Privacy Statement
The protection of your personal data is important to us. In general, our websites can be used without providing any personal data. However, if you wish to use specific services offered by our company via our website or app, the processing of personal data may be required. Where no legal basis exists for such processing, for example the performance of a contractual agreement, we will ask for your consent.
This Privacy Statement explains which of your personal data we process on our website and in our app, the purposes for which this data is processed, and the rights to which you are entitled in connection with the processing of your personal data, such as your right to object.
Our Privacy Statement has a modular structure. It consists of a general section (A. General Information), which contains information that generally applies to the processing of personal data when using our digital services, and specific sections relating to the respective processing activity or service described therein, in particular visits to our websites (B. Visiting Our Websites) and the use of our app (C. Use of the Flinkster App). Finally, we provide information about your rights as a data subject under the GDPR (D. Your Data Subject Rights).
Structure of the Privacy Statement
A. General Information
B. Visiting Our Websites
C. Use of the Flinkster App
D. Your Data Subject Rights
A. General Information
Who is responsible for the processing of your personal data?
The controller responsible for the processing of personal data within the meaning of Article 4 (7) GDPR is:
Deutsche Bahn Connect GmbH (DB Connect) Mainzer Landstraße 169 60327 Frankfurt am Main Germany
The role of the Data Protection Officer for Deutsche Bahn Connect GmbH is fulfilled by the Group Data Protection Officer of Deutsche Bahn Group. If you have any questions or suggestions regarding data protection, please contact us by email at dbconnect-datenschutz@deutschebahn.com or konzerndatenschutz@deutschebahn.com, or by postal mail at the above address.
Joint Controllership
For the processing of your personal data for the purposes of fraud prevention and compliance with legal obligations, in particular the validation of driving authorisation and driver’s licence checks, Deutsche Bahn Connect GmbH and Digital Mobility Solutions GmbH, Römerstraße 41–43, 52064 Aachen, Germany, hereinafter referred to as “MOQO”, act as joint controllers pursuant to Article 26 GDPR.
The essential terms of the agreement pursuant to Article 26 GDPR between Deutsche Bahn Connect GmbH, Mainzer Landstraße 169, 60327 Frankfurt am Main, Germany, and MOQO are set out below:
• Deutsche Bahn Connect GmbH is responsible for the following processing activities and processes:
Defining the functional requirements for the mobility solution and the processing activities required within its area of responsibility.
Collecting the personal data referred to above from the relevant categories of data subjects and transmitting such data to MOQO.
Providing the data protection information within its own area of responsibility and information on the essential terms of the joint controllership agreement pursuant to Article 26 (2), sentence 2 GDPR.
Supporting the handling of data subject requests where the personal data or processing activities concerned fall within Deutsche Bahn Connect GmbH’s area of responsibility, in particular with regard to Article 16 GDPR.
• MOQO is responsible for the following processing activities and processes:
Operating and providing the mobility platform, including the technical processing of personal data.
Storing, maintaining, updating, where corresponding information is entered by the data subject, and deleting personal data within the systems operated by MOQO, and matching the personal data referred to above against existing user profiles.
Handling and forwarding data subject requests to the controller responsible in each case, and assuming primary responsibility for ensuring the rights of data subjects pursuant to Articles 20 and 21 GDPR.
Liaising with supervisory authorities insofar as this concerns the systems and processing activities operated by MOQO.
•The following processes and processing activities are subject to joint responsibility:
Determining the purposes and means of processing personal data.
Fulfilling the information obligations pursuant to Article 13 GDPR.
Creating and updating user profiles.
Ensuring data subject rights pursuant to Articles 15, 17, 18 and 19 GDPR.
The controllers have also contractually undertaken to ensure compliance with the applicable statutory provisions within their respective areas of responsibility and influence, in particular the lawfulness of the processing activities carried out within the scope of joint controllership.
In particular, each controller shall, within its respective area of responsibility and influence:
Ensure that only personal data strictly necessary for the lawful operation of the mobility solution is collected.
Ensure that its personnel maintain the confidentiality of personal data in accordance with Articles 28 (3), 29 and 32 GDPR, are bound by appropriate confidentiality obligations and are instructed in the data protection provisions relevant to them.
Implement, regularly review and keep up to date with the current state of the art the necessary technical and organisational security measures pursuant to Article 32 GDPR.
Include the processing activities subject to joint controllership in its records of processing activities pursuant to Article 30 (1) GDPR.
Properly retain documentation pursuant to Article 5 (2) GDPR that serves to demonstrate proper data processing within the framework of the accountability obligation.
MOQO acts as the central point of contact for all matters and questions relating to the joint processing described above and for the exercise of your data subject rights in this context. If you have any questions, please contact support@moqo.de.
Legal Basis for Data Processing
We collect and process your personal data exclusively for specified purposes. These purposes may arise from technical requirements, contractual obligations or explicit user requests. Where we obtain your consent for the processing of personal data, for example when you subscribe to a newsletter, such consent serves as the legal basis pursuant to Article 6 (1) (a) GDPR.
Where the processing of personal data is necessary for the performance of a contract with you, the legal basis is Article 6 (1) (b) GDPR. Article 6 (1) (b) GDPR also applies to processing operations required for the implementation of pre-contractual measures, for example in connection with enquiries regarding our products or services. If our company is subject to a legal obligation requiring the processing of personal data, for example to comply with tax law obligations, such processing is based on Article 6 (1) (c) GDPR.
For the purpose of analysing and improving our online services, we process usage data. Depending on the nature of the respective procedure, the processing is carried out either on the basis of your consent or, where legally permissible, on the basis of our legitimate interests pursuant to Article 6 (1) (f) GDPR.
We also have a legitimate interest in maintaining our customer relationship with you and in providing you with information and offers that we believe may be relevant to your travel preferences and interests. We therefore process your personal data on the basis of Article 6 (1) (f) GDPR, including with the support of service providers, in order to send you information and offers. We use your contact details, namely your first name, surname and postal address, for advertising by post and for market research unless you object to such use. The email address obtained from you in the context of a business relationship may also be used for marketing purposes. You may object to such marketing use of your personal data at any time with effect for the future by sending an email to support@flinkster.de.
Where processing activities are subject to specific statutory provisions, for example in the area of electronic direct marketing, such as newsletters sent to existing customers, the lawfulness of the processing is governed by those specific statutory provisions. For each processing activity described below, we indicate the applicable legal basis. In individual cases, the processing of personal data may be based on more than one legal basis.
How long will your personal data be stored?
We store your personal data only for as long as is necessary to fulfil the purpose for which it was collected, for example in connection with a contractual relationship, or where retention is provided for by law. In the context of a contractual relationship, we generally retain your personal data until the contract has been fully terminated. Following termination of the contractual relationship, we retain your personal data only to the extent and for as long as necessary to comply with statutory retention obligations or for the establishment, exercise or defence of legal claims. Your personal data will then be deleted.
Is your personal data shared with third parties?
To provide our contractual services, it is generally necessary to engage processors, such as data centre operators, printing and mailing service providers, or other parties involved in the performance of the contract who process personal data on our behalf. These service providers are carefully selected, contractually bound by comprehensive obligations and process personal data solely in accordance with our instructions.
Apart from this, your personal data will only be transferred to other recipients where a legal basis exists for such transfer, where you have given your consent, or where the transfer is necessary for the performance or administration of a contractual relationship.
Where personal data is transferred to recipients in countries outside the European Union (EU) or the European Economic Area (EEA), such transfers will take place only in compliance with the statutory requirements of Articles 44 et seq. GDPR. Appropriate safeguards may include, in particular, adequacy decisions issued by the European Commission or the Standard Contractual Clauses adopted by the European Commission.
Personal data may be disclosed to third parties in particular in the following cases:
Driver’s licence validation service provider
To verify the validity of your driver’s licence, the personal data required for this purpose, namely registration data and photographic evidence comprising images of both sides of your driver’s licence, both sides of your identity card and facial photographs (“selfies”) for authentication, is transmitted to the service provider engaged by us to record and perform the initial verification of the driver’s licence. The detailed manual review is carried out by DB Connect. Further information is provided in the “Driver’s Licence Validation” section.Debt collection service providers
In the event of payment irregularities or default, personal data required for the recovery of outstanding amounts may be disclosed to a debt collection agency where this is necessary to pursue our legitimate interests in enforcing outstanding claims.Payment by credit card
If you choose to pay by credit card, the data you enter will be transmitted directly to the systems of our payment service provider.Payment by direct debit
If you choose to pay by direct debit, the data required to verify and process the payment will be disclosed to the payment service providers engaged by us.Newsletter service providers
We use a newsletter service provider to send newsletters and other marketing communications to customers. For this purpose, the personal data required for sending such communications, in particular your email address and information relating to your consent, is transmitted to and processed by the service provider. The service provider supports us solely with the technical distribution of newsletters.Market research and customer satisfaction surveys
Where you have consented to receive such surveys or the statutory requirements are met, we may transmit your contact details, in particular your name and email address, to market and opinion research institutes engaged by us. These institutes conduct surveys on our behalf and support us in evaluating and developing the quality of our products and services in a customer-oriented manner.Hosting and technical service providers
External IT and hosting service providers whose servers are located within the EU, for example in Frankfurt am Main, are used to operate the mobility platform and send technical notifications. In connection with the provision of the platform, technical usage data in particular may be processed.Customer service and support providers
External customer service and support providers may be used to handle customer enquiries and provide support services. In this context, contact, booking and case-related data in particular may be processed where this is necessary to handle the respective request. A list containing the names of recipients of personal data may be requested at any time by contacting dbconnect-datenschutz@deutschebahn.com.
Data Processing in General
Regardless of whether you use our websites or our app, the processing of personal data is required in the following cases:
a) Registration
When you register for Flinkster, a customer account will be created. We process the personal data collected during registration for the purpose of setting up and managing your customer account and for the performance and administration of the respective user relationship.
In addition to the mandatory information required for registration and use of the service, you may provide further information on a voluntary basis. The provision of voluntary information is not required for registration or use of the service.
Mandatory information:
Master data, including title, first name, surname, date of birth and place of birth.
Address data, including street, house number, postcode, town or city and country.
Contact details, in particular your email address.
Payment details, for example credit card or bank account details.
Driver’s licence details, in particular driver’s licence number and licence category.
Depending on the selected tariff or service, additional data may be collected to verify the applicable eligibility requirements, for example your BahnCard number. If you choose to pay by credit card, the card security code will be requested to authorise each payment transaction. This information is not stored.
We also process your booking and usage data for the performance, billing and documentation of vehicle rentals and to provide the contractually agreed services. The legal basis for this processing is Article 6 (1) (b) GDPR.
b) Driver’s Licence Validation
Use of Flinkster requires prior verification of the validity of your driving authorisation. A driver’s licence validation is carried out for this purpose. As part of this process, driver’s licence data, identity data and other information required to verify your authorisation to drive may be processed. Where required for identity verification, an official identity document may also be checked. The specific data is collected during the validation process by the service provider engaged by us. Following successful verification, we receive the information required to verify your eligibility, in particular your first name, surname, driver’s licence number and verification status. The processing is carried out to verify your eligibility to use the service and to perform the user agreement. The legal basis is Article 6 (1) (b) GDPR and, where applicable, Article 6 (1) (c) GDPR. Information on any required subsequent validation of your driver’s licence is provided in the General Terms and Conditions.
c) Creditworthiness Check
Renting a vehicle requires certain identity and address details and sufficient creditworthiness. To assess your creditworthiness, we transmit the personal data required for this purpose, in particular your name, address and date of birth, to a credit reference agency engaged by us. As part of the creditworthiness check, we receive information about the likelihood of a payment default or the creditworthiness of the person concerned. The results are used solely to decide whether to establish and perform the contractual relationship. The legal basis is Article 6 (1) (b) GDPR and our legitimate interest in preventing payment defaults pursuant to Article 6 (1) (f) GDPR. Further information on the processing of personal data by the credit reference agency is available in the information provided by Experian pursuant to Article 14 GDPR (PDF).
d) Booking and Use of Flinkster
When you book and use a vehicle through Flinkster, we process the usage and journey data required for the performance and administration of the rental relationship. This includes in particular:
Duration of vehicle use.
Distance travelled.
Starting location of the journey.
Return location of the journey.
The starting and return locations are recorded using the vehicle’s location data. As a general rule, the vehicle is not tracked during an ongoing journey. The processing is carried out for the performance, billing and documentation of the respective rental relationship.
The legal basis is Article 6 (1) (b) GDPR.
Newsletter
If you subscribe to one of our newsletters when registering, we process the personal data collected during your registration for this purpose. This data is processed in order to send you the newsletter. By subscribing to our newsletter, you consent to the processing of your personal data. The legal basis is Article 6 (1) (a) GDPR.
We use a specialised service provider to send the newsletter. The personal data required for distribution is transmitted to and processed by the service provider on our behalf.
You may withdraw your consent to receive the newsletter at any time with effect for the future. You can unsubscribe at any time using the relevant settings in the “My Profile” section of the app or the unsubscribe link contained in the newsletter.
Specific statutory provisions may apply to electronic marketing communications in certain cases, for example advertising sent to existing customers, in particular Section 7 (3) of the German Act Against Unfair Competition (UWG). You may object to such use of your personal data at any time with effect for the future.
Analysis and Market Research
We process selected customer, booking and usage data for analysis and market research purposes. This includes in particular information about your bookings and use of vehicles, registration data, information about existing customer characteristics, for example whether you hold a BahnCard, and information provided by you, where applicable.
The processing is carried out in order to better understand the use of our services, develop our service offering and tailor our products and services to users’ needs. We also process usage data to analyse and improve our online services. Depending on the nature of the procedure used, the processing is carried out either on the basis of your consent or, where legally permissible, on the basis of our legitimate interests pursuant to Article 6 (1) (f) GDPR. The legal basis for analysis and market research measures is Article 6 (1) (f) GDPR. Our legitimate interest lies in developing our products, services and sales offerings in line with users’ needs.
You may object to the processing of your personal data for analysis, market research or direct marketing purposes at any time with effect for the future by sending an email to support@flinkster.de.
Encryption When Contacting Us
Data and emails transmitted via the Internet are often not encrypted and may therefore not be protected against unauthorised access. We consequently recommend using a secure method of transmission or postal mail when sending particularly sensitive or confidential information.
Use of the Flinkster Chatbot
Our website includes the virtual assistant “Flinkster Chatbot”. The Chatbot serves as an information channel for enquiries relating to Flinkster car sharing. It enables you to communicate easily, obtain information and receive prompt responses to your questions. The Flinkster Chatbot automatically answers a wide range of enquiries on the basis of a knowledge base containing answers to frequently asked questions (FAQs). It may also provide further suggestions and guidance during the conversation or refer you to another customer service channel, such as email.
The Flinkster Chatbot cannot answer complex or individual customer enquiries. Such matters continue to be handled personally by telephone or email. Providing personal data is therefore neither required nor requested when using the Chatbot.
We process your chat history solely to handle your request and for internal purposes, for example to improve the Chatbot, optimise the recognition and accuracy of responses and provide users with convenient automated assistance. In this way, the content and functionality of the Chatbot are continuously developed.
We use technical service providers to provide the Chatbot and handle support requests. This may require the service provider to process information entered by you when using the Chatbot or submitting a support request.
The legal basis for the processing is Article 6 (1) (f) GDPR. Our legitimate interest lies in providing an efficient, user-friendly digital service tailored to users’ needs and in continuously improving and optimising our digital services.
Your chat history, the time of use, namely the date and time of access, and information about the operating system used are stored for a maximum of 30 days and then deleted.
Links to External Websites
Our website may contain links to third-party websites. If you follow a link to an external website, you will leave the services provided by Deutsche Bahn Connect GmbH.
The respective operators of the linked websites are solely responsible for the content, products and services offered on those websites. Please note that these websites are subject to their own privacy policies and may apply different security standards over which we have no control.
B. Visiting Our Websites
We appreciate your visit to our websites:
When you visit our websites, certain information is processed for technical reasons. This processing is required to provide the website content and to ensure the security and stability of our systems.
The following data in particular may be processed:
Date and time of access.
Webpages and content accessed.
Information about the browser and operating system used.
The previously visited website (referrer URL).
IP address of the device accessing the website.
This data is processed solely for the technical provision and secure use of the websites, for error analysis and to ensure system security. The legal basis is Article 6 (1) (f) GDPR. Our legitimate interest lies in the secure, stable and functional provision of our online services.
Use of Embedded Third-Party Content: YouTube and MOQO (Google Maps)
Some of our websites include embedded videos from YouTube, a service provided by Google. If you play such a video, information is transmitted to YouTube’s servers. This may include, in particular, your IP address, browser type, the date and time of access and other technical information.
Videos are played only on the basis of your consent, which may be withdrawn at any time, pursuant to Article 6 (1) (a) GDPR. Before the respective video is loaded, you must actively consent to the processing of your personal data using the confirmation field in the consent layer. The player will be displayed and data will be transmitted only after you have given your consent.
To display maps, location information and vehicle availability, we also use a service provided by our partner MOQO through which Google Maps content is embedded. When you display a map, information may be transmitted to Google servers. This may include, in particular, your IP address, browser type, the date and time of access and other technical information.
The content is embedded indirectly through our service provider MOQO. We have no influence over any further processing by Google. The map function is used on the basis of our legitimate interest in providing a user-friendly display of location information on our website pursuant to Article 6 (1) (f) GDPR.
Further information about Google’s processing of personal data is available in Google’s Privacy Policy at https://policies.google.com/privacy.
Encryption
Data transmitted via our website is protected using SSL encryption. When SSL encryption is enabled, data transmitted between your device and our systems cannot be read by third parties. You can recognise an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the padlock symbol displayed in your browser.
Use of Cookies
Cookies are small text files stored on your device that may contain certain information. When a website is accessed, cookies may be transmitted to the website and thereby enable a user to be recognised. They help enable the use of websites, make them more user-friendly and provide certain functions.
We distinguish between:
Strictly necessary cookies, which are required to operate and provide the website.
Non-essential cookies, which are used, for example, for analysis, statistics or marketing purposes.
In general, our websites can also be used without non-essential cookies. Where such cookies are used, this takes place only on the basis of your consent, where consent is required by law.
Further information about the cookies used and about your options for selecting and withdrawing consent is provided in the respective cookie settings on the website.
Portal.flinkster.de
Information about the cookies used on the customer portal is available in the cookie information provided in the Flinkster portal.
C. Use of the Flinkster App
Downloading the App
When you download the app from an app store, namely the Apple App Store or Google Play Store, the information required to download and provide the app is transmitted to the respective app store operator.
This may include in particular:
Your user name.
Your email address.
Customer number.
Time of download.
Payment information.
Unique device identifier.
We have no influence over the collection and processing of this data by the respective app store operator. The respective operator of the app store is solely responsible for this processing. The privacy policy of the respective provider applies.
Processing of Personal Data When Using the App
To provide the functions of the Flinkster app and perform the user relationship, we process the personal data required for this purpose. This includes in particular:
Mobile telephone number.
Customer number.
Login details.
Other data required to use the app and the car sharing services offered.
The processing is carried out to authenticate users, provide the app functions and perform and administer the contractual relationship. The legal basis is Article 6 (1) (b) GDPR.
Technical Usage Data
When you use the app, certain information may be processed for technical reasons, in particular:
IP address of the device.
Technical log data.
Information about the operating system and app version used.
Information about technical errors and app crashes.
This data is processed to ensure the security, stability and functionality of the app, to analyse errors and to technically optimise our services. The legal basis is Article 6 (1) (f) GDPR. Our legitimate interest lies in the secure and reliable provision of the app and the continuous improvement of its functionality.
Core Functions
The Flinkster app provides various functions for searching for, booking and using vehicles. Depending on the function used, the app may access certain device settings or permissions. Access takes place only where this is necessary for the respective function or where you have granted the relevant permission.
Location Data and Vehicle Search
If you enable the location function on your device, location data may be used to display available vehicles in your vicinity and to navigate to a booked vehicle.
Location data from your device is processed only to the extent necessary for the function you use. Alternatively, you can search for available vehicles by entering a place or address.
The location data is processed to provide the functions and services used by you. The legal basis is Article 6 (1) (b) GDPR.
Vehicle Booking
When you book a vehicle, we process the data required to perform and bill the booking. This includes in particular:
Vehicle details, for example vehicle type and registration number.
Station information.
Booking period.
Duration of use.
Billing-related information.
The processing is carried out for the performance and administration of the rental relationship. The legal basis is Article 6 (1) (b) GDPR.
Opening a Vehicle via Bluetooth
For appropriately equipped vehicles, the vehicle can be opened via a Bluetooth connection. This requires the Bluetooth function on your device to be enabled.
The Bluetooth connection is used solely for technical communication between the device and the vehicle in order to carry out the opening process.
The legal basis is Article 6 (1) (b) GDPR.
My Profile
In the “My Profile” section, you can view and update the master data you have provided and access and download your invoices.
My Station
You can save a preferred station as a favourite. This provides you with a quick overview of the vehicles currently available at that station.
D. Your Data Subject Rights
Subject to the applicable statutory requirements, you have the following rights in particular as a data subject:
You may request information as to whether and which personal data we process about you (Article 15 GDPR).
You may request the rectification of inaccurate personal data or the completion of incomplete personal data (Article 16 GDPR).
You may request the deletion of your personal data where the statutory requirements are met (Article 17 GDPR).
You may request restriction of the processing of your personal data where the statutory requirements are met (Article 18 GDPR).
You have the right to receive personal data that you have provided to us on the basis of consent or a contract in a structured, commonly used and machine-readable format or to have such data transmitted to another controller (Article 20 GDPR).
You have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data where the processing is based on Article 6 (1) (e) or (f) GDPR. Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time (Article 21 GDPR).
Where processing is based on your consent, you may withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The supervisory authority responsible for Deutsche Bahn Connect GmbH is: The Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.
To exercise your rights, you may contact us at any time using the contact details provided in Section A.
No Automated Decision-Making, Including Profiling
No decision-making based solely on automated processing, including profiling, within the meaning of Article 22 GDPR takes place.
Legal Obligation to Transmit Certain Data to Third Parties
In individual cases, legal obligations may require us to transmit personal data to public authorities or other authorised third parties. The legal basis for this is Article 6 (1) (c) GDPR.
Updates to this Privacy Statement
We update this Privacy Statement when our services or functions change or where this is required due to changes in legal requirements. The version published at the time of your visit applies. We therefore recommend that you review this Privacy Statement regularly.
Precedence of the German-Language Version
For ease of understanding, this Privacy Statement is provided in German and English. In the event of any discrepancy, conflict or difference in interpretation between the language versions, the German-language version shall prevail.
Version: Oktober 2026