1Controller and data protection officer
This policy explains what happens to personal data when you visit swobbee.com. It describes what we actually do — not what a website of this kind might do.
Controller under Art. 4(7) GDPR
Swobbee GmbH · Johann-Hittorf-Straße 8 · 12489 Berlin · Germany
Phone +49 30 587 04 70 00 · info@swobbee.com
Managing directors: Thomas Duscha, Ludwig Speidel · Amtsgericht Charlottenburg, HRB 185134 B
Data protection officer
Kevin Goebel · k.goebel@swobbee.com
Postal address as above, marked „Datenschutzbeauftragter“.
2What this website does and does not do
We say this first because it answers most of the questions people have:
- Analytics only with your consent. We use Google Analytics, and only if you press “Allow” in the notice at the bottom of the page (section 12). There is no advertising pixel and no other tracking tool.
- No cookies without consent. Cookies are only set by Google Analytics, and only after you allow it.
- No geolocation. We do not look up your location from your IP address. Which region you see is decided by what you click, and by nothing else.
- No fonts or scripts from third parties before you decide. Fonts are served from our own domain. Nothing is loaded from Google unless you allow analytics or press play on a video.
- No profiling and no automated decision-making under Art. 22 GDPR.
3Server log data
When you open a page, your browser necessarily transmits data to the server that delivers it. Our hosting provider, ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, records this in a log file: IP address, date and time, the page requested, the referring page, browser and operating system, and the amount of data transferred.
Purpose: delivering the site, operational security and error analysis. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a site that works and is not abused. Retention: IP addresses in the log files are stored in shortened (anonymised) form; the log files are deleted after 7 days. Our hosting provider processes this data on our behalf under a data processing agreement (Art. 28 GDPR), on servers in Germany.
4Storage on your device
Name: swobbee_region — stored in your browser’s sessionStorage, not as a cookie.
Content: the value eu or us — whichever region you selected.
Duration: until you close the browser tab. It is not transmitted to us and does not identify you.
Legal basis: § 25(2) no. 2 TDDDG. Storing the choice you just made is necessary to provide the service you asked for, so it needs no consent. You can clear it at any time in your browser settings.
In addition, your browser stores your answer to the analytics question under swobbee_consent (localStorage), and Google Analytics sets cookies if you allowed it. Both are described in section 12.
5Contact forms
On our contact and partner pages you can send us an enquiry. We process the details you enter there — name, organisation, email address, country, role and your message — solely in order to answer you.
Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns a contract or its initiation, otherwise Art. 6(1)(f) GDPR — our legitimate interest in answering enquiries addressed to us. Providing the data is voluntary; without it we cannot reply.
Processing: the form is sent to the server that hosts this website and from there to a Swobbee mailbox. A copy is also held on that server for two months as a fallback against failed mail delivery; it sits outside the publicly reachable area, is readable only by signed-in Swobbee staff, and is deleted automatically when the two months are up. Our mailboxes are provided by Microsoft (Microsoft 365, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) under a data processing agreement. Microsoft stores this data within the EU Data Boundary.
Transfer to a third country: the web server is in the European Union, and Microsoft processes mailbox data within the EU Data Boundary. Access by Microsoft Corporation in the USA, for example for support or security purposes, cannot be ruled out entirely. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework; the European Commission has found that this framework ensures an adequate level of protection (Art. 45 GDPR).
No data is transmitted before you press the send button.
Retention: we keep enquiries for as long as needed to deal with them, and afterwards for up to three years so that we can follow up on the exchange. Statutory retention obligations under commercial and tax law remain unaffected.
6Job applications
Applications reach us either through the form on our careers page or by email to the address shown below that form. If you attach a CV, the file is sent to us by email and is also stored on our server as a fallback, so that an application is not lost if mail delivery fails. That store sits outside the publicly reachable part of the server and can only be opened by Swobbee staff who are signed in. Everything in it — message and attachment — is deleted automatically two months after it arrives. We process the documents you send in order to assess your application. Legal basis: Art. 6(1)(b) GDPR — steps taken at your request before entering into an employment relationship.
Retention: if we do not make an offer, we delete your documents six months after the process ends. That period covers the limitation period under the German General Equal Treatment Act. We keep them longer only if you have agreed to be considered for future roles.
7Video and location map
Our home page and our rider pages embed videos hosted on YouTube. It is not loaded when the page opens. You see a preview with a play button, and only when you press it does your browser connect to youtube-nocookie.com. From that moment YouTube receives your IP address and can store information on your device. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process data on servers of Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the European Commission has found that this framework ensures an adequate level of protection (Art. 45 GDPR). Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG — your consent, given by pressing play. You can withdraw it by reloading the page without pressing play.
Location map. Our station page can show a map of all Swobbee Stations from our US station portal at admin.us.swobbee.io, operated by Swobbee. It is not loaded when the page opens. Only when you press “Load map” does your browser connect to that server, which then receives your IP address and the usual technical request data. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG — your consent, given by pressing the button. You can withdraw it by reloading the page.
8Service providers
- Web hosting and form processing: ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, see sections 3 and 5
- Web analytics: Google Ireland Limited — only with your consent, see section 12
- Email (form delivery and applications): Microsoft Ireland Operations Limited (Microsoft 365), see section 5
- Video: Google Ireland Limited — only after you press play, see section 7
Where a provider processes personal data on our behalf, we have a data processing agreement in place under Art. 28 GDPR.
9Your rights
Under the GDPR you have the right to:
- Access (Art. 15) — ask what data we hold about you
- Rectification (Art. 16) — have inaccurate data corrected
- Erasure (Art. 17) — have data deleted
- Restriction (Art. 18) — have processing limited
- Data portability (Art. 20) — receive your data in a structured format
- Withdraw consent (Art. 7(3)) — with effect for the future
Right to object under Art. 21 GDPR. Where we process data on the basis of a legitimate interest — that is the server logs in section 3 and, in part, the contact forms in section 5 — you may object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
To exercise any of these rights, write to privacy@swobbee.com or to our data protection officer at k.goebel@swobbee.com.
Right to lodge a complaint (Art. 77 GDPR). You may complain to a supervisory authority, in particular in the member state of your residence or workplace. The authority responsible for us is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit · Alt-Moabit 59–61 · 10555 Berlin · Germany
10Data security
The site is delivered over an encrypted connection (HTTPS/TLS). We use access controls, keep our systems updated and train the people who work with personal data. No system can be fully secure; we continuously improve our safeguards.
11Children
This website is not directed at children. We do not knowingly process data of persons under 16. If you believe we have, please tell us and we will delete it.
12Web analytics (Google Analytics)
With your consent we use Google Analytics 4 on all pages of swobbee.com, including the rider sign-up pages. When you first visit, a notice asks whether we may do so. Only if you press “Allow” does your browser load Google Analytics. It then records which pages you view, how you got there and how you use them (for example clicks and time on page), together with device, browser, approximate location and your shortened IP address. Cookies beginning with _ga are set for this, for up to two years.
Purpose: to understand how the website is used and to improve it. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process data on servers of Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has found an adequate level of protection (Art. 45 GDPR). Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. Retention: analytics data is deleted after 14 months.
Your choice and how to change it. Your answer is stored in your browser under swobbee_consent (localStorage) so that we do not ask on every page (§ 25(2) no. 2 TDDDG). You can withdraw your consent at any time with the “Cookie settings” link at the bottom of every page; Google Analytics stops on the next page load. If you decline, nothing is loaded from Google.
13Rider sign-up pages
Our pages for delivery riders in New York (swobbee.com/deliverusa/ in English, Spanish, French and Arabic, and swobbee.com/riders/ in English, Spanish and French) load additional content in the following points.
Google Analytics runs only with your consent, as described in section 12. Your choice applies to the rider pages and the rest of swobbee.com alike.
Station map — only after a click. The map is not loaded when the page opens. Only when you press “Show the map” does your browser load map tiles from CARTO (CartoDB Inc., USA), based on OpenStreetMap data. CARTO receives your IP address. By pressing the button you consent to this, including the transfer to the USA (Art. 6(1)(a) and Art. 49(1)(a) GDPR). The list of stations below the map works without any third-party service.
Videos. The videos work as described in section 7: they load from YouTube only when you press play.
WhatsApp. The buttons to chat with us open WhatsApp (WhatsApp Ireland Limited). Nothing is transmitted before you tap one of them.
14Changes to this policy
We update this policy when our processing changes or the legal position does. The current version always applies, and the date at the top of this page tells you when it was last revised.