Privacy Policy

Last updated: 12 July 2026.

1. Controller

The controller responsible for data processing on this website is:
Skynet Worldwide Express Germany GmbH
Behringstraße 10, 82152 Planegg, Germany
Managing Directors: Bastian Weber, Stefan Weber
Phone: +49 (0)89 7455750 · Email: info@skynetworldwide.de

2. Data Protection Officer

We are not legally required to appoint a Data Protection Officer and have not appointed one. If you have any questions about how we process your personal data, please contact us using the details in section 1.

3. Hosting, infrastructure & server log files

When you visit this website, our hosting provider automatically records technical data in server log files: your IP address, browser type and version, operating system, the page requested, the referring page, and the date and time of access. This is necessary to operate, deliver and secure the website and is processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR). Log data is stored only as long as needed for these purposes.

This website is hosted for us by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA, which acts as our processor. Static content is delivered from Vercel's global edge network (visitors in Europe are served from European edge locations), and the website's dynamic functions and our database run in the Frankfurt (Germany) region, within the EU. Because Vercel is a US company, limited data (in particular the server log data described above, and administrative or support access) may be transferred to or accessed from the USA; such transfers are safeguarded by the EU Standard Contractual Clauses concluded with Vercel.

To keep the website reliable, we use an error-monitoring service, Sentry, operated by Functional Software, Inc. (USA), acting as our processor. When a technical fault occurs, limited diagnostic data about the error — such as the error itself, the page or request concerned and the browser and device type — is transmitted to Sentry so that we can detect and fix it. We have configured the service to minimise personal data and not to attach identifiers such as your IP address by default. This is based on our legitimate interest in a secure, reliable website (Art. 6(1)(f) GDPR); any transfer to the USA is safeguarded by the EU Standard Contractual Clauses.

4. Fonts

Fonts on this site are self-hosted and served from our own hosting. No data is transmitted to Google or other third parties in order to display fonts.

5. Customer portal & account data

We operate a customer portal in which registered business customers can manage their account, book shipments and store shipping information. Accounts are created by us — there is no public sign-up. When you use the portal, we process:

• your account details (name, company, email address and role);
• your password, which is never stored in readable form — it is kept only as a salted Argon2id hash;
• billing details you choose to enter (VAT/tax ID, invoicing contact and billing address);
• saved address-book entries and the details of shipments you create (sender and recipient name, company, address, contact details and, where applicable, tax ID, plus package and service information); and
• where a shipping API key is stored for your account, it is held encrypted at rest (AES-256) and is only ever used server-side.

This data is processed to provide the portal and perform our contract with you (Art. 6(1)(b) GDPR) and to keep the service secure (Art. 6(1)(f) GDPR). It is stored in a managed PostgreSQL database provided by Neon on servers located in Frankfurt, Germany (EU). Neon acts as our processor; as the provider is a US company, support access from outside the EU is safeguarded by EU Standard Contractual Clauses. How long we keep each kind of record is set out further down in this section.

When you book a shipment in the portal, we transmit the shipment data to our shipping platform provider PostShipping, whose interface creates the shipment and produces the shipping label. This includes the full address details of both sender and recipient — name, company, street, city, state or province, postcode, country, phone number and, where given, email address — as well as the shipment details themselves (piece count, dimensions, weights, goods description, reference and, for customs shipments, customs value and incoterm). This also covers recipients who have never visited this website; we receive their data from you as the booking customer (Art. 14 GDPR). Without this transmission no shipment can be created and no label produced. PostShipping acts as our processor for this purpose; the legal basis is performance of our contract with you (Art. 6(1)(b) GDPR).

The portal also sends transactional emails — such as password-reset and email-verification links — through our email delivery provider, Resend (USA), acting as our processor under EU Standard Contractual Clauses. These emails are sent only in response to an action you take and contain no marketing.

To help you complete address forms in the portal, when you enter a postcode we send that postcode and its country code — with no name, street or other identifier — to a postal-reference service to suggest the matching town: Zippopotam.us and, where enabled, GeoNames (both operated in the USA). This is used solely to look up public postal reference data.

The portal login is protected against automated attacks by Cloudflare Turnstile, a bot-detection service provided by Cloudflare, Inc. (USA), acting as our processor. When you sign in, Turnstile processes technical information about your interaction with the login page — including your IP address and browser signals — to tell human users apart from bots. It is designed to be privacy-preserving and is not used for advertising or cross-site tracking. This is based on our legitimate interest in protecting accounts and the login form against abuse (Art. 6(1)(f) GDPR); any transfer to the USA is safeguarded by the EU Standard Contractual Clauses.

To prevent abuse, we limit how often a single IP address can use certain functions — signing in, resetting a password, tracking a shipment, looking up a postcode, and the contact and newsletter forms. To do this we store the IP address together with a counter in our own database (Neon, Frankfurt) for a short time. These entries expire after 60 seconds to 15 minutes depending on the function, and are deleted automatically every day. They are used solely to prevent abuse and are not combined with your browsing behaviour. The legal basis is our legitimate interest in a secure, available service (Art. 6(1)(f) GDPR). In the same way we briefly store two further technical protection entries: when a shipment is booked, a random request identifier (up to 24 hours) so that a booking submitted twice is not carried out twice; and when a pickup is requested, a non-reversible check value derived from the date and pickup address (around two days) so that two drivers are not dispatched for the same day by mistake. Neither entry contains a readable address, and both are covered by the same automatic deletion.

We retain account and address-book data for as long as your account is active. Shipment and invoicing records are kept for the retention periods required by German commercial and tax law (generally up to ten years) and are deleted thereafter. You can request erasure at any time; where a legal retention obligation applies, the data is restricted from further processing until the period expires and then deleted.

6. Shipment tracking

If you enter a tracking number, it is transmitted to our shipping platform provider, PostShipping, in order to retrieve and display the status of your shipment. The data processed is the tracking number you enter and the shipment status and event information returned. PostShipping acts as our processor for this purpose. This processing is carried out to perform our services and on the basis of Art. 6(1)(b) and (f) GDPR; the tracking number you enter here is not used for any other purpose. What else we transmit to PostShipping when you book a shipment in the customer portal is set out in section 5.

7. Contacting us

If you contact us — by email, by telephone, or by sending us an enquiry via the website — we process the details you provide (such as your name, email address, phone number, shipment details and your message) in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual and contractual measures) and, where applicable, our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). If you use the form on the website, your message is delivered to our team as an email — technically via our email service provider Resend (USA), which acts as our processor on the basis of the EU Standard Contractual Clauses and processes the details you entered in the form. Enquiries are received and handled by our team by email and are kept until your enquiry has been dealt with and thereafter only for as long as statutory retention periods require.

8. Newsletter

If you subscribe to our newsletter, we process your email address to send you logistics insights and updates about our services. We use a double opt-in procedure: after you enter your address, we send you a confirmation email, and we only add you to the newsletter list once you click the confirmation link. We store your email address, your subscription status and the date of your confirmation as a record of your consent.

The legal basis is your consent (Art. 6(1)(a) GDPR and § 7(2) UWG). You can withdraw your consent at any time with effect for the future — every newsletter contains an unsubscribe link, and unsubscribing removes your address from the list. Newsletter delivery is handled by our email provider, Resend (USA), acting as our processor under EU Standard Contractual Clauses. We keep your subscription data until you unsubscribe, after which it is retained only as needed to document your prior consent and to honour your unsubscribe request.

9. Cookies, local storage & analytics

Strictly necessary cookies. When you sign in to the customer portal, we set an essential, encrypted session cookie so that you stay logged in. It is not used for tracking and is required to provide the service you requested (Art. 6(1)(f) GDPR and § 25(2) TDDDG). Your cookie preference is also stored locally in your own browser.

Web analytics. We currently use no analytics or tracking cookies and embed no analytics services. That is also why no cookie banner appears: apart from the strictly necessary session cookie in the customer portal described above, nothing is set that would need your consent. If that changes, we will say so here and obtain your consent first.

10. Recipients & transfers

We do not sell your personal data. We share it only with the processors described in this policy (our hosting, database, email, analytics and shipping-platform providers), each of which processes it on our behalf under a data processing agreement and only as needed to provide their service, and with public authorities where we are legally required to do so. Where a processor is based outside the EU/EEA, transfers are safeguarded by the EU Standard Contractual Clauses.

11. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7(3)). To exercise these rights, contact us using the details in section 1.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

12. Data security

This website is delivered over an encrypted TLS/SSL connection to protect data transmitted between your browser and our servers. Portal passwords are stored only as salted Argon2id hashes, and stored API keys are encrypted at rest with AES-256. We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse.

13. Changes to this policy

We may update this privacy policy to reflect changes to our processing or legal requirements. The current version always applies and is available on this page.