Data Protection Statement - App
Last amended: March 2026
For the provision of the functions, the controller also processes personal data pursuant to Art. 4 No. 1 GDPR. The following explanation provides the relevant information for the data subjects.
1. Controller pursuant to Art. 4 No. 7 GDPR
The controller for the processing of personal data on the platform is
WIRKSTATT GmbH
Raiffeisenplatz 1
65189 Wiesbaden
2. Data Protection Officer of the Controller
Datenschutzbeauftragter
Raiffeisenplatz 1
65189 Wiesbaden
Telefon: 0800 533-1112
Fax: 0611 533-4500
E-Mail: datenschutz@ruv.de
3. Technical Requirements for Use
A requirement for use is a suitable end device. This is a smartphone with an iOS operating system or Android operating system that allows the installation and use of the app, or a device with a current internet browser to access and use the web application. In your own interest, we recommend that you always keep the software on your end device up to date, regularly install updates for the operating system and any installed protective programs, and protect your end device from unauthorized access.
4. Processing of Personal Data on the WIRKSTATT Platform and Legal Basis for Processing
4.1. Account Creation for Providers (Providers)
To use the platform, a company-related provider account must be created, for which the controller processes the following data:
Company name of the providers
Information on the service provider WIRKSTATT
Email address for the provider account
First name, last name
Company address of the providers:
Company name
Street and house number
Postcode and city
Location address(es) of the parking spaces and charging stations:
The following contact details are displayed to users at the location and/or web-based:
Company name of the providers
Organizational contact
Name of the contact person or department (department name; first name, last name)
Email address (personalized or functional mailbox)
Telephone number for organizational coordination
Telephone number for technical problems (on site)
4.2. Administrator User Account of the Users
To use the web application, no additional software needs to be installed on the end device. Access is gained by entering the internet address (URL) https://web.kravag-truck-parking.de into a third-party internet browser (e.g., Safari, Google Chrome, Microsoft Edge, Firefox, etc.). WIRKSTATT has no influence on the collection, processing, and use of data in connection with the agreement on access to the browser of the respective third-party provider. Responsibility for this lies with the operator of the respective internet browser. For further details, please inform yourself directly with the respective provider.
To use the platform, a company-related operator account must be created. Registration is carried out via email address and a self-assigned password, and optionally by providing a mobile phone number.
For the intended use of the web application and within the scope of offering your location, we process and store the following data:
For all user groups:
Browser, operating system, and IP address of the end device used
In addition to the data mentioned for all user groups, specifically for operators:
Name and address of the freight forwarding company
Geographical data of the freight forwarding company (longitude, latitude)
Public contact details of the freight forwarding company (email address and telephone number)
In addition to the previously mentioned data for operators and dispatchers:
First and last name of the user
Email address and optionally the mobile phone number of the user
Password
Language setting
Booking data when making bookings
Location of the booking (site)
Booking period (start and end of the booking)
License plate of the driver’s truck tractor
Log entries regarding activities in the app:
Login
Booking of parking and charging spaces
Cancellation of made bookings for parking and charging spaces
Token/Contract ID (for linking/displaying the users‘ tokens) of WIRKSTATT (service provider)
The platform operator WIRKSTATT requests all of the above-mentioned data from the utilizing freight forwarding companies. In the event of a malfunction, the respective vehicle user may contact the hotline of the offering freight forwarding company.
To validate the email address, a confirmation email containing a link is sent. The user sets a password for managing the operator account.
The stated data may relate to an identified or identifiable natural person, cf. Art. 4 No. 1 GDPR. For the execution of the user contract, the controller processes personal data required for this purpose pursuant to Art. 6 para. 1 lit. b GDPR. If the entered data relates to a natural person, this data is strictly required for the execution of the contract.
If a natural person enters optional data (depending on the constellation, this can be an email address or a telephone number) into the operator account, this data is processed on the basis of Art. 6 para. 1 lit. a GDPR, provided that the data is personal. By entering the data, the data subject declares their consent to the processing. This consent can be freely revoked for the future by deleting the data from the operator account. The revocation of consent does not affect the lawfulness of processing based on consent before its revocation. To use the platform again, the user (natural person) would have to register anew.
Location Determination in the App: The platform uses location data to display locations on the map as well as nearby „Points of Interest (POIs)“ such as parking and charging spaces. In addition, the app uses the location of permanently attached Bluetooth Low Energy iBeacons on locking devices. This ensures that only authorized drivers who are physically near the locking device can open or close it via the app. For the purpose of determining the location, the app uses the location service of the respective operating system. For this purpose, GPS data is determined in the smartphone and transmitted to the location service provider (Google Maps), which determines the location of your smartphone from this information in order to display it on the map or to use it to grant permission to open locking devices in the vicinity. The app does not record movement profiles. If location determination by the app is not desired, you can refuse permission when asked or withdraw it later in the app settings. In this case, no location data will be collected by the app. Consequently, the „Go to my location“ function on the map can no longer be used. Furthermore, after revoking the right to determine the location or the right to use Bluetooth, or after switching off the Bluetooth function, it is no longer possible to open doors and gates by clicking the button in the app. Instead, opening is only possible by scanning the QR code displayed in the app at the external QR code reader. The legal basis for location determination is your consent declared via authorization pursuant to Art. 6 para. 1 lit. a GDPR.
4.3. User Account of the Drivers
A user account is the driver’s account in the app. It is not provided by the user, but by WIRKSTATT. It is linked to the administration account (web app).
For this purpose, the platform operator processes (justified under data protection law for the performance of a contract, Art. 6 para. 1 lit. b GDPR):
Email address of the driver (personalized, regularly business email)
First and last name of the driver
Telephone number of the driver and email address for communication purposes with the data subject
License plate of the truck tractor
This information is provided by the respective vehicle user themselves. All fields must be filled out, otherwise automated approval of the account is not possible. Authorization for data release and dispatch is granted by the vehicle user.
To validate the email address, a confirmation email containing a link is sent. The utilizing driver sets their own password for managing the user account.
For the execution of the user contract, the controller processes personal data required for this purpose pursuant to Art. 6 para. 1 lit. b GDPR – or pursuant to Art. 6 para. 1 lit. f GDPR, provided that the affected natural person is not a party to the contract themselves. The interest of the controller in executing the contract with a third party, and in doing so also the precise billing of the service, outweighs the interests of the data subject.
If the user enters optional data into the user account, this personal data is processed on the basis of Art. 6 para. 1 lit. a GDPR. By entering the data, the data subject declares their consent to the processing. This consent can be freely revoked for the future by deleting the data from the user account. The revocation of consent does not affect the lawfulness of processing based on consent before its revocation.
4.3.1. Download and Installation of the Mobile App
To use the app, you must install it on your end device. In order to download and install the app, you may first need to enter into an agreement with a third-party provider (e.g., Google Ireland Limited, iTunes SARL, hereinafter referred to as „Third-Party Provider“) regarding access to a portal or online shop of the respective third-party provider (e.g., Google Play Store, iTunes App Store, hereinafter referred to as „Third-Party Portal“). WIRKSTATT has no influence on the collection, processing, and use of data in connection with the agreement on access to the portal or online shop of the respective third-party provider. Responsibility for this lies with the operator of the respective app store. For further details, please inform yourself directly with the respective app store provider.
4.3.2. Permissions of the Mobile App
In order to use the app on your device to its full extent, the following services must be permitted on the end device:
Use of Bluetooth
Location determination via GPS and BLE iBeacons (for details, see Section XII)
Push notifications (for details, see Section XVI)
4.3.3. Data Processing in the Mobile App
As soon as you use the mobile app or attempt to do so, your end device establishes an online connection to the provider’s server, whereby data is exchanged between the app and the server. Which data this involves in detail is explained below.
You must register on the platform to use all functions of the app, in particular to make binding bookings. In the case of using the smartphone app, registration is carried out by means of a mobile phone number and password, as well as an optional email address. In the case of using the web application, registration is carried out via email address and password, as well as optionally the mobile phone number. Your data collected during registration is transmitted in encrypted form to the server and stored there. Data necessary for logging in, such as first and last name and the user ID in the form of the mobile phone number, is stored on the end device, as is the language chosen by the user. For the intended use of the app, we store and process the following data of the user, which they provide/enter themselves or which is transmitted by the device used:
First and last name
Mobile phone number and/or email address
Password
Language setting
Unique identifier of the device for receiving push notifications
If applicable, profile picture
Booking data
Location of the booking (site)
Booking period (start and end of the booking)
License plate of the driver’s truck tractor
Log entries regarding activities in the app:
Login
Booking of parking and charging spaces
Cancellation of made bookings for parking and charging spaces
Access to locking devices
4.4. Duration of Data Storage
We store your data until you delete your user account. Exceptions and details regarding this can be found under 7. Rights of Data Subjects, section „Delete user account“.
User account: We store your personal data that we process within the scope of your user account (first name, last name, mobile phone number, email, password, language setting, unique identifier of the device for receiving push notifications, and profile picture) until the user account is deleted.
Bookings: Your booking data is stored until the purpose of the data storage no longer applies.
4.5. Contact Form
If you contact us via email or contact form, the details provided by you will be stored for the purpose of processing the inquiry as well as for possible follow-up questions.
The legal basis for the processing of personal data described here is Art. 6 para. 1 lit. f GDPR. Our legitimate interest is to offer you the possibility of quick and easy contact in order to answer your questions and concerns.
5. Recipients of Personal Data
5.1. Disclosure of Personal Data to Service Providers, Art. 28 GDPR
For the provision of the platform, the operator is supported by IT service companies (software development & operations, payment service providers) that are involved with corresponding security requirements within the scope of data processing on behalf pursuant to Art. 28 para. 3 GDPR. The responsibility under data protection law for the processing of personal data remains with the operator of the platform.
The payment service provider based in Europe has a US-based parent company and uses sub-service providers in so-called unsafe third countries. Therefore, in addition to the data processing agreement, the standard contractual clauses of the EU Commission have been implemented. The level of data protection is maintained at the European standard. Further information is available here, directly from the provider.
5.2. Disclosure of Personal Data to Third Parties
The platform operator discloses the names and contact details of the users, as well as their telephone number/email address, to the provider once a booking has been made. In addition, it transmits the UID token and the contract ID of the utilizing freight forwarding company to the provider. The billing of the charging process booked by the user via the sharing platform takes place between the provider, WIRKSTATT, and the user.
The legal basis for the disclosure of personal data by transmission is likewise Art. 6 para. 1 lit. b GDPR, i.e., the processing is necessary for the performance of the contract.
5.3. Data Transfer to Third Countries:
Google Maps Map material from Google Maps is integrated within the platform. Google Maps is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, short „Google“. In order to integrate the service effectively, corresponding program libraries or map content are called up from Google servers. This requires that Google, as the provider of the service, receives your IP address and, if applicable, further address information provided by you. Without the IP address, Google could not send the content back to your browser or smartphone app. The IP address is therefore required for displaying the Google Maps content. In this context, we point out that external servers of Google in the USA may be called up through this use.
The use of Google Maps is for the purpose of an appealing, comfortable design of the platform and serves the purpose of making it easier to find the locations specified in the platform. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR.
You are not obliged to provide personal data; however, use of the affected parts of the platform is not possible without its provision.
The terms of use for Google Maps can be found under Terms of Use for Google Maps. Further details can be read in the Privacy Center of google.de as well as in the Privacy Policy.
Firebase WIRKSTATT uses Firebase, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; short „Google“. Firebase offers the possibility of so-called Dynamic Links and, through the use of Google Analytics for Firebase, enables the analysis of user behavior in order to better understand the use of our app, improve the offer, and analyze the success of advertising measures. Furthermore, we use the Firebase service Firebase Cloud Messaging to send users information via push notifications (see „Push Notifications“).
Through Dynamic Links, it is possible via a single universal link to direct the user to the download page of the respective app store to load the app or to the homepage, depending on their end device.
For the data from the app collected with the Firebase SDKs, an automatic anonymization of IP addresses takes place. Google will use the collected data to evaluate the use of our apps and to provide further services associated with the use of the apps to us. In this context, Firebase records age, country, gender, interests, languages, as well as app store, app version, device-specific information, operating system version, and data on user behavior. The identification of your device takes place, among other things, through the Android Advertising ID or the Advertising Identifier for iOS (IDFA). When using this service, it cannot be ruled out that the collected information is also transmitted to and stored on a server of Google’s parent company in the USA.
For the transfer of data to the USA, we have agreed the standard data protection clauses approved by the EU Commission with Google. Data transfer to Google servers in the USA is therefore based on Art. 46 para. 2 c) GDPR.
Firebase uses the Advertising ID or the Advertising Identifier for iOS to provide you with personalized advertising. You can restrict the use of the Advertising ID or the Advertising Identifier in the device settings of your smartphone. You can find these settings on iOS devices under Settings/Privacy/Tracking or on Android devices under Settings/Google/Ads.
The storage period for the collected data is 14 months.
The legal basis for processing your data is your previously granted consent pursuant to Art. 6 para. 1 lit. a GDPR. Firebase is deactivated when the app is installed and is only activated after consent has been given by the user. You have the option to revoke your consent to the collection of data by Firebase under „Cookies & Tracking“ in the „Info“ menu item.
The privacy policy of Firebase can be found at https://www.firebase.com/terms/privacy-policy.html
Push Notifications Push notifications are messages displayed on the home screen of your smartphone that link into the app. This makes it possible, for example, to display a welcome message when entering a location and to jump directly into the app by clicking or swiping the message. Push notifications are also used to inform you about news within the scope of the service, such as the availability of a new app version, or other interesting offers regarding our services or offers from third parties. In order to transmit push notifications to you, the Google service Firebase Cloud Messaging is used, which accesses existing services of the operating system installed on your smartphone.
As part of the initial launch of the app, a registration is automatically carried out with the push service that supports the operating software and application installed on your end device. Upon your registration with the push service, your device and app data are transmitted to the push service (which may be located in a third country outside the EU/EEA). Your end device is assigned a push reference by the respective operating system manufacturer. This serves as the destination for push notifications and is used to allow push notifications to be displayed on your smartphone.
When starting the app for the first time, you will be asked whether you wish to receive and display push notifications. You will only receive push notifications if you have expressly consented to them.
You can prevent the transmission of push notifications at any time by applying the corresponding device setting.
The legal basis for sending push notifications is your consent declared via authorization pursuant to Art. 6 para. 1 lit. a GDPR.
5.4. Data Security
WIRKSTATT uses current methods and standards for data security. Only strong passwords (at least 8 characters with at least 1 special character) are permitted, and these are generally stored exclusively in encrypted form in the database. In order to ensure the confidentiality of your data also during communication between the app you use and the server, we use so-called state-of-the-art TLS encryption. According to the current state of knowledge, the 256-bit encryption possible with this is to be regarded as secure. All current browsers also achieve this security level. If necessary, you should update the browser on the end devices you use. In order to always guarantee the best possible protection, it is also necessary to always keep your operating system used on the respective end device as well as the mobile app up to date.
6. No Automated Decision-Making
Automated decision-making – profiling pursuant to Art. 22 GDPR – does not take place.
7. Rights of Data Subjects
Data subjects, natural persons, have the following rights regarding the personal data concerning them to the extent permitted by law under the GDPR:
Right of access,
Right to rectification,
Right to erasure/right to be forgotten,
Right to restriction of processing,
Right to object to processing carried out on the basis of Art. 6 para. 1 lit. f GDPR,
Right to revoke a granted consent (the revocation of consent does not affect the lawfulness of processing based on consent before its revocation),
Right to data portability.
Pursuant to Art. 77 GDPR, data subjects have a right to lodge a complaint with a data protection supervisory authority.
Information: Should these data protection notices need to be changed, you will be informed of the corresponding changes within the scope of updates.
Delete user account: If you no longer wish to use the platform, please select the link to delete your user account in your user profile. Please subsequently confirm the warning notice to complete the deletion process. Deleting the user account does not alter any contractual relationship regarding contracts that may exist from a separate legal relationship with one of the provider’s clients mentioned under Section I. Personal data will be deleted if the collection or processing was inadmissible from the start, if the processing or use proves to be inadmissible due to subsequently occurred circumstances, or if knowledge of the data is no longer required by the provider to fulfill the purpose of processing or use.
Excluded from deletion is data that the controller requires to handle outstanding tasks or to enforce its own rights and claims, as well as data that the controller must retain according to statutory, contractual, statutory-charter, or official requirements. Also excluded from deletion is personal data insofar as there is reason to assume that deletion would impair your interests worthy of protection, or if deletion is not possible or only possible with disproportionate effort due to the special nature of storage. In place of erasure, a restriction of processing (blocking) will then apply. Likewise excluded from deletion is anonymized data used by the controller or its contractual partner for statistical purposes.