This English translation is provided for information only. Only the German version is legally binding.

1. Data protection at a glance

General information

The following information provides an overview of what happens to your personal data when you use MiFaZ or our other websites.

Personal data is any information that can be used to identify you personally. This includes, for example, your email address, your phone number, your username or messages that you send via MiFaZ.

More detailed information can be found in the following sections of this privacy policy.

Who is responsible for data processing?

The controller is:

JaSt-IT / MiFaZ
Dipl.-Inform. Inna Janssen
Im Wendischen Dorfe 1A
21335 Lüneburg
Germany

Phone: 04131 9275379
Email: info@mifaz.de

The full provider information can be found in the imprint.

How do we collect your data?

Some data is collected because you provide it to us yourself. This happens, for example, when you:

• create a user account;
• fill in a profile;
• offer or search for a ride;
• upload an image;
• write a chat message;
• enter a phone number;
• use a contact or report form;
• contact us by email or phone.

Other data is generated automatically when you use our websites. This mainly includes technical data such as your IP address, the browser used, the operating system and the time a page was accessed.

What do we use your data for?

We use your data in particular:

• to provide MiFaZ technically;
• to manage user accounts;
• to display ride offers and ride requests;
• to match suitable carpools;
• to enable users to contact each other;
• to check uploaded images;
• to prevent misuse and illegal content;
• to process support requests and reports;
• to determine whether a carpool has been formed;
• to keep listings up to date;
• to comply with legal obligations.

What rights do you have?

Within the scope of the statutory requirements, you have, among other things, the right:

• to obtain information about your stored data;
• to have incorrect data rectified;
• to request the erasure of your data;
• to have the processing of your data restricted;
• to receive certain data in a portable format;
• to withdraw consent;
• to object to certain processing;
• to lodge a complaint with a data protection supervisory authority.

You can contact us about this at any time.

2. General information on data processing

Legal bases

We only process personal data if there is a legal basis for doing so.

This may be in particular:

• Art. 6(1)(a) GDPR: you have given your consent;
• Art. 6(1)(b) GDPR: the processing is necessary for the use of MiFaZ or for a contract;
• Art. 6(1)(c) GDPR: we have to comply with a legal obligation;
• Art. 6(1)(f) GDPR: we or a third party have a legitimate interest in the processing and your rights do not override this interest.

Retention period

We only store personal data for as long as it is needed for the respective purpose.

It is then deleted, unless there are statutory retention obligations, ongoing legal disputes, misuse investigations or other legally permissible reasons for further storage.

Recipients of data

Personal data may be disclosed in particular to the following recipients:

• hosting and IT service providers;
• email and communication service providers;
• Google as part of the automatic image check;
• Mitfahren-BW and other users of the public application programming interface;
• authorities or courts, if we are legally obliged to do so.

Where service providers process data only on our behalf, we conclude the data processing agreements required by law with them.

Processing outside the European Union

With individual service providers, data may be processed outside the European Union or the European Economic Area.

Such processing only takes place if the statutory requirements are met. These include in particular an adequacy decision of the European Commission or appropriate contractual data protection safeguards.

3. Hosting and technical provision

Hosting with Hetzner

Our websites and MiFaZ are hosted by the following provider:

Hetzner Online GmbH
Industriestraße 25
91710 Gunzenhausen

When our websites are accessed, Hetzner processes technical connection data.

We use Hetzner to provide our websites securely and reliably. The legal basis is Art. 6(1)(f) GDPR.

A data processing agreement is in place with Hetzner.

Further information can be found at:

https://www.hetzner.com/de/rechtliches/datenschutz/

Server log files

When you visit our websites, technical data is stored automatically. This may include:

• IP address;
• date and time of access;
• page or file accessed;
• amount of data transferred;
• previously visited page;
• browser type and browser version;
• operating system;
• error messages.

We need this data to provide the websites technically, to detect errors and to fend off attacks.

The legal basis is Art. 6(1)(f) GDPR.

The data is deleted as soon as it is no longer needed for secure operation and error analysis. In the event of a specific security incident, individual log data may be stored for longer.

Technically necessary cookies

Our websites only use cookies and comparable storage technologies that are technically necessary for the operation of the website and for the functions you request.

They are needed, for example:

• to maintain a session;
• to recognise logged-in users;
• to protect forms and user accounts;
• to store technically necessary settings.

Depending on their function, the cookies are deleted at the end of the session or when the intended storage period expires.

They are stored on the basis of § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act).

The associated processing of personal data takes place on the basis of Art. 6(1)(b) or (f) GDPR.

4. Registration and user account

A user account is required for certain MiFaZ functions.

In this context, we process in particular:

• username;
• email address;
• password in encrypted form;
• first and last name, if applicable;
• phone number;
• time of registration;
• time of last use;
• user account settings;
• technical login information.

Mandatory information is marked accordingly in the registration form.

We need this data to set up the user account and to provide the MiFaZ functions.

The legal basis is Art. 6(1)(b) GDPR.

As a rule, the data is stored for as long as the user account exists. After the account has been deleted, the data is removed, unless there are statutory or other legally permissible reasons for further storage.

5. Profiles and ride listings

Publicly visible information

Users can publish a profile as well as ride offers or ride requests.

Depending on the information provided, the following may in particular be publicly visible:

• username;
• profile picture;
• vehicle picture;
• description;
• start, destination and intermediate locations;
• travel times, date or days of the week;
• vehicle details;
• time the listing was created and last changed.

This information can also be accessed without registration.

The following in particular is not publicly visible:

• the stored email address;
• a phone number that has not been explicitly released;
• internal chat messages;
• password and login data;
• other account data not intended for publication.

Please do not publish private contact details or other information that should not be publicly visible in free-text fields.

Publication serves to arrange carpools. The legal basis is Art. 6(1)(b) GDPR.

Public content may be captured and cached by search engines or other internet services. Such copies may therefore still be findable for a limited time after deletion.

Ride offers and ride requests

When a listing is posted, we process in particular:

• start and destination;
• possible intermediate stops;
• date, time or days of the week;
• regularity of the ride;
• free or wanted seats;
• description;
• username;
• profile or vehicle picture;
• vehicle details;
• time of creation and last change;
• assignment to the user account.

This data is needed to display the listing, find suitable rides and enable users to make contact.

The legal basis is Art. 6(1)(b) GDPR.

Listings are stored until they are deleted, deactivated or removed because they have expired.

Location and route data

To search for suitable carpools, we process the specified start, destination and intermediate locations as well as route and geodata derived from them.

As a rule, MiFaZ does not require exact addresses. Please only provide the level of precision needed for matching.

The legal basis is Art. 6(1)(b) GDPR.

6. Application programming interface (API) and data partners

MiFaZ provides a documented application programming interface, known as an API. The interface description is publicly accessible.

The API itself can only be used with an API token issued by us. Interested organisations must first contact us, describe the intended purpose of use and conclude an agreement on the use and processing of the data.

Once this agreement has been concluded, a personal API key can be issued. It may not be passed on to unauthorised third parties.

Only the publicly visible ride offers and ride requests released for the agreed purpose can be retrieved via the API. These may include in particular:

• username;
• start, destination and intermediate locations;
• date, travel times or days of the week;
• description of the listing;
• profile or vehicle picture or a reference to it;
• time of creation and last change;
• technical identifiers;
• link to the listing.

The following in particular is not provided via the API:

• email addresses;
• phone numbers;
• internal chat messages;
• passwords and login data;
• other non-public account data.

The API serves in particular to integrate MiFaZ listings into other mobility services, to make them easier to find and to support the arrangement of carpools.

The legal basis for providing the public listing data is Art. 6(1)(f) GDPR. Our legitimate interest and that of the users lie in a wider reach of the listings and better chances of finding a match.

API partners may only use the retrieved data for the agreed purpose and in accordance with the agreement concluded. If a listing is changed or deleted on MiFaZ, the API partners must update their data accordingly and delete data that is no longer needed.

Current API partners

The current users of the API include in particular Mitfahren-BW. There, suitable MiFaZ listings are integrated into a comprehensive mobility service.

Further information on Mitfahren-BW can be found at:

https://mitfahren-bw.de/

8. Regional MiFaZ portals

MiFaZ is in some cases offered under regional web addresses for districts, municipalities, companies, associations or other organisations.

JaSt-IT operates the technical platform and, as a rule, is itself the controller for the processing of users' personal data.

The regional contractual partners mainly provide the regional access and the regional look and feel. As a rule, they are neither operators of the MiFaZ platform nor providers of the arranged rides.

Regional contractual partners may receive aggregated statistics, for example on visitor numbers, search queries or successful matches. Insofar as these statistics do not allow conclusions to be drawn about individual persons, they are not personal data.

Should a regional contractual partner receive or itself collect personal data in an individual case, the users concerned will be informed of this separately.

9. Contact between users

Internal chat system

Registered users can communicate with each other via the internal chat system.

In this context, we process in particular:

• sender and recipient;
• content of the message;
• time of transmission;
• assignment to the conversation and to the listing;
• technical delivery or read status, where available.

The processing serves to enable users to make contact and organise carpools.

The legal basis is Art. 6(1)(b) GDPR.

Chat messages are automatically deleted three years after they were created.

If a conversation then no longer contains any messages, the conversation is deleted as well.

When a user account is deleted, the content of the messages sent from this account is removed. Instead, a notice that the message has been deleted may remain visible to other participants in the conversation.

Longer storage may be necessary if a message is the subject of a report, a misuse investigation or a legal dispute.

Display of a phone number

Users can voluntarily release a phone number for contact purposes.

The phone number is only displayed to another user after that user has explicitly triggered the display using the button provided for this purpose.

In this context, we may store in particular:

• which user displayed the phone number;
• which listing the contact related to;
• time of display;
• assignment to the user accounts involved.

This processing serves:

• to provide the contact function;
• to protect against misuse;
• to ask later whether a carpool has been formed.

The legal basis is Art. 6(1)(b) GDPR.

Insofar as the data is used to prevent or investigate misuse, the processing is additionally based on Art. 6(1)(f) GDPR.

10. Success and up-to-dateness follow-ups

Success follow-ups

If a user sends a chat message or has a phone number displayed, we may later send the users involved an email asking whether a carpool has been formed.

In this context, we process in particular:

• the user accounts involved;
• the listing concerned;
• type and time of contact;
• the email addresses;
• the answers to the follow-up.

The information helps us:

• to determine whether matches were successful;
• to evaluate MiFaZ statistically;
• to improve the service;
• to identify outdated or unsuitable listings.

The processing is based on Art. 6(1)(b) and (f) GDPR.

Up-to-dateness follow-ups

At regular intervals, in particular after six months, we may ask by email whether a listing is still up to date.

In this context, we process in particular:

• email address;
• user account;
• listing concerned;
• date of creation and update;
• answer to the follow-up.

The processing serves to avoid outdated listings.

The legal basis is Art. 6(1)(b) and (f) GDPR.

System and service messages

We use the email address stored in the user account for necessary messages, for example:

• to confirm registration;
• to reset the password;
• for the security of the user account;
• on chat and contact activities;
• on success and up-to-dateness follow-ups;
• on important changes or technical faults;
• to process support cases and reports;
• on deleted content or accounts.

The legal basis is Art. 6(1)(b) GDPR. Security-related messages may additionally be based on Art. 6(1)(f) GDPR.

11. Automatic image check with Google Cloud Vision

Profile and vehicle pictures uploaded by users are automatically checked with the Google Cloud Vision API before they are published.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

In this context, the following in particular is processed:

• the uploaded image;
• technical information about the request;
• the automatic check result;
• the assignment to the user account.

The check is intended in particular to detect:

• potentially illegal content;
• pornographic content or content harmful to minors;
• violence-related content;
• images unrelated to the purpose;
• text or contact details within an image.

If an image is flagged during the automatic check, it is not published.

If you believe that an image was rejected wrongly, you can contact us via our contact form. We can then check the image manually and approve it if appropriate.

The processing is based on Art. 6(1)(f) GDPR.

Our legitimate interests lie in protecting users, preventing illegal or unsuitable content and enforcing our Terms of Use.

Anyone who does not want an automatic check by Google Cloud Vision cannot use the image function.

We use the synchronous Google Cloud Vision API. According to Google, the images are only processed in memory and are not permanently stored on a storage medium. According to Google, it does not use the images to train or improve its models.

Technical metadata about the API request may be stored temporarily by Google.

Further information can be found at:

https://cloud.google.com/vision/docs/data-usage

https://policies.google.com/privacy

A data processing agreement is in place with Google.

12. Moderation and reporting of content

Review of content

Content may be reviewed if:

• we notice it while operating MiFaZ;
• a user or third party reports content;
• an authority or a court informs us;
• there are specific indications of a violation of the law or of the Terms of Use.

In this context, we may process in particular:

• the content concerned;
• information about the user who published it;
• information provided by the person submitting the report;
• related messages and log data;
• internal review notes;
• warnings;
• decisions taken.

The processing serves to protect users and to ensure the secure and lawful operation of MiFaZ.

Depending on the case, the processing is based on Art. 6(1)(b), (c) or (f) GDPR.

Automatic check for spam and phishing

Contact requests and chat messages are automatically checked for spam, phishing and other misuse. For this purpose, we may process the content of the message, user account information, technical identifiers, included links and information on the time and frequency of sending.

Depending on the result, a message may be flagged, withheld or not sent. In the case of repeated or serious misuse, individual communication functions or the user account may also be blocked temporarily or permanently. Suspicious activities and measures taken may be reviewed by authorised staff. If you consider a measure to be unjustified, you can contact us using the contact details given above and request a review.

The check takes place within the MiFaZ systems that we operate ourselves. Messages are not transmitted to external AI or moderation services for this purpose.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interests lie in protecting users from fraudulent or unwanted messages and keeping the MiFaZ communication functions secure and working.

As a rule, check results and associated references are stored for a maximum of 90 days. Decisions on measures as well as access and change logs may be stored for up to 180 days for evidence and security purposes. Insofar as data is needed for longer to handle a specific incident or to fend off further attacks, it is only stored for the period required for this.

You can object to the processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation. You can also use the contact details given above for this purpose.

Reports under the Digital Services Act

Users and third parties can report allegedly illegal content via our DSA report form.

In this context, we process in particular:

• name and contact details of the person submitting the report, if provided;
• location of the content;
• reasons for the report;
• information about the user concerned;
• correspondence and review notes;
• the decision taken.

The processing is carried out to comply with legal obligations on the basis of Art. 6(1)(c) GDPR.

The data is stored for as long as necessary to process and document the report and for possible legal claims.

Warnings and account deletions

In the event of violations of the Terms of Use, content may be deleted and users may be warned. In the event of serious or repeated violations, the user account may also be deleted.

Information about the violation and the decision may continue to be stored temporarily if this is necessary:

• to handle a complaint;
• to prevent abusive re-registrations;
• to comply with legal obligations;
• to enforce or defend legal claims.

13. Contacting JaSt-IT

Contact form

When you use our contact form, we process:

• your contact details;
• the content of your request;
• time and technical details of the transmission;
• where applicable, information about a user account, listing or image.

We use this data to process your request.

If the request relates to your user account or a contractual relationship, Art. 6(1)(b) GDPR is the legal basis.

For general requests, the processing is based on Art. 6(1)(f) GDPR.

The data is deleted once the request has been fully processed and there are no statutory or other reasons for further storage.

Contact by email or phone

When you contact us by email or phone, we process the data you provide in order to deal with your request.

Depending on the content of the request, the processing is based on Art. 6(1)(b) or (f) GDPR.

14. Newsletter

When you subscribe to our newsletter, we process in particular:

• your email address;
• time of subscription;
• time of confirmation;
• technical data on the subscription;
• voluntary information, if you provide any.

The processing is based on your consent in accordance with Art. 6(1)(a) GDPR.

As a rule, we use the double opt-in procedure for confirmation. You receive an email in which you must confirm your subscription.

You can unsubscribe from the newsletter at any time via the unsubscribe link or by notifying us.

After you unsubscribe, your email address may be stored in a block list. This prevents us from contacting you again by mistake.

15. Blog and comments

We run a blog on www.die-mitfahrzentrale.de.

When you leave a comment there, we process in particular:

• the published comment;
• the name provided;
• the email address provided;
• the time of creation;
• IP address and technical log data, insofar as these are stored.

We need this data to publish comments and to detect misuse or illegal content.

The legal basis is Art. 6(1)(f) GDPR.

Antispam Bee

To detect spam, we use the WordPress plugin “Antispam Bee” in the blog.

The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting the blog from spam.

16. OpenStreetMap

For maps and routes, we use map data from OpenStreetMap.

The maps are provided via our own servers. When the map is accessed, your browser therefore does not, as a rule, establish a direct connection to the OpenStreetMap Foundation.

The processing is carried out to provide the map, route and search functions on the basis of Art. 6(1)(b) GDPR.

17. Google Fonts

We use Google Fonts that are stored locally on our own servers.

When the website is accessed, no connection to Google is established because of the fonts.

18. External links and affiliate link

Our websites contain simple links to external services, for example to Facebook or Deutsche Bahn.

As long as you do not click on such a link, the mere link does not, as a rule, transmit any data to the target page.

After clicking, you leave our website. The operator of the target page is responsible for the subsequent processing.

Affiliate link via Awin

At least one link is redirected via the affiliate network Awin, formerly Affilinet, to the offer of a third-party provider.

No affiliate cookie is set on our website as a result.

Only when you click on the link is a connection established to Awin and then to the target provider.

In this context, the following in particular may be processed:

• IP address;
• time of the click;
• previously visited page;
• browser and device data;
• identifier of the affiliate link;
• target of the link.

The link is used on the basis of Art. 6(1)(f) GDPR.

Further information can be found at:

https://www.awin.com/de/datenschutzerklaerung

19. Data security

We take technical and organisational measures to protect personal data against loss, unauthorised access and unauthorised alteration.

Our websites use TLS encryption. You can recognise an encrypted connection by the address beginning with https:// and the padlock symbol in your browser.

Despite appropriate security measures, complete security of data transmission over the internet cannot be guaranteed.

20. Your rights

Access

You can request information about which personal data we process about you.

Rectification

You can request that incorrect data be rectified or incomplete data be completed.

Erasure

You can request the erasure of your data under the statutory conditions.

Restriction of processing

Under certain conditions, you can request that your data only be processed to a restricted extent.

Data portability

Insofar as we process data by automated means on the basis of consent or a contract, you can receive this data in a commonly used, machine-readable format under the statutory conditions.

Withdrawal of consent

You can withdraw consent you have given at any time with effect for the future.

Processing carried out before the withdrawal remains lawful.

Objection

If we process your data on the basis of Art. 6(1)(f) GDPR, you can object on grounds relating to your particular situation.

You can object to direct marketing at any time without giving any particular reason.

Complaint to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority.

In particular, you can contact the supervisory authority of your place of residence, your place of work or the place of the alleged infringement.

21. Changes to this privacy policy

We adapt this privacy policy when our data processing, the services we use or legal requirements change.

Last updated: September 2026