PRIVACY POLICY
PRIVACY POLICY
FairFleet — Privacy Policy
FairFleet GmbH and FairFleet, Inc. – As of: July 30, 2026 – English convenience translation; the German version is authoritative (except for the U.S. Annex, where this English version prevails)
1. Controller and Contact
The controller for the processing of personal data in connection with the website fairfleet.com / fairfleet360.com (including all subdomains), our mobile apps, and our services (together, the "Platform") is FairFleet GmbH, Gotzinger Str. 48, 81371 Munich, Germany, phone +49 (0) 89 5191 9916, email datenschutz@fairfleet.com, represented by its managing directors Alexander Engelfried and Marco Kreuzer, commercial register: Local Court of Munich, HRB 239862 ("FairFleet," "we"). For all data protection matters, contact us at datenschutz@fairfleet.com or by post at the address above.
Note for the USA: For customers seated in the USA and for pilots in the USA, FairFleet, Inc., 120 Wall Street, 20th Floor, New York, NY 10005, USA, is the contracting party and the controller for contract-related processing; the separate U.S. Privacy Notice of FairFleet, Inc. (available on our legal page) applies in that respect. FairFleet GmbH operates the Platform in this context as a technical service provider to FairFleet, Inc.
2. What Data We Process
• Account and profile data: Name, company name, address, email address, phone/mobile number, VAT ID, profile picture, references, and your settings.
• Pilot verification data: Proof of identity, licenses and certificates (e.g., EU remote pilot certificates), drone registrations, evidence of insurance, tax documents, training and test results, and — where required for specific missions — the results of identity verification and reliability checks (including a criminal record certificate provided by you).
• Mission and flight data: Mission details, deployment locations and flight area data, flight plans, and the aerial imagery/data and analyses created.
• Location data from the apps: Our apps may — in accordance with your device settings — collect location data, in particular to offer pilots nearby missions and to coordinate mission execution. For certain missions, recording location during flight (including camera access where necessary) may be part of the mission for safety reasons or due to customer or regulatory requirements; this is indicated in the mission. Location sharing can be deactivated at any time in your device settings; certain functions may then be unavailable.
• Payment data: Payments are processed via external payment service providers (in particular Stripe and GoCardless); credit card and account data are collected and processed exclusively by the respective payment service provider, not by us. We receive confirmation and status information only.
• Usage and device data: IP address, date and time of access, browser type and version, operating system, referrer URL, device type, screen resolution, language, pages visited, and duration of the visit (server log files). IP addresses are stored only for the duration of use and are then deleted or anonymized by truncation.
3. Purposes and Legal Bases
We process your data on the basis of the GDPR, in particular:
• Performance of contract (Art. 6(1)(b) GDPR): Provision of the Platform and accounts, conclusion and performance of missions and bookings, pilot onboarding and verification, mission coordination including mission-related location data, payment processing, invoicing, support.
• Legal obligations (Art. 6(1)(c) GDPR): Commercial and tax retention obligations, aviation-law record obligations, disclosures to authorities.
• Legitimate interests (Art. 6(1)(f) GDPR): Security and abuse prevention; quality assurance of the pilot network (including sharing qualification and audit evidence with customers and their auditors to the extent required for subcontractor approval); enforcement of legal claims; improvement and further development of the Platform, including the training of analysis software and AI models — for which we use data in anonymized or aggregated form without personal reference; direct marketing for our own similar services within the limits permitted by law.
• Consent (Art. 6(1)(a) GDPR): Newsletter, non-essential cookies and tracking (see Section 4), and specific checks where consent is legally required. You may withdraw any consent at any time with effect for the future.
The provision of certain data is necessary for using the Platform: without an email address no account can be operated; without verification data pilots cannot take on missions; without invoicing data paid services cannot be processed.
4. Cookies, Consent Management, and Analytics
When you access our website, we use technically necessary cookies (Section 25(2) TDDDG). All non-essential cookies and comparable technologies — in particular analytics, statistics, and marketing services such as Google Analytics, Google Ads/conversion tracking, Google Tag Manager, Hotjar, Meta Pixel (Facebook), and LinkedIn — are used only if you have consented via our consent banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). The banner shows the services currently in use in detail; you can change your selection there at any time and withdraw consent with effect for the future (via the "Cookie Settings" link on the website). Embedded third-party content (e.g., YouTube videos, Google Maps) is likewise loaded only after your consent or interaction; data may be transmitted to the respective providers in the process.
5. Recipients and Service Providers
We share personal data only where necessary for the performance of a contract, where you have consented, where a legal obligation exists, or where a legitimate interest supports it. Processors are contractually bound in accordance with Art. 28 GDPR. Our recipients include in particular:
• Hosting and infrastructure: Amazon Web Services (data centers in Frankfurt am Main); Platform data is stored on servers in Germany or the EU.
• Payment service providers: Stripe and GoCardless for card payments and direct debits; their privacy notices apply in addition.
• Business software: Zoho (CRM and support), Lexware Office (invoicing), Mailgun (email and newsletter dispatch — newsletters only with your consent).
• Identity and screening providers: Specialized providers for identity verification and — where required for specific missions — reliability checks of pilots, as well as verification and payout platforms for document uploads.
• Customers and their auditors: For pilots, we share name, qualification, certificate, and insurance evidence and screening status with customers, their auditors, and competent authorities to the extent required for the approval, vetting, or auditing of subcontractors.
• FairFleet, Inc. (USA): The Platform is operated by FairFleet GmbH for US customers and US pilots as well; all Platform data remains stored on servers in Germany or the EU. FairFleet, Inc., as the contracting party of US customers and US pilots, receives access to this data to the extent required for contract performance (see Section 7).
• Review and web services: Trustpilot and Google My Business (reviews, entered by you), Google Maps (determining mission areas), and our social media presences (LinkedIn, Instagram, Facebook, X/Twitter, YouTube) — where you contact us via these channels, the providers’ notices apply in addition.
6. Services Used in Detail
For maximum transparency, we describe below the individual services we use, what they do, and where data flows in the process. Consent-based services (Section 4) run only after your approval in the cookie banner.
6.1 Amazon Web Services (hosting). Provider: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Our Platform and all Platform data are hosted in AWS data centers in Frankfurt am Main; we use server locations in Germany or the EU exclusively. Legal basis: Art. 6(1)(b) and (f) GDPR. Privacy notice: aws.amazon.com/privacy.
6.2 Stripe (payment processing). Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland (with involvement of Stripe, Inc., USA where applicable — safeguarded under the EU-U.S. Data Privacy Framework). Processes card payments and other payment methods; card and account data are collected directly by Stripe, not by us. Legal basis: Art. 6(1)(b) GDPR. Privacy notice: stripe.com/privacy.
6.3 GoCardless (direct debits). Provider: GoCardless Ltd., Sutton Yard, 65 Goswell Road, London EC1V 7EN, United Kingdom (EU adequacy decision for the UK). Processes direct debit payments; bank details are processed directly by GoCardless. Legal basis: Art. 6(1)(b) GDPR. Privacy notice: gocardless.com/legal/privacy.
6.4 Lexware Office (invoicing). Provider: Haufe-Lexware GmbH & Co. KG, Munzinger Str. 9, 79111 Freiburg, Germany. We transmit invoicing data (name, address, booked services) to create proper invoices. Legal basis: Art. 6(1)(b) and (c) GDPR.
6.5 QuickBooks (US accounting) and Xero (UK accounting). For the accounting of FairFleet, Inc. we use QuickBooks (Intuit Inc., 2700 Coast Avenue, Mountain View, CA 94043, USA — safeguarded under the EU-U.S. Data Privacy Framework or Standard Contractual Clauses); invoicing and payment data of US customers and US pilots are processed. For the United Kingdom we use Xero (Xero (UK) Ltd., Bankside 2, 90–100 Southwark Street, London SE1 0SW, United Kingdom — EU adequacy decision for the UK); invoicing and payment data with a UK connection are processed. Legal basis: Art. 6(1)(b) and (c) GDPR.
6.6 Zoho (CRM and support). Provider: Zoho Corporation B.V. (EU) / Zoho Corporation Pvt. Ltd., Chennai, India. Supports our customer relationship and support management (contact data, inquiries, booking and invoicing information); we use Zoho’s EU data centers, transmissions are TLS-encrypted, and data at rest is AES-256 encrypted. Legal basis: Art. 6(1)(b) and (f) GDPR. Privacy notice: zoho.com/privacy.html.
6.7 Mailgun (email and newsletter dispatch). Provider: Mailgun Technologies, Inc. (Sinch), 112 E Pecan St. #1135, San Antonio, TX 78205, USA; an EU region with processing in the EU is offered for EU customers, and US transfers are safeguarded under the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. Dispatches our system emails and newsletters; processed data includes the email address, dispatch and delivery status, and, for newsletters, open and click statistics. Legal basis: Art. 6(1)(b) GDPR for system emails; for newsletters, your consent (Art. 6(1)(a) GDPR) — unsubscribe at any time via the link in every newsletter. Privacy notice: sinch.com/legal/privacy.
6.8 Google Analytics (web analytics). Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (US transfers to Google LLC safeguarded under the EU-U.S. Data Privacy Framework). Analyzes the use of our website (truncated IP addresses, pages visited, session duration, device data); we have concluded a data processing agreement and activated IP anonymization. Legal basis: your consent via the cookie banner; withdrawal possible there at any time. Privacy notice: policies.google.com/privacy.
6.9 Google Ads with conversion tracking. Provider: Google Ireland Ltd. Measures whether users reached us via a Google ad and, for example, completed a booking; we receive statistics only, without personal reference. Legal basis: your consent via the cookie banner.
6.10 Google Tag Manager. Provider: Google Ireland Ltd. A pure management tool for deploying website tags; it does not set cookies or collect personal data itself. Services triggered by it (e.g., Google Analytics) run only after your consent.
6.11 Google Maps (map service). Provider: Google Ireland Ltd. Used in our map-selection tool with which customers define flight areas and property boundaries — an essential part of order processing. When the maps load, connection data (including your IP address) is transmitted to Google. Legal basis: Art. 6(1)(b) GDPR within the booking process, otherwise your consent.
6.12 Google Business Profile and Trustpilot (reviews). We collect feedback from customers and pilots via Google Business Profile (Google Ireland Ltd.) and Trustpilot (Trustpilot A/S, Pilestræde 58, 1112 Copenhagen, Denmark). Submitting a review is voluntary and done by you via the respective platform; their privacy notices apply. Reviews are used for advertising only with the author’s consent.
6.13 Hotjar (usage analytics). Provider: Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian’s STJ 3141, Malta. Analyzes user behavior on our website in pseudonymized form (e.g., heatmaps) to identify usability issues; input fields are automatically masked. Legal basis: your consent via the cookie banner; Hotjar additionally respects your browser’s "Do Not Track" signal. Privacy notice: hotjar.com/legal/policies/privacy.
6.14 Meta Pixel (Facebook/Instagram advertising). Provider: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland (US transfers safeguarded under the EU-U.S. Data Privacy Framework). Measures the effectiveness of our ads on Facebook and Instagram; we receive statistical reports only, without personal reference. Legal basis: your consent via the cookie banner. Privacy notice: facebook.com/privacy/policy.
6.15 LinkedIn Insight Tag. Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Measures the effectiveness of our LinkedIn campaigns (aggregated reports). Legal basis: your consent via the cookie banner. Privacy notice: linkedin.com/legal/privacy-policy.
6.16 YouTube (embedded videos). Provider: Google Ireland Ltd. Videos embedded on our website are loaded only after you have consented or actively started the video; connection data is then transmitted to YouTube and — if you are logged in — attributed to your account.
6.17 Checkr (background checks, US pilots). Provider: Checkr, Inc., San Francisco, CA, USA. Performs background checks under the Fair Credit Reporting Act for pilots in the USA — only where customer requirements mandate them for specific missions (identity, criminal records, motor-vehicle records, sanctions lists). You receive a separate standalone disclosure and provide separate authorization beforehand (see U.S. Annex). Privacy notice: checkr.com/privacy-policy.
6.18 Mobile apps (App Store / Google Play). Our apps are distributed via the Apple App Store (Apple Distribution International Ltd., Ireland) and Google Play (Google Ireland Ltd.); the store operator’s privacy notice applies to the download. The data processed by the apps themselves — in particular location data during missions — is described in Section 2.
7. Transfers to Third Countries
Where service providers process data outside the EU/EEA (in particular in the USA), we ensure an adequate level of data protection in accordance with Art. 44 et seq. GDPR: through the recipient’s certification under the EU-U.S. Data Privacy Framework (adequacy decision of the EU Commission) and/or through the EU Standard Contractual Clauses, supplemented by additional measures where required. This also applies to access by FairFleet, Inc. from the USA to the data stored in the EU; the data itself remains on servers in Germany or the EU, and corresponding safeguards have been agreed with FairFleet, Inc. You may request a copy of the relevant safeguards via datenschutz@fairfleet.com.
8. Retention
We store personal data for as long as your account exists or as required for the purposes described. After termination or deletion of your account, we generally delete your data within 90 days. We store data for longer only where statutory retention obligations exist (e.g., six or ten years for business and accounting records under the German Commercial Code and Fiscal Code) or where required to assert or defend legal claims. Verification, qualification, and mission-related evidence of pilots may be retained for up to ten years due to regulatory, statutory, or customer-specific audit requirements. Aerial imagery/data is available to customers for retrieval in accordance with the terms and conditions.
9. Data Security
We protect our systems through technical and organizational measures against loss, destruction, unauthorized access, and unauthorized modification. Transmissions are encrypted (TLS); mission data is captured and transported on encrypted storage media. Please note that the transmission of information over the internet is never completely secure.
10. No Automated Individual Decisions; AI Note
We do not make decisions based solely on automated processing with legal effect within the meaning of Art. 22 GDPR. Where we use AI systems to analyze or edit content, we label AI-generated or substantially AI-edited results in accordance with Regulation (EU) 2024/1689 (AI Act).
11. Your Rights and Contact
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20), and the right to withdraw any consent at any time with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you may object to the processing at any time on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without stating reasons.
You may exercise all of these rights at any time free of charge, unless statutory provisions prevent this. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. For this — as for any other questions, comments, or requests regarding the processing of your personal data — please contact the data protection officer of FairFleet GmbH: FairFleet GmbH, Gotzinger Str. 48, 81371 Munich, Germany, phone +49 (0) 89 5191 9916, email datenschutz@fairfleet.com — by email, post, or phone.
Contact forms: If you send us inquiries via a contact or support form, the information you provide in the form, including the contact details stated there, is stored and processed by us exclusively to handle the inquiry and for follow-up questions (Art. 6(1)(b) or (f) GDPR).
Contact via social media: You can also contact us via our social media presences (LinkedIn, Instagram, Facebook, X/Twitter, YouTube). Data collected in this context (e.g., name or account) is stored only for the duration of handling your matter and is not used for other purposes without your consent. Storage by the respective social network is subject to its own privacy terms.
Right to complain: You further have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de; a list of all supervisory authorities with contact details is available at www.bfdi.bund.de.
U.S. Annex — Additional Notices for Users in the United States
This Annex applies in addition to customers seated in the USA and to pilots in the USA. For these users, FairFleet, Inc., 120 Wall Street, 20th Floor, New York, NY 10005, USA, is the contracting party and responsible for contract-related processing; FairFleet GmbH operates the Platform as its technical service provider. The data of US users is likewise stored exclusively on servers in Germany or the EU; teams in Germany and the United States may access it as needed to provide the services. For US users, the English version of this Annex is authoritative.
• State privacy rights: Depending on your state of residence (including California, Colorado, Connecticut, Texas, and Virginia), you may have the right to know/access, correct, and delete personal information, to obtain a portable copy, to opt out of targeted advertising, and not to receive discriminatory treatment for exercising your rights. Submit requests to datenschutz@fairfleet.com or by mail to FairFleet, Inc.; we verify requests using information associated with your account. Authorized agents may submit requests with proof of authorization. If we decline a request, you may appeal by replying to our decision, and you may contact your state Attorney General.
• No sale of personal information: We do not sell personal information for money. Where advertising technologies on our website could constitute "sharing" for cross-context behavioral advertising under applicable state law, you can opt out via the cookie preferences tool on our website ("Your Privacy Choices").
• Background checks (pilots, FCRA): Background checks of US pilots are performed by consumer reporting agencies in accordance with the Fair Credit Reporting Act. You will receive a separate, standalone disclosure and will be asked to provide separate written authorization beforehand; before any adverse action based on a report, you will receive the legally required notices, including a copy of the report and the CFPB "Summary of Your Rights Under the Fair Credit Reporting Act."
• Children: Our services are intended for business users and individuals 18 years of age or older; we do not knowingly collect personal information from children.
12. Changes to this Privacy Policy
We update this privacy policy when our processing operations or the legal situation change. The current version is available at fairfleet.com/legal/privacy.
FairFleet — Privacy Policy
As of: July 30, 2026
English convenience translation; the German version is authoritative (except for the U.S. Annex, where this English version prevails)
1. Controller and Contact
The controller for the processing of personal data in connection with the website fairfleet.com / fairfleet360.com / mstrpiece.de (including all subdomains), our mobile apps, and our services (together, the "Platform") is FairFleet GmbH, Gotzinger Str. 48, 81371 Munich, Germany, phone +49 (0) 89 5191 9916, email privacy@fairfleet.com, represented by its managing directors Alexander Engelfried and Marco Kreuzer, commercial register: Local Court of Munich, HRB 239862 ("FairFleet," "we"). For all data protection matters, contact us at datenschutz@fairfleet.com or by post at the address above.
Note for the USA: For customers seated in the USA and for pilots in the USA, FairFleet, Inc., 120 Wall Street, 20th Floor, New York, NY 10005, USA, is the contracting party and the controller for contract-related processing; the separate U.S. Privacy Notice of FairFleet, Inc. (available on our legal page) applies in that respect. FairFleet GmbH operates the Platform in this context as a technical service provider to FairFleet, Inc.
2. What Data We Process
• Account and profile data: Name, company name, address, email address, phone/mobile number, VAT ID, profile picture, references, and your settings.
• Pilot verification data: Proof of identity, licenses and certificates (e.g., EU remote pilot certificates), drone registrations, evidence of insurance, tax documents, training and test results, and — where required for specific missions — the results of identity verification and reliability checks (including a criminal record certificate provided by you).
• Mission and flight data: Mission details, deployment locations and flight area data, flight plans, and the aerial imagery/data and analyses created.
• Location data from the apps: Our apps may — in accordance with your device settings — collect location data, in particular to offer pilots nearby missions and to coordinate mission execution. For certain missions, recording location during flight (including camera access where necessary) may be part of the mission for safety reasons or due to customer or regulatory requirements; this is indicated in the mission. Location sharing can be deactivated at any time in your device settings; certain functions may then be unavailable.
• Payment data: Payments are processed via external payment service providers (in particular Stripe and GoCardless); credit card and account data are collected and processed exclusively by the respective payment service provider, not by us. We receive confirmation and status information only.
• Usage and device data: IP address, date and time of access, browser type and version, operating system, referrer URL, device type, screen resolution, language, pages visited, and duration of the visit (server log files). IP addresses are stored only for the duration of use and are then deleted or anonymized by truncation.
3. Purposes and Legal Bases
We process your data on the basis of the GDPR, in particular:
• Performance of contract (Art. 6(1)(b) GDPR): Provision of the Platform and accounts, conclusion and performance of missions and bookings, pilot onboarding and verification, mission coordination including mission-related location data, payment processing, invoicing, support.
• Legal obligations (Art. 6(1)(c) GDPR): Commercial and tax retention obligations, aviation-law record obligations, disclosures to authorities.
• Legitimate interests (Art. 6(1)(f) GDPR): Security and abuse prevention; quality assurance of the pilot network (including sharing qualification and audit evidence with customers and their auditors to the extent required for subcontractor approval); enforcement of legal claims; improvement and further development of the Platform, including the training of analysis software and AI models — for which we use data in anonymized or aggregated form without personal reference; direct marketing for our own similar services within the limits permitted by law.
• Consent (Art. 6(1)(a) GDPR): Newsletter, non-essential cookies and tracking (see Section 4), and specific checks where consent is legally required. You may withdraw any consent at any time with effect for the future.
The provision of certain data is necessary for using the Platform: without an email address no account can be operated; without verification data pilots cannot take on missions; without invoicing data paid services cannot be processed.
4. Cookies, Consent Management, and Analytics
When you access our website, we use technically necessary cookies (Section 25(2) TDDDG). All non-essential cookies and comparable technologies — in particular analytics, statistics, and marketing services such as Google Analytics, Google Ads/conversion tracking, Google Tag Manager, Hotjar, Meta Pixel (Facebook), and LinkedIn — are used only if you have consented via our consent banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). The banner shows the services currently in use in detail; you can change your selection there at any time and withdraw consent with effect for the future (via the "Cookie Settings" link on the website). Embedded third-party content (e.g., YouTube videos, Google Maps) is likewise loaded only after your consent or interaction; data may be transmitted to the respective providers in the process.
5. Recipients and Service Providers
We share personal data only where necessary for the performance of a contract, where you have consented, where a legal obligation exists, or where a legitimate interest supports it. Processors are contractually bound in accordance with Art. 28 GDPR. Our recipients include in particular:
• Hosting and infrastructure: Amazon Web Services (data centers in Frankfurt am Main); Platform data is stored on servers in Germany or the EU.
• Payment service providers: Stripe and GoCardless for card payments and direct debits; their privacy notices apply in addition.
• Business software: Zoho (CRM and support), Lexware Office (invoicing), Mailgun (email and newsletter dispatch — newsletters only with your consent).
• Identity and screening providers: Specialized providers for identity verification and — where required for specific missions — reliability checks of pilots, as well as verification and payout platforms for document uploads.
• Customers and their auditors: For pilots, we share name, qualification, certificate, and insurance evidence and screening status with customers, their auditors, and competent authorities to the extent required for the approval, vetting, or auditing of subcontractors.
• FairFleet, Inc. (USA): The Platform is operated by FairFleet GmbH for US customers and US pilots as well; all Platform data remains stored on servers in Germany or the EU. FairFleet, Inc., as the contracting party of US customers and US pilots, receives access to this data to the extent required for contract performance (see Section 7).
• Review and web services: Trustpilot and Google My Business (reviews, entered by you), Google Maps (determining mission areas), and our social media presences (LinkedIn, Instagram, Facebook, X/Twitter, YouTube) — where you contact us via these channels, the providers’ notices apply in addition.
6. Services Used in Detail
For maximum transparency, we describe below the individual services we use, what they do, and where data flows in the process. Consent-based services (Section 4) run only after your approval in the cookie banner.
6.1 Amazon Web Services (hosting). Provider: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Our Platform and all Platform data are hosted in AWS data centers in Frankfurt am Main; we use server locations in Germany or the EU exclusively. Legal basis: Art. 6(1)(b) and (f) GDPR. Privacy notice: aws.amazon.com/privacy.
6.2 Stripe (payment processing). Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland (with involvement of Stripe, Inc., USA where applicable — safeguarded under the EU-U.S. Data Privacy Framework). Processes card payments and other payment methods; card and account data are collected directly by Stripe, not by us. Legal basis: Art. 6(1)(b) GDPR. Privacy notice: stripe.com/privacy.
6.3 GoCardless (direct debits). Provider: GoCardless Ltd., Sutton Yard, 65 Goswell Road, London EC1V 7EN, United Kingdom (EU adequacy decision for the UK). Processes direct debit payments; bank details are processed directly by GoCardless. Legal basis: Art. 6(1)(b) GDPR. Privacy notice: gocardless.com/legal/privacy.
6.4 Lexware Office (invoicing). Provider: Haufe-Lexware GmbH & Co. KG, Munzinger Str. 9, 79111 Freiburg, Germany. We transmit invoicing data (name, address, booked services) to create proper invoices. Legal basis: Art. 6(1)(b) and (c) GDPR.
6.5 QuickBooks and Xero (US accounting). For the accounting of FairFleet, Inc. we use QuickBooks (Intuit Inc., 2700 Coast Avenue, Mountain View, CA 94043, USA) and Xero (Xero Inc., USA/New Zealand). Invoicing and payment data of US customers and US pilots are processed; safeguarded under the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. Legal basis: Art. 6(1)(b) and (c) GDPR.
6.6 Zoho (CRM and support). Provider: Zoho Corporation B.V. (EU) / Zoho Corporation Pvt. Ltd., Chennai, India. Supports our customer relationship and support management (contact data, inquiries, booking and invoicing information); we use Zoho’s EU data centers, transmissions are TLS-encrypted, and data at rest is AES-256 encrypted. Legal basis: Art. 6(1)(b) and (f) GDPR. Privacy notice: zoho.com/privacy.html.
6.7 Mailgun (email and newsletter dispatch). Provider: Mailgun Technologies, Inc. (Sinch), 112 E Pecan St. #1135, San Antonio, TX 78205, USA; an EU region with processing in the EU is offered for EU customers, and US transfers are safeguarded under the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. Dispatches our system emails and newsletters; processed data includes the email address, dispatch and delivery status, and, for newsletters, open and click statistics. Legal basis: Art. 6(1)(b) GDPR for system emails; for newsletters, your consent (Art. 6(1)(a) GDPR) — unsubscribe at any time via the link in every newsletter. Privacy notice: sinch.com/legal/privacy.
6.8 Google Analytics (web analytics). Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (US transfers to Google LLC safeguarded under the EU-U.S. Data Privacy Framework). Analyzes the use of our website (truncated IP addresses, pages visited, session duration, device data); we have concluded a data processing agreement and activated IP anonymization. Legal basis: your consent via the cookie banner; withdrawal possible there at any time. Privacy notice: policies.google.com/privacy.
6.9 Google Ads with conversion tracking. Provider: Google Ireland Ltd. Measures whether users reached us via a Google ad and, for example, completed a booking; we receive statistics only, without personal reference. Legal basis: your consent via the cookie banner.
6.10 Google Tag Manager. Provider: Google Ireland Ltd. A pure management tool for deploying website tags; it does not set cookies or collect personal data itself. Services triggered by it (e.g., Google Analytics) run only after your consent.
6.11 Google Maps (map service). Provider: Google Ireland Ltd. Used in our map-selection tool with which customers define flight areas and property boundaries — an essential part of order processing. When the maps load, connection data (including your IP address) is transmitted to Google. Legal basis: Art. 6(1)(b) GDPR within the booking process, otherwise your consent.
6.12 Google Business Profile and Trustpilot (reviews). We collect feedback from customers and pilots via Google Business Profile (Google Ireland Ltd.) and Trustpilot (Trustpilot A/S, Pilestræde 58, 1112 Copenhagen, Denmark). Submitting a review is voluntary and done by you via the respective platform; their privacy notices apply. Reviews are used for advertising only with the author’s consent.
6.13 Hotjar (usage analytics). Provider: Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian’s STJ 3141, Malta. Analyzes user behavior on our website in pseudonymized form (e.g., heatmaps) to identify usability issues; input fields are automatically masked. Legal basis: your consent via the cookie banner; Hotjar additionally respects your browser’s "Do Not Track" signal. Privacy notice: hotjar.com/legal/policies/privacy.
6.14 Meta Pixel (Facebook/Instagram advertising). Provider: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland (US transfers safeguarded under the EU-U.S. Data Privacy Framework). Measures the effectiveness of our ads on Facebook and Instagram; we receive statistical reports only, without personal reference. Legal basis: your consent via the cookie banner. Privacy notice: facebook.com/privacy/policy.
6.15 LinkedIn Insight Tag. Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Measures the effectiveness of our LinkedIn campaigns (aggregated reports). Legal basis: your consent via the cookie banner. Privacy notice: linkedin.com/legal/privacy-policy.
6.16 YouTube (embedded videos). Provider: Google Ireland Ltd. Videos embedded on our website are loaded only after you have consented or actively started the video; connection data is then transmitted to YouTube and — if you are logged in — attributed to your account.
6.17 Checkr (background checks, US pilots). Provider: Checkr, Inc., San Francisco, CA, USA. Performs background checks under the Fair Credit Reporting Act for pilots in the USA — only where customer requirements mandate them for specific missions (identity, criminal records, motor-vehicle records, sanctions lists). You receive a separate standalone disclosure and provide separate authorization beforehand (see U.S. Annex). Privacy notice: checkr.com/privacy-policy.
6.18 Mobile apps (App Store / Google Play). Our apps are distributed via the Apple App Store (Apple Distribution International Ltd., Ireland) and Google Play (Google Ireland Ltd.); the store operator’s privacy notice applies to the download. The data processed by the apps themselves — in particular location data during missions — is described in Section 2.
7. Transfers to Third Countries
Where service providers process data outside the EU/EEA (in particular in the USA), we ensure an adequate level of data protection in accordance with Art. 44 et seq. GDPR: through the recipient’s certification under the EU-U.S. Data Privacy Framework (adequacy decision of the EU Commission) and/or through the EU Standard Contractual Clauses, supplemented by additional measures where required. This also applies to access by FairFleet, Inc. from the USA to the data stored in the EU; the data itself remains on servers in Germany or the EU, and corresponding safeguards have been agreed with FairFleet, Inc. You may request a copy of the relevant safeguards via datenschutz@fairfleet.com.
8. Retention
We store personal data for as long as your account exists or as required for the purposes described. After termination or deletion of your account, we generally delete your data within 90 days. We store data for longer only where statutory retention obligations exist (e.g., six or ten years for business and accounting records under the German Commercial Code and Fiscal Code) or where required to assert or defend legal claims. Verification, qualification, and mission-related evidence of pilots may be retained for up to ten years due to regulatory, statutory, or customer-specific audit requirements. Aerial imagery/data is available to customers for retrieval in accordance with the terms and conditions.
9. Data Security
We protect our systems through technical and organizational measures against loss, destruction, unauthorized access, and unauthorized modification. Transmissions are encrypted (TLS); mission data is captured and transported on encrypted storage media. Please note that the transmission of information over the internet is never completely secure.
10. No Automated Individual Decisions; AI Note
We do not make decisions based solely on automated processing with legal effect within the meaning of Art. 22 GDPR. Where we use AI systems to analyze or edit content, we label AI-generated or substantially AI-edited results in accordance with Regulation (EU) 2024/1689 (AI Act).
11. Your Rights and Contact
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20), and the right to withdraw any consent at any time with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you may object to the processing at any time on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without stating reasons.
You may exercise all of these rights at any time free of charge, unless statutory provisions prevent this. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. For this — as for any other questions, comments, or requests regarding the processing of your personal data — please contact the data protection officer of FairFleet GmbH: FairFleet GmbH, Gotzinger Str. 48, 81371 Munich, Germany, phone +49 (0) 89 5191 9916, email datenschutz@fairfleet.com — by email, post, or phone.
Contact forms: If you send us inquiries via a contact or support form, the information you provide in the form, including the contact details stated there, is stored and processed by us exclusively to handle the inquiry and for follow-up questions (Art. 6(1)(b) or (f) GDPR).
Contact via social media: You can also contact us via our social media presences (LinkedIn, Instagram, Facebook, X/Twitter, YouTube). Data collected in this context (e.g., name or account) is stored only for the duration of handling your matter and is not used for other purposes without your consent. Storage by the respective social network is subject to its own privacy terms.
Right to complain: You further have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de; a list of all supervisory authorities with contact details is available at www.bfdi.bund.de.
U.S. Annex — Additional Notices for Users in the United States
This Annex applies in addition to customers seated in the USA and to pilots in the USA. For these users, FairFleet, Inc., 120 Wall Street, 20th Floor, New York, NY 10005, USA, is the contracting party and responsible for contract-related processing; FairFleet GmbH operates the Platform as its technical service provider. The data of US users is likewise stored exclusively on servers in Germany or the EU; teams in Germany and the United States may access it as needed to provide the services. For US users, the English version of this Annex is authoritative.
• State privacy rights: Depending on your state of residence (including California, Colorado, Connecticut, Texas, and Virginia), you may have the right to know/access, correct, and delete personal information, to obtain a portable copy, to opt out of targeted advertising, and not to receive discriminatory treatment for exercising your rights. Submit requests to datenschutz@fairfleet.com or by mail to FairFleet, Inc.; we verify requests using information associated with your account. Authorized agents may submit requests with proof of authorization. If we decline a request, you may appeal by replying to our decision, and you may contact your state Attorney General.
• No sale of personal information: We do not sell personal information for money. Where advertising technologies on our website could constitute "sharing" for cross-context behavioral advertising under applicable state law, you can opt out via the cookie preferences tool on our website ("Your Privacy Choices").
• Background checks (pilots, FCRA): Background checks of US pilots are performed by consumer reporting agencies in accordance with the Fair Credit Reporting Act. You will receive a separate, standalone disclosure and will be asked to provide separate written authorization beforehand; before any adverse action based on a report, you will receive the legally required notices, including a copy of the report and the CFPB "Summary of Your Rights Under the Fair Credit Reporting Act."
• Children: Our services are intended for business users and individuals 18 years of age or older; we do not knowingly collect personal information from children.
12. Changes to this Privacy Policy
We update this privacy policy when our processing operations or the legal situation change. The current version is available at fairfleet.com/legal/privacy.
FairFleet — Privacy Policy
As of: July 30, 2026
English convenience translation; the German version is authoritative (except for the U.S. Annex, where this English version prevails)
1. Controller and Contact
The controller for the processing of personal data in connection with the website fairfleet.com / fairfleet360.com / mstrpiece.de (including all subdomains), our mobile apps, and our services (together, the "Platform") is FairFleet GmbH, Gotzinger Str. 48, 81371 Munich, Germany, phone +49 (0) 89 5191 9916, email privacy@fairfleet.com, represented by its managing directors Alexander Engelfried and Marco Kreuzer, commercial register: Local Court of Munich, HRB 239862 ("FairFleet," "we"). For all data protection matters, contact us at datenschutz@fairfleet.com or by post at the address above.
Note for the USA: For customers seated in the USA and for pilots in the USA, FairFleet, Inc., 120 Wall Street, 20th Floor, New York, NY 10005, USA, is the contracting party and the controller for contract-related processing; the separate U.S. Privacy Notice of FairFleet, Inc. (available on our legal page) applies in that respect. FairFleet GmbH operates the Platform in this context as a technical service provider to FairFleet, Inc.
2. What Data We Process
• Account and profile data: Name, company name, address, email address, phone/mobile number, VAT ID, profile picture, references, and your settings.
• Pilot verification data: Proof of identity, licenses and certificates (e.g., EU remote pilot certificates), drone registrations, evidence of insurance, tax documents, training and test results, and — where required for specific missions — the results of identity verification and reliability checks (including a criminal record certificate provided by you).
• Mission and flight data: Mission details, deployment locations and flight area data, flight plans, and the aerial imagery/data and analyses created.
• Location data from the apps: Our apps may — in accordance with your device settings — collect location data, in particular to offer pilots nearby missions and to coordinate mission execution. For certain missions, recording location during flight (including camera access where necessary) may be part of the mission for safety reasons or due to customer or regulatory requirements; this is indicated in the mission. Location sharing can be deactivated at any time in your device settings; certain functions may then be unavailable.
• Payment data: Payments are processed via external payment service providers (in particular Stripe and GoCardless); credit card and account data are collected and processed exclusively by the respective payment service provider, not by us. We receive confirmation and status information only.
• Usage and device data: IP address, date and time of access, browser type and version, operating system, referrer URL, device type, screen resolution, language, pages visited, and duration of the visit (server log files). IP addresses are stored only for the duration of use and are then deleted or anonymized by truncation.
3. Purposes and Legal Bases
We process your data on the basis of the GDPR, in particular:
• Performance of contract (Art. 6(1)(b) GDPR): Provision of the Platform and accounts, conclusion and performance of missions and bookings, pilot onboarding and verification, mission coordination including mission-related location data, payment processing, invoicing, support.
• Legal obligations (Art. 6(1)(c) GDPR): Commercial and tax retention obligations, aviation-law record obligations, disclosures to authorities.
• Legitimate interests (Art. 6(1)(f) GDPR): Security and abuse prevention; quality assurance of the pilot network (including sharing qualification and audit evidence with customers and their auditors to the extent required for subcontractor approval); enforcement of legal claims; improvement and further development of the Platform, including the training of analysis software and AI models — for which we use data in anonymized or aggregated form without personal reference; direct marketing for our own similar services within the limits permitted by law.
• Consent (Art. 6(1)(a) GDPR): Newsletter, non-essential cookies and tracking (see Section 4), and specific checks where consent is legally required. You may withdraw any consent at any time with effect for the future.
The provision of certain data is necessary for using the Platform: without an email address no account can be operated; without verification data pilots cannot take on missions; without invoicing data paid services cannot be processed.
4. Cookies, Consent Management, and Analytics
When you access our website, we use technically necessary cookies (Section 25(2) TDDDG). All non-essential cookies and comparable technologies — in particular analytics, statistics, and marketing services such as Google Analytics, Google Ads/conversion tracking, Google Tag Manager, Hotjar, Meta Pixel (Facebook), and LinkedIn — are used only if you have consented via our consent banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). The banner shows the services currently in use in detail; you can change your selection there at any time and withdraw consent with effect for the future (via the "Cookie Settings" link on the website). Embedded third-party content (e.g., YouTube videos, Google Maps) is likewise loaded only after your consent or interaction; data may be transmitted to the respective providers in the process.
5. Recipients and Service Providers
We share personal data only where necessary for the performance of a contract, where you have consented, where a legal obligation exists, or where a legitimate interest supports it. Processors are contractually bound in accordance with Art. 28 GDPR. Our recipients include in particular:
• Hosting and infrastructure: Amazon Web Services (data centers in Frankfurt am Main); Platform data is stored on servers in Germany or the EU.
• Payment service providers: Stripe and GoCardless for card payments and direct debits; their privacy notices apply in addition.
• Business software: Zoho (CRM and support), Lexware Office (invoicing), Mailgun (email and newsletter dispatch — newsletters only with your consent).
• Identity and screening providers: Specialized providers for identity verification and — where required for specific missions — reliability checks of pilots, as well as verification and payout platforms for document uploads.
• Customers and their auditors: For pilots, we share name, qualification, certificate, and insurance evidence and screening status with customers, their auditors, and competent authorities to the extent required for the approval, vetting, or auditing of subcontractors.
• FairFleet, Inc. (USA): The Platform is operated by FairFleet GmbH for US customers and US pilots as well; all Platform data remains stored on servers in Germany or the EU. FairFleet, Inc., as the contracting party of US customers and US pilots, receives access to this data to the extent required for contract performance (see Section 7).
• Review and web services: Trustpilot and Google My Business (reviews, entered by you), Google Maps (determining mission areas), and our social media presences (LinkedIn, Instagram, Facebook, X/Twitter, YouTube) — where you contact us via these channels, the providers’ notices apply in addition.
6. Services Used in Detail
For maximum transparency, we describe below the individual services we use, what they do, and where data flows in the process. Consent-based services (Section 4) run only after your approval in the cookie banner.
6.1 Amazon Web Services (hosting). Provider: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. Our Platform and all Platform data are hosted in AWS data centers in Frankfurt am Main; we use server locations in Germany or the EU exclusively. Legal basis: Art. 6(1)(b) and (f) GDPR. Privacy notice: aws.amazon.com/privacy.
6.2 Stripe (payment processing). Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland (with involvement of Stripe, Inc., USA where applicable — safeguarded under the EU-U.S. Data Privacy Framework). Processes card payments and other payment methods; card and account data are collected directly by Stripe, not by us. Legal basis: Art. 6(1)(b) GDPR. Privacy notice: stripe.com/privacy.
6.3 GoCardless (direct debits). Provider: GoCardless Ltd., Sutton Yard, 65 Goswell Road, London EC1V 7EN, United Kingdom (EU adequacy decision for the UK). Processes direct debit payments; bank details are processed directly by GoCardless. Legal basis: Art. 6(1)(b) GDPR. Privacy notice: gocardless.com/legal/privacy.
6.4 Lexware Office (invoicing). Provider: Haufe-Lexware GmbH & Co. KG, Munzinger Str. 9, 79111 Freiburg, Germany. We transmit invoicing data (name, address, booked services) to create proper invoices. Legal basis: Art. 6(1)(b) and (c) GDPR.
6.5 QuickBooks and Xero (US accounting). For the accounting of FairFleet, Inc. we use QuickBooks (Intuit Inc., 2700 Coast Avenue, Mountain View, CA 94043, USA) and Xero (Xero Inc., USA/New Zealand). Invoicing and payment data of US customers and US pilots are processed; safeguarded under the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. Legal basis: Art. 6(1)(b) and (c) GDPR.
6.6 Zoho (CRM and support). Provider: Zoho Corporation B.V. (EU) / Zoho Corporation Pvt. Ltd., Chennai, India. Supports our customer relationship and support management (contact data, inquiries, booking and invoicing information); we use Zoho’s EU data centers, transmissions are TLS-encrypted, and data at rest is AES-256 encrypted. Legal basis: Art. 6(1)(b) and (f) GDPR. Privacy notice: zoho.com/privacy.html.
6.7 Mailgun (email and newsletter dispatch). Provider: Mailgun Technologies, Inc. (Sinch), 112 E Pecan St. #1135, San Antonio, TX 78205, USA; an EU region with processing in the EU is offered for EU customers, and US transfers are safeguarded under the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. Dispatches our system emails and newsletters; processed data includes the email address, dispatch and delivery status, and, for newsletters, open and click statistics. Legal basis: Art. 6(1)(b) GDPR for system emails; for newsletters, your consent (Art. 6(1)(a) GDPR) — unsubscribe at any time via the link in every newsletter. Privacy notice: sinch.com/legal/privacy.
6.8 Google Analytics (web analytics). Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (US transfers to Google LLC safeguarded under the EU-U.S. Data Privacy Framework). Analyzes the use of our website (truncated IP addresses, pages visited, session duration, device data); we have concluded a data processing agreement and activated IP anonymization. Legal basis: your consent via the cookie banner; withdrawal possible there at any time. Privacy notice: policies.google.com/privacy.
6.9 Google Ads with conversion tracking. Provider: Google Ireland Ltd. Measures whether users reached us via a Google ad and, for example, completed a booking; we receive statistics only, without personal reference. Legal basis: your consent via the cookie banner.
6.10 Google Tag Manager. Provider: Google Ireland Ltd. A pure management tool for deploying website tags; it does not set cookies or collect personal data itself. Services triggered by it (e.g., Google Analytics) run only after your consent.
6.11 Google Maps (map service). Provider: Google Ireland Ltd. Used in our map-selection tool with which customers define flight areas and property boundaries — an essential part of order processing. When the maps load, connection data (including your IP address) is transmitted to Google. Legal basis: Art. 6(1)(b) GDPR within the booking process, otherwise your consent.
6.12 Google Business Profile and Trustpilot (reviews). We collect feedback from customers and pilots via Google Business Profile (Google Ireland Ltd.) and Trustpilot (Trustpilot A/S, Pilestræde 58, 1112 Copenhagen, Denmark). Submitting a review is voluntary and done by you via the respective platform; their privacy notices apply. Reviews are used for advertising only with the author’s consent.
6.13 Hotjar (usage analytics). Provider: Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian’s STJ 3141, Malta. Analyzes user behavior on our website in pseudonymized form (e.g., heatmaps) to identify usability issues; input fields are automatically masked. Legal basis: your consent via the cookie banner; Hotjar additionally respects your browser’s "Do Not Track" signal. Privacy notice: hotjar.com/legal/policies/privacy.
6.14 Meta Pixel (Facebook/Instagram advertising). Provider: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland (US transfers safeguarded under the EU-U.S. Data Privacy Framework). Measures the effectiveness of our ads on Facebook and Instagram; we receive statistical reports only, without personal reference. Legal basis: your consent via the cookie banner. Privacy notice: facebook.com/privacy/policy.
6.15 LinkedIn Insight Tag. Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Measures the effectiveness of our LinkedIn campaigns (aggregated reports). Legal basis: your consent via the cookie banner. Privacy notice: linkedin.com/legal/privacy-policy.
6.16 YouTube (embedded videos). Provider: Google Ireland Ltd. Videos embedded on our website are loaded only after you have consented or actively started the video; connection data is then transmitted to YouTube and — if you are logged in — attributed to your account.
6.17 Checkr (background checks, US pilots). Provider: Checkr, Inc., San Francisco, CA, USA. Performs background checks under the Fair Credit Reporting Act for pilots in the USA — only where customer requirements mandate them for specific missions (identity, criminal records, motor-vehicle records, sanctions lists). You receive a separate standalone disclosure and provide separate authorization beforehand (see U.S. Annex). Privacy notice: checkr.com/privacy-policy.
6.18 Mobile apps (App Store / Google Play). Our apps are distributed via the Apple App Store (Apple Distribution International Ltd., Ireland) and Google Play (Google Ireland Ltd.); the store operator’s privacy notice applies to the download. The data processed by the apps themselves — in particular location data during missions — is described in Section 2.
7. Transfers to Third Countries
Where service providers process data outside the EU/EEA (in particular in the USA), we ensure an adequate level of data protection in accordance with Art. 44 et seq. GDPR: through the recipient’s certification under the EU-U.S. Data Privacy Framework (adequacy decision of the EU Commission) and/or through the EU Standard Contractual Clauses, supplemented by additional measures where required. This also applies to access by FairFleet, Inc. from the USA to the data stored in the EU; the data itself remains on servers in Germany or the EU, and corresponding safeguards have been agreed with FairFleet, Inc. You may request a copy of the relevant safeguards via datenschutz@fairfleet.com.
8. Retention
We store personal data for as long as your account exists or as required for the purposes described. After termination or deletion of your account, we generally delete your data within 90 days. We store data for longer only where statutory retention obligations exist (e.g., six or ten years for business and accounting records under the German Commercial Code and Fiscal Code) or where required to assert or defend legal claims. Verification, qualification, and mission-related evidence of pilots may be retained for up to ten years due to regulatory, statutory, or customer-specific audit requirements. Aerial imagery/data is available to customers for retrieval in accordance with the terms and conditions.
9. Data Security
We protect our systems through technical and organizational measures against loss, destruction, unauthorized access, and unauthorized modification. Transmissions are encrypted (TLS); mission data is captured and transported on encrypted storage media. Please note that the transmission of information over the internet is never completely secure.
10. No Automated Individual Decisions; AI Note
We do not make decisions based solely on automated processing with legal effect within the meaning of Art. 22 GDPR. Where we use AI systems to analyze or edit content, we label AI-generated or substantially AI-edited results in accordance with Regulation (EU) 2024/1689 (AI Act).
11. Your Rights and Contact
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20), and the right to withdraw any consent at any time with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you may object to the processing at any time on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without stating reasons.
You may exercise all of these rights at any time free of charge, unless statutory provisions prevent this. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. For this — as for any other questions, comments, or requests regarding the processing of your personal data — please contact the data protection officer of FairFleet GmbH: FairFleet GmbH, Gotzinger Str. 48, 81371 Munich, Germany, phone +49 (0) 89 5191 9916, email datenschutz@fairfleet.com — by email, post, or phone.
Contact forms: If you send us inquiries via a contact or support form, the information you provide in the form, including the contact details stated there, is stored and processed by us exclusively to handle the inquiry and for follow-up questions (Art. 6(1)(b) or (f) GDPR).
Contact via social media: You can also contact us via our social media presences (LinkedIn, Instagram, Facebook, X/Twitter, YouTube). Data collected in this context (e.g., name or account) is stored only for the duration of handling your matter and is not used for other purposes without your consent. Storage by the respective social network is subject to its own privacy terms.
Right to complain: You further have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de; a list of all supervisory authorities with contact details is available at www.bfdi.bund.de.
U.S. Annex — Additional Notices for Users in the United States
This Annex applies in addition to customers seated in the USA and to pilots in the USA. For these users, FairFleet, Inc., 120 Wall Street, 20th Floor, New York, NY 10005, USA, is the contracting party and responsible for contract-related processing; FairFleet GmbH operates the Platform as its technical service provider. The data of US users is likewise stored exclusively on servers in Germany or the EU; teams in Germany and the United States may access it as needed to provide the services. For US users, the English version of this Annex is authoritative.
• State privacy rights: Depending on your state of residence (including California, Colorado, Connecticut, Texas, and Virginia), you may have the right to know/access, correct, and delete personal information, to obtain a portable copy, to opt out of targeted advertising, and not to receive discriminatory treatment for exercising your rights. Submit requests to datenschutz@fairfleet.com or by mail to FairFleet, Inc.; we verify requests using information associated with your account. Authorized agents may submit requests with proof of authorization. If we decline a request, you may appeal by replying to our decision, and you may contact your state Attorney General.
• No sale of personal information: We do not sell personal information for money. Where advertising technologies on our website could constitute "sharing" for cross-context behavioral advertising under applicable state law, you can opt out via the cookie preferences tool on our website ("Your Privacy Choices").
• Background checks (pilots, FCRA): Background checks of US pilots are performed by consumer reporting agencies in accordance with the Fair Credit Reporting Act. You will receive a separate, standalone disclosure and will be asked to provide separate written authorization beforehand; before any adverse action based on a report, you will receive the legally required notices, including a copy of the report and the CFPB "Summary of Your Rights Under the Fair Credit Reporting Act."
• Children: Our services are intended for business users and individuals 18 years of age or older; we do not knowingly collect personal information from children.
12. Changes to this Privacy Policy
We update this privacy policy when our processing operations or the legal situation change. The current version is available at fairfleet.com/legal/privacy.