Controller
The controller within the meaning of Art. 4 no. 7 of the General Data Protection Regulation (GDPR) for the processing of personal data on the "Carrier Space" platform is: Nader Grebe Rheinwerkallee 6 53227 Bonn Germany Phone: +49 16098429799 Email: admin@carrier-space.com
Data Protection Officer
We are not legally required to appoint a data protection officer and have not appointed one (the requirements, in particular of Art. 37 GDPR and sec. 38 BDSG, are not met). Please direct any data protection matters directly to the controller named above.
General information and legal bases
We process personal data in accordance with the principle of data minimization and only to the extent necessary for the respective purposes stated. Depending on the context, the legal basis for the processing is: • Art. 6(1)(b) GDPR, insofar as the processing is necessary for the performance of a contract or for the implementation of pre-contractual measures • Art. 6(1)(a) GDPR, insofar as you have consented to the processing • Art. 6(1)(c) GDPR, insofar as the processing is necessary for compliance with a legal obligation • Art. 6(1)(f) GDPR, insofar as the processing is necessary to safeguard our legitimate interests and your interests do not override them
Access data / server log files
Each time the platform is accessed, technical access data is automatically processed and stored in server log files. This includes in particular: • the IP address of the accessing device • the date and time of access • the requested resource (URL) • the previously visited page (referrer), where transmitted • information about the browser and operating system used (user agent) The processing serves the technical delivery of the pages, the assurance of system stability, and the detection and prevention of misuse; this also includes the logging of login attempts for rate limiting. The legal basis is Art. 6(1)(f) GDPR.
Cookies and session
We use exclusively technically necessary cookies, in particular a login or session cookie to maintain your logged-in session and a cookie to store your language setting. No tracking takes place; no third-party advertising or analytics cookies are used. The legal basis is Art. 6(1)(f) GDPR; the storage of technically necessary information on your device is permitted without consent pursuant to sec. 25(2) TDDDG.
Registration and account
To set up and maintain a user account, we process the data you provide. The following are stored: • email address • name, first and last name • phone number (optional) • your password exclusively as a cryptographic bcrypt hash (not in plain text) • if activated: information on two-factor authentication (TOTP) • language setting • login timestamp and status of email confirmation • optionally a profile picture The processing serves the provision, administration, and protection of your account. The legal basis is Art. 6(1)(b) GDPR.
Company and billing data
To handle contracts and issue invoices, we process the company data of your organization, in particular company name, VAT identification number, business address and, where applicable, a differing billing address, email domain, and a stored logo. The processing is carried out for the performance of the contract and for compliance with legal obligations, in particular under commercial and tax law. The legal basis is Art. 6(1)(b) and (c) GDPR.
Requests, bookings, and messages
In the course of the mediation and handling, we process the transaction, mission, and payload data you enter, as well as the messages exchanged between customer and provider (in each case content and sender name), and the documents you upload. The processing serves the mediation between customer and provider and the handling of requests and bookings. The legal basis is Art. 6(1)(b) GDPR.
Passenger flight: passenger data and aeromedical self-declaration
For passenger flight requests, we process the passenger data required to carry out the flight, in particular name, date of birth, nationality, height, and weight. For reasons of data minimization, the aeromedical self-declaration is stored exclusively as a yes/no confirmation. Diagnoses or other health details are neither collected nor stored. Insofar as the confirmation may have a health-related connection, this constitutes a special category of personal data within the meaning of Art. 9 GDPR. The processing is based on your explicit consent pursuant to Art. 9(2)(a) GDPR and on carrying out the request you have initiated. We limit the processing to the extent strictly necessary for this purpose.
Email dispatch
We send emails to confirm your registration (double opt-in), to reset your password, and to notify you of activities on the platform. For this purpose, we process your email address and keep a dispatch log (recipient address, time, and status of dispatch); time-limited one-time tokens are used for confirmation and reset processes. The legal basis is Art. 6(1)(b) GDPR as well as Art. 6(1)(f) GDPR based on our legitimate interest in a reliable and traceable dispatch of messages.
Hosting and processing on our behalf
The platform is operated by external service providers that process personal data on our behalf and in accordance with our instructions. We have concluded data processing agreements with them pursuant to Art. 28 GDPR: • Web hosting as well as email sending and communication: STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany • Database: Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 Where personal data is transferred to a country outside the EU/EEA in this context, this takes place on the basis of appropriate safeguards, in particular the EU standard contractual clauses (Art. 46 GDPR).
Recipients and disclosure
As part of the mediation, we make the data required for a request or booking accessible to the provider you have selected in each case, so that they can prepare an offer and handle the service. Beyond this, we do not disclose your data to third parties, in particular not for advertising purposes. Regarding a possible transfer to countries outside the EU/EEA (third countries) in the context of the database hosting we use, please see the section "Hosting and processing on our behalf".
Storage period and deletion
We store personal data only for as long as is necessary for the stated purposes or as required by statutory retention periods, in particular those under commercial and tax law. Once the purpose no longer applies and any retention periods have expired, the data is deleted. Your account, including the associated data, can be deleted. Booking records that must be retained for legal reasons are in this case kept without any personal reference.
Your rights
Subject to the statutory requirements, you have the following rights: • access to the data processed about you (Art. 15 GDPR) • rectification of inaccurate or incomplete data (Art. 16 GDPR) • erasure of your data (Art. 17 GDPR) • restriction of processing (Art. 18 GDPR) • data portability (Art. 20 GDPR) • objection to the processing (Art. 21 GDPR) • withdrawal of a consent given, with effect for the future (Art. 7(3) GDPR) To exercise your rights, please contact the contact named under "Controller".
Right to lodge a complaint
Without prejudice to any other remedies, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR (Art. 77 GDPR). Competent supervisory authority: State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
Data security
We take appropriate technical and organizational measures to protect your data against loss, misuse, and unauthorized access. Data transmission between your device and our servers is encrypted via TLS/SSL. Passwords are stored exclusively as a cryptographic bcrypt hash. Our security measures are continuously reviewed and adapted in line with technological developments.
Changes to this privacy policy
We will amend this privacy policy as soon as changes in the legal situation or changes in our processing activities make this necessary. The current version published on the platform applies in each case. As of: 30 July 2026