1. Controller and contact
The controller for personal data processed through x25pronto.de is Management Consulting Mayr, Waldaustrasse 2, 9500 Wil SG, Switzerland. “x25pronto” and “x25pronto.de” are business and service names of the controller and are not separate legal entities. Privacy requests may be sent to info@x25pronto.ch or +41 71 554 72 93. For users in Germany, the GDPR applies in particular, supplemented by the German Federal Data Protection Act (BDSG) where applicable; Swiss data protection law also remains relevant to the controller established in Switzerland.
2. Categories of data processed
Depending on use, we process identity and contact data, account and security data, email verification and activation status, timestamps and technical evidence of acceptance of Terms/privacy notices, billing and company data, application, courier-partner, vehicle, insurance and evidence data, tax and VAT information, payment and payout data, routes, schedules, shipment details, prices, booking, order, document and complaint data, pickup and delivery evidence including photos, correspondence and technical access, device, log, analytics and security data. The referral programme may additionally involve referrer data, the recipient email address, invitation and activation status, reward status and technically recorded sending, opening and click events.
3. Purposes and legal bases
Processing supports website, app and portal operation, registration, account activation, authentication and security, documentation of consents, address and route checks, pricing, bookings and payments, transport performance, partner assignment, the driver portal, settlement and payouts, complaint handling, the referral programme, contractual communications, lawful customer communications, accounting, evidence, fraud and abuse prevention, error analysis, audience measurement, legal obligations and the establishment, exercise or defence of legal claims. Where the GDPR applies, processing is based as appropriate on contract or pre-contractual steps (Art. 6(1)(b)), legal obligations (Art. 6(1)(c)), legitimate interests in secure and orderly operation, abuse prevention, evidence and legal enforcement (Art. 6(1)(f)), or consent (Art. 6(1)(a)).
4. Registration, acceptance and account activation
Registration may technically record whether the required Terms/privacy confirmation was provided and when. New accounts may remain inactive until the email address is confirmed. One-time tokens may be created for activation, password setup or comparable security processes, stored only in hashed or otherwise technically protected form, provided with an expiry and invalidated after use. Email-verification status is used for account, security, evidence and contractual purposes.
5. Account activation is not marketing consent
Activating or verifying an account, making a booking, applying or entering a courier partnership does not by itself constitute consent to advertising. Advertising by electronic mail is sent only where the statutory requirements are met, including section 7 of the German Act Against Unfair Competition (UWG). Unsubscribes, suppression entries, blocking flags and “do not contact” indicators are respected. Contractual, security and strictly necessary account communications are treated separately.
6. Germany as service and billing country
x25pronto.de is directed at Germany. For signed-in accounts and bookings, the billing or service country may be stored server-side as ISO country code DE. It is displayed as “Deutschland” on German pages and “Germany” on English pages. Server-side contractual, tax and billing records prevail over manipulated browser values.
7. Bookings, driver portal and courier partners
Independent courier partners used for a particular transport receive only the order, contact, route, schedule, shipment and evidence information required for performance. The driver portal may process company, contact, tax/VAT, billing, vehicle, insurance, bank/payout, terms, order, evidence, complaint and settlement data. System status, timestamps, acceptances, rejections, pickup and delivery evidence and comparable events may be logged for contract performance, quality assurance, settlement, tax classification, complaint handling and abuse prevention.
8. Driver-portal fees and tax evidence
Billing of driver-portal or partner services may require evidence of business status, place of establishment, billing address and tax/VAT details. Where a cross-border B2B service is subject to reverse charge, the information required for invoicing, evidence and any later correction may be processed. Data processing does not itself determine the tax treatment; the actual circumstances and applicable tax law govern.
9. Referral programme
Within the referral programme, a signed-in user may enter a recipient address and review or confirm the referral before sending. Administration and attribution may process referrers, recipients, sending status, account activation and reward status as well as technical opening and click events. Automated fetches, security scanners or similar technical access may be evaluated separately from human interaction. These data support programme operation, attribution, statistics, security and abuse detection. A referral does not replace any consent that may be required for further advertising to the recipient.
10. Payment data
Card payments are processed through Stripe. x25pronto receives transaction information needed for authorisation, payment status, accounting, refunds, invoices and records, but not full card details. Depending on the payment method, Apple Pay or Google Pay may be used as a wallet within the Stripe payment flow. Payment and invoice status may be processed to activate contractually provided portal or service functions automatically.
11. AI Bot
The AI Bot uses approved x25pronto content as its knowledge base. Questions and chat context required for generation are transmitted to the configured AI service and may be logged server-side for operation, quality, abuse prevention and administration. The visible AI chat history is kept in sessionStorage so that it survives page changes and reloads within the same browser session; it is not intended as a permanent local history. Signed-in accounts may have additional privacy or feature switches according to system status.
12. WhatsApp and electronic communications
When WhatsApp is opened, the message is handed to the WhatsApp service selected by you. Until then, the draft remains local in the browser. Contract, account, security, order and partner information may be sent electronically to the contact details stored in the account. Delivery, bounce, open or comparable technical status data may be processed where required for operation, security, evidence, deliverability or lawful communications. Further processing by WhatsApp/Meta or other external communication providers is governed by their own terms and privacy information.
13. First-party statistics, Google Tag Manager and local storage
Data-minimised operational baseline statistics are operated through x25pronto’s own infrastructure without an optional persistent browser identifier. Optional extended first-party analytics with visitor and session identifiers is enabled only according to the choice made in Cookie settings. With the relevant consent, the Google Tag Manager web container (container ID GTM-5XQMWR58) is additionally enabled. Permission is verified server-side using signed consent information; the GTM bootstrap is delivered only after a successful backend check through the x25pronto.de endpoint /api/privacy/gtm.js. Google Analytics is not configured on x25pronto.de. Advertising and personalisation storage remain denied by x25pronto by default. German section 25 TDDDG additionally applies to storing or accessing information on terminal equipment.
14. Recipients and service providers
Data may be disclosed as necessary to hosting, email, payment, mapping/routing, communication, AI and IT service providers and to courier partners used for a particular transport. Providers receive only the data required for the relevant function. Where data is transferred outside the EU/EEA, to Switzerland or to other third countries, applicable GDPR and Swiss data-protection requirements and safeguards are taken into account where required.
15. Retention, archiving and deletion
Data is retained only as long as needed for the relevant purpose, evidence, complaint handling, security or statutory retention obligations. Accounting, contract, payment, tax, security and evidence data may therefore be retained longer. Archived or deleted accounts may have active access disabled and the current contact address technically replaced or suppressed for operational communications. Data still required for legal, accounting, security or evidentiary reasons may remain in restricted form until the relevant purpose ceases.
16. Data security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or unlawful alteration. Measures may include access restrictions, hashed one-time tokens, server-side plausibility and authorisation checks, logging of security-relevant events and separation of active from archived accounts.
17. Data-subject rights
Where the GDPR applies, data subjects may in particular request access, rectification, erasure, restriction of processing and data portability and may object to processing; consent can be withdrawn for the future. Statutory retention and evidence duties and other overriding legal grounds remain reserved. Data subjects may also lodge a complaint with a competent data-protection supervisory authority. Requests should be sent to info@x25pronto.ch.