Privacy policy

1. Controller and contact

The controller within the meaning of the General Data Protection Regulation (GDPR) is quickz GmbH, Wampachstraße 10, 54295 Trier, Germany, represented by its managing director Tom Robin Scholtes.

Please send questions about data protection and requests to exercise your rights to [email protected] or by post to quickz GmbH, Datenschutz, Wampachstraße 10, 54295 Trier, Germany.

No data protection officer has been appointed at present.

2. One account for all quickz services

quickz Freight uses the shared quickz account. The same account works in the quickz app, on bus.quickz.eu and on freight.quickz.eu. If you already have a quickz account, you sign in here with the same email address. If you register here, you can use the same account to sign in to the quickz app.

Account data is held centrally on the quickz platform: first name, last name, email address, mobile number with country code, account status, the time your email address was confirmed and the service through which the account was created. It is stored in a database run by our service provider MongoDB ("MongoDB Atlas") located in Frankfurt am Main, Germany.

quickz Freight's business data is kept separately in its own database on servers in Germany: role, company profile, requests, quotes, fleet, payments, sessions and sign-in codes. The two are linked by the account ID. quickz Freight also keeps a copy of your name, email address and mobile number so that listings and emails work without querying the platform each time.

The legal basis is Art. 6(1)(b) GDPR: the account is part of the user agreement for the quickz services. Managing it centrally also serves our legitimate interest in you only having to maintain one account and in detecting abuse across services (Art. 6(1)(f) GDPR).

If you create an account via quickz Freight, we do not add you to the newsletter for passengers.

3. Visiting the website and server logs

When you open our pages, we process technically necessary data: IP address, date and time, requested address, referrer, status code, amount of data transferred and browser and operating system details. Without this data we cannot deliver the pages, find errors or fend off attacks.

Our web server logs are rotated daily and deleted after 14 days.

The website is delivered through Cloudflare's network. Cloudflare forwards each request to our server, filters attacks and also processes the connection data listed above for that purpose. See section 13.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is secure and stable operation.

4. Cookies and local storage

We only store what is needed to run the service. There are no analytics, advertising or tracking tools. Fonts are served from our own server, so no connection to Google or other font providers is made.

• freight_quickz_session: session cookie after sign-in. It contains a random identifier, cannot be read by scripts (HTTP-only), is only sent over encrypted connections and is valid for 30 days. We only store a hash of it. Signing out or deleting your account ends the session on our server.
• NEXT_LOCALE: remembers your language (German or English) so the home page greets you in your language.
• quickz-freight-theme (browser local storage): remembers whether you chose the light or dark theme. The value never leaves your device.

The legal basis for storing and reading this information is Section 25(2) no. 2 of the German TDDDG, because it is strictly necessary for the service you request. The related processing is based on Art. 6(1)(b) GDPR (sign-in) and Art. 6(1)(f) GDPR (language, theme).

5. Sign-in and registration

Signing in works without a password: you enter your email address and receive a six-digit code that is valid for ten minutes. We store the code only as a cryptographic hash and limit the number of attempts.

If there is no quickz account for your email address yet, we ask for your first name, last name, mobile number with country code, the role you want (shipper or transport company) and optionally a company name. We also record when you accepted the terms and conditions.

To prevent abuse, we store the IP address and browser identifier (user agent) with sign-in codes and sessions and limit the number of requests per IP address and email address.

While you are signed in, we check with the quickz platform at least every 15 minutes whether your account is still active. In addition, we check every night whether accounts have been deleted elsewhere.

The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for abuse prevention.

6. Signing in from the quickz app

If you open quickz Freight from the quickz app, the app sends your account ID and app session token to our server. We verify both with the quickz platform and create a one-time code that is valid for 60 seconds and can only be used once. The app opens the website with this code and you are signed in. We do not store the app session token.

The legal basis is Art. 6(1)(b) GDPR.

7. Transport requests

For a transport request we process the details from the form: type and description of the cargo, weight, dimensions, loading metres, number of pieces, packaging, value of goods, pickup and delivery location with street, postcode, town and country, dates and time windows, vehicle and body requirements, special features, temperature range, budget, a free-text description and your contact details (first name, last name, email address, mobile number, optionally company).

Without signing in

If you publish a request without being signed in, we first store it unconfirmed together with your IP address and email you a confirmation link. The link is valid for 48 hours. The request is only published once you click it. If you do not have a quickz account yet, one is created with your contact details at that point. We delete unconfirmed requests after 14 days.

Who sees what

• Public: cargo details, postcode, town and country of the pickup and delivery locations, dates, vehicle requirements and budget. Streets, the free-text description, the value of goods and your contact details are not public.
• Activated transport companies can also see the description and the value of goods.
• Only the transport company whose quote you accept sees the streets and your contact details. Our server enforces this, not just what the browser displays.

Review

If the free-text description contains recognisable contact details such as email addresses, phone numbers or messenger links, the request is flagged automatically and only published after our team has reviewed it. This keeps your contact protection effective.

A request expires on the day after the pickup date and is then no longer public.

The legal basis is Art. 6(1)(b) GDPR; for the review and for the IP address stored with unconfirmed requests, Art. 6(1)(f) GDPR (protection against abuse and spam).

8. Quotes and award

For a quote we store the net price, VAT rate, gross price, vehicle, possible pickup date, transit time, validity, a message to the shipper and the status (submitted, accepted, declined, withdrawn, expired).

The shipper sees the quotes for their request together with the company name. Once the shipper accepts a quote, each side sees the other's contact details: name, email address, mobile number and company, if any, and the transport company also sees the streets of the pickup and delivery locations. The other bidders are told that their quote was not accepted.

The legal basis is Art. 6(1)(b) GDPR. Sharing contact details after the award is necessary so that you can arrange the transport.

9. Company profile and fleet

Transport companies provide their company name, legal form, address, VAT ID or tax number, website, description, countries served, default VAT rate and billing address and billing email. For the fleet we store vehicle type, model, body, licence plate, payload, loading metres, equipment and temperature range.

Shippers see the company name and the details of each quote. Licence plates and billing details are never shown publicly.

The legal basis is Art. 6(1)(b) GDPR.

10. Activation, payment and invoice

Transport companies activate their quote access with a one-time fee. Payment is handled by Stripe Checkout. You enter card and other payment details directly with Stripe; we do not receive them. Stripe sends us the payment status, the ID of the checkout session and the amount. Stripe is partly a controller in its own right for payments, fraud prevention and its own legal obligations; see Stripe's privacy policy.

We create the invoice with Lexware Office. For this we transmit the billing address, company name, VAT ID, billing email and the invoice item. We send you the invoice by email.

The legal basis is Art. 6(1)(b) GDPR, and for retention Art. 6(1)(c) GDPR in conjunction with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).

11. Emails

We only send emails that are part of the process: sign-in codes, confirmation links for requests, confirmation of a published request, notices about new quotes, acceptance or rejection, activation and invoices. We do not send advertising through quickz Freight.

Emails are sent via our own mail server, which is also operated at Contabo in Germany.

The legal basis is Art. 6(1)(b) GDPR.

12. Administration and platform protection

Our team can review, approve or reject requests, set or withdraw activations manually and suspend accounts, for example for breaches of the terms and conditions or suspected abuse. Suspensions and deletions are logged with time, reason and the person acting. A suspension ends all sessions of the account.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a secure, lawful and trustworthy platform. Where the Digital Services Act requires us to review content and give reasons, Art. 6(1)(c) GDPR applies.

13. Recipients and service providers

Other users only receive data to the extent described in sections 7 to 9. We also use the following service providers. Unless stated otherwise, they process data on our behalf (Art. 28 GDPR):

• Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany: servers for the website, API, the quickz Freight database and the mail server. Location: Germany.
• Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: website delivery, protection against attacks, connection encryption. Connection data may be processed in the USA.
• MongoDB, Inc., 1633 Broadway, New York, NY 10019, USA: database of the shared quickz account (MongoDB Atlas). Location: Frankfurt am Main (Amazon Web Services, region eu-central-1).
• Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland: payment processing for activation, partly as a controller in its own right.
• Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany: invoicing (Lexware Office).

We only disclose data to authorities and courts where we are legally required to do so.

14. Transfers to third countries

Cloudflare, MongoDB and Stripe belong to groups of companies headquartered in the USA. Access from the USA, for example for support or attack protection, cannot be ruled out. For the USA there is an adequacy decision of the European Commission (EU-US Data Privacy Framework), to the extent the recipient is certified under it. In addition, we have agreed the European Commission's standard contractual clauses with these providers (Art. 46(2)(c) GDPR). You can obtain a copy of the safeguards on request from [email protected].

15. Retention periods

• Web server logs: 14 days.
• Sign-in codes: valid for ten minutes, deleted after seven days. One-time codes from the app: valid for 60 seconds, deleted after seven days.
• Sessions: valid for 30 days. The record with IP address and browser identifier is deleted 30 days after expiry or sign-out.
• Unconfirmed requests: 14 days.
• Account, requests, quotes, company profile and fleet: as long as your account exists.
• Payments and invoices: until the end of the statutory retention period, up to ten years depending on the document (Section 147 AO, Section 257 HGB).

16. Deleting your account

You can delete your account at any time under "Account". Because it is a shared quickz account, it is deleted in all quickz services, including the quickz app and bus.quickz.eu.

When you delete it, we anonymise the account on the quickz platform and at quickz Freight. Open requests are cancelled and submitted quotes withdrawn. Contact details, streets, licence plates, company and billing details are removed. What remains without personal reference, such as the cargo details of a past request, we keep so that the platform's records stay consistent. We keep invoices and payment records until the end of the statutory period.

If an agreed transport is still upcoming, you can only delete your account after that date so that the other side can reach you.

If you delete your account in the quickz app, we end your quickz Freight session within 15 minutes and anonymise the data here by the following night at the latest.

17. Mandatory information and automated decisions

Mandatory fields are marked as such. Without them we cannot create an account, publish a request or pass on a quote. There is no statutory obligation to provide the data.

There is no solely automated decision within the meaning of Art. 22 GDPR. Automatically flagging contact details in free text only leads to a review by a person.

18. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future; at present we do not base any processing on consent.

Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Complaints

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany, www.datenschutz.rlp.de.

19. Changes

We update this policy when the service or the law changes. The version published on this page applies.