Privacy policy

This is a translation for your convenience. Only the German version (Datenschutzerklärung) is legally binding.

Last updated: 27 September 2026

1. Controller

FA Transport GmbH
Torfbruchstr. 46, 40625 Düsseldorf, Germany
Managing Director: Reda Fakih
Phone: 015679 678637 · Email: kontakt@transport-fa.de
VAT ID: DE 453 977 991

For any questions about data protection and to exercise your rights, contact us at kontakt@transport-fa.de. We are not required to appoint a data protection officer under Art. 37 GDPR and § 38 BDSG.

2. Overview and legal bases

We only process personal data to the extent necessary for the website, your enquiries, our jobs and the customer portal. The legal bases are in particular Art. 6(1)(b) GDPR (contract and pre-contractual measures), (c) (legal obligations, e.g. retention under commercial and tax law), (f) (legitimate interests, e.g. secure operation) and (a) (consent, where we expressly ask for it).

3. Hosting and server log files

The website is operated by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA) and delivered from data centres in Frankfurt am Main. The customer portal’s programming interface (API) is operated by Railway Corporation (USA) in the Europe region. When you visit the site, these providers process technically necessary data (IP address, date and time, page requested, browser type) to deliver the website securely and reliably (Art. 6(1)(f) GDPR). Log data is deleted after 30 days at the latest.

We base transfers to the USA on the adequacy decision for the EU-US Data Privacy Framework or on the EU standard contractual clauses (Art. 45, 46 GDPR).

4. Cookies and browser storage

We do not use tracking or marketing cookies or analytics tools. Only the following are technically necessary (§ 25(2) no. 2 TDDDG):

• a session cookie after you sign in to the customer portal or admin area (until you sign out, at most 14 days),
• a cookie storing your chosen language (German/English, 1 year) when you change the language,
• an entry in your browser’s local storage if you allow Google Maps in the app presentation (see section 12).

All fonts are served from our own server; there is no connection to Google Fonts.

5. Contact and quote form, enquiries

We process the data you enter in the form (name, contact details, job details, message) to handle your enquiry and prepare a quote (Art. 6(1)(b) GDPR). The enquiry is sent to our team by encrypted email and stored in our customer management system for processing (status, notes, follow-up). To prevent abuse, we briefly process your IP address in memory (Art. 6(1)(f) GDPR).

Enquiries that do not lead to a job are deleted automatically six months after they were last processed. If a job results, we keep the enquiry for three years (standard limitation period); invoices are subject to the retention periods in section 9.

6. Job applications

We process application data including uploaded documents to carry out the application process (§ 26 BDSG, Art. 6(1)(b) GDPR). Files are not stored on the web server but sent directly by email. We delete the data no later than six months after the process ends, unless you have agreed to longer storage.

7. Customer portal

For registration we process your name, address (billing address), email address, optionally your company, and an encrypted password (Argon2id). We need the address for jobs and invoices; you can add a phone number in your profile if you wish. In the portal we process your jobs, documents, quotes, invoices and messages (Art. 6(1)(b) GDPR). For security we store session data (time, IP address, browser) and a security log of sign-in events (12 months, Art. 6(1)(f) GDPR).

While a transport is under way for you, you can see the vehicle’s position. The GPS data belongs to the vehicle, not to you, and is deleted automatically after 30 days.

Sign in with Google

If you choose “Sign in with Google”, you are redirected to Google (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). We receive your name, email address and, if applicable, your profile picture. The connection to Google is only established after your click (Art. 6(1)(b) GDPR).

Live chat

We store live chat messages until the chat is closed and delete them automatically 24 hours afterwards. If nobody from our team is online and you have allowed it, we notify you of replies by email.

Deleting your account

You can delete your account yourself at any time in the settings. We then delete your sign-in data, sessions, jobs, documents, messages and email history. Exempt are invoices, credit notes, quotes and order confirmations that we are legally required to keep (section 9, Art. 17(3)(b) GDPR): they are no longer visible in the portal, are only used for accounting and tax audits and are deleted automatically when the retention period ends. With the deletion confirmation we send you your invoices as PDF.

8. Emails

We send transactional emails (e.g. confirmation links, invoices, status updates) via Resend (Resend Inc., USA; sent via servers in Ireland). You choose which notifications you receive in the customer portal under “Settings”. We send invoices, payment reminders and security-related notices regardless. Our mailbox and the contact form emails run via IONOS SE (Montabaur, Germany).

9. Invoices, payments and accounting

For quotes, invoices and payments we process your name, address, company and VAT ID if applicable, service and payment data (Art. 6(1)(b) and (c) GDPR). We issue invoices as e-invoices (ZUGFeRD/XRechnung). For accounting and tax returns we pass invoices and booking data to our tax adviser, who is bound by professional secrecy (Art. 6(1)(c) GDPR).

Retention periods (§ 147 AO, § 257 HGB): invoices and credit notes 8 years, quotes and order confirmations 6 years, in each case from the end of the calendar year in which they were issued. If an invoice is overdue, we remind you of the payment by email.

10. Storage of files and data

We store customer portal data in a database at MongoDB Inc. (Amazon Web Services data centre in Frankfurt am Main) and documents and PDFs at Cloudflare, Inc. (R2 storage with data kept exclusively in the EU). Data processing agreements (Art. 28 GDPR) are in place with all service providers.

11. Reviews

On our website we show customer reviews that are publicly published on our profiles at review platforms (such as Google) – unchanged, with shortened name, town and date (Art. 6(1)(f) GDPR). If you don’t want your review shown here, just let us know and we will remove it immediately. Data is only transferred to the platform operators when you click the links to the platforms; their privacy policies then apply.

12. Google Maps

In the presentation of our tracking app we show a locally stored map by default (map data © OpenStreetMap contributors). Only if you click “Load Google Maps” is the Google Maps service (Google Ireland Ltd.) loaded, which transfers your IP address, among other things, to Google (Art. 6(1)(a) GDPR). We store your decision locally in your browser; you can revoke it at any time by deleting the website data.

13. Recipients at a glance

• Vercel Inc. – website hosting
• Railway Corporation – operation of the customer portal API
• MongoDB Inc. – database (Frankfurt am Main)
• Cloudflare, Inc. – file storage (EU)
• Resend Inc. – sending emails
• IONOS SE – mailbox and domain
• Google Ireland Ltd. – only when signing in with Google or after enabling Google Maps
• our tax adviser – accounting and taxes

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). Where we process data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can also lodge a complaint with a data protection supervisory authority, e.g. the authority responsible for us: the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.