Company: Freera UG (operating as Avidelux)
Address: 45475 Mülheim an der Ruhr, Germany
Email: [email protected]
Phone: +49 1522 4001111
Privacy Policy
GDPR / DSGVO compliant. Covers avidelux.com and all Avidelux services.
1. Controller
2. Data we collect and why
a) Server log data
When you access our website or platform, your browser automatically transmits log data including IP address (truncated where possible), date/time of access, pages visited, HTTP status, bytes transferred, referring URL, and browser/OS type.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in stable, secure operation. Retention: 30 days unless required for security investigation.
b) Contact form and direct email
When you send an enquiry we collect: name, email address, company name, message content, and any other information you voluntarily provide.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures). Retention: 3 years after correspondence closes; contract-related data up to 10 years (§ 257 HGB, § 147 AO).
c) Platform / SaaS usage data
When using the Avidelux B2B platform (dispatch dashboard, booking management), we process operational data including: booking details, vehicle GPS coordinates, driver status, trip records, and financial transaction logs.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract. Retention: 10 years for financial records (GoBD compliance, § 147 AO). GPS data retained 30 days unless required for dispute resolution.
d) GPS and location data
The platform processes real-time GPS coordinates of fleet vehicles for dispatch and tracking purposes. Location data is processed only during active trips and is accessible only to authorised platform administrators and the relevant fleet operator.
Legal basis: Art. 6(1)(b) GDPR — contractual necessity for dispatch services.
e) Financial and invoicing data
For B2B transactions, we process company name, VAT number, bank details, and transaction amounts. All financial records are maintained as append-only entries in compliance with German GoBD regulations.
Legal basis: Art. 6(1)(c) GDPR — legal obligation. Retention: 10 years (§ 147 AO).
3. Membership Card Program
If you sign up for a free Avidelux digital membership card, we additionally collect your full name, email address, optional Instagram handle, marketing consent choice, membership tier, and — if you were referred — the referral relationship between you and the member who invited you. We use two named processors to deliver this feature:
PassKit.com (digital wallet pass provider)
We share your full name, member ID, and membership tier with PassKit.com to generate and host your Apple/Google Wallet card.
Legal basis: Art. 6(1)(b) GDPR — necessary to provide the membership card you requested. Location: USA — an EU-U.S. Data Privacy Framework certification and/or Standard Contractual Clauses (Art. 46 GDPR) applies. Retention: for the lifetime of your active membership, deleted upon account deletion.
Postmark (transactional email provider)
We share your email address and full name with Postmark to send your "card is ready" confirmation email, and — only if you opted in — occasional marketing emails.
Legal basis: Art. 6(1)(b) GDPR for the transactional confirmation email; Art. 6(1)(a) GDPR (consent) for any marketing email, withdrawable at any time. Location: USA — same international-transfer safeguard as above. Retention: per Postmark's own message-log retention, plus as long as your member record exists.
Referral data
If you sign up using a referral link, we record the referring member so we can attribute the referral. Only the referring member's first name is ever shown to the person they referred.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in operating the referral program.
Consent records
We store your marketing-consent choice and the timestamp it was given so we can demonstrate lawful consent per Art. 7(1) GDPR.
Self-service export & deletion
Membership card holders can request a copy of their data or delete their membership at any time via avidelux.com/membership/gdpr-confirm, in addition to the manual process described in Section 7 below.
4. Cookies
Our website uses only technically necessary cookies required for the site to function. We do not use analytics, advertising, or third-party tracking cookies. Session preferences may be stored in localStorage
— this is client-side only and is not transmitted to any server.
5. Recipients of your data
Your personal data is not shared with third parties except:
With processors acting on our instructions under Art. 28 GDPR data processing agreements (hosting, email, payment processors)
With fleet partners where necessary to fulfil a booking you have placed
Where legally required by German or EU law
Where you have given explicit consent
We do not sell your data.
6. International transfers
Some processors operate outside the EEA (primarily in the USA). We ensure adequate protection via EU-US Data Privacy Framework certification and/or Standard Contractual Clauses (Art. 46 GDPR). Our primary infrastructure is hosted in the EU (Google Cloud, europe-west3, Frankfurt).
7. Your rights under GDPR
Access (Art. 15) — know what data we hold about you
Rectification (Art. 16) — have inaccurate data corrected
Erasure (Art. 17) — have your data deleted (subject to legal retention obligations)
Restriction (Art. 18) — restrict processing in certain circumstances
Portability (Art. 20) — receive your data in machine-readable format
Object (Art. 21) — object to processing based on legitimate interest
Withdraw consent (Art. 7(3)) — at any time, without affecting past lawful processing
To exercise any right, email [email protected]. We respond within one month (Art. 12(3) GDPR).
8. Right to lodge a complaint
You have the right to complain to a supervisory authority (Art. 77 GDPR). The authority responsible for our location:
Authority: Landesbeauftragte für Datenschutz und Informationsfreiheit NRW
Address: Kavalleriestraße 2–4, 40213 Düsseldorf
Email: [email protected]
Website: www.ldi.nrw.de
9. Data security
We use TLS encryption (HTTPS) on all pages and API endpoints. We apply appropriate technical and organizational measures per Art. 32 GDPR. All financial records are maintained as append-only (GoBD compliant). Please report any security concerns to [email protected].
10. Automated decision-making
Our platform uses automated dispatch algorithms to assign reservations to fleet partners. This process does not constitute automated individual decision-making within the meaning of Art. 22 GDPR, as it relates to business-to-business trip assignments rather than decisions producing legal effects on individuals.
11. Changes to this notice
We may update this notice to reflect changes in our services or legal requirements. The "Last updated" date at the top reflects any changes. For material changes affecting active clients we will provide notice via email.