Privacy
1. Privacy at a glance
General information
The following notes give a simple overview of what happens to your personal data when you visit this website, calculate a price or book a delivery. Personal data is any data that can be used to identify you personally. You will find detailed information in the sections below.
Who is responsible for data collection on this website?
Data on this website is processed by the website operator. You will find their contact details in the section “Controller”.
How do we collect your data?
Some data is collected because you give it to us, for example in the price calculator or the booking form. Other data is collected automatically by our IT systems when you visit the website. This is mainly technical data, e.g. browser, operating system or time of the page request.
What do we use your data for?
Some data is collected to provide the website without errors and securely. We use the details from the price calculator and booking to give you a price and to carry out and invoice your delivery. We evaluate the use of the website statistically and without cookies using the self-hosted software Umami (see “Web analytics with Umami”). This website uses no advertising services, no social media plugins and no embedded third-party content.
What rights do you have regarding your data?
You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request that this data be corrected or deleted. If you have given consent to data processing, you can withdraw it at any time with effect for the future. You also have the right, under certain circumstances, to request that the processing of your personal data be restricted. You also have the right to lodge a complaint with the competent supervisory authority. For this and any other questions about data protection you can contact us at any time.
2. Hosting
We host this website on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. For details see Hetzner’s privacy policy: https://www.hetzner.com/legal/privacy-policy/
Hetzner is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in providing our website as reliably and securely as possible.
Data processing agreement
We have concluded a data processing agreement for the use of the above service. This is a contract required by data protection law which ensures that the provider processes our website visitors’ personal data only according to our instructions and in compliance with the GDPR.
Server log files and security
When you visit our website, the hosting system, which we operate ourselves on a server of Hetzner Online GmbH in Germany, automatically processes information your browser transmits: IP address, date and time, requested address, amount of data transferred, browser and operating system identifier and the previously visited page. This data is used solely for secure and stable operation, in particular for the automated detection and prevention of attacks and abuse. The legal basis is our legitimate interest in the security of our systems (Art. 6(1)(f) GDPR). Log data is deleted after 14 days at the latest; if an attack is detected, information about its origin may be kept for up to 7 days longer where necessary for defence. The data is not combined with other data. Data on detected attacks (IP address, attack pattern, time) is transmitted to CrowdSec SAS, France, for joint defence against attacks; the legal basis here too is our legitimate interest in the security of our systems (Art. 6(1)(f) GDPR).
To keep individual visitors from overloading the services, the website counts requests per connection (IP address) for a short time. These counters are not stored and expire after 24 hours at the latest.
3. General information and mandatory notices
Data protection
The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
Please note that data transmission over the internet (e.g. when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.
Controller
The controller responsible for data processing on this website is:
Monaco Urban GmbH Sedanstr. 29 RGB 81667 München Germany
Managing director: Attila Ergün Phone: +49 (0)89 41 15 40 43 Email: info@isar-express.de
The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (e.g. names, email addresses or similar).
Storage period
Unless a more specific storage period is stated in this privacy policy, your personal data remains with us until the purpose of processing no longer applies. If you make a justified request for deletion or withdraw your consent, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law); in that case it is deleted once those reasons no longer apply.
General information on the legal basis for processing
If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR. If your data is required to perform a contract or to take steps prior to entering into a contract, we process it on the basis of Art. 6(1)(b) GDPR. We also process your data where this is necessary to comply with a legal obligation, on the basis of Art. 6(1)(c) GDPR. Processing may also be based on our legitimate interest under Art. 6(1)(f) GDPR. The individual sections of this privacy policy state the legal basis relevant in each case.
Recipients of personal data
We only pass on personal data where this is necessary to perform a contract, where we are legally obliged to do so (e.g. to tax authorities), where we have a legitimate interest under Art. 6(1)(f) GDPR or where another legal basis permits it. We only pass personal data to processors on the basis of a valid data processing agreement.
Withdrawal of your consent
Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the processing carried out until withdrawal remains unaffected.
Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)
IF DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE LEGAL BASIS FOR EACH PROCESSING OPERATION IS STATED IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) GDPR).
IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING (OBJECTION UNDER ART. 21(2) GDPR).
Right to lodge a complaint with the competent supervisory authority
In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work or the place of the alleged breach. This right exists without prejudice to other administrative or judicial remedies. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done where technically feasible.
Access, erasure and rectification
Within the scope of the applicable law you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of processing, and where applicable a right to rectification or erasure of this data. For this and any other questions about personal data you can contact us at any time, for example by email to info@isar-express.de.
Right to restriction of processing
You have the right to request that the processing of your personal data be restricted. You can contact us at any time for this. The right to restriction of processing applies in the following cases:
- If you dispute the accuracy of your personal data stored by us, we usually need time to check this. For the duration of the check you have the right to request restriction of processing.
- If the processing of your personal data was or is unlawful, you can request restriction of processing instead of erasure.
- If we no longer need your personal data but you need it to exercise, defend or assert legal claims, you have the right to request restriction of processing instead of erasure.
- If you have lodged an objection under Art. 21(1) GDPR, your interests and ours must be weighed. As long as it has not been determined whose interests prevail, you have the right to request restriction of processing.
If you have restricted the processing of your personal data, this data may, apart from being stored, only be processed with your consent or to establish, exercise or defend legal claims, to protect the rights of another natural or legal person or for reasons of important public interest of the European Union or a member state.
SSL/TLS encryption
For security reasons and to protect the transmission of confidential content, such as bookings or enquiries you send to us as the site operator, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the address line of the browser starting with “https://” and by the padlock symbol in your browser bar. When encryption is active, the data you send us cannot be read by third parties.
Objection to advertising emails
We hereby object to the use of contact data published as part of the legal notice obligation for sending unsolicited advertising and information material. The operators of this website expressly reserve the right to take legal action in the event of unsolicited advertising, such as spam emails.
4. Data collection on this website
Cookies and browser storage
This website sets only one cookie: if you choose a language, the website remembers this choice in a cookie.
Your entries in the price calculator and the booking form are kept by your browser in the session storage of this tab so they are not lost when the page reloads. They do not leave your browser and are deleted as soon as you close the tab.
Both are technically necessary for the function you requested (§ 25(2) no. 2 TDDDG); the legal basis for further processing is Art. 6(1)(f) GDPR. We use no cookies for analytics or advertising. You can set your browser to notify you about cookies or to reject them altogether; your language choice will then not be remembered.
Price calculator, address search and map
When you enter pickup and delivery locations in the price calculator, your browser sends the input to our server. For address suggestions and the road route, our server forwards only the search text or the coordinates of the locations to services of Geofabrik GmbH, Amalienstraße 44, 76133 Karlsruhe, Germany (address search, route calculation). Your IP address, your name or other details are not transmitted.
To avoid repeated requests, our server keeps search results and routes for at most one hour and selected address points for at most six hours, without any link to you as a person.
Processing is based on Art. 6(1)(b) GDPR (steps prior to a contract at your request) and Art. 6(1)(f) GDPR (legitimate interest in accurate price information).
Map tiles, map fonts and all other content come from our own server; displaying the map involves no connection to third parties.
Web analytics with Umami
We use the analytics software Umami, which we operate ourselves on a server of Hetzner Online GmbH in Germany (data processing agreement), to evaluate the use of our website statistically. It records the pages visited, times, referring pages and information about browser, operating system, device type and approximate geographic origin. Umami sets no cookies; screen resolution and browser language are not read. Your IP address is processed for approximate location and for a technical identifier that changes daily, but it is not stored in the analytics database. The legal basis is our legitimate interest in measuring reach and improving our website (Art. 6(1)(f) GDPR). You can object to this processing at any time (Art. 21 GDPR), for example by sending a message to the contact address given in this policy. Analytics data is deleted after 24 months at the latest.
Fonts (hosted locally)
For consistent display this site uses the fonts Alumni Sans and Anek Latin. They are installed locally on our server; no connection to third-party servers (such as Google) takes place.
We refer to our Instagram profile with a simple link only. No data is transferred to Instagram when you visit this website. Only when you click the link does the Instagram page open; the provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Their privacy policy applies to processing there: https://privacycenter.instagram.com/policy
Enquiries by email or phone
If you contact us by email or phone, your enquiry including all resulting personal data (name, enquiry) is stored and processed by us to handle your request. We do not pass on this data without your consent.
Processing is based on Art. 6(1)(b) GDPR if your enquiry relates to the performance of a contract or is necessary for steps prior to entering into a contract. In all other cases processing is based on our legitimate interest in handling enquiries effectively (Art. 6(1)(f) GDPR).
The data remains with us until you ask us to delete it, withdraw your consent to storage or the purpose of storage no longer applies (e.g. after your request has been dealt with). Mandatory statutory provisions, in particular retention periods, remain unaffected.
5. Booking, delivery and payment
Processing of customer and contract data
When you book a delivery, we process the details from the booking form: pickup and delivery addresses including contact names and address details, day and time window, selected services, contents of the shipment if proof of delivery is chosen, your contact details (name, phone, email address), optionally customer number, cost centre and notes, and the chosen payment method.
We collect, process and use this customer and contract data to establish, carry out and invoice the order and to deal with queries. The legal basis is Art. 6(1)(b) GDPR. Without these details we cannot carry out the delivery.
Your booking is sent to ISAR EXPRESS by email and stored there for carrying out and invoicing the delivery. You receive a booking confirmation at the email address you entered. For sending emails we use the mail service of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.
Customer data is deleted after the order has been completed or the business relationship has ended and statutory retention periods have expired (usually six to ten years under § 257 HGB and § 147 AO).
Transfer of data to carry out the delivery
We only transfer personal data to third parties where this is necessary to perform the contract. To carry out the delivery, we pass pickup and delivery addresses, contact names, times and notes to the courier who takes on the job. With proof of delivery, the courier records the handover in a courier declaration with photo proof, which you receive as evidence.
No further transfer takes place unless you have expressly agreed to it. Your data is not passed on to third parties without your express consent, for example for advertising purposes.
Payment
No payment takes place on this website; you only choose the payment method (PayPal, cash or invoice). If you later pay via PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, processes the payment under its own responsibility. Details: https://www.paypal.com/de/legalhub/privacy-full
Communication via WhatsApp
To coordinate deliveries with our couriers and, where applicable, with customers, we use WhatsApp among other channels. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
Communication is end-to-end encrypted, which prevents WhatsApp or other third parties from accessing the content. WhatsApp does, however, have access to metadata created during communication, such as sender, recipient and time. According to WhatsApp, it shares personal data with its US-based parent company Meta. More information: https://www.whatsapp.com/legal/privacy-policy-eea
This is based on our legitimate interest in fast and reliable coordination of deliveries (Art. 6(1)(f) GDPR). Communication content remains with us until the purpose of processing no longer applies; statutory retention obligations remain unaffected.
Last updated: November 2026