1Controller and data protection officer
This policy explains what happens to personal data when you visit swobbee.com. It describes what we actually do — not what a website of this kind might do.
Controller under Art. 4(7) GDPR
Swobbee GmbH · Johann-Hittorf-Straße 8 · 12489 Berlin · Germany
Phone +49 30 587 04 70 00 · info@swobbee.com
Managing directors: Thomas Duscha, Ludwig Speidel · Amtsgericht Charlottenburg, HRB 185134 B
Data protection officer
Kevin Goebel · k.goebel@swobbee.com
Postal address as above, marked „Datenschutzbeauftragter“.
2What this website does and does not do
We say this first because it answers most of the questions people have:
- Analytics only with your consent. We use Google Analytics, and only if you press “Allow” in the notice at the bottom of the page (section 12). There is no advertising pixel and no other tracking tool.
- No cookies without consent. Cookies are only set by Google Analytics, and only after you allow it.
- No geolocation. We do not look up your location from your IP address. Which region you see is decided by what you click, and by nothing else.
- No fonts or scripts from third parties before you decide. Fonts are served from our own domain. Nothing is loaded from Google unless you allow analytics or press play on a video.
- No profiling and no automated decision-making under Art. 22 GDPR.
3Server log data
When you open a page, your browser necessarily transmits data to the server that delivers it. Our hosting provider, ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, records this in a log file: IP address, date and time, the page requested, the referring page, browser and operating system, and the amount of data transferred.
Purpose: delivering the site, operational security and error analysis. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a site that works and is not abused. Retention: IP addresses in the log files are stored in shortened (anonymised) form; the log files are deleted after 7 days. Our hosting provider processes this data on our behalf under a data processing agreement (Art. 28 GDPR), on servers in Germany.
4Storage on your device
Name: swobbee_region — stored in your browser’s sessionStorage, not as a cookie.
Content: the value eu or us — whichever region you selected.
Duration: until you close the browser tab. It is not transmitted to us and does not identify you.
Legal basis: § 25(2) no. 2 TDDDG. Storing the choice you just made is necessary to provide the service you asked for, so it needs no consent. You can clear it at any time in your browser settings.
In addition, your browser stores your answer to the analytics question under swobbee_consent (localStorage), and Google Analytics sets cookies if you allowed it. Both are described in section 12.
5Contact forms
On our contact and partner pages you can send us an enquiry. We process the details you enter there — name, organisation, email address, country, role and your message — solely in order to answer you.
Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns a contract or its initiation, otherwise Art. 6(1)(f) GDPR — our legitimate interest in answering enquiries addressed to us. Providing the data is voluntary; without it we cannot reply.
Processing: the form is sent to the server that hosts this website and from there to a Swobbee mailbox. A copy is also held on that server for two months as a fallback against failed mail delivery; it sits outside the publicly reachable area, is readable only by signed-in Swobbee staff, and is deleted automatically when the two months are up. Our mailboxes are provided by Microsoft (Microsoft 365, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) under a data processing agreement. Microsoft stores this data within the EU Data Boundary.
Transfer to a third country: the web server is in the European Union, and Microsoft processes mailbox data within the EU Data Boundary. Access by Microsoft Corporation in the USA, for example for support or security purposes, cannot be ruled out entirely. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework; the European Commission has found that this framework ensures an adequate level of protection (Art. 45 GDPR).
No data is transmitted before you press the send button.
Retention: we keep enquiries for as long as needed to deal with them, and afterwards for up to three years so that we can follow up on the exchange. Statutory retention obligations under commercial and tax law remain unaffected.
6Job applications
You can apply through the form on our careers page or by email to bewerbung@swobbee.com. We process your details and documents in order to assess your application, stay in touch with you and decide whether to offer you a position.
What data: the role you are applying for, first and last name, email address, phone number if you give one, when you are available, your salary expectations and your message, plus your CV and up to five further documents. Please send only what matters for the role, and no information about health, religion or ethnic origin. If you choose to tell us something like that, for example a severe disability, we take it into account only where it is legally relevant to the process.
How your application reaches us: when you press “Send application”, the form is sent over an encrypted connection to the server that hosts this website at our provider ALL-INKL in Germany (section 3). The server immediately passes your details and files through an encrypted interface to Personio, the applicant tracking system used by our HR team. Nothing is kept on the web server: the files exist there only as temporary files while they are being transferred and are deleted automatically afterwards. Your browser does not connect to Personio itself. Nothing is transmitted before you press the button.
If Personio cannot be reached: only then does the server send your application with all attachments by email from website@swobbee.com to our applications mailbox bewerbung@swobbee.com (Microsoft 365, see section 5). We transfer it into Personio from there. Applications you send us directly by email are handled the same way.
Error log: if the transfer fails, the server records only the date and time, the processing step, the HTTP status and an error code, and nothing from your application.
Spam protection: the form contains a field that is invisible to people and checks whether it was filled in unusually fast. We do not use a third-party captcha for this and set no cookies. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a form that bots cannot misuse.
Who sees your application: only the people at Swobbee involved in the selection, that is HR and the team the role belongs to. Personio (Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, Germany) processes the data on our behalf under a data processing agreement (Art. 28 GDPR). Our host ALL-INKL and, only in the exceptional case described above and for applications by email, Microsoft also act on our behalf. We do not sell your data. Decisions on your application are made by people, not by an automated process (Art. 22 GDPR).
Legal basis: Art. 6(1)(b) GDPR, steps taken at your request before entering into an employment contract. Information you choose to give us about a severe disability or similar circumstances is processed under Art. 9(2)(b) GDPR so that we can meet our obligations under employment and social security law.
Roles in the United States: our careers page also lists roles in the United States. The employer for these roles is Swobbee US Corp., 19 Morris Avenue, Brooklyn, NY 11205, USA. These applications use the same form and the same Personio account, which is operated by Swobbee GmbH. Swobbee GmbH and Swobbee US Corp. are joint controllers for them (Art. 26 GDPR): Swobbee GmbH operates the form and the applicant tracking system and is your point of contact for questions and for exercising your rights, while Swobbee US Corp. assesses your application and makes the hiring decision. You can exercise your rights against either company; we will send you the essence of our arrangement on request. So that Swobbee US Corp. can assess your application, it receives your data in the United States. For this transfer we have agreed the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR); you can request a copy. The legal basis is Art. 6(1)(b) GDPR for Swobbee US Corp. and Art. 6(1)(f) GDPR for Swobbee GmbH, our legitimate interest in handling applications for both companies in one place.
Do you have to provide data? No, there is no legal or contractual obligation to do so. Without the details marked * and your CV, however, we cannot process an application submitted through the form.
Retention: if no employment relationship results, we delete your data six months after the process ends. We keep it for that long so that we can defend ourselves against possible claims under the German General Equal Treatment Act (Art. 6(1)(f) GDPR). For roles in the United States we keep applications longer where US law requires Swobbee US Corp. to do so, and only for as long as it requires. Beyond that, we keep your data only if you have expressly agreed to be considered for future roles (Art. 6(1)(a) GDPR); you can withdraw this consent at any time. If we hire you, we transfer the documents needed for the employment relationship to your personnel file.
Your rights: access, rectification, erasure and your other rights, including the right to object to retention after the process has ended, are set out in section 9. The easiest way to reach us is privacy@swobbee.com.
7Video and location map
Our home page and our rider pages embed videos hosted on YouTube. It is not loaded when the page opens. You see a preview with a play button, and only when you press it does your browser connect to youtube-nocookie.com. From that moment YouTube receives your IP address and can store information on your device. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process data on servers of Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework; the European Commission has found that this framework ensures an adequate level of protection (Art. 45 GDPR). Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG — your consent, given by pressing play. You can withdraw it by reloading the page without pressing play.
Location map. Our station page can show a map of all Swobbee Stations from our US station portal at admin.us.swobbee.io, operated by Swobbee. It is not loaded when the page opens. Only when you press “Load map” does your browser connect to that server, which then receives your IP address and the usual technical request data. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG — your consent, given by pressing the button. You can withdraw it by reloading the page.
8Service providers
- Web hosting and form processing: ALL-INKL.COM - Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, see sections 3, 5 and 6
- Applicant tracking: Personio SE & Co. KG, Seidlstraße 3, 80335 Munich, Germany, see section 6
- Web analytics: Google Ireland Limited, only with your consent, see section 12
- Email (form delivery, applications by email and fallback for the application form): Microsoft Ireland Operations Limited (Microsoft 365), see sections 5 and 6
- Video: Google Ireland Limited, only after you press play, see section 7
Where a provider processes personal data on our behalf, we have a data processing agreement in place under Art. 28 GDPR.
9Your rights
Under the GDPR you have the right to:
- Access (Art. 15) — ask what data we hold about you
- Rectification (Art. 16) — have inaccurate data corrected
- Erasure (Art. 17) — have data deleted
- Restriction (Art. 18) — have processing limited
- Data portability (Art. 20) — receive your data in a structured format
- Withdraw consent (Art. 7(3)) — with effect for the future
Right to object under Art. 21 GDPR. Where we process data on the basis of a legitimate interest, you may object at any time on grounds relating to your particular situation. This covers the server logs in section 3, in part the contact forms in section 5, and from section 6 the spam protection, the handling of applications for roles in the United States by Swobbee GmbH and the retention after an application process has ended. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or we need the data to defend legal claims.
To exercise any of these rights, write to privacy@swobbee.com or to our data protection officer at k.goebel@swobbee.com.
Right to lodge a complaint (Art. 77 GDPR). You may complain to a supervisory authority, in particular in the member state of your residence or workplace. The authority responsible for us is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit · Alt-Moabit 59–61 · 10555 Berlin · Germany
10Data security
The site is delivered over an encrypted connection (HTTPS/TLS). We use access controls, keep our systems updated and train the people who work with personal data. No system can be fully secure; we continuously improve our safeguards.
11Children
This website is not directed at children. We do not knowingly process data of persons under 16. If you believe we have, please tell us and we will delete it.
12Web analytics (Google Analytics)
With your consent we use Google Analytics 4 on all pages of swobbee.com, including the rider sign-up pages. When you first visit, a notice asks whether we may do so. Only if you press “Allow” does your browser load Google Analytics. It then records which pages you view, how you got there and how you use them (for example clicks and time on page), together with device, browser, approximate location and your shortened IP address. Cookies beginning with _ga are set for this, for up to two years.
Purpose: to understand how the website is used and to improve it. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process data on servers of Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has found an adequate level of protection (Art. 45 GDPR). Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG. Retention: analytics data is deleted after 14 months.
Your choice and how to change it. Your answer is stored in your browser under swobbee_consent (localStorage) so that we do not ask on every page (§ 25(2) no. 2 TDDDG). You can withdraw your consent at any time with the “Cookie settings” link at the bottom of every page; Google Analytics stops on the next page load. If you decline, nothing is loaded from Google.
13Rider sign-up pages
Our pages for delivery riders in New York (swobbee.com/deliverusa/ in English, Spanish, French and Arabic, and swobbee.com/riders/ in English, Spanish and French) load additional content in the following points.
Google Analytics runs only with your consent, as described in section 12. Your choice applies to the rider pages and the rest of swobbee.com alike.
Station map — only after a click. The map is not loaded when the page opens. Only when you press “Show the map” does your browser load map tiles from CARTO (CartoDB Inc., USA), based on OpenStreetMap data. CARTO receives your IP address. By pressing the button you consent to this, including the transfer to the USA (Art. 6(1)(a) and Art. 49(1)(a) GDPR). The list of stations below the map works without any third-party service.
Videos. The videos work as described in section 7: they load from YouTube only when you press play.
WhatsApp. The buttons to chat with us open WhatsApp (WhatsApp Ireland Limited). Nothing is transmitted before you tap one of them.
14Changes to this policy
We update this policy when our processing changes or the legal position does. The current version always applies, and the date at the top of this page tells you when it was last revised.