Privacy Policy

1. Controller

The controller for data processing on this website is:

Altora Technologies UG (haftungsbeschränkt)
Managing Director: Marjan Akhoundi
Jägerhofstr. 50
40880 Ratingen
Deutschland

Email: info@friend-park.de

2. General Information on Data Processing

The protection of your personal data is important to us. We process personal data exclusively in accordance with the applicable provisions of the GDPR and other applicable data protection legislation. Personal data means all data with which you can be personally identified, in particular name, email address, vehicle data and technical data such as IP addresses.

3. Legal Basis for Data Processing

We process your data on the following legal bases:

• Art. 6(1)(a) GDPR – Consent (e.g. cookies)
• Art. 6(1)(b) GDPR – Contract performance (booking, user account)
• Art. 6(1)(c) GDPR – Legal obligation (e.g. tax law)
• Art. 6(1)(f) GDPR – Legitimate interest (IT security, fraud prevention)

4. Data Collected and Purposes

We collect and process the following data:

• Name and contact details (email address, phone number)
• Booking data (dates, parking space, extras, price)
• Vehicle data (licence plate, model)
• Login data (encrypted password, email confirmation status)
• IP address and technical log data
• Coin balance and transaction history (loyalty programme)

Purposes: booking processing, user account management, email communication (confirmation, invoices), IT security, fraud prevention, fulfilment of legal obligations.

The details marked as mandatory for a booking are required to conclude the contract; without them we cannot carry out the booking. All other details are voluntary. No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

5. Website Provision and Log Files

Each time our website is accessed, technical data such as browser type and version, operating system, IP address, date/time of access and the referrer URL are automatically collected. For logged-in users, we additionally log individual actions taken on the platform (function accessed, IP address, browser identifier, timestamp) for IT security and fraud-prevention purposes. This data is stored only for as long as necessary for these purposes and is reviewed and deleted on a regular basis. The legal basis is Art. 6(1)(f) GDPR.

Hosting and email delivery: we operate the website, database and email delivery with MonsterASP.NET s.r.o., Jičínská 226/17, 130 00 Prague, Czech Republic, on servers in the EU (Hetzner Online GmbH data centres in Germany and Finland). The host processes the data solely on our behalf under a data processing agreement (Art. 28 GDPR). Legal basis: Art. 6(1)(b) and (f) GDPR.

6. Cookies

We use technically necessary cookies to operate the website. In addition, we use – only with your consent via our cookie notice – analytics cookies (Google Analytics 4) and marketing cookies (Google Ads, Meta pixel) to measure reach and campaign performance. Specifically:

Necessary

• Authentication cookie ("FriendPark.Auth"): keeps you logged in; expires after 24 hours of inactivity, or after up to 7 days if you select “Remember me”.
• Language preference cookie: stores your selected language; valid for up to 1 year.
• Cookie consent cookie ("jfp_consent_v2"): stores your granular choice (statistics/marketing) from the cookie banner, so it is not shown again on every visit; valid for up to 1 year.
• Security token (Anti-Forgery / CSRF protection): a pure session cookie, deleted when you close your browser.
• Stripe cookies (“__stripe_mid”, “__stripe_sid”): set only on the payment page by our payment provider Stripe Payments Europe Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland) and used exclusively to prevent fraud in online payments; valid for 30 minutes (“__stripe_sid”) or up to 1 year (“__stripe_mid”). Technically necessary for the payment you requested (Section 25(2) No. 2 TDDDG).
• Other technically necessary storage on your device: “fp_last_search” (session storage, remembers the airport and travel dates of your last search so you do not have to enter them again; deleted when you close the tab), “jfpChatConversationId” (local storage, only if you use the chat; links your chat history), scroll position in the customer area (session storage) and “fp_noanalytics” (set only on our team’s devices, excludes our own visits from statistics).

Statistics

• Google Analytics cookies ("_ga", "_ga_<container ID>"): only set if you have consented to the statistics cookie in our cookie notice; used for statistical reach measurement (visitor numbers, page views) via Google Analytics 4; valid for up to 2 years. Only if you have also consented to the marketing category is the "Google signals" feature active as well: users who are logged in to Google and have consented to personalised advertising there are analysed by Google across devices; from this, Google provides us with aggregated information on age, gender and interests as well as remarketing audiences, which may also be shared with a Google Ads account. You can view and delete this data via "My Activity" (myactivity.google.com). Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Marketing

• Google Ads click identifier ("fp_gclid"): only set if you have consented to the marketing cookie in our cookie notice AND you arrived at our site via a Google Ads advertisement; stores the click identifier (GCLID) assigned by Google so that a later booking can be attributed to the respective ad (conversion measurement); set by us; valid for up to 90 days.
• Google conversion linker cookie ("_gcl_au"): set by the Google tag (gtag.js) once you have consented to the marketing cookie; attributes ad clicks to conversions triggered on our website; provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; valid for up to 90 days.
• Enhanced conversions (Google Ads): only if you have consented to marketing cookies and complete a booking, the Google tag sends the email address entered for the booking to Google in hashed form (SHA-256; hashing takes place in your browser before transmission). This allows the booking to be attributed to a Google Ads ad you clicked earlier, even if cookies are missing. According to Google, the hash is used solely for conversion measurement. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via "Cookie settings". Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For data transfers see section 10.
• Meta pixel cookie ("_fbp"): only set if you have consented to the marketing cookie in our cookie notice; enables performance and reach measurement of our ads on Facebook and Instagram as well as the creation of remarketing audiences (Meta pixel); valid for up to 90 days. Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (jointly with Meta Platforms, Inc., USA). See section 10 for details on the data transfer.
• Channel attribution (“fp_utm”, “fp_landing_ref”): set only if you have consented to the marketing cookie; stores how you reached us – the campaign label of a link (UTM parameters) or only the domain name of the referring page (e.g. “google.de”), never the full address. This is linked to a later booking so we can see which advertising and channels are worthwhile. Set by us, not transmitted to third parties; valid for up to 90 days (“fp_landing_ref” only 2 minutes as an intermediate step).

Cookieless search statistics: when you search for parking on our website, we store – without a cookie and without any personal reference – only the airport, travel period, lead time, number of offers found and the lowest price; no IP address, no device or user identifier. This shows us where and when parking is lacking. Nothing is stored on or read from your device.

You can change or withdraw your choice for the Statistics and Marketing categories at any time via the "Cookie Settings" link in the footer. If our use of cookies changes significantly, we will ask for your consent again.

The legal basis is Art. 6(1)(b) GDPR (contract performance) for the login cookie and Art. 6(1)(f) GDPR (legitimate interest in secure, functional operation) for the other strictly necessary cookies; no separate consent is required for these pursuant to § 25(2) of the German TDDDG. For the Google Analytics, Google Ads and Meta pixel cookies, however, the legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you grant or decline via our cookie notice. Declining has no disadvantages for your use of the website. You can withdraw or change your consent at any time with future effect – most easily via the "Cookie Settings" link in the footer, which reopens the cookie notice. Alternatively, you can delete the cookies set for this site in your browser; you can also disable cookies in your browser generally, although this may restrict the functionality of the website.

7. Registration and User Account

When you create a user account, we store: first name, last name, email address (encrypted password), optional telephone number, company data (for B2B accounts), and coin balance. Passwords are stored encrypted and cannot be viewed in plain text. Data are processed on the basis of Art. 6(1)(b) GDPR. You can optionally secure your account with two-factor authentication (2FA) via an authenticator app (under "Account" → "Security").

8. Booking Data

When making a booking, we process: name, email address, telephone number, vehicle licence plate, vehicle data, flight data, extras booked, voucher codes used and coins redeemed. These data are necessary for contract performance (Art. 6(1)(b) GDPR). Booking confirmation and invoices are sent by email. B2B parking operators receive the booking-relevant data for processing. For online payments, payment-related data is additionally transmitted to our payment provider Stripe (see section 10).

Vehicle handover: at drop-off and return, the parking provider documents the condition of your vehicle with photos, mileage and your signature. This serves to perform the contract and to provide evidence in case of damage (Art. 6(1)(b) and (f) GDPR). Photos and signatures can only be viewed by you, the respective provider and Friend-Park and are automatically deleted seven days after the vehicle is returned (see section 11). You receive a copy by email.

9. Email Communication

We send transactional emails for: email address confirmation, password reset, booking confirmation, booking cancellation, and invoice. These emails are sent exclusively for contractual and account management purposes. The legal basis is Art. 6(1)(b) GDPR.

Newsletter: only if you have expressly consented (checkbox at registration or in your customer account, never pre-ticked) and your email address is confirmed do we send you offers and holiday tips by email (Art. 6(1)(a) GDPR, Section 7(2) UWG). We store the times of subscription and unsubscription as proof. You can unsubscribe at any time via the link in every email or in your customer account.

Review requests: Only if you have ticked the box for review requests (not pre-selected) when booking will we send you an email 3 days after the return of your vehicle asking you to review the provider in our own review system and – as long as no review has been submitted – at most three weekly reminders (at most 4 emails in total). The legal basis is your consent (Art. 6(1)(a) GDPR). As evidence, we store the time of your consent, the version of the consent text, its origin (booking form) and the times at which emails were sent. Consent is voluntary and not a condition for booking. You can withdraw it at any time with effect for the future – one click on the unsubscribe link in the email is sufficient; the withdrawal also applies to future bookings with the same email address.

Contact form, email and chat: when you contact us, we process your details (e.g. name, email address, booking number, message) to handle your request (Art. 6(1)(b) GDPR where related to a booking, otherwise (f)). The data is deleted once the request has been dealt with and no retention obligations apply.

AI support in customer service: for the chat on our website and to handle support emails faster (classifying the request, drafting a reply) we use AI services of OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland, as a processor. The content of your message is transmitted, for emails additionally the sender address, sender name and subject and – where your message can be assigned to a booking – the booking code, parking location and booked period; the data is not used to train the AI. Where data is transferred to the USA, this is based on the EU Standard Contractual Clauses. The chat clearly indicates that an AI is responding. Legal basis: Art. 6(1)(b) or (f) GDPR.

10. Data Disclosure

Your personal data is only disclosed where necessary for the performance of the contract (in particular to the respective parking provider in order to carry out your booking), where we are legally obliged to do so, or where you have expressly consented. In addition, we use the following service providers: a) Hosting, content delivery and attack protection: Our website is operated via the infrastructure of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare acts as a reverse proxy and content delivery network and protects against overload and abuse attacks (DDoS) between your browser and our server, processing technically necessary connection data in the process, in particular your IP address, the date and time of access and browser and request information. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and resilient operation). b) Protection against automated abuse (Cloudflare Turnstile): We use Cloudflare Turnstile on registration, on booking, in the contact form, in the review form and in the "Become a partner" form. Technical data (including IP address, browser signals) is transmitted to Cloudflare, Inc. in this process. The legal basis is Art. 6(1)(f) GDPR. c) Payment processing (Stripe): For online payments we use Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland, potentially involving Stripe, Inc., USA. The data required for payment processing (including name, email address, payment amount, payment method, transaction identifier) is transmitted to Stripe; full card data is processed exclusively by Stripe and does not pass through our systems. The legal basis is Art. 6(1)(b) GDPR. d) Reach measurement (Google Analytics 4): If you have consented to the statistics cookies, we transmit pseudonymous usage data (including truncated IP address, device and browser information, on-site interactions) to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If you have consented to statistics, we additionally transmit the completion of a booking (booking value, transaction identifier and the identifier from the analytics cookie) directly from our server to Google (Measurement Protocol). The legal basis is your consent (Art. 6(1)(a) GDPR). e) Conversion measurement (Google Ads): If you have consented to the marketing cookies, we transmit technical data (including the Google click identifier "GCLID", information about the conversion triggered, and device and browser information) to Google Ireland Limited and/or Google LLC in order to measure the performance of our ads. We ourselves cannot identify individual persons in this process; with enhanced conversions (see section 6), however, Google may assign the data to a Google account. The legal basis is your consent (Art. 6(1)(a) GDPR). f) Conversion and reach measurement (Meta pixel): If you have consented to the marketing cookies, we transmit technical data (including IP address, device and browser information, the page visited and, in the case of a completed booking, the booking value and currency) to Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, in order to measure the performance and reach of our ads on Facebook and Instagram. For this processing we are joint controllers with Meta within the meaning of Art. 26 GDPR; Meta Platforms Ireland Limited may also transfer the data to Meta Platforms, Inc., USA. We cannot identify individual persons in this process. The legal basis is your consent (Art. 6(1)(a) GDPR). Transfers to third countries: Where personal data is transferred to the USA in connection with the above services, the respective recipients (Cloudflare, Stripe, Google, Meta) are certified under the EU-US Data Privacy Framework, for which the EU Commission established an adequate level of data protection by decision of 10 July 2023; in addition, we have agreed the EU Standard Contractual Clauses with these providers. For AI support in customer service (OpenAI, see section 9) the EU Standard Contractual Clauses apply. No further transfer to countries outside the EU or the EEA takes place.

11. Data Retention

Your data is only stored for as long as is necessary for the respective purposes or as required by statutory retention obligations. Currently, the following applies in detail: personal booking data (name, contact details, address, vehicle and flight data, notes) is automatically anonymised ten years after the end of the booking; the booking number, amounts and status are retained without personal reference for accounting and statistics. Photos and signatures from the vehicle handover are deleted seven days after the vehicle is returned, or at the latest 90 days after they were taken if there is no return. Technical error and access logs are deleted after 90 days, action logs of logged-in users after 365 days and chat histories after 30 days. Other data (e.g. support emails, damage reports, reviews, records of consent) is deleted as soon as it is no longer required for the respective purpose and neither retention obligations nor open claims prevent this. User accounts are deleted on request unless statutory retention obligations prevent this.

12. SSL/TLS Encryption

This website uses SSL/TLS encryption. An encrypted connection is indicated by "https://" in the address bar and the padlock symbol in the browser.

13. Your Rights as a Data Subject

You have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent at any time (Art. 7(3) GDPR)

To exercise your rights, please contact: info@friend-park.de

14. Right to Lodge a Complaint

You have the right to lodge a complaint with the competent supervisory authority. The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, www.ldi.nrw.de.

15. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy as required, e.g. due to legal changes or new features on the platform. The current version is always available here.

Customer reviews

If you submit a review via the provider info page, we use your booking number and the email address you provide to check whether a completed booking with the reviewed provider exists (Art. 6(1)(b) and (f) GDPR – performance of the contract and our legitimate interest in genuine, manipulation-free reviews); we use Cloudflare Turnstile for this (see section 10 b). The review is stored linked to the corresponding booking. To detect abuse and duplicates, we also store a hash value of your email address and of your IP address. These hash values are pseudonymous personal data: they can be attributed to a person via the link to the booking or by comparison with a known address. They are stored for as long as the review is stored. Only the star rating, your review text, an abbreviated display name (e.g. "Max M.") and the publication date are shown publicly; the booking number, email address and hash values are not published. Customers with an account receive bonus coins for a review – regardless of the star rating and content. You can request the deletion of your review at any time using the contact address given above.