PRIVACY POLICY & DATA GOVERNANCE

1. Data Controller Identification

The entity responsible for the collection, processing, and safeguarding of your personal data under Article 4(7) of the General Data Protection Regulation (GDPR) is:

Pickoracuriouscrew Mobility GmbH
Holzmarktstraße 25, 10243 Berlin, Federal Republic of Germany
Commercial Registry: Amtsgericht Charlottenburg (Berlin), HRB 249811 B
Direct Inquiries: [email protected]

2. Categories of Data Collected and Technical Telemetry

When interacting with the Pickoracuriouscrew digital platform or reserving party coach services, we process several categories of information depending on your level of interaction:

• Server Access Telemetry: Anonymized Internet Protocol (IP) address, operating system, browser user-agent string, HTTP referral sources, timestamp of page access, and WebGL rendering capabilities to adjust 3D graphic load.
• Client Inquiry Data: Full name, corporate entity, valid email address, phone contact, desired charter dates, passenger counts, customized route selections, and specific catering requests submitted through our dispatch forms.
• Transaction & Security Telemetry: Invoiced banking identifiers, transaction reference IDs, and verification records for corporate compliance. We do not store raw credit card numbers; payment tokens are handled through PCI-DSS Level-1 certified payment service partners.
• On-Board Safety Logs: For passenger safety and regulatory adherence under German Passenger Transportation Regulations (PBefG), exterior navigational telemetry and GPS transit tracking are active during operational runs. No covert interior video audio logging is performed without clear visual signage and prior charter agreement.

3. Legal Bases for Data Processing (GDPR Art. 6)

We only collect and process personal data when an explicit legal justification exists under European law:

• Performance of a Contract (Art. 6(1)(b) GDPR): Processing essential details to formulate reservations, deliver chartered mobile party experiences, manage crew logistics, and issue commercial invoices.
• Compliance with Legal Obligations (Art. 6(1)(c) GDPR): Retention of commercial transport registers, VAT invoices, and commercial manifests under German commercial (HGB) and fiscal law (AO).
• Legitimate Interests (Art. 6(1)(f) GDPR): Enhancing platform security, mitigating cyber-attacks, optimizing 3D WebGL user interface performance, and safeguarding our high-value mobile assets.
• Explicit Consent (Art. 6(1)(a) GDPR): Voluntary opt-in interactions, including optional analytics tracking and custom event update subscriptions.

4. Data Retention Architecture

Personal data is retained only for the duration strictly necessary to accomplish the designated operational purpose or as mandated by federal statutory retention timelines. Reservation agreements and financial documentation are held for 10 years in compliance with Section 147 of the German Fiscal Code (Abgabenordnung). Technical access logs are purged or pseudonymized within 30 days of generation.

5. Data Subject Rights Under Chapter III GDPR

As a European or international data subject, you maintain unconditional rights regarding your processed personal data:

• Right of Access (Art. 15 GDPR): Obtain confirmation regarding whether your personal information is undergoing processing and receive an unencrypted digital export.
• Right to Rectification (Art. 16 GDPR): Demand immediate correction of inaccurate or incomplete contact records.
• Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): Request complete purging of your records when legal justification no longer holds.
• Right to Restrict Processing (Art. 18 GDPR): Limit operational access to your data during pending verification inquiries.
• Right to Data Portability (Art. 20 GDPR): Receive personal data provided in a structured, standard, and machine-readable JSON format.
• Right to Object (Art. 21 GDPR): Challenge data processing justified by legitimate interest grounds at any time.

To exercise any of the rights listed above, transmit a signed request to [email protected]. You also have the right to lodge a formal complaint with the competent supervisory authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.