an applicant pool beyond this requires a separate legal basis.
- Driver, partner, and activity records: for as long as they are needed for the specific collaboration, to verify eligibility requirements, and, if necessary, for subsequent documentation. Replaced or expired documents must be evaluated separately based on this purpose.
- Health information: only for as long as it is necessary for the specific authorized purpose or as long as a specific statutory retention requirement applies. A single transport incident does not, in and of itself, justify the blanket, permanent retention of medical details.
- Technical logs and security data: for the necessary operational and security analysis or the investigation of a specific incident. If an incident is detected, the process of preserving the necessary evidence may take longer than for routine access requests.
- Consents and opt-outs: Records of consent for the required retention period; information regarding an opt-out, if applicable, in a limited opt-out list so that the opt-out is honored in future mailings.
If the basis for retention no longer applies, personal data must be deleted or effectively anonymized. If a statutory retention requirement precludes deletion, its use must be limited to the purposes permitted under that requirement. In addition to entries in the administrative system, this must also take into account original forms, uploaded files, copies of messages, and associated reports. Backup copies are subject to their backup and overwrite cycle; a restoration must not permanently override a previously effective deletion or restriction on use.
18. Your Privacy Rights
Subject to the legal requirements, you have the following rights in particular:
- Information regarding the processing of your personal data and a copy of such data pursuant to Article 15 of the GDPR;
- Rectification of inaccurate information or completion of incomplete information pursuant to Article 16 of the GDPR;
- Erasure pursuant to Article 17 of the GDPR and restriction of processing pursuant to Article 18 of the GDPR;
- Data portability under Article 20 of the GDPR for the data you have provided, provided that the conditions are met;
- Withdrawal of consent pursuant to Article 7(3) of the GDPR, effective for the future;
- File a complaint with a data protection supervisory authority pursuant to Article 77 of the GDPR, in particular at your usual place of residence, workplace, or at the location of the alleged violation. For our company, headquartered in Berlin, you may contact the Berlin Commissioner for Data Protection and Freedom of Information (https://www.datenschutz-berlin.de/). You retain the right to contact the supervisory authority in the federal state where you reside.
Right to Object
If processing is based on Article 6(1)(e) or (f) of the GDPR, you may object under Article 21(1) of the GDPR for reasons related to your particular situation. We will then no longer process the data in question unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.
You may object to the use of your personal data for direct marketing at any time without providing a reason. This also applies to profiling, to the extent that it is related to such direct marketing. The data will then no longer be used for these purposes.
To exercise your rights, simply send a message to info@saatkary.net. If necessary, we may ask for additional information to verify your identity and prevent unauthorized persons from accessing your data. We will notify you of the outcome of your request within the statutory time limits.