Privacy policy

This policy describes which personal data we process when you use Parkoni, why we do so and what rights you have. It applies to travellers, to visitors to the website, to car park operators and their staff, and to sales partners.

1 Controller

Cryon UG (haftungsbeschränkt), Landsberger Str. 35, 04157 Leipzig, Germany, represented by the managing director . Email for all data protection questions: support@parkoni.com. Telephone: +49 341 97854900.

We are not obliged to appoint a data protection officer and have not appointed one. Your requests are handled by the management.

2 Who is responsible for which data

  • Parkoni (we) are responsible for the website, the search, the booking process, your customer account, our emails and text messages, payment processing on behalf of the operators, our customer service and our cooperation with the operators.
  • The operator with which you book is your contract partner for the parking service and is itself responsible for carrying out the booking on its premises. It receives your booking data for this purpose. Its contact details are in your booking emails, on your voucher and on your booking page.
  • On behalf of the operator (Art. 28 GDPR) we process data when the operator uses our software for its yard operations (handover records, photos, scans, till) and for bookings that it records itself, on its own website or on site. The operator is responsible for this processing; you can exercise your rights with it or with us.
  • Stripe processes the payments and is itself partly responsible for payment data (see section 6).

3 Visiting the website

Server logs. Each time a page is called up, our server processes your IP address, the date and time, the page requested (without search parameters and with shortened identifiers), the status code, the amount of data transferred and information about your browser. We need this data to deliver the website, find errors and fend off attacks (Art. 6(1)(f) GDPR). The logs containing the IP address are deleted after 30 days.

Country of your connection. To show you approximate amounts in your local currency, we determine from your IP address the country from which you call up the page. For this we use a country database from DB-IP that is kept on our own server: your IP address does not leave the server, and we store neither the address nor the country (Art. 6(1)(f) GDPR).

Protection against misuse. To prevent overload and misuse, we limit the number of requests per connection. For this we store, instead of your IP address, only an encrypted value (hash) for one day at most (Art. 6(1)(f) GDPR). In the search, a great many searches in a short time, searches from data centres and visiting a trap for automated programs lead to a short security check that your browser solves by itself. For this we look up the network of your IP address in a DB-IP database on our own server, without storing it.

Our own statistics without cookies. To know how Parkoni is used, we count page views, searches, views of offers, the booking steps and bookings with our own tool on our own server. For this we store the page called up (without search parameters except campaign details such as utm_source, and without booking references or access codes), the address of the website you came from (without its subpage), campaign details from the link, the country (from your IP address using the DB-IP country database), the device class (phone, tablet or computer), the browser family, the step in the booking process and, for a search, the airport or port searched for and how many days ahead the search is. To count the visitors of a day, we form a value (hash) from your IP address and browser identifier together with a random value that is created anew every day and deleted when the day is over. We do not store your IP address or the full browser identifier. The value changes every day, so nobody, including us, can link visits on different days or trace them back to you. We set no cookies for this and store nothing on your device; consent is therefore not required. We do not count search engines and other programs. The data stays on our server, is not passed on and is deleted after 13 months. The legal basis is Art. 6(1)(f) GDPR (interest in a functioning, improved service). You can object (section 18); as we cannot recognise you, it is also enough to block requests to /api/a/collect in your browser, for example with an ad blocker. We use no advertising and no social media plugins. We load fonts from our own server.

4 Cookies and storage on your device

We set the following cookies without consent because they are strictly necessary for the service you have requested (§ 25 Abs. 2 Nr. 2 TDDDG). We load Google Analytics and Microsoft Clarity only with your consent (below).

  • parkoni_sid: keeps your booking process together after you have chosen "Book"; 6 hours.
  • parkoni_t: keeps you logged in to your customer account; 30 days, only after login.
  • parkoni_p and parkoni_a: login to the partner area of the operators (up to 7 days) and to the Parkoni administration (up to 8 hours).
  • parkoni_c: keeps the login step together with the code that we send by email to operators and Parkoni staff; 10 minutes.
  • parkoni_dt, parkoni_dp and parkoni_da: remember a device on which a login was confirmed with the code sent by email, so that no code is needed there for 30 days; one each for the customer account, the operators' partner area and the Parkoni administration.
  • parkoni_lk: keeps the step together in which you link a further email address to your customer account with a code sent by email; 10 minutes.
  • parkoni_sg and parkoni_as: keep the step together in which an operator signs the partner contract or an annex with a code sent by email; 10 minutes.
  • parkoni_cs: keeps the countersignature of a contract with a code sent by email together; 10 minutes, only for Parkoni staff.
  • parkoni_rebook: remembers a rebooking you have started; 2 hours.
  • parkoni_sp: confirms after the security check in the search that your browser solved it, so you can keep searching without a new check; 30 minutes, only after that check.
  • parkoni_ops_f: remembers the car park chosen in the operators' Staff app; 1 year, only for operators' staff.
  • parkoni_consent: stores your choice in the cookie notice (which categories you allowed, with version and date); 12 months.

Your choice in the cookie notice. On your first visit we ask whether you allow two further categories: statistics (Google Analytics 4) and experience (Microsoft Clarity). Without your consent, neither tool is loaded and no connection to Google or Microsoft is made. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25 Abs. 1 TDDDG). Your choice applies for 12 months, after which we ask again. Via "Cookie settings" at the bottom of every page you can change it at any time and withdraw your consent with effect for the future; we then delete the tools' cookies as far as your browser allows and no longer load them.

Google Analytics 4 (statistics). Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Purpose: understanding how visitors use our pages and how bookings come about. Data: pages called up and times, the origin (website or campaign), device, browser, approximate region, the steps search, view of an offer, start of the booking, payment details chosen and completed booking (with amount and booking reference), and a random identifier in the cookies _ga and _ga_ with an identifier appended (up to 2 years). We do not transmit your name, email address, telephone number or licence plate. Google Analytics 4 does not store IP addresses; Google signals and advertising features are switched off, and Google Consent Mode is set to "denied" without consent. Transfer: Google may transfer data to the USA (section 15). Storage period: Google deletes the data after 14 months. More in Google's privacy policy.

Microsoft Clarity (experience). Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Purpose: recognising where our pages are hard to use or show errors. Clarity records how you use the page (mouse movements, clicks, scrolling, page changes) and creates session recordings and heatmaps from this. Entries in forms are masked, and the pages of the booking process entirely. Data: this usage data, device, browser, approximate region and random identifiers in the cookies _clck (1 year) and _clsk (1 day); Microsoft may set further cookies on its own domains (for example MUID). Transfer: Microsoft may transfer data to the USA (section 15). Storage period: recordings up to 30 days, aggregated evaluations up to 13 months. More in Microsoft's privacy statement.

Payment step. On the page where you pay, the payment service Stripe loads its payment form. Stripe sets its own cookies (for example __stripe_mid, up to 1 year, and __stripe_sid, 30 minutes) to prevent fraud and process the payment securely. They are necessary for the payment. More in the Stripe privacy policy.

Staff app. For offline use, the operators' Staff app stores the day's bookings (name, registration number, times) and a random identifier of the device (parkoni_device), which assigns scans and offline entries to the device, in the device's memory and deletes both on logout.

Map. If we offer a map view, it loads map images from an external service only after you have clicked "Load map"; the service then receives your IP address. We store your click as consent (Art. 6(1)(a) GDPR, § 25 Abs. 1 TDDDG). Without a click, no connection is made.

5 Your booking

Which data. First and last name, email address, telephone number, registration number and type of your vehicle (make and model if you wish), number of people, flight numbers for outbound and return flights (optional), your message to the operator (optional), period, chosen extras, price, payment method and payment status, the language and, if you came through a partner's link, its identifier.

Why. We pass your booking on to the operator, process the payment in its name, send you the confirmation, voucher and information about your booking, enable you to make changes and cancellations and help you in customer service. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). We keep invoices and receipts because the law requires it (Art. 6(1)(c) GDPR). We store the origin of a booking (for example through a partner) in order to settle commissions correctly, and we check bookings for duplicate or abusive entries (Art. 6(1)(f) GDPR).

Mandatory details. Without name, email address, telephone number and registration number the operator cannot provide your booking; these details are therefore required.

Recipients. The operator receives your booking data in order to provide the service; if it uses its own system, the booking is also transmitted there. If you booked through a sales partner, the partner receives the data of its booking. Other recipients are Stripe (section 6) and our service providers (section 14).

Protection. We store telephone number and registration number in encrypted form.

How long. 90 days after the end of your parking period, we remove name, email address, telephone number, registration number, flight numbers, your message and the billing address you entered from the booking; a booking without any personal reference remains for settlement. As long as a card payment can still be reversed (up to 180 days after the end of your parking period), a dispute about the booking is open (at most three years after the parking period) or money is still outstanding (a refund to you or an amount you still owe the car park, at most six months after the parking period), we wait. We keep invoices and receipts bearing your name and your billing address for eight years (§ 147 AO, § 257 HGB, § 14b UStG) and the accounts for ten years.

6 Payment with Stripe

Online payments are processed by Stripe (Stripe Payments Europe, Ltd., Ireland, with affiliated companies). You enter your card details directly in Stripe's payment form; we and the operator do not receive them. Stripe receives the amount, currency, booking number and your email address for the payment receipt. The payment runs through the operator's Stripe account.

Stripe processes payment data to carry out the payment (Art. 6(1)(b) GDPR) and is itself responsible for fraud prevention and for meeting its own legal obligations. Stripe may transfer data to the USA; Stripe is certified under the EU-US Data Privacy Framework and additionally uses the standard contractual clauses of the EU Commission. If you pay with Apple Pay or Google Pay, the privacy terms of these providers also apply. More in the Stripe privacy policy.

7 Emails and text messages

We send you emails about your booking: confirmation with voucher, reminder, changes, cancellation and refund. We do not send advertising. Our emails contain no tracking pixels. We send them through our email provider IONOS and, only if sending there is disrupted, through Postmark (sections 14 and 15). If an address cannot be delivered to or an email is reported as spam, we block the address for further emails until it is released again. The legal basis is Art. 6(1)(f) GDPR (protection of the mail server and of travellers against misdelivery).

If you choose this when booking, we also send you a text message with the link to your voucher three hours before your arrival. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by email to support@parkoni.com. For sending, our text message provider receives your telephone number and the text of the message.

We store the content of messages to operators for 90 days; the proof that and when a message was sent, for as long as the booking (Art. 6(1)(f) GDPR, proof of delivery).

8 Flight data

If you give your return flight number, we can inform the operator of delays so that it can adjust the collection. For this we query the status of the flight from a flight data provider. We transmit only the flight number and date, no information about you personally.

9 Customer account

An account is optional. You log in with your email address and a password. We store the password only as an irreversible hash value; nobody at Parkoni can read it. We store your email address, your name, your telephone number, your bookings and the active logins (without IP address). The legal basis is Art. 6(1)(b) GDPR. We keep your account until you request deletion; bookings in it are anonymised after the periods in section 5.

10 At the car park

When your vehicle is handed over and returned, the operator's staff can use our Staff app to scan your voucher, take photos of the condition of the vehicle, record the mileage, fuel level and key storage, and capture your signature. We process this data on behalf of the operator, who is responsible for it; it serves as evidence in the event of damage. Photos and signatures are deleted after 365 days, unless damage or a payment is still disputed (then at most three years after the parking period).

11 Customer service and reports

When you write to us, we process your details in order to answer your request (Art. 6(1)(b) or (f) GDPR) and pass them on to the operator if it is responsible for the answer. If you report unlawful content to us, we process your report and your contact details in order to examine it and to tell you the decision (Art. 6(1)(c) GDPR in conjunction with Art. 16 DSA). We keep business correspondence for up to six years (§ 257 HGB). If you use our contact form, we receive your name, your email address, the topic, the booking reference if you give one and your message, send them to our support mailbox and also keep them in our administration for 180 days; the check against automated requests runs in your browser, without cookies and without third parties.

12 Operators, their staff and sales partners

Cooperation. From operators and sales partners we process the data of the business and its contact persons (name, position, email, telephone, address, VAT identification number, bank details via Stripe), the contract data, statements and communication, in order to conclude and perform the contract (Art. 6(1)(b) GDPR) and to meet legal obligations, for example for invoices, taxes and platform reporting duties (Art. 6(1)(c) GDPR). We check VAT identification numbers through the EU Commission's VAT Information Exchange System (VIES).

Contract signing and evidence. If an operator signs the partner contract online, we store as evidence the name and position entered, the email address, date and time, the IP address, the browser and a checksum of the contract text (Art. 6(1)(b) and (f) GDPR). Proof of business activity (for example a trade registration) that an operator uploads is checked by us before the car park goes live. The operator sets up its Stripe account directly with Stripe; Stripe carries out the identity check as an independent controller.

Operators' staff. For staff members whom the operator invites, we store name, email address, telephone number, rights, devices and logins, and who carried out which steps in the Staff app (Art. 6(1)(b) and (f) GDPR). The operator is responsible for the data of its staff in its business.

Storage period. For the duration of the cooperation and afterwards until the statutory retention periods (up to ten years) and the limitation periods for claims under the contract have expired. By way of exception: an application whose email address was never confirmed is closed after 14 days, and 30 days later we remove the names, email addresses and telephone numbers of the persons. 90 days after the end of the cooperation we delete the accounts of the operator and its staff (name, telephone, devices, login) and replace their names in notes and logs; the signed contract and the statements remain. We delete a rejected document 30 days after the rejection, a replaced one after one day.

13 Approaching operators and car parks not yet available

We also present car parks at airports and ports when their operator does not yet work with us, and we invite the operators to offer their car parks on Parkoni. The following applies to operators and their contact persons (Art. 14 GDPR):

  • Data: name and address of the business, business contact details (email, telephone, website), the details of the car park (location, description, photos) and the number of travellers who wish to book there.
  • Sources: the operator's website and legal notice, public registers (for example the EU's VAT Information Exchange System) and public directories and platforms on which the operator presents itself.
  • Purpose and legal basis: we show the car park as "not yet available on Parkoni" and invite the operator by email, letter or telephone to offer it. The legal basis is our legitimate interest in a complete overview for travellers and in winning new partners (Art. 6(1)(f) GDPR).
  • Recipients: a separate email delivery service through which we send the invitations (separate from the emails about bookings); the details of the car park are publicly visible.
  • Objection: you can object at any time, using the unsubscribe link in every invitation or by email to support@parkoni.com. We will then no longer approach you and will note this. On request we remove your car park from Parkoni entirely.
  • Storage period: for as long as we show the car park and keep the invitation open; after an objection, only the name of the business, the email address and the note not to approach you there. We then delete notes on calls and a telephone number we took from public sources.

14 Service providers

We use carefully selected service providers who process data only on our instructions (Art. 28 GDPR):

  • Hetzner Online GmbH, Gunzenhausen, Germany: servers, storage and backups (Storage Box) in data centres in Germany.
  • IONOS SE, Montabaur, Germany: sending our emails and our mailboxes, for example support@parkoni.com and info@parkoni.com.
  • Postmark (ActiveCampaign, LLC, Chicago, USA): fallback for sending our emails about bookings and accounts, only if sending through IONOS is disrupted; without open and click tracking.
  • seven.io, Kiel, Germany: sending text messages, only for text message reminders.
  • AeroDataBox (via API.Market): flight status, only flight number and date, without personal reference.
  • Sentry (Functional Software, Inc., USA; data stored in the EU): error reports from the software, from which we remove personal details beforehand.

We use text messages, flight data, error reports and Postmark only if the function concerned is switched on. The legal basis for error reports and backups is Art. 6(1)(f) GDPR (interest in stable and secure operation). Stripe is described in section 6. The DB-IP country database (section 3) is kept on our own server; DB-IP receives no data.

15 Transfers to third countries

In principle, we process your data in the European Union. A transfer to the USA is possible for Stripe, Sentry and Postmark, and with your consent also for Google and Microsoft (section 4). All these companies are certified under the EU-US Data Privacy Framework, for which the EU Commission has found an adequate level of protection (Art. 45 GDPR); standard contractual clauses also apply (Art. 46 GDPR).

16 Security

We transmit all data in encrypted form (TLS), store telephone numbers, registration numbers and access secrets in encrypted form, grant access rights only as needed, require two-step login for operators and administrators, log changes and back up the data daily. Deleted data remains in the database backups and in the backup copy of our files (photos, signatures, documents, data exports) for at most eight more days and is then deleted for good.

17 No automated decisions

We take no decisions that produce legal effects concerning you or similarly significantly affect you solely by automated means (Art. 22 GDPR). The order of the search results rates offers, not people.

18 Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and withdrawal of consent with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): If we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. You can object at any time, without giving reasons, to processing for direct marketing, including the approach to operators under section 13.

How to exercise your rights: Through the "Manage booking" link you can request a copy of your data and ask for deletion. You can also write to us at support@parkoni.com. We reply within one month. Data that we must keep (for example invoices) is blocked rather than deleted.

Complaint: You can lodge a complaint with any data protection supervisory authority, in particular in the country where you live or work. A list of all authorities in the EU is available from the European Data Protection Board. The authority responsible for us is the Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner), Maternistraße 17, 01067 Dresden, datenschutz.sachsen.de.

19 Changes

We amend this policy when our services or the legal situation change. The current version is always on this page, with the date of the last change.