Privacy Policy
Stand: 10/03/2026
We are pleased that you have chosen to use Movacar’s services. In the following, we inform you about the processing of your personal data.
I. Data Controller
The controller responsible for processing your data in connection with the use of the Movacar website and services is Target Mobility GmbH, Eiderstedter Weg 5b, 14129 Berlin, service@movacar.de, registered in the commercial register of the District Court of Charlottenburg under No. HRB 195781 B (hereinafter: „Movacar“ or „we“).
II. Data Processing When Downloading the App
When downloading the App, certain required information is transmitted to the App Store you have selected (e.g. Google Play or Apple App Store). In particular, your username, email address, account customer number, time of download, payment information and the individual device identifier may be processed. However, this data is processed exclusively by the respective App Store and is outside our sphere of influence.
For further information, please refer to the Google Play Store or Apple App Store privacy policies.
III. Data Processing When Visiting the Website and the App
The following data processing activities take place throughout your use of our website and the App:
1. Log Data
When you visit our website and the App, the following log data is processed:
We partly use so-called „cookies“ for this purpose. These are small text files stored on your computer. Cookies can generally be divided into three categories: cookies that are strictly necessary for the functioning of the website/app (so-called Functional Cookies), cookies that enhance the convenience of using the website, e.g. by saving your chosen language (so-called Comfort Cookies), and cookies used to create a pseudonymised user profile (so-called Tracking Cookies).
For the processing of the personal data mentioned above, we use Functional Cookies to enable you to use the website and the App. Processing is carried out on the basis of Art. 6(1)(1)(b) GDPR. For the storage periods of the respective cookies, please refer to our Cookies Policy.
Our website and App are hosted by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland („Google“). In this context, Google processes your data on our behalf and in accordance with our instructions.
2. Information on Service Providers Used by Us
We use service providers to operate the App and the platform as well as individual functions. Where service providers process personal data on our behalf, we have concluded a data processing agreement with these service providers and agreed appropriate guarantees to protect personal data. We select our service providers carefully; they process personal data exclusively to fulfil their tasks and are contractually bound by our instructions via a data processing agreement pursuant to Art. 28(3) GDPR, have appropriate technical and organisational measures in place to protect personal data, and are regularly audited by us. If a data transfer to third countries (e.g. the USA) becomes necessary, the transfer is carried out pursuant to Art. 45 GDPR on the basis of the European Commission’s adequacy decision on the EU-US Data Privacy Framework (DPF). In addition, the relevant EU Standard Contractual Clauses (SCC) for the transfer of personal data to third countries are concluded. The EU Standard Contractual Clauses used can be accessed at: https://eur-lex.europa.eu/legal-content/de/TXT/?uri=CELEX%3A32021D0914.
3. Processing of Enquiries
Salesforce.com EMEA Limited, operating a cloud within the European Union, supports us as a processor in handling your enquiries and managing our services. Access to the information by Salesforce.com, Inc., based in the USA, cannot be excluded. A theoretical third-country transfer is based on Art. 45 GDPR on the basis of the European Commission’s adequacy decision on the EU-US Data Privacy Framework (DPF). In addition, the relevant EU Standard Contractual Clauses for the transfer of personal data to processors in third countries (as an appropriate safeguard for data processing in non-European countries) have been concluded to adequately protect your personal data.
The use of Salesforce.com Inc. services is carried out on the basis of Art. 6(1)(b) or (f) GDPR and is intended to enable the efficient provision of Movacar’s services. Klippa App B.V., Laan Corpus Den Hoorn 1, 9728 JM Groningen, Netherlands, supports us as a processor in verifying your identity and driving licence.
We store your data for as long as this is necessary to provide our services and the associated services, or as long as we have a legitimate interest in continued storage. In all other cases, we delete your personal data, with the exception of data that we must continue to retain in order to fulfil statutory (e.g. tax or commercial law) retention periods (e.g. invoices).
4. Google Analytics
On the website and in the App, we use the analytics tools Google Analytics and Google Firebase from Google Inc. („Google“): Google Analytics and Google Firebase process data about your usage behaviour (open rates, links, functionalities, usability of internal links, etc.) in pseudonymised form, enabling us to tailor our services to your needs. Furthermore, the collected data may be used for advertising and market research purposes based on your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time by email to service@movacar.de. For more information on data processing by Google Firebase, please visit https://firebase.google.com/support/privacy.
Google Analytics uses cookies for this purpose. For the storage periods of the respective cookies, please refer to our Cookies Policy. The information generated by cookies about your use of this website is generally transferred to and stored on a Google server in the USA. A theoretical third-country transfer is based on Art. 45 GDPR on the basis of the European Commission’s adequacy decision on the EU-US Data Privacy Framework (DPF). In addition, the relevant EU Standard Contractual Clauses for the transfer of personal data to processors in third countries have been concluded to adequately protect your personal data.
If IP anonymisation is activated on this website, your IP address will first be truncated by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. Google will use this information to evaluate your use of the website, compile reports on website activity, and provide further services related to website and internet use.
The IP address transmitted by your browser as part of Google Analytics will not be merged with other data held by Google.
This website and the App use Google Analytics with the „_anonymizeIp()“ extension. This means that IP addresses are further processed in truncated form, thereby excluding any direct personal identification.
Third-party provider information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://www.google.de/intl/de/policies/privacy.
5. Google Ads
To promote our services, we place Google Ads and use Google Conversion Tracking for personalised, interest-based and location-based online advertising, provided you have consented to this (Art. 6(1)(a) GDPR). You may withdraw your consent at any time by email to service@movacar.de.
In this case, Google Dynamic Remarketing (see next section) will also be deactivated, as Google Ads is a prerequisite for its functionality.
Google Ads uses cookies. The information generated by the cookie about your use of this website is generally transferred to and stored on a Google server in the USA. A data transfer is based on Art. 45 GDPR on the basis of the European Commission’s adequacy decision on the EU-US Data Privacy Framework (DPF). The relevant EU Standard Contractual Clauses for the transfer of personal data to processors in third countries have also been concluded to adequately protect your personal data. For storage periods of the respective cookies, please refer to our Cookies Policy.
The option to anonymise IP addresses is managed in Google Tag Manager via an internal setting that is not visible in the source code of this page. This internal setting is configured to achieve the IP address anonymisation required by the GDPR.
Advertisements are displayed following search queries on websites in the Google advertising network. We have the option to combine our advertisements with certain search terms. Using cookies, we can display advertisements based on a user’s previous visits to our website.
When an advertisement is clicked, Google places a cookie on the user’s computer. Further information on the cookie technology used can also be found in Google’s notes on website statistics and in their privacy policy.
Using this technology, Google and we as the client receive information that a user has clicked on an advertisement and has been redirected to our website. The information obtained in this way is used exclusively for statistical analysis for advertisement optimisation. We do not receive any information that allows visitors to be personally identified. The statistics provided to us by Google include the total number of users who have clicked on one of our advertisements and, where applicable, whether they were redirected to a page on our website tagged with a conversion tag. Based on these statistics, we can understand which search terms led to particularly frequent clicks on our advertisement and which advertisements lead to contact via the contact form.
You have the option to select the types of Google advertisements or to deactivate interest-based advertisements on Google via the ad settings at https://support.google.com/ads/answer/2662922?hl=de. However, we and Google will still receive the statistical information as to how many users visited this page and when. If you do not wish to be included in this statistic either, you can prevent this using additional programmes for your browser (e.g. the Ghostery add-on).
Google Ads is provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.de/intl/de/policies/privacy.
6. Google Dynamic Remarketing
On our website, we use the dynamic remarketing function of Google AdWords, provided you have consented to this (Art. 6(1)(a) GDPR). You may withdraw your consent at any time by email to service@movacar.de.
This technology enables us to automatically display targeted advertising to you after you have visited our website. The advertisements are based on the products and services you clicked on during your last visit to our website.
To create interest-based advertisements, Google uses cookies. The information generated by the cookie about your use of this website is generally transferred to and stored on a Google server in the USA. The relevant EU Standard Contractual Clauses for the transfer of personal data to processors in third countries have been concluded to adequately protect your personal data. The EU Standard Contractual Clauses used can be accessed at: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX%3A32010D0087. For storage periods of the respective cookies, please refer to our Cookies Policy.
Google typically stores information such as your web request, IP address, browser type, browser language, the date and time of your request. This information is used solely to assign the web browser to a specific computer. It is not used to identify a person.
Google Dynamic Remarketing is provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy policy: https://www.google.de/intl/de/policies/privacy.
7. Google Fonts
We use Google Fonts for the uniform display of fonts. When a page is accessed, the browser loads the required web fonts into the browser cache to display texts and fonts correctly. For this purpose, the browser connects to Google’s servers. This enables Google to learn that our website was accessed from your IP address.
The legal basis for the processing of this data is Art. 6(1)(f) GDPR. Our legitimate interest lies in the tailored design of our website.
8. Facebook Pixel and Website Custom Audience
We would like to present users of this online service with advertising tailored to their interests and special offers („interest-based advertising“) and to limit the frequency of display of certain advertisements. For this purpose, we use Facebook’s Website Custom Audiences tool and the Facebook Pixel, provided you have consented to each (Art. 6(1)(a) GDPR). You may withdraw your consent at any time by email to service@movacar.de.
Cookies are used for this purpose. The information generated by the cookie about your use of this website is generally transferred to and stored on a Facebook server in the USA. The relevant EU Standard Contractual Clauses for the transfer of personal data to processors in third countries have been concluded to adequately protect your personal data. The EU Standard Contractual Clauses used can be accessed at: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX%3A32010D0087. Cookies are deleted after 3 months.
The Facebook Pixel is a JavaScript code that sends the following data to Facebook Ireland Ltd, Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland („Facebook“):
Facebook automatically checks, using the hashed user-specific Facebook ID (contained in the Facebook cookie), whether the data transmitted by the Facebook Pixel can be assigned to a Facebook user. If no Facebook cookies are stored in your browser, no classification into one of the user groups referred to as „Custom Audience“ is carried out.
If the Facebook ID contained in the Facebook cookie can be assigned to a Facebook user, Facebook assigns that user to a „Custom Audience“ in accordance with the rules we have defined, provided the applicable criteria are met. The information obtained in this way is used by us to display advertisements on Facebook („Facebook Ads“). However, advertisements are only displayed once a „Custom Audience“ size of 20 different users has been reached — so no conclusions can be drawn from the placement of advertisements about the characteristics of individual users. Assignment to a „Custom Audience“ lasts for a maximum of 180 days. This period restarts when you visit our website again and there is a match with the same „Custom Audience“ rules.
Facebook may associate your visit to our website and your related activities with your Facebook user account. This is not possible for us. We only receive statistical information from Facebook about the use of our website via Audience Insights.
Facebook passes your data on to Facebook Inc., Facebook 1 Hacker Way, Menlo Park, CA 94025, USA, and uses your data to improve the quality of its advertising, including by improving the optimisation algorithm used by Facebook for displaying Facebook Ads and the News Feed ranking. The relevant EU Standard Contractual Clauses have been concluded to adequately protect your personal data. https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX%3A32010D0087.
When using the App and the website, we also offer you the option to log in or register using your Facebook user data from the social network Facebook, a service of Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland („Facebook“). To do this, you must press the Facebook Connect button. For registration, you will be redirected to the Facebook page, where Facebook requests certain permissions and you can log in with your Facebook user data. This links your Facebook profile with our services. Through this link, we can see the data you have provided on Facebook (first and last name, email address, profile picture). The legal basis for the processing is Art. 6(1)(a) GDPR.
For further information on Facebook Connect and privacy settings, please refer to Facebook’s privacy policy and terms of use at: https://www.facebook.com/policy.php.
If you do not wish your data to be processed as described above, you cannot use the Facebook Connect function. If you have previously used Facebook Connect, you can prevent the further processing of the above-mentioned data stored on Facebook for the future by removing our services in your Facebook account under „Settings“ and then „Apps and Websites“.
9. Sendgrid
If you have created a customer account on our website or in the App (III. 2.), we use your email address to inform you about the latest developments on our website and in the App using Sendgrid, a service of Twilio Ireland Limited, 70 Sir John Rogerson’s Quay, Dublin 2, D02 R296, Ireland. We process your email address for this purpose. Data processing takes place only on the basis of your prior consent, Art. 6(1)(a) GDPR. Email logs are deleted after 30 days.
10. GetSiteControl
If you are interested in the latest developments on the website and in the App without having created a customer account with us, you can enter your email address and name in a specially provided pop-up and receive the desired information. The associated tool is provided by Getwebcraft Limited, Klimentos 41-43, Tower, Flat/Office 25, 1061 Nicosia, Cyprus. Data processing takes place only on the basis of your prior consent, Art. 6(1)(a) GDPR.
11. Customer Engagement and Marketing Automation
We use the customer engagement tool from MoEngage Global Inc., 580 California St, Suite 1200, San Francisco, CA 94104, integrated into our platform. Data processing is carried out according to our instructions on the basis of a data processing agreement pursuant to Art. 28(3) GDPR.
This is used for the following purposes:
Data processing is carried out on the basis of your prior consent, Art. 6(1)(a) GDPR, as well as on the basis of our legitimate interest, Art. 6(1)(f) GDPR. Where data processing is necessary for the execution of a rental car offer, it is carried out on the basis of Art. 6(1)(b) GDPR.
The following data may be processed in the course of use:
Data subjects include: website visitors, registered users and customers (business customers & private customers). Data is deleted when the purpose ceases to apply or upon withdrawal of your consent.
IV. Data Processing When Booking a Rental Car Offer
1. Contract Conclusion
When you wish to book a rental car offer, we process the following data:
We require this data in order to process the brokerage agreement you conclude with us. We also transmit your data to the rental company you selected when booking, which, upon receipt of the data, itself becomes the data controller within the meaning of the GDPR. The legal basis for our processing of the data is Art. 6(1)(1)(b) GDPR. We delete your data as soon as the contract has been processed and we are not required to retain the data for longer due to mandatory statutory or regulatory provisions.
2. Login Area
You can also create a customer account with us. This saves you a great deal of time with future bookings, as we can store the data required for the conclusion of the contract and provide you with a history of past bookings.
3. Payment Processing
To process payments and prevent fraud, we integrate the payment services of Stripe Payments Europa, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland on our website, which acts as our processor in this regard. When you make a purchase with us, the following data is processed:
The use of Stripe is carried out on the basis of Art. 6(1)(b) GDPR and is intended to enable a payment process that is as smooth, convenient and secure as possible.
V. Route Alert
If no offer is currently available for the route you are searching for, we ask whether you would like to receive our route alert. If you consent (Art. 6(1)(a) GDPR), we process the following data you provide:
We use the so-called double opt-in procedure to obtain consent. You will receive an email to the address provided asking you to confirm your consent. This does not apply if you are already registered with Movacar.
You may withdraw your consent at any time by email to service@movacar.de, via the contact details provided in the legal notice, or via a dedicated link in the route alert email.
We delete the data provided if you withdraw your consent, or at the latest when the time period you specified has expired, unless you have expressly consented to further processing of your data or we reserve the right to further processing that is permitted by law and about which we inform you in this privacy policy.
VI. Customer Support
You have the option to send us an enquiry via a contact form.
When using the contact form, we process the following data:
As an alternative to the contact form, you also have the option of contacting us via a chatbot. An integrated Large Language Model (LLM) is used to answer customer enquiries and general queries. All data you transmit to us in the course of using the chatbot is processed. The data transmitted is used exclusively to process individual enquiries and is not stored. It is also not used for training purposes.
For processing, we use the SaaS platform „innochat.ch“, operated by innoQ Research GmbH, Schutzengelstrasse 57, 6340 Baar, Switzerland. Data is hosted within the EU.
The processing of your data is carried out on the basis of Art. 6(1)(1)(b) GDPR. We delete your data as soon as we have answered your enquiry to your satisfaction and provided no other retention periods apply (e.g. statutory retention periods for tax purposes). Chat inputs are deleted after four days.
VII. Newsletter
You have the option to subscribe to our newsletter. If you sign up for our newsletter, we use the data required for this purpose or separately provided by you to send you our email newsletter on a regular basis based on your consent pursuant to Art. 6(1)(1)(a) GDPR. In this case, your email address is processed for the purpose of delivering advertising.
We use the so-called double opt-in procedure to obtain consent. You will receive an email to the address provided asking you to confirm your consent. You may withdraw this consent at any time by unsubscribing from the newsletter.
Unsubscribing from the newsletter is possible at any time and can be done either by sending a message to service@movacar.de, via the contact details provided in the legal notice, or via a dedicated link in the newsletter. After unsubscription, we delete your email address unless you have expressly consented to further processing of your data or we reserve the right to further data processing that is permitted by law and about which we inform you in this privacy policy.
VIII. Data Protection for Registration and Contract Conclusion on the Movacar Dashboard (App)
1. Login Data
In order to conclude transport contracts with Movacar either in person or via the Movacar Dashboard, registration is required. As part of your registration with us, we must collect and process certain personal data from you, which is also used to simplify the processing of any future contracts. We collect and process the following data:
The processing of your data is carried out on the basis of Art. 6(1)(1)(b) GDPR.
If you close your customer account, we will delete all data stored about you, unless statutory retention obligations prevent this.
For example, the German Commercial Code (HGB) and the German Fiscal Code (AO) provide for longer retention obligations. Among other things, this means that order and payment data must be retained for up to ten years for tax audits and financial audits. Only after this period may we permanently delete the relevant data.
Even if your data is not subject to a statutory retention obligation, we may refrain from immediate deletion in cases permitted by law. This applies in particular in cases where we may still require the relevant data for the further processing of the contract or for the assertion or defence of legal claims. The applicable statutory limitation periods are then the determining criterion for the duration of the retention. After the relevant limitation periods have expired, the data concerned will be permanently deleted.
2. Reporting & Analytics
During the vehicle transfer, the following data is processed via the Movacar App:
Geodata tracking for rental vehicles serves to trace vehicle movements in accordance with the contractual agreement, as well as to check for anomalies in route usage, Art. 6(1)(b) GDPR. Furthermore, we have a legitimate interest in using the data for theft or fraud prevention and quality assurance vis-à-vis fleet companies pursuant to Art. 6(1)(f) GDPR.
The data is processed by our processor Zoho Corporation GmbH, Trinkausstr. 7, 40213 Düsseldorf.
The processed data is retained for 10 years, unless a statutory retention obligation for a longer period applies. Live tracking data is deleted after quality control has been completed, but no later than seven days after the vehicle is handed over, unless longer storage is exceptionally required to investigate anomalies in the route.
IX. Your Rights
You may exercise the following rights against Movacar at any time, free of charge:
1. Right of Access
You have the right to obtain from us information about the processing of your personal data.
2. Right to Rectification
You have the right to demand that we rectify inaccurate or incomplete personal data relating to you.
3. Right to Erasure
You have the right to request the erasure of your data if the conditions set out in Art. 17 GDPR are met. For example, you can request the erasure of your data if it is no longer necessary for the purposes for which it was collected. You can also request erasure if we process your data on the basis of your consent and you withdraw that consent, provided we are not required to retain the data by law.
4. Right to Restriction of Processing
You have the right to request the restriction of the processing of your data if the conditions of Art. 18 GDPR are met. This is the case, for example, if you contest the accuracy of your data. For the duration of the verification of the accuracy of the data, you may request restriction of processing.
5. Right to Object
If processing is based on an overriding legitimate interest (Art. 6(1)(1)(f) GDPR) or your data is used for direct marketing purposes, you have the right to object to the processing of your data. In the event of an objection to processing based on an overriding legitimate interest (Art. 6(1)(1)(f) GDPR), we ask you to inform us of the reasons for your objection to the data processing. You may object to data processing for direct marketing purposes at any time without giving reasons.
6. Right to Data Portability
If data processing is based on consent or serves the performance of a contract and is also carried out using automated processing, you have the right to receive your data in a structured, commonly used and machine-readable format and to transmit it to another data controller.
7. Right to Withdraw Consent
If data processing is based on consent, you have the right to withdraw consent to data processing at any time with effect for the future, free of charge, at service@movacar.de or via the contact details provided in the legal notice.
You may also withdraw your consent to receive our newsletter and route alerts via the link provided in the newsletter or route alert.
You can manage your consents regarding the use of cookies.
8. Right to Lodge a Complaint
You also have the right to lodge a complaint with a supervisory authority regarding our processing of your data.
X. Your Contact Person
To exercise your rights, please contact Karl Markiewicz, service@movacar.de.