Privacy Notice

Your rights, your data. Secure and protected.

General Information

We are pleased that you are visiting our website, on which we offer you personalized functionalities in addition to information about our company and our services. Transparency and integrity in the processing of your personal data are important to us. When processing personal data, we comply with data protection regulations, in particular the EU General Data Protection Regulation (“GDPR”) and the German Federal Data Protection Act (“BDSG”).

In this Privacy Notice, we explain which information, including personal data, is processed by us during your visit to and use of our aforementioned online offering on our website https://www.time-matters.com and its subpages (“Website”), and which rights you have with regard to your personal data.

Who is the Controller?

The controller under data protection law for the processing of personal data is:

time:matters GmbH
Gutenbergstr. 6
63263 Neu-Isenburg
Germany
(also referred to in this notice as “time:matters”, “we” or “us”)

Further information can be found in our legal notice at https://www.time-matters.com/imprint/.

Singapore Personal Data Protection Act (PDPA)

The Personal Data Protection Act in Singapore (PDPA) comprises the following obligations, and we as a company undertake to ensure compliance with these obligations:

Accountability
Collection of personal data
Notification
Consent
Purpose limitation
Care of personal data
Accuracy
Protection
Retention limitation
Transfer limitation
Individual autonomy over personal dataAccess and correction
Notification of data breaches
Data portability

Who can you contact?

We have appointed the Group Data Protection Officer of the Lufthansa Group as our Data Protection Officer. If you have any questions regarding the processing of your personal data, you may contact the Data Protection Officer at any time by post (Deutsche Lufthansa AG (DLH), FRA CJ, 60546 Frankfurt) or by email (datenschutz@dlh.de).

If you have any questions regarding data protection in connection with our Website, the services and offerings provided, or if you wish to exercise your rights as a data subject, please contact us at:

time:matters GmbH
Data Protection | time:matters
Gutenbergstr. 6
63263 Neu-Isenburg
Germany

You may also contact us by email at: data.protection@time-matters.com

Please note that communication with us by email is generally unencrypted.

For what purposes do we process your data and on what legal basis?

a) Processing in connection with the provision and use of our Website

Server Log Files

We collect and use your personal data in server log files to the extent necessary to enable the use of our online offering. Any personal data contained in server log files is processed to enable you to use our Website. This is carried out on the basis of Article 6(1)(f) GDPR to safeguard our legitimate interest in operating our Website. Server log files include:

Name of the accessed web page
Date and time of access
Amount of data/file transferred
Message regarding successful access
Browser type and version
User operating system
Referrer URL (previously visited page)
IP address and
Requesting provider

Log file information is stored for security reasons, for example to investigate misuse or fraud, for a period of 8 days and is then deleted. Data that must be retained for evidentiary purposes is exempt from deletion until the respective incident has been finally clarified.

Information on Cookies

In this section, we explain the use of cookies. To make our offering as user-friendly as possible, we use cookies, local storage and session storage.

Cookies

A “cookie” is a small text file that a web server sends to your browser when you visit a website. Depending on your browser settings, the cookie file is stored or rejected. If the file is stored, our web server can recognize your device. During later visits and when switching between functions that require you to enter a password, the cookie can save you from having to re-enter certain information. Cookies therefore make it easier for you to use websites that require user input.

We also distinguish between the following categories of cookies:

Essential cookies

These cookies are essential for the operation of the site and enable, for example, login, the redemption of miles and security-relevant functionalities. In addition, we can use this type of cookie to recognize whether you wish to remain logged into your profile in order to make our services available to you more quickly when you visit our site again.

Personalization

These cookies are used to display personalized content that matches your interests. This enables us to present offers that are particularly relevant to you.

Analytics & Statistics

To improve user-friendliness and optimize the performance of our website booking.time-matters.com, we use tools that help us understand how users move around the site, where problems arise during use and which processes cause difficulties for users.

Local Storage (“Local Storage”)

We use the functionality of local storage. In this process, your data (master data, status data and program data) is stored locally in your browser cache after login. After you close the browser window, your data is deleted, except for your most recently selected login method. If you do not clear your browser cache, this information remains stored and can be read the next time you access the Website. By using local storage, we enable the correct display of your data while you browse our Website without unnecessarily slowing down the process and overloading interfaces.

If you do not wish to use local storage, you can configure this at any time in the settings of your respective browser. Please note that in this case the functionalities of our Website may only be available to you to a limited extent or may no longer be available. In particular, you may then no longer be able to access your personal profile.

Legal Basis

Where cookies are stored on or read from your device, this is carried out for technically necessary functions on the basis of Section 25(2) of the German Telecommunications Digital Services Data Protection Act (“TDDDG”). For all non-essential cookies/technologies, for example analytics and statistics, access to the device takes place only on the basis of your consent pursuant to Section 25(1) TDDDG. Where personal data is processed in this context, we base such processing, depending on the purpose, on your consent pursuant to Article 6(1)(a) GDPR or Article 6(1)(f) GDPR to safeguard our legitimate interests.

etracker Services

We use the services of etracker GmbH to analyze usage data on our Website. If we use analytics and optimization cookies, we obtain your explicit consent separately in advance. If this is the case and you consent, cookies are used that enable statistical reach analysis of this Website, success measurement of our online marketing measures and testing procedures, for example to test and optimize different versions of our online offering or its components. Cookies are small text files that are stored by the internet browser on the user’s device. etracker cookies do not contain any information that enables a user to be identified.

The data generated by etracker is processed and stored exclusively in Germany by etracker on our behalf and is therefore subject to strict German and European data protection laws and standards. etracker has been independently audited and certified in this respect and awarded the ePrivacySeal data protection seal of approval (https://www.eprivacy.eu/kunden/vergebene-siegel/firma/etracker-gmbh/).

The data processing is carried out on the basis of statutory provisions in the context of legitimate interest pursuant to Article 6(1)(f) GDPR. Our concern is the optimization of our online offering and our web presence. Since the privacy of our visitors is important to us, data that may allow reference to an individual person, such as IP address, login identifiers or device identifiers, is anonymized or pseudonymized as early as possible. No other use, combination with other data or disclosure to third parties takes place.

You may object to the data processing described above at any time. The objection has no negative consequences.

Further information on data protection at etracker can be found at https://www.etracker.com/en/data-protection-by-etracker/.

Use of Social Media

We maintain online presences within social networks and platforms in order to communicate with customers, interested parties and users active there and to inform them about our services. Please note that we neither have knowledge of nor influence over how social networks handle information shared by you and whether this information is made available to other websites. We recommend that you read the respective privacy notices carefully. When accessing the respective networks and platforms, the terms and conditions and data processing policies of the respective operators apply. Unless otherwise stated in our Privacy Notice, we process the users’ data if they communicate with us within the social networks and platforms, for example by posting content on our online presences or sending us messages. Of course, our online offerings can generally also be accessed and used without using social networks.

Processing by Google

It is possible that Google also processes data collected via our Website for its own purposes. In such cases, further processing is carried out by Google Ireland Limited as an independent controller. Google Ireland Limited is a subsidiary of Google LLC (USA).

Google Maps

At various points, we offer the option of using the location and map service “Google Maps” via the Google Maps API.

By using Google Maps, information about your visit to our Website or your use of the app, including your IP address, may be transmitted to a Google server in the USA and stored there. Google may transfer the information obtained through Maps to third parties where required by law or where third parties process such data on behalf of Google.

Google will under no circumstances link your IP address with other Google data. Nevertheless, it would be technically possible for Google to identify at least individual users on the basis of the data received. It would be possible for Google to process personal data and user profiles of users of the Website for other purposes over which we have no influence and can have no influence.

Google Maps is operated by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

The Google Privacy Policy and additional terms of use for Google Maps can be found at https://www.google.com/intl/en_us/help/terms_maps/.

Geo Controller

This site uses the WordPress Geo Controller plugin (formerly CF Geo Plugin) to display public visitor information based on IP addresses, which may then be collected or used for various purposes depending on the plugin settings.

We use the Geo Controller plugin to display the regionally appropriate customer service to the user by processing geolocation data. No cookies are used or processed in connection with Geo Controller. The legal basis for the processing is Article 6(1)(f) GDPR, whereby the balancing of interests did not result in any overriding impairment of the rights and freedoms of the data subjects.

Please also see the privacy policy under WordPress Geo Plugins: WordPress Geo Plugins Privacy Policy.

b) Processing of your data as a (future) customer

We collect, process and use personal data that is transmitted to us in connection with the booking of transport services or stored to facilitate future shipment handling, for example customer address data. We process this personal data exclusively in relation to shipments. The shipping customer is solely responsible for the lawful collection, processing and transmission as well as the accuracy of the customer data. In the context of transport processing, it may be necessary for us to transmit your personal data to our shipping partners.

If a contractual relationship is to be established, defined or amended between you and us, we process the personal data that you enter in the order or registration form or otherwise transmit to us, in particular required contact and address data.

Such processing of personal data is necessary, among other things, for carrying out the required pre-contractual steps, responding to related questions, transmitting shipping and invoice information and processing or providing customer feedback and support. The legal basis for this is the performance of pre-contractual measures or the performance of a contract pursuant to Article 6(1)(b) GDPR.

All mandatory information that we must collect in order to provide our services is clearly identifiable for you and is marked either with brief explanatory notes or marked with an asterisk (*). You provide non-marked information to us on a voluntary basis so that we can offer you a solution for your order or inquiry that is perfectly tailored to your needs.

Screening against Sanctions Lists / No-Fly Lists

On the basis of our legitimate interests in the integrity and security of business operations and compliance with statutory requirements, we transmit the personal data you provide to an external service provider for screening. This provider checks your information on our behalf, for example against relevant sanctions or no-fly lists. The legal basis for this transmission is Article 6(1)(b) and Article 6(1)(c) GDPR.

Customer Data within the time:matters Group

Due to internal processes, in particular for the performance of a concluded contract, we or our customers themselves also disclose customers’ personal contractual data to the following affiliated companies. The disclosure depends on which company the customer has concluded a contract with.

time:matters Courier Terminals GmbH, Tor 26, Gebäude 455d, Airportring, 60549 Frankfurt am Main, Germany
time:matters Austria GmbH, Air Cargo Center Obj. 262/8/3, 1300 Vienna Airport, Austria
time:matters Netherlands B.V., Beechavenue 30–50, 1119 PV Schiphol-Rijk, Netherlands
time:matters (Asia Pacific) Pte Ltd., 390 Orchard Road, Palais Renaissance #13-01, 238871 Singapore, Singapore
time:matters (Shanghai) International Freight Forwarding Ltd., Huashan Road No. 1568, NanFung Tower, Room 1204, (Changning District), 200052 Shanghai, China
time:matters Americas, Inc., 6100 Waterford District Dr, Suite 440, Miami, FL 33126-2080, USA

The legal basis in this context is the performance of a contract to which the data subject is party, or the implementation of measures at the request of the data subject prior to entering into a contract, pursuant to Article 6(1)(b) GDPR, as well as our legitimate interests pursuant to Article 6(1)(f) GDPR.

Customer Relationship Management (CRM)

We categorize (potential) new customers into different categories. This is done on the basis of various assessment standards, for example by reference to the industry and size of the (potential) new customer. If we determine that further business relationships may develop in the future, we create a profile in our customer relationship management system (CRM) for our (potential) new customers. We use our CRM both to manage existing and new customers and to analyze potential new customers/new contacts. The data processing includes, on the one hand, general information such as general company information and contact data and/or, on the other hand, more extensive data processing such as recording visits and conversations.

The legal basis for this data processing in our CRM are Article 6(1)(b) GDPR in the context of pre-contractual measures and for the performance of the contract, as well as the safeguarding of our legitimate interests pursuant to Article 6(1)(f) GDPR.

Our internal processes are designed so that potential new customers receive an email from our systems in which we refer to our Privacy Notice for the purpose of fulfilling information obligations and provide the opportunity to object. The objection can be asserted against us via a link included in the email. Until an objection is submitted, the profile remains comprehensive, meaning that we also process information that helps us track our communication and prepare new appointments and approaches. If we receive an objection from the data subject, we will immediately delete all personal data from the profile. If data subjects wish to have their personal data processed more extensively again at a later point in the future, we will manually trigger this process again and provide information about the data processing once more.

Customer Account

We set up a user account for our customers in which contact and address information is processed and into which additional optional information, such as payment information and contact person data, can be entered in order to facilitate communication or accelerate subsequent booking processes. The user account is stored with the email address provided to us. Login data is generated by the customers themselves. For this purpose, the customer receives an automated email with an activation link, an email summarizing relevant data and instructions for choosing a password.

We also offer interested parties the option to set up a customer account with us. The registration form on our Website can be used for this purpose. We collect general contact and payment data for the user account.

For registration, we process personal data on the basis of Article 6(1)(b) GDPR for the purpose of pre-contractual measures and for the performance of the contract. Data entered additionally on an optional basis is processed by us on the basis of your consent pursuant to Article 6(1)(a) GDPR.

Evaluation of our Services

To submit a review of our services, we process the personal data provided if it is made available to us voluntarily. As a rule, this includes the contact data of the data subject and the review comment submitted.

Data subjects may of course request that reviews submitted to us be deleted or that their processing be restricted. Processing up to the time of withdrawal remains unaffected.

As a company, we rely on evaluations of our services in our efforts to continuously improve. We collect the data from submitted reviews on the basis of Article 6(1)(b) GDPR in the context of the subsequent contractual relationship and pursuant to Article 6(1)(f) GDPR in connection with our legitimate interest in improving our services.

Contact Form (Contact)

If you wish to contact us, a contact form is available on our Website that you can use for electronic contact with us. The data entered in the form is transmitted to us and stored. This data includes:

Name
Email address
Company
Your message

When the message is sent, the IP address you use is also stored. The data from the contact form is used exclusively for the purpose of the communication initiated by you. The legal basis for the processing of your personal data is Article 6(1)(b) GDPR and Article 6(1)(f) GDPR.

Payment Service Providers

To offer you a selection of secure and efficient payment options for our services, we use external payment service providers.

The data collected and processed by the payment service providers used includes, among other things:

Payment method used
Name
Details of the means of payment, for example credit card data or electronic payment data
Payment amounts

The payment data entered by you is collected by the payment service providers used by us and processed by them as controllers within the meaning of the GDPR. This processing is necessary in order to carry out the payment transaction to us. We do not receive information on entered bank account data, credit card data or other electronic payment methods at any time. We are only informed whether the payment was successful or not.

For payment transactions, the privacy notices and terms and conditions of the respective payment service providers used by us must also be observed.

We use the following payment service providers:

Braintree – a payment service of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

The Braintree Privacy Policy can be found at: https://www.braintreepayments.com/de/legal/braintree-privacy-policy

c) Processing of your data in connection with the use of booking.time-matters.com

On our website “booking.time-matters.com”, you can use our online service to search for the best offers for transport solutions from our range of services.

We use the transport-related framework data you provide, including content, size and weight information, place of dispatch and destination, as well as the desired date of the shipment(s), in a first step to display possible transport solutions including the price.

If you wish to use one of the transport solutions offered, you can book a transport order with us via the “Book now” function. During the booking process, the following data is collected, among other things:

First name / last name
Company (optional)
Email address
Number (optional)
Address data (street, house number, postal code, city, country)
Data on pick-up / destination location (street, house number, postal code, city, country)
Contact details for pick-up location / destination (first name / last name, telephone number, email address)
Shipper data
Payment data (billing address, first name / last name, email address, telephone number, payment method)

We use the data you provide to send you booking confirmations and other necessary communications, documents and invoices in connection with the booking you have made. Optional information that is not strictly required is marked accordingly. In the context of transport processing, it will be necessary to disclose personal data to participating partners and payment service providers for the purpose of transport execution and payment processing. Depending on the place of dispatch or destination, it may also be necessary, due to local statutory security requirements, to transmit transport order data to competent authorities in the country of origin or destination.

The legal basis for the processing of personal data is Article 6(1)(b) GDPR in the context of contract performance and contract fulfillment through the booking made by you.

New Relic

We use the service “New Relic” on our booking platform “booking.time-matters.com” if you have given your consent, in order to measure technical performance, for example loading times and errors, and to understand how users interact with the platform.

New Relic, Inc.
188 Spear Street, Suite 1000
San Francisco, CA 94105, USA

The objective is to improve the user-friendliness and stability of the platform. Depending on the configuration, technical usage data, for example page loading times and errors, as well as event data relating to interactions, for example clicks/inputs, may be processed. According to our project concept, “Custom Events” may contain information that can enable assignment to a user, for example a booking ID. We process such content only with explicit consent. If activated, session replay reconstructs interactions within a session from the HTML representation. Inputs and text fields are to be obscured. Only a portion of sessions is recorded.

Data processed:

Timestamp of the activity
Latitude / longitude of the internet service provider (ISP)
ISP
Browser window size, browser and operating system
City and country of the ISP
URL
Search inputs
All inputs relating to addressees, consignees, sender / collecting person, etc. In this context, we process
first name / last name
email
telephone number
pick-up / delivery address
Shopping cart ID
Username and user ID, if logged in
Customer number
User click sequence, including which elements were clicked and interacted with

Personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States of America. Such transfers are carried out on the basis of Standard Contractual Clauses (SCCs), where applicable.

The use of New Relic and the setting of the cookies required for this purpose take place only with your consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future via the cookie settings.

https://newrelic.com/privacy: https://newrelic.com/termsandconditions/privacy?has_gdpr=true

d) Processing of data when registering as an Onboard Courier (airmates.eu / become an airmate)

In order to make the functions of airmates.eu, both the website and the app, available to our (potential) Onboard Couriers, (potential) Onboard Couriers must first register with us as such and create a personal user profile.

The login data collected during this registration is stored together with an Onboard Courier profile. Personal login data must always be kept confidential. Shared profiles are not permitted at any time. The login data is limited to the email address provided and a self-selected password so that we can identify the courier. In addition, we collect the mobile phone number to verify the user of the account. It is also possible to receive orders via SMS directly on the mobile phone if our offered app is no longer used.

During the registration process, the user provides some information about themselves. All mandatory information that we strictly require for providing our service and for registration is clearly marked with an asterisk (*). Non-marked information is transmitted voluntarily so that we can send the courier tailored orders. The personal data provided is used only for the defined purposes.

During the registration process, (potential) Onboard Couriers must verify themselves with our service provider IDnow GmbH, Auenstraße 100, 80469 Munich, Germany, so that we can comply with our statutory and contractual obligations to verify identity. A valid identity document is required for this purpose. We do not receive copies of identity documents from our contractually bound partner at any time. Further information about IDnow GmbH, the registration process and contact options can be found here: https://www.idnow.io/de/datenschutz/

We collect and process the following data in connection with an Onboard Courier profile:

Address and postal address data
Identity data
Contact and/or location data
Preferences and skills
Verification status
Information on orders already performed

The legal basis for the processing of Onboard Courier data is Article 6(1)(b) GDPR, because the processing is necessary for the performance of a contract to which the Onboard Courier is party or for the implementation of measures carried out at the request of the Onboard Courier prior to entering into a contract. In addition, we process the personal data of our (potential) Onboard Couriers on the basis of Article 6(1)(c) GDPR.

The personal data is processed only for as long as is necessary to fulfill the processing purpose. We reserve the right, on the basis of Article 6(1)(f) GDPR, to maintain so-called blocking lists. We process the data on our blocking lists for a maximum of 5 years, after which it is deleted.

In some cases, we may place the profile in an “on-hold” status. As a rule, we make this change if we cannot guarantee timely orders, for example because a very large number of potential couriers are already registered for a particular region. In this case, we initially only store the identity data and contact and/or location data and process it further only if the order situation changes, for example if it becomes more likely that we can assign an order or if we wish to inform the data subject about the current status of their profile. We regularly process the data in cases of on-hold status for only 12 months. Shortly before the expiry of these 12 months, the data subject has the option to consent to processing extended by a further 12 months. The legal basis for the processing of personal data on the basis of consent is Article 6(1)(a) GDPR.

Processing of data as a stem cell courier

Registration/application as a stem cell courier

To apply as a stem cell courier, it is necessary to provide relevant personal information during registration. The following is a list of the personal data collected:

Address data
Identity data
Contact data
Tax data
Bank data
Passport data and passport photo
Information on orders already performed

The legal basis for the processing of stem cell courier data is Article 6(1)(b) GDPR, because the processing is necessary for the performance of a contract to which the stem cell courier is party or for the implementation of measures carried out at the request of the stem cell courier prior to entering into a contract. In addition, we process the personal data of our (potential) stem cell couriers on the basis of Article 6(1)(c) GDPR for reasons of compliance with EU sanctions regulations.

Processing in connection with the OBC Lounge

In addition, stem cell couriers have the option to register in the “OBC Lounge” in order to participate in the order allocation process. This is an extension of our booking system and provides couriers with greater transparency. Registration is voluntary.

The following is a list of the personal data collected:

Login information
Mobile phone number

The personal data is processed only for as long as is necessary to fulfill the processing purpose. The legal basis for the processing is Article 6(1)(f) GDPR. We offer the OBC Lounge for simplified and transparent presentation and therefore wish to offer a service that may also be used to the benefit of stem cell couriers.

The login data collected during this registration is stored together with the profile of a stem cell courier. Personal login data must always be kept confidential. Shared profiles are not permitted at any time. The login data is limited to the email address provided and a self-selected password so that we can identify the courier. In addition, we collect the mobile phone number to verify the user of the account. It is also possible to receive orders directly on the mobile phone via SMS.

e) Processing of your data in connection with newsletters

We offer you the option on our Website to subscribe to various email newsletters. The information required for subscription is shown in the registration form and generally includes your email address. Mandatory information is marked accordingly. You may optionally provide us with further information.

By subscribing to one of our newsletters, you declare your consent to regular delivery to you and to receipt of the newsletter. The newsletters we send also enable us to evaluate and statistically analyze whether they were opened and which content may have been clicked. Subscription to our newsletters is carried out using a double opt-in procedure, meaning that interested parties receive an email after registration in which we ask them to confirm the subscription submitted. This confirmation is necessary to prevent misuse of newsletter subscriptions. Newsletter registrations are logged in order to be able to prove the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation as well as the IP address of your internet connection used at that time. The current status in the registration process is also logged by the shipping service provider used by us.

We send newsletters and process your data in this context only with your consent as the recipient and therefore on the basis of Article 6(1)(a) GDPR. If the content of one of our newsletters is specifically described during registration, this content is decisive for the users’ consent. Otherwise, our newsletters contain information about our services and about us.

You may unsubscribe from our newsletters at any time with effect for the future, meaning that you may withdraw your consent. A link to withdraw the respective newsletter subscription can be found at the end of each newsletter. Withdrawal results in deletion of your data from the newsletter distribution list. You may also send us a corresponding notification at any time by post or email using the contact details provided above.

Additional information regarding the press distribution list:

We also offer persons working in journalism the option to receive a newsletter for journalistic purposes. If you contact us with a request to be added to the press distribution list, we will manually add your email address to our distribution list. We will then trigger the consent process described above through our shipping service provider. If you do not respond to this email, your email address will be automatically blocked after 48 hours.

f) Processing of your data in connection with applications for job vacancies

If you apply to us for job vacancies, your personal data will be stored by us in the context of the application process. You can submit your application for advertised positions only via the Deutsche Lufthansa AG Career Cockpit. This can be accessed at https://www.lufthansagroup.careers/de or https://www.lufthansagroup.careers/de/time-matters.

To participate in the application process, you need a user account, which you must create accordingly. The Privacy Notice of Deutsche Lufthansa AG at https://www.lufthansagroup.careers/de/datenschutz applies to the Career Cockpit and must be confirmed by you as part of registration and use. The personal data entered is managed exclusively within the Lufthansa Career Cockpit. We additionally store applicant data only when an interview with us is to take place. In this case, the application documents are forwarded by our HR department exclusively to the relevant departments and used in the further application and selection process.

If a rejection occurs, applicant data is stored due to legal requirements and claims for up to 6 months after notification by time:matters and is deleted after expiry of this period. Please note that the Lufthansa Privacy Notice also continues to apply here and that deletion periods may differ. The legal basis for the processing of your personal data as an applicant is Article 88 GDPR in conjunction with Section 26 BDSG and, where applicable, declarations of consent additionally provided during the application process within the meaning of Article 6(1)(a) GDPR.

Further information on frequently asked questions (FAQ) during the time:matters application process can be found at the following address: https://www.time-matters.com/career/

Who receives personal data?

Personal data is generally processed within our company. Depending on the type of personal data, only certain teams (organizational units) have access to personal data. These include, in particular, the teams involved in providing our digital offerings, such as websites, or the business processes described, and our IT department. Through a role and authorization concept, access within our company is limited to those functions and to the scope required for the respective purpose of processing.

We may also transmit personal data to third parties outside our company to the extent permitted by law. These external recipients may include in particular:

affiliated companies within the time:matters Group to which we transmit personal data for internal administrative purposes and to provide central services, for example invoicing services;
those third parties whose services we use to provide our services, for example to carry out transport and logistics services, to load and unload our freight and to provide related services, insofar as the transmission is necessary for the performance of the contracts concluded with us, such as ground handling and customs service providers at the respective airports;
the service providers engaged by us, for example our transport, IT, CRM, payment or, in some cases, ground handling service providers, who provide services for us on a separate contractual basis that may also include the processing of personal data on our behalf, as well as the subcontractors of our service providers engaged with our consent. In the IT area, this includes in particular:
(Web) hosting service providers
Software-as-a-Service (SaaS) service providers
email dispatch service providers
verification service providers for identity verification
non-public and public bodies, for example airports, customs and police, insofar as we are obliged to transmit personal data due to legal obligations;
recipients of a shipment that we deliver for one of our business partners. In individual cases, these may also include your personal data if you are named as a contact person in the transmitted shipment data;
other contact persons within your organization if they are also registered to use our services. In this case, all contact persons within the organization of a business partner may be able to access information on all business transactions of that business partner, including information on your involvement in such a business transaction, via the services;
we may also transmit further data to third parties in connection with the use of cookies and tracking functions on our Website.

If we process data in a third country, meaning outside the European Union (EU) or the European Economic Area (EEA), or if this occurs in connection with the use of third-party services or the transmission of data to third parties, this takes place only if it is necessary for the fulfillment of our pre-contractual or contractual obligations, on the basis of your consent, due to a legal obligation or on the basis of our legitimate interests.

Subject to statutory or contractual permissions, we transmit personal data to a third country only if the special requirements of Articles 44 et seq. GDPR are met. Where such transmissions are not based on a statutory basis or are not made to a country for which an adequacy decision by the EU Commission exists, we use the EU Standard Contractual Clauses.

Is automated decision-making used?

In connection with the operation of our Website, we generally do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR. If we use such procedures in individual cases, we will inform you separately to the extent required by law.

How long is your data stored?

We process the data only for as long as it is no longer required to fulfill the stated purpose, or until deletion/blocking or withdrawal of consent has been declared to us by the data subject. The internal deletion processes are designed so that everyone entrusted with data processing is obliged to regularly review the appropriateness, timeliness and legitimacy of the data processing. Personal data that we must store to fulfill retention obligations is stored until the end of the respective retention obligation. To the extent that we store personal data exclusively to fulfill retention obligations, it is generally blocked so that it can be accessed only when this is necessary with regard to the purpose of the retention obligation. Information on the individual storage period for specific processing activities can be found in the corresponding sections of this Privacy Notice.

What data protection rights do you have as a data subject?

a) Right to object

Pursuant to Article 21 GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of Article 6(1)(e) or Article 6(1)(f) GDPR. This also applies to profiling based on these provisions. In the event of such an objection, we will no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defense of legal claims.

If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing purposes. This also applies to profiling insofar as it is related to such direct marketing. If you object to processing for direct marketing purposes, the personal data concerned will no longer be processed for these purposes.

b) Withdrawal of consent

If you have given us consent to process your personal data, we hereby inform you that you may withdraw this consent at any time. This can be done, for example, by clicking on the corresponding link in any of our newsletters or in our emails or by sending a corresponding notification by post, fax or email via one of the contact channels mentioned above in this Privacy Notice. In all other cases, or if you have problems withdrawing your consent, you are also welcome to contact the data protection team of time:matters via the contact channels listed above.

Please note that any consent withdrawn by you has effect only for the future and does not affect the legitimacy of processing in the past. In some cases, despite your withdrawal, we remain entitled to continue processing your personal data on another legal basis, for example for the performance of a contract.

c) Further rights

As a data subject, you also have the right:

to request confirmation as to whether personal data concerning you is being processed and, where this is the case, to obtain access to such data, its purposes of use and further information pursuant to Article 15 GDPR (right of access);
to correction of inaccurate data concerning you. Taking the circumstances into account, you also have the right to have incomplete personal data concerning you completed, including by means of a supplementary statement, pursuant to Article 16 GDPR (right to correction);
to request that personal data concerning you be deleted pursuant to Article 17 GDPR (right to erasure);
to request restriction of processing pursuant to Article 18 GDPR (right to restriction of processing);
to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit such data to another controller pursuant to Article 20 GDPR (right to data portability);
To exercise these rights, you may contact us at any time by post (Data Protection, time:matters GmbH, Gutenbergstr. 6, 63263 Neu-Isenburg) or by email (protection@time-matters.com).

Please note that, in order to exercise your rights and to ensure data protection, we must identify you in each case and, if we cannot identify you clearly, we may have follow-up questions regarding your request. Despite our efforts, processing your rights is not possible without a minimum amount of information about you. For identification, we therefore ask you to provide the following minimum information:

Last name, first name
Postal address
Email address
and, optionally, customer or booking number

When communicating via the internet, for example by email, complete confidentiality and data security cannot always be guaranteed. We therefore recommend that you use postal mail for confidential information.

d) Competent Supervisory Authority

As a data subject, pursuant to Article 77 GDPR you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you violates the GDPR.

The supervisory authority responsible for time:matters is:

Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)

Postfach 3163
65021 Wiesbaden
Gustav-Stresemann-Ring 1
64189 Wiesbaden

Telephone: +49 (0)611 1408-0
Fax: +49 (0)611 1408-900/901
Email: poststelle@datenschutz.hessen.de

Further information and contact details can be found here:
https://datenschutz.hessen.de/

A list of the supervisory authorities of other German federal states and their contact details can be found here: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html

Neu-Isenburg, July 2026