Always reachable

Vienna, Austria

Always reachable

Vienna, Austria

Account

Language

Privacy policy

Protecting your personal data matters to us. We process your data solely on the basis of the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). This statement tells you which data we process for which purpose and on which legal basis, who receives that data, how long we keep it and which rights you have.

1. Controller

The controller within the meaning of art. 4 no. 7 GDPR is:

LIMOSEN KG
Gürtlgasse 24
2401 Fischamend, Austria
Phone: +43 660 876 06 06
E-mail: office@limosen.at
Web: https://limosen.at

Further details about the company are in the imprint. We have not appointed a data protection officer because the conditions of art. 37 GDPR are not met. For any question about data protection please write to the e-mail address above.

2. The processing operations in detail

2.1 Visiting this website and server logs

When you open this website, the hosting service automatically records log data: the IP address of the requesting device, the date and time of the request, the address requested, the page visited before, the browser with its version and the operating system, the response status and the volume of data transferred.

Purpose: delivering the page, operational security, defence against attacks and misuse, error analysis.
Legal basis: art. 6(1)(f) GDPR, our legitimate interest in the secure and undisturbed operation of this website.
Storage period: the hosting service deletes these logs automatically after a few days. We do not evaluate them per person and do not combine them with other data.

2.2 Booking, offer and carrying out the ride

When you request or book a ride we process the data required for it: first and last name, e-mail address, telephone number, pick-up and destination address including stops, date and time, number of passengers and pieces of luggage, flight or train number, the vehicle you prefer, your remarks, the language chosen, and the price, the method of payment and the paying party.

Purpose: preparing the offer, concluding and performing the transport contract, dispatching the ride and assigning a driver, communication about the ride.
Legal basis: art. 6(1)(b) GDPR, performance of a contract and pre-contractual steps taken at your request.
Recipients: the driver assigned to the ride receives the data required to carry it out, in particular name, telephone number, pick-up and destination address and the time. Prices, the method of payment and the paying party are neither shown nor transmitted to drivers.
Storage period: for the duration of the business relationship, then in accordance with the statutory retention obligations (see 2.6).

2.3 Contact form and enquiries by e-mail or telephone

If you reach us through the contact form, by e-mail or by telephone, we process your name, your e-mail address, your telephone number and the content of your message.

Purpose: handling and answering your enquiry.
Legal basis: art. 6(1)(b) GDPR where the enquiry is aimed at a contract, otherwise art. 6(1)(f) GDPR, our legitimate interest in answering enquiries.
Storage period: until the enquiry has been dealt with, then until the limitation periods expire, unless a retention obligation applies.

We do not run a password directory of our own for the customer area and the driver and dispatcher application. Identity is managed by the identity service accounts.netsnek.com (Zitadel), operated for us by Netsnek e.U. as a processor. It processes e-mail address, first and last name, telephone number, display name, the password in encrypted form, the roles assigned and the times of sign-in.

Purpose: secure sign-in, assignment of permissions, protection of the accounts.
Legal basis: art. 6(1)(b) GDPR for customer accounts, art. 6(1)(b) GDPR in connection with the employment relationship for driver accounts.
Storage period: until the account is deleted, after that only where a retention obligation applies.

2.5 Sending mail

Confirmations, offers, status messages and invoices are sent through the mail service emailwerk of Netsnek e.U., acting as a processor. Your e-mail address, your name, the content of the message and the delivery and error logs are processed.

Legal basis: art. 6(1)(b) GDPR.

2.6 Offers, statements, invoices and records

Offers and invoices are generated and stored as PDF files. Statements of the rides are kept in a spreadsheet at Google Sheets. Records and uploaded documents are held in the object store Cloudflare R2 and in the storage service osg.netsnek.com of Netsnek e.U.

Purpose: making offers, invoicing, settling with drivers, bookkeeping.
Legal basis: art. 6(1)(b) GDPR for performing the contract and art. 6(1)(c) GDPR for meeting our obligations under tax and commercial law.
Storage period: books, records and vouchers are kept for seven years under section 132 of the Austrian Federal Fiscal Code (BAO) from the end of the calendar year the entry relates to, longer while proceedings are pending. Section 212 UGB provides for the same period.

2.7 Push notifications

If you switch push notifications on in the application, your browser asks you for permission explicitly. Only after that do we process the push address (the endpoint) of your browser together with the associated public keys, and the content of the message, usually the code of the ride and a short line of text. Delivery runs through the push service of your browser, which is Google, Mozilla, Apple or Microsoft depending on the browser. The content of the message is encrypted in transit.

Purpose: notification about new rides, assignments, confirmations and changes.
Legal basis: art. 6(1)(a) GDPR, your consent.
Withdrawal: you can switch the notifications off in the application at any time or withdraw the permission in your browser settings. The lawfulness of the processing carried out until then is unaffected.
Storage period: until withdrawal or until the push service reports the address as invalid.

2.8 The driver's location while a ride is running

For driver accounts we process the location of the device while a ride is running. The transmission starts when the ride begins and ends when it is completed. The location is shown to the customer on the page of the booked ride so that it is visible where the vehicle is.

Purpose: showing the vehicle to the customer, dispatching the running ride.
Legal basis: art. 6(1)(b) GDPR towards the customer, art. 6(1)(f) GDPR for dispatching. Recording the location by the device additionally requires the permission in the device settings, which you can withdraw at any time.
Storage period: only the most recently reported position is kept. When the ride is completed the transmission ends. No movement history is built outside running rides and there is no permanent tracking outside working hours.

2.9 Maps

To show the route and the locations we embed maps from Mapbox. When the map loads, your IP address is transmitted to Mapbox, along with technical details of your device and the map section requested.

Legal basis: art. 6(1)(f) GDPR, our legitimate interest in a comprehensible presentation of pick-up and destination.

2.10 Pictures and documents

The pictures of this website and uploaded documents are held in the storage service osg.netsnek.com of Netsnek e.U. When they are fetched your IP address is transmitted to that service.

Legal basis: art. 6(1)(f) GDPR.

2.11 Reach measurement and error diagnosis

We use Google Analytics only if you have allowed the statistics category in the consent banner. It processes a shortened IP address, the pages opened, the time spent, an approximate location at city level, the device and the browser.

Legal basis: art. 6(1)(a) GDPR and section 165(3) TKG 2021. Without your consent no analytics service is loaded.

To detect program faults we use Sentry. This produces technical error reports which may contain the address opened, the browser, the sequence of the fault and the IP address.

Legal basis: art. 6(1)(f) GDPR, our legitimate interest in a working application. The data is received in a data centre in the European Union.

3. Recipients and processors

We pass your data on only to recipients who need it to provide their service. Contracts under art. 28 GDPR are in place with every processor.

Recipient	Service	Place of processing
Cloudflare, Inc.	Hosting of this website (Pages), application server (Workers), database (D1), object store (R2), protection against attacks	Worldwide network with data centres in the EU, seat in the USA
Netsnek e.U.	Identity service accounts.netsnek.com, mail service emailwerk, storage service osg.netsnek.com, maintenance of the application	Austria and EU
Google Ireland Limited and Google LLC	Google Sheets for the statements, Google Analytics and embedded maps subject to consent	EU and USA
Mapbox, Inc.	Map rendering	EU and USA
Functional Software, Inc. (Sentry)	Error diagnosis	Data centre EU, seat in the USA
Push services of the browsers (Google, Mozilla, Apple, Microsoft)	Delivery of push notifications subject to consent	EU and USA
Drivers and partner companies	Carrying out the booked ride	Austria and EU
Tax adviser, bank, authorities and courts	Meeting statutory obligations	Austria

4. Transfer to third countries

Some of the services named above have their seat in the United States of America or process data there. A transfer takes place only where it is necessary for the respective purpose and rests on an adequacy decision of the European Commission (EU-US Data Privacy Framework) or on the standard contractual clauses of the European Commission under art. 46(2)(c) GDPR together with supplementary safeguards. We provide a copy of the safeguards on request.

5. Storage periods at a glance

Server logs: a few days.
Enquiries without a contract: until they are dealt with, then until the limitation periods expire.
Booking and ride data: for the duration of the business relationship.
Invoices, records and statements: seven years under section 132 BAO.
Customer account: until the account is deleted.
Consents and the record of them: until withdrawal and then for the limitation periods.

6. Your rights

You have the following rights towards us:

Access to the data processed about you (art. 15 GDPR).
Rectification of inaccurate data and completion of incomplete data (art. 16 GDPR).
Erasure of your data unless a retention obligation stands in the way (art. 17 GDPR).
Restriction of processing (art. 18 GDPR).
Notification of every recipient in case of rectification, erasure or restriction (art. 19 GDPR).
Data portability, that is receiving the data you provided in a common machine readable format (art. 20 GDPR).
Objection to processing based on a legitimate interest, on grounds relating to your particular situation (art. 21 GDPR).
The right not to be subject to a decision based solely on automated processing, including profiling (art. 22 GDPR). We do not use such decision making.
Withdrawal of a consent with effect for the future (art. 7(3) GDPR).

A message to office@limosen.at is enough to exercise them. We answer without delay and at the latest within one month.

7. Right to lodge a complaint with the supervisory authority

If you consider that the processing of your data infringes the GDPR you may lodge a complaint with the supervisory authority, without prejudice to any other remedy:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40-42, 1030 Vienna, Austria
Phone: +43 1 52 152-0
E-mail: dsb@dsb.gv.at
Web: https://www.dsb.gv.at

The first time you open this website a consent banner is shown. There you decide about the categories necessary, statistics and marketing. Necessary cookies are required for operation and cannot be switched off, everything else is loaded only after your agreement. Your decision is stored in the cookie cc_cookie for 182 days and can be changed at any time through the cookie settings.

Necessary in particular are: the storage of your consent itself, the session and sign-in data of the customer area, the language chosen and the local cache of the application, which holds the data last loaded for offline operation. That data stays on your device and is cleared when you sign out.

Legal basis: section 165(3) TKG 2021 and art. 6(1)(a) GDPR for everything that is not strictly necessary, otherwise art. 6(1)(f) GDPR.

9. Whether you have to provide the data

Providing the data required for a booking is neither required by law nor by contract, but it is necessary in order to conclude and perform the transport contract. Without it we can neither offer nor carry out a ride.

10. Changes to this privacy policy

We adapt this statement when the processing operations or the legal situation change. The version published on this page applies.

Last updated: 7 September 2026