Privacy Policy

Controller

Deal Logistik GmbH
Holderäckerstr. 4
70499 Stuttgart
Deutschland
Represented by: Latif Aydogan
info@deallogistik.de

Controller and scope

The controller within the meaning of the General Data Protection Regulation (GDPR) is Deal Logistik GmbH as named above, represented by its managing director Latif Aydogan. The postal address and e-mail address are shown at the top of this page and in the legal notice. For any question about data protection and for exercising your rights, the easiest way to reach us is by e-mail to the address given there.

This privacy policy applies to the website www.deallogistik.de in all language versions and to the contact form and application form offered on this website.

Hosting and server log files

This website runs on a server we rent from Ubden A.Ş., Maslak Mah. AOS 55. Sok. No 2/25, 34398 Sarıyer/Istanbul, Turkey. The server is located in a data centre in Germany. The provider processes the data generated when the website is accessed on our behalf under a data processing agreement pursuant to Art. 28 GDPR. Because the provider is established in Turkey, for which no adequacy decision of the European Commission exists, access from a third country cannot be ruled out. As the safeguard under Art. 46(2)(c) GDPR we have concluded the European Commission's standard contractual clauses with the provider.

Each time a page is requested, the web server processes technically necessary data and stores it in server log files. These usually include the IP address of the requesting device, the date and time of access, the page or file requested, the previously visited page (referrer) if your browser transmits it, the browser type and operating system, the volume of data transferred and the HTTP status code. Which fields are actually recorded depends on the hosting provider's configuration.

This processing serves to deliver the website, to keep it running stably, to ensure IT security, in particular detecting and defending against attacks, and to analyse faults. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and undisturbed operation of the website. The log files are not merged with other data and are deleted after 14 days.

In addition, the website keeps a technical error log on the web server. It contains error messages from the application with date and time, but no form entries. The error log cannot be accessed via the internet and is deleted after 30 days at the latest.

Cookies and storage on your device

This website uses only technically necessary cookies. No cookies are used for audience measurement, tracking or advertising, and no data is sent to analytics services. A cookie banner is therefore not required.

The cookie "dl_session" is a session cookie. It is set when any page is opened and is used to protect the forms against misuse (protection against cross-site request forgery) and to show you the confirmation message after you submit a form. It contains only a random session identifier and is deleted as soon as you close your browser. The associated session data on the server contains no form entries and is cleaned up automatically after the session ends.

The cookie "dl_lang" stores the language in which the website is shown to you (German, English or Turkish). It is set on your first visit based on your browser's language setting and updated when you switch the language. Its lifetime is twelve months. Both cookies carry the HttpOnly and SameSite=Lax attributes and are sent only to our own domain.

Storing these cookies on your device is permitted without consent under Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), because it is strictly necessary to provide the website functions you request. Where personal data is processed in this context, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and user-friendly provision of the website. Your decision to load the Google Maps view is additionally stored in your browser's local storage (entry "dl_consent_maps"). Details are given in the section on Google Maps.

Contact form and other contact

You can send us enquiries via the contact form. In doing so we process the details you enter: contact person, e-mail address, type of enquiry, subject and message (mandatory fields) as well as company and telephone number (optional fields). The system also transmits the date and time of submission, the language version you used and the address of the page from which the form was sent. Your IP address is not included in the enquiry.

We process this data in order to handle and answer your enquiry. If your enquiry is aimed at concluding or performing a contract, for example a transport order or a cooperation, the legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). In all other cases the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is responding to enquiries and communicating with interested parties.

Your enquiry is sent as an e-mail to our company mailbox, which we operate with Microsoft 365 (see the section "E-mail delivery and processors"). Your e-mail address is set as the reply address. Should e-mail delivery from the web server be temporarily unavailable, the form entries are instead stored temporarily in a non-public area of the web server, transferred by us to the mailbox and then deleted from the web server.

If you contact us by e-mail or telephone, we process your details in the same way. The data is deleted once your enquiry has been fully dealt with and no further communication is expected. Where the correspondence must be retained as a commercial or business letter or as an accounting record (Section 257 of the German Commercial Code (HGB), Section 147 of the German Fiscal Code (AO)), we keep it for the statutory retention periods of six to ten years.

Applications

Through the application form on the careers page we process the following details: first name, surname, e-mail address, telephone number, place of residence and desired position (mandatory fields) as well as driving licence class, professional experience and message (optional fields). You may also upload up to six files: CV, copy of your driving licence, certificates and other documents (PDF, JPG, PNG, DOC or DOCX, up to 5 MB each and 15 MB in total). As with the contact form, the date and time, language version and page address are transmitted, but not your IP address.

We process this data solely to conduct the application procedure and to decide on establishing an employment relationship. The legal basis is Section 26(1) of the German Federal Data Protection Act (BDSG) in conjunction with Art. 6(1)(b) GDPR. Please send us special categories of personal data, for example health data from medical certificates or information about a severe disability, only where this is required for the position or you expressly wish to do so. Where your documents contain such data, we process it on the basis of Art. 9(2)(b) GDPR in conjunction with Section 26(3) BDSG.

Your application including the uploaded files is sent as an e-mail with attachments to our mailbox at Microsoft 365. The files are not stored on the web server; they are removed automatically immediately after sending. Should e-mail delivery be temporarily unavailable, the note in the contact form section applies; uploaded files are not stored on the web server in that case. Alternatively, you may also apply by e-mail or by post.

We delete application data six months after the end of the application procedure, that is after a rejection or the withdrawal of your application. This period serves to assert and defend claims under the German General Equal Treatment Act (AGG). Longer storage, for example to consider you for future positions, takes place only with your express consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect for the future. If you are hired, we transfer your data to your personnel file.

E-mail delivery and processors

We operate our company mailbox with Microsoft 365 (Exchange Online). The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Enquiries and applications received via the forms on this website are received and stored in this mailbox. Microsoft processes the data as a processor on the basis of a contract under Art. 28 GDPR (Microsoft Products and Services Data Protection Addendum).

The notification e-mails are handed over from the web server to Microsoft through an encrypted connection (SMTP with STARTTLS). A transfer of individual data to Microsoft Corporation in the USA, for example for support or operational purposes, cannot be ruled out. Microsoft Corporation is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, Art. 45 GDPR). In addition, the European Commission's standard contractual clauses apply (Art. 46(2)(c) GDPR).

A further processor is our hosting provider Ubden A.Ş., Istanbul, Turkey, which operates the web server located in Germany (see the hosting section above, which also covers the standard contractual clauses). We pass your data on to other recipients only where we are legally obliged to do so, for example to authorities or courts, or where this is necessary to perform a contract with you.

Google Maps

On the contact page we may embed a map from Google Maps to show you our location. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the page is opened, only a placeholder image from our own server is loaded at first. No data is transferred to Google.

The map is only loaded when you click "Load map". By clicking you consent to your browser connecting to Google servers. Google then receives your IP address, technical details of your browser and the address of our website, and can set and read its own cookies inside the map. We have no influence on the further processing by Google. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Your decision is stored in your browser's local storage under the entry "dl_consent_maps" so that the map loads on later visits to the contact page without asking again. The entry has no fixed lifetime and is not transmitted to us. You can withdraw your consent at any time with effect for the future by clicking "Hide map and withdraw consent" below the map or by deleting the site data for this domain in your browser settings. After that the map is only loaded after a new click.

Google may also transfer the data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. In addition, the European Commission's standard contractual clauses apply (Art. 46(2)(c) GDPR). Further information is available in Google's privacy policy at https://policies.google.com/privacy.

Protection against misuse

To protect our forms and our mailbox against spam and automated submissions, we use three measures: a form field invisible to humans that is filled in only by programs (honeypot), a check that a plausible amount of time has passed between opening the form and submitting it, and a limit on the number of submissions per sender (five submissions within 15 minutes for the contact form, three for the application form).

For the submission limit, your IP address is stored on the web server at the time of submission not in plain text but as a pseudonymised hash value (SHA-256 with a secret additional value) together with the time of submission. Entries older than 15 minutes are discarded at the next check; the files are generally deleted within 30 minutes. The honeypot field and the timing check process no personal data. If either of these two checks fails, the entry is discarded and is neither stored nor sent.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is protecting the forms and the mailbox against misuse.

Data security

The website is delivered over an encrypted connection (HTTPS with TLS), so that your entries in the forms are protected in transit. The e-mails from the web server to our mailbox are also transmitted in encrypted form (STARTTLS).

Fonts, scripts and stylesheets are loaded exclusively from our own server. No connection to third-party servers is established when pages are opened; the only exception is the Google Maps map, which is loaded only after your click. No analytics or social media services are embedded.

In addition, the website sends security headers, in particular a Content Security Policy that restricts the loading of content to our own server and the Google Maps map, as well as headers against embedding the page in other websites, against misinterpretation of file types and to limit the referrer information transmitted. Please note that e-mails you send to us yourself without encryption are transmitted outside our control.

Retention period

We store personal data only for as long as necessary for the respective purpose. After that, the data is deleted unless statutory retention obligations, in particular under commercial and tax law, prevent deletion or the data is needed to establish, exercise or defend legal claims. In these cases, processing is restricted to storage.

In summary: server log files 14 days; session cookie until the browser is closed; language cookie twelve months; pseudonymised IP hash values for the submission limit generally up to 30 minutes; contact enquiries until fully dealt with, six to ten years where retention is required by law; applications six months after the end of the procedure, longer with your consent; the map view entry in your browser until you delete it.

Your rights

You have the following rights against us regarding the personal data concerning you: the right of access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR) and the right to data portability (Art. 20 GDPR).

Where processing is based on your consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected. To exercise your rights, an e-mail to the address given above is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Heilbronner Straße 35, 70191 Stuttgart, Germany, telephone +49 711 615541-0, e-mail poststelle@lfdi.bwl.de, https://www.baden-wuerttemberg.datenschutz.de.

Right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. On this website this concerns in particular the server log files, the technically necessary cookies, the protection measures against misuse and the handling of general enquiries.

If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. We do not engage in direct marketing. Please send your objection by e-mail to the address given above.

No obligation to provide data, no automated decision-making

Providing your personal data is neither required by law nor by contract, and you are not obliged to provide it. Without the details marked as mandatory, however, we cannot process your enquiry or application. Simply visiting the website does not require you to provide any personal data.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. Enquiries and applications are reviewed exclusively by employees of our company.

Changes to this privacy policy

We will adapt this privacy policy when the legal situation, our website or our processing operations change. The version published on this page applies at any given time. This privacy policy is available in German, English and Turkish; in the event of discrepancies, the German version prevails.

Last updated: September 2026