Privacy information

This English translation is provided for information only. Only the German version is legally binding.

1. Controller

NB Spedition GmbH
Boehringerstraße 16
68307 Mannheim
Germany

Phone: +49 621 79940188
Email: info@nbspedition.de
Represented by the managing director, Nisali Bay.

Data protection contact

For questions about data protection, you can reach our internal contact person:
Edanur Kablan
edanur.kablan@nbspedition.de

2. Visiting the website, hosting and server log files

When you visit our website, the web server automatically processes data transmitted by your browser. This usually includes the IP address, the date and time of access, the address accessed, the HTTP status code, the amount of data transferred, the previously visited page (referrer) and the browser and operating system. This processing is necessary to deliver the website, to ensure its security and to analyse faults.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and stable provision of the website.

The server for the website is provided to us by the following processor (Art. 28 GDPR):
NB Fleet & Solutions GmbH
Boehringerstraße 16
68307 Mannheim
Germany

NB Fleet & Solutions GmbH uses the following sub-processors for this purpose:

• Data centre: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in the Falkenstein data centre (Germany).
• Server management and deployment: Laravel Forge by Laravel Holdings Inc., 60 Broad Street, 24th Floor, #1559, New York, NY 10004, USA. Forge has access to the server in order to manage and update it. Laravel Holdings Inc. participates in the EU-U.S. Data Privacy Framework; the transfer to the USA is based on the corresponding adequacy decision (Art. 45 GDPR).

The web server does not keep access logs or error logs for this website. Technical errors in the website application are recorded in a separate error log so that we can fix them. It contains details of the failed operation (e.g. time, requested address and error message) and may in individual cases also contain personal data if it is part of the failed operation. The error log is deleted after 7 days unless it is needed for longer to investigate a specific security incident.

The connection is encrypted using TLS. All components of the website – fonts, images, videos, maps and scripts – are loaded from our own server. No external fonts, no analytics, advertising or tracking services, no social media plugins and no third-party map services are loaded automatically when you visit the website. Third parties only have access to data in the course of hosting and technical operation, as described in this section. External services such as Google Maps or WhatsApp only open when you select the respective link yourself (sections 4 and 7).

3. Cookies

We only use technically necessary cookies:

• nb-spedition-session – a session cookie containing a random identifier. It protects the forms against forged submissions and, only in the protected administration area under /admin/, is used for login. After a form has been sent, the session passes the reference number to the thank-you page once; if entries are invalid, it returns your details and the error messages to the form so that you do not have to enter them again. This session data is stored encrypted on our server and expires two hours after your last activity. It cannot be read by JavaScript and is only transmitted via HTTPS.
• XSRF-TOKEN – contains a security token that protects against forged form submissions (cross-site request forgery).

Both cookies expire no later than two hours after your last activity on the website.

The legal basis is § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.

4. Contacting us and enquiry forms

If you contact us via a form, by email, by telephone or via WhatsApp, we process your details in order to handle your enquiry. In the “Request a quote” form, these are your name, email address, optionally your company and telephone number, and your shipment details (transport type, collection and delivery locations, preferred dates, packages, packaging, weight, goods and dimensions, special requirements and notes). In the contact form, these are your name, email address, optionally your company and telephone number, your topic and your message. In the callback form, these are your name, telephone number, preferred time slot and, optionally, a short description of your request. In the quick driver application, these are your name, telephone number, optionally your email address, driving licence classes, ADR certificate (yes/no), optionally a possible start date and a short note (see also section 8). We also store the language in which you use the website and the date and time of receipt.

Form data is transmitted to our server in encrypted form and forwarded from there by email to our mailbox. Each enquiry receives a reference number (for example NBS-2026-000123). If you provide an email address, we send an automatic acknowledgement of receipt to it with the reference number and the options you selected (for example transport type, dates, packages and weight); it does not constitute acceptance of an order. Your name and free-text entries such as your message or notes are not included in the acknowledgement. Your email address is also used as the reply address.

So that no enquiry is lost if email delivery is disrupted, we additionally store a backup copy of your form data in the database on our server, where your details are stored in encrypted form. If email delivery fails, our server automatically tries again later.

Retention of the backup copy: In the database, the backup copy is deleted automatically 30 days after submission. As the database is backed up daily in encrypted form, the backup copy is also contained in these data backups; each data backup is deleted automatically 14 days after it was created. Your form data is therefore also removed from the data backups no later than about 44 days after submission.

For sending emails and for our mailbox, we use the following provider, which processes the data on our behalf (Art. 28 GDPR):
STRATO GmbH
Otto-Ostrowski-Straße 7
10249 Berlin
Germany

The server with the database is provided to us by NB Fleet & Solutions GmbH and is located in the Hetzner Online GmbH data centre in Falkenstein (see section 2).

The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry is aimed at concluding a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). We delete enquiries in our mailbox once they have been dealt with, unless statutory retention obligations, in particular under commercial and tax law, apply.

Technical protection of the forms

To prevent misuse, our server counts submission attempts per internet connection for a maximum of one hour; the counter is then deleted automatically. The IP address is not stored in plain text but only as a cryptographic hash value; for IPv6 addresses, only the network prefix (the first 64 bits) is used. In addition, the forms contain a field that is invisible to people and a minimum completion time of a few seconds, checked via an encrypted timestamp in the form, in order to detect automated entries. The legal basis is Art. 6(1)(f) GDPR.

Local maps and Google Maps

The maps on our website are loaded from our own server. Google Maps only opens in a new tab when you choose “Open route in Google Maps” or “Route in Google Maps” on the contact page; with the route planner, the collection location and destination are transmitted to Google. Google also receives connection data, in particular your IP address. If you only choose “Request a quote for this route”, the locations are transferred exclusively to our enquiry form. Google’s privacy policy applies to the external service.

5. Spam protection with ALTCHA

We additionally protect our forms with ALTCHA. Your browser solves a small computational task (proof of work) that is generated and verified by our own server. The task contains no personal data. So that a solution cannot be used more than once, our server keeps a hash of the task until it expires (20 minutes). No external service is integrated, no cookies are set and no data is transferred to third parties.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protection against spam and misuse. Without this check, the form cannot be sent; you can reach us at any time by email or telephone.

6. Contact by telephone and AI telephone assistant

Calls to us may be answered by the AI telephone assistant of STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. At the start of the call, the assistant introduces itself as an AI telephone assistant and refers to this privacy information. You can end the call at any time and reach us by email or via our forms instead.

The purpose is to take down your request by telephone and pass it on to our team. To do so, the call is processed automatically: your speech is recognised and converted into text (speech recognition and transcription) and analysed for its content (semantic analysis), and the assistant replies by speech output. Your name, callback number, request and a summary of the call are sent by email to our mailbox info@nbspedition.de. We do not record the call and do not receive or store an audio file.

The data processed includes your telephone number, if it is transmitted, the date, time and duration of the call (connection data), the content of what you say, the information you provide voluntarily (for example your name, company, callback number and request) and information on the course of the call (for example if the call is ended early).

STRATO processes the data as a processor (Art. 28 GDPR); we concluded a data processing agreement with STRATO on 27 February 2026. STRATO uses sub-processors for hosting, speech recognition and semantic analysis. Personal data may be transferred to the USA in this context. The transfer is based on the adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the recipients are certified under it, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). According to STRATO, pseudonymised data may be used to improve speech processing; it is then impossible or considerably more difficult to attribute the data to individual persons.

STRATO stores the data only for as long as required for these purposes and then deletes or anonymises it. We delete the emails containing callback requests once your request has been dealt with and no statutory retention obligations apply.

The legal basis is Art. 6(1)(b) GDPR insofar as your call concerns a contract or its initiation, and otherwise Art. 6(1)(f) GDPR (legitimate interest in being reliably reachable by telephone and in handling enquiries efficiently). You can object to processing based on point (f) (section 14). No automated decision-making within the meaning of Art. 22 GDPR takes place; the assistant does not make any binding commitments. Offers and decisions are made exclusively by our team.

7. WhatsApp Business

Our website contains links to WhatsApp. A connection to WhatsApp is only established when you open the link. If you write to us via WhatsApp, we process your telephone number, your profile name and the content of your messages in order to respond to your enquiry (Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR). We delete chat histories as soon as they are no longer required for handling your enquiry and there are no retention obligations.

The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. When you use WhatsApp, it also processes data under its own responsibility; a transfer to Meta Platforms, Inc. in the USA is possible. Details can be found in WhatsApp’s privacy policy. If you do not want this, you can reach us by email or telephone. Please do not send us any particularly sensitive data via WhatsApp.

8. Applications

Applications reach us by email, via the quick driver application on our careers page, via the contact form or by telephone. For the quick application, the backup copy described in section 4 and its retention period apply. We process your details and documents exclusively in order to decide whether to establish an employment relationship (Art. 6(1)(b) GDPR). Only the persons involved in the selection process have access.

If no employment relationship is established, we delete your documents and the related correspondence 4 months after the conclusion of the application procedure. We only keep them for longer if this is necessary because of a specific legal dispute (Art. 6(1)(f) GDPR; legitimate interest in defending against legal claims) or if you have consented to being included in our talent pool (Art. 6(1)(a) GDPR); you can withdraw this consent at any time with effect for the future. If you are hired, the necessary data is transferred to your personnel file.

9. Customer and order data

If you commission us, we process the contact, order, shipment and billing data required for performance (Art. 6(1)(b) GDPR) and retain it in accordance with obligations under commercial and tax law (Art. 6(1)(c) GDPR).

10. Data we do not collect from you (Art. 14 GDPR)

Data of consignees, consignors and loading points: To carry out transport orders, our customers send us details of consignors, consignees and loading and unloading points, for example name or company, address, contact person, telephone number, email address and delivery and time-slot details. We use this data to collect, announce and deliver shipments. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest and that of our customers lies in the proper performance of the transport order. The source of the data is the respective customer.

Contact details of employees of our business customers and partners: We process the name, position and business contact details (telephone number, email address) of contact persons at our business customers, suppliers and transport partners in order to communicate with these companies and handle orders. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in communicating with our business partners. The source of the data is the respective company or the contact person themselves.

We store this data for as long as it is required for the respective order or business relationship and beyond that only insofar as statutory retention obligations, in particular under commercial and tax law, apply. The recipients are the parties named in section 11.

11. Recipients

Your data is received only by parties that need it for the purposes stated: the service providers named in this information, carriers and subcontractors engaged in carrying out orders, consignees of the shipment, our tax advisers and authorities, insofar as we are legally obliged to disclose it.

12. Transfers to third countries

A transfer to countries outside the EU and the EEA may take place in the case of server management via Laravel Forge (see section 2), sub-processors of the telephone assistant (see section 6) and WhatsApp (Meta). It is based on an adequacy decision (EU-U.S. Data Privacy Framework) or on appropriate safeguards such as standard contractual clauses (Arts. 45, 46 GDPR). For cross-border transport, we transmit the necessary shipment data to parties involved in the country of destination, for example in Switzerland, for which an adequacy decision exists.

13. Provision of data and automated decision-making

You are not obliged to provide us with any data. However, without the information marked as mandatory fields, we cannot process your enquiry. There is no automated decision-making, including profiling, under Art. 22 GDPR.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). To do so, please use the contact details given above.

Right to object under Art. 21 GDPR: Where we process your data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, www.baden-wuerttemberg.datenschutz.de.