Last updated: July 29, 2024
Welcome to TripFast! This service is operated by SeroDesign, Serhat Cakmaktepe ("we," "our," or "us"). We respect your privacy and are committed to protecting your personal data according to the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
This privacy policy explains how we collect, use, store, and share your personal data when you use our website and the TripFast application (collectively, the "Service"), and informs you about your privacy rights.
The data controller responsible for processing your personal data is:
SeroDesign
Serhat Cakmaktepe
Meuschelstraße 60
90408 Nürnberg
Germany
Email: Serhatc580@gmail.com
If you have any questions about this privacy policy or our data protection practices, please contact us using the email address above. As a small business, we are generally not required to appoint a formal Data Protection Officer (DPO) under Art. 37 GDPR / § 38 BDSG. Your primary contact for data protection matters is Serhat Cakmaktepe.
We collect and process the following categories of personal data:
We do not intentionally collect special categories of personal data (e.g., health, religion, ethnicity).
We use different methods to collect data from and about you including through:
We only use your personal data when the law allows us to. The table below describes the ways we use your personal data and the legal bases we rely on (primarily from Art. 6 GDPR):
| Purpose / Activity | Type of Data | Legal Basis for Processing |
|---|---|---|
| To register you as a new user and manage your account | Identity, Contact, Technical | Performance of a contract with you (Art. 6(1)(b)) |
| To provide the core TripFast service (generate itineraries, display maps, enable collaboration) | Identity, Contact, Technical, Travel Planning, Usage, Location (IP-based) | Performance of a contract with you (Art. 6(1)(b)) |
| To process payments and manage your subscription | Identity, Contact, Payment, Technical | Performance of a contract with you (Art. 6(1)(b)); Necessary for compliance with a legal obligation (e.g., tax law) (Art. 6(1)(c)) |
| To manage our relationship with you (e.g., notifications about service changes, responding to support requests) | Identity, Contact, Usage, Travel Planning (contextual) | Performance of a contract with you (Art. 6(1)(b)); Necessary for our legitimate interests (to keep records updated and provide support) (Art. 6(1)(f)) |
| To administer and protect our business and this Service (troubleshooting, data analysis, testing, system maintenance, security, preventing abuse/fraud, rate limiting) | Identity, Contact, Technical, Usage | Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, fraud prevention) (Art. 6(1)(f)); Necessary for compliance with a legal obligation (Art. 6(1)(c)) |
| To use data analytics and performance monitoring to improve our Service, user experience, and marketing (understanding feature usage, identifying trends, monitoring site speed) | Technical, Usage (often aggregated or pseudonymized) | Necessary for our legitimate interests (to define types of customers for our products and services, to keep our Service updated, relevant, and performant, to develop our business) (Art. 6(1)(f)). Where cookies or similar technologies requiring consent are used for analytics or performance insights (e.g., Vercel Analytics, Speed Insights, PostHog), the basis is Consent (Art. 6(1)(a)) - see Cookie Policy. |
We will generally only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
We may have to share your personal data with the categories of parties set out below for the purposes listed in the table in section 5. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We conclude data processing agreements (DPAs) where required.
We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions and legal agreements (DPAs).
Some of the external third parties we work with are based outside the European Economic Area (EEA) or process data outside the EEA, so their processing of your personal data will involve a transfer of data outside the EEA. This primarily includes providers based in the United States (USA) such as:
Whenever we transfer your personal data out of the EEA to such countries (particularly the USA, which the European Commission has not deemed to provide an adequate level of data protection equivalent to the EU in all aspects), we ensure a similar degree of protection is afforded to it by implementing appropriate safeguards. This typically involves using specific contracts approved by the European Commission known as Standard Contractual Clauses (SCCs), or relying on the provider's participation in the EU-U.S. Data Privacy Framework (DPF) if they are certified and the transfer falls within its scope, or other valid transfer mechanisms under the GDPR.
You can request further information about the specific mechanism used when transferring your personal data out of the EEA by contacting us. Note that some providers (like Supabase and Upstash) offer infrastructure within the EEA (e.g., Frankfurt, Germany), and we strive to utilize these options where feasible to minimize data transfers.
We have put in place appropriate technical and organizational security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. Examples include using encryption (e.g., HTTPS), access controls, and secure infrastructure provided by our service providers.
We limit access to your personal data to employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and the relevant supervisory authority (see section 13) of a breach where we are legally required to do so, in accordance with GDPR requirements (Art. 33 and 34).
We will only retain your personal data for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it and whether we can achieve those purposes through other means, and the applicable legal requirements (e.g., German commercial and tax laws often require retention for 6 or 10 years).
Generally, account data is retained as long as your account is active and for a reasonable period afterward to allow for reactivation or to fulfill legal obligations. Usage data for analytics is often aggregated or anonymized sooner. You can request deletion of your account and associated personal data via the contact details in Section 2, subject to legal retention obligations.
Under the GDPR and German data protection laws, you have the following rights regarding your personal data:
If you wish to exercise any of these rights, please contact us at: Serhatc580@gmail.com.
You generally do not have to pay a fee to exercise your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances (§ 65 BDSG).
We may need to request specific information from you to help us confirm your identity and ensure your right to exercise these rights. This is a security measure.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer if your request is complex or you have made multiple requests. In this case, we will notify you.
Our Service uses cookies and similar technologies (like local storage) to distinguish you from other users, provide functionality, and analyze usage.
For detailed information on the cookies we use, the purposes for which we use them, and how you can manage your consent, please see our Cookie Policy.
We keep our privacy policy under regular review and may update it from time to time. We will notify you of any significant changes, for example by posting a notice on the Service or sending you an email. The "Last updated" date at the top indicates when it was last revised.
We encourage you to review this privacy policy periodically. Changes are effective when posted on this page.
For questions about this policy or to exercise your rights, please contact us:
Email: Serhatc580@gmail.com
Address: SeroDesign, Serhat Cakmaktepe, Meuschelstraße 60, 90408 Nürnberg, Germany
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us in Bavaria, Germany is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
Phone: +49 (0) 981 180093-0
Email: poststelle@lda.bayern.de
Website: www.lda.bayern.de
We would, however, appreciate the chance to deal with your concerns before you approach the BayLDA, so please contact us in the first instance.
