Privacy Policy

1. Controller

FLYYT GmbH

Isekai 1A

20249 Hamburg

Germany

Email: privacy@flyyt.app

2. Principles of Data Processing

We process personal data only where permitted by law or where you have given your consent. The legal framework is provided by the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the Telecommunications and Telemedia Data Protection Act (TDDDG). The legal bases are in particular Art. 6(1) GDPR (contract performance, legitimate interests, legal obligation, consent) and § 25 TDDDG for access to end-user devices (cookies, tracking).

3. Website

3.1 Server Logs / Hosting

When you visit our website, no access data is currently stored (IP address, timestamp, browser type, page accessed) — neither by the content delivery network (CloudFront) nor by the web storage (S3) the website runs on. Your request is processed briefly to technically deliver the page, but is not logged or stored.

Hosting provider: Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg. Server location: AWS EU (Frankfurt).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation) for the brief technical processing of your request to deliver the page.

3.2 Cookies and Access to Your Device

Our website itself stores nothing on your device: no cookies, no entries in local browser storage. There is therefore nothing we would need to ask your consent for under § 25(1) TDDDG, and nothing for you to manage here.

This does not apply to the third-party content embedded on individual pages — see 3.3.

3.3 Embedded Third-Party Forms and Appointment Booking

Our contact, careers and waiting-list forms, as well as the appointment booking, are not our own forms. They are third-party pages embedded as an iframe. They load as soon as you open the page — before you fill in a field or submit anything. In doing so, your browser transmits to the respective provider the data that any page request technically involves: your IP address, browser type and version, operating system, and the address of the page the content is embedded in.

This affects these pages (each under its language prefix, e.g. /en/fleet):

• Pipedrive: /, /fleet, /depot, /enterprise, /cpo, /schedule, /contact, /partner, /careers, /invest
• Google Calendar: /about

The Pipedrive forms and appointment booking load from webforms.pipedrive.com and flyyt.pipedrive.com, the appointment booking on /about from calendar.google.com. What you enter into one of these forms goes directly to the respective provider; we receive it from there. Whether and what the provider stores on your device is decided by the provider — we have no influence over it. Pipedrive Inc. is based in the USA; for the basis of that transfer see 6.

Legal basis for transmitting the connection data on load: Art. 6(1)(f) GDPR (legitimate interest in offering you a way to get in touch and book an appointment).

3.4 Our presence on social media

We operate profiles on social media platforms in order to stay in contact with prospective customers and applicants.

When you visit our profiles, the platform operators process your data in accordance with their own privacy policies — including your IP address and, if you are logged in there, your user account. From this the operators produce usage statistics, among other things, which they make available to us in aggregated form.

Insofar as we use these statistics functions, we are joint controllers with the respective platform operator (Art. 26 GDPR). The agreements concluded for this purpose and their essential content can be found here:

• LinkedIn — LinkedIn Ireland Unlimited Company, Dublin, Ireland — Privacy Policy · Page Insights Joint Controller Addendum

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in our public presence and reach); for the statistics functions additionally the consent you have given to the platform.

You may exercise your data subject rights both against us and directly against the platform operator. As the platform operator has direct access to your data, we recommend contacting them first.

Where data is transferred to third countries (e.g. USA), this is done on the basis of EU Standard Contractual Clauses or an adequacy decision by the EU Commission.

4. App

4.1 User Account / Registration

Use of the FLYYT App requires registration. We collect:

• Phone number *(to sign you in and identify you uniquely)*
• VAT identification number (VAT ID) *(to verify your status as a business)*
• Display name *(optional, to personalise the app)*
• Email address *(optional, for contact purposes)*
• Company name *(required to add a payment method and for invoicing)*
• Company address *(required to add a payment method and for invoicing)*

To sign in, we send you a one-time code by SMS to the phone number you provided. The message is sent via Amazon Web Services and the mobile network operators involved.

Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement) for the required fields; for the fields marked as optional (display name, email address) Art. 6(1)(f) GDPR — our legitimate interest lies in the purposes named above.

4.2 Payment Processing

Payments are processed via our payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin D02 H210, Ireland.

Card data (e.g. credit card number) is transmitted directly to Stripe and is not stored by us. Payment-related data such as the amount, currency and status of the payment, as well as invoices including company name and address, are stored by us for the periods set out in Section 9. To associate your payment, we transmit only a pseudonymous reference to Stripe — no name, no email address and no postal address.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

4.3 Location Data, Maps and Route Planning

To display nearby charging stations and for route planning, we process your device location.

Maps and turn-by-turn navigation in the app are provided via the Google Maps Navigation SDK. Your location is transmitted directly from your device to Google. For this processing, Google acts as an independent controller under the Google Maps Controller-Controller Data Protection Terms; Google's own privacy policy applies accordingly.

Route calculation and scoring additionally takes place server-side via TomTom International BV as a processor. In this case, coordinates are transmitted to TomTom from our server, not from your device.

During a trip we store the position of your device in order to announce charging stops in good time and to recalculate the route if you deviate from it. After the trip has ended we retain this location data for up to 60 days, so that we can reconstruct what happened in the event of a fault or error. It is deleted thereafter.

Shortly after the trip ends, unless you have objected, your trip data is also folded into an anonymized, aggregated evaluation across multiple drivers, which we use to improve route calculation and consumption forecasts. This evaluation no longer allows any conclusions about individual trips or people, and is retained indefinitely.

Legal basis: Art. 6(1)(b) GDPR for carrying out the trip itself; for the subsequent 60-day retention for fault and error analysis, as well as for the aggregated evaluation, Art. 6(1)(f) GDPR — our legitimate interest lies in ensuring and improving the service. You may object to the aggregated evaluation at any time in the app settings (Art. 21(1) GDPR) without any restriction on your use of the app.

4.4 App Permissions

The FLYYT App requests the following device permissions:

• Location: For charging station search and route planning (see 4.3). On iOS devices also in the background, so that navigation continues during an active trip while the app is not in the foreground. On Android devices during active use only.

Operational notices (e.g. charging status) are displayed exclusively within the app while it is open. We do not send operating system push notifications.

4.5 Error diagnostics and session replay

To find crashes and malfunctions in the app, we use the service Sentry, in two stages.

Stage 1 (always active): anonymous crash reports only — technical details of the error (device type, operating system version, app version, timestamp, technical error trace), with no personal data, no session recordings and no logs.

Stage 2 (only after your explicit consent): in addition, your IP address, your user identifier, logs, and a session recording as a screen recording — 10% of all sessions as a sample, and every session in which an error occurs. This makes it possible to reconstruct which steps led to an error. The recording is masked: text, images and vector graphics are rendered unrecognizable. What is recorded is the structure of the interface and your interactions, not the content you enter or that is displayed.

Legal basis: Art. 6(1)(a) GDPR (consent) for Stage 2. Consent is requested the first time the app is launched, before anything else is shown, and can be withdrawn at any time with effect for the future under Settings → Privacy.

Processing takes place in Sentry's EU region (Frankfurt).

4.6 Usage analytics

To improve the app user experience, we use Firebase Analytics, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The following is collected:

• Screens viewed within the app
• Events around your account: sign-in, registration, sign-out, and completion of setup
• Events around your trips: computing a route, creating a trip, and its start and completion. When a route is computed and when a trip is created, the origin and destination are transmitted as place names, together with the number of planned charging stops and legs, the estimated total cost of the trip and the estimated charging share of it
• Events around charging: the start and end of a charging session, a skipped charging stop, a state of charge you corrected, and the case that no charge point could be assigned to you within the expected time — with the charge point identifier, the energy charged, the states of charge in percent, and the position of the stop within the trip
• Events recording an interruption: that trip planning could not continue because no payment method was on file, and that checking your payment method took too long — each with the place in the app where it happened, or with the number of attempts
• A technical identifier of the trip concerned, on every trip and charging event
• Your device language, the language selected in the app, and your user group
• Data the Firebase SDK collects on its own: app start and session duration, device model, operating system and app version, and the country derived from your IP address

This means that information about where you set off from and where you intend to drive also reaches Firebase Analytics. Your ongoing device location is not part of it — it is processed for route guidance (see 4.3) and is not transmitted to Firebase Analytics.

This data is attributed to a randomly generated identifier for your app installation, not to your user account. Your name, phone number and email address are not transmitted to Firebase Analytics.

We additionally use Firebase Remote Config to control which features of the app are active; the same device identifier is transmitted in the process.

Legal basis: Art. 6(1)(a) GDPR (consent). This is the only basis: collection is switched off until you have consented, and does not take place without your consent. You may withdraw your consent at any time with effect for the future — in the app under "Settings" or by contacting privacy@flyyt.app.

5. General

5.1 Contact

We do not operate a contact form of our own — the forms on our website are embedded forms of our service provider Pipedrive (see 3.3), which we also use as our CRM system. When you contact us by email, we store your inquiry including all provided data for processing and follow-up purposes.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

6. Disclosure to Third Parties

Data is only shared where necessary for contract performance, where required by law, or where you have consented.

We distinguish between two types of recipients:

• Processors handle data exclusively on our instructions and are contractually bound to us pursuant to Art. 28 GDPR. We remain the controller; you exercise your data subject rights vis-à-vis us.
• Independent controllers determine the purposes and means of their processing themselves. Their own privacy policies apply to that processing; you exercise your data subject rights directly with them.

The role of each recipient is indicated in the table below:

For the processing activities in which Stripe or Google act as independent controllers, their own privacy policies apply: Stripe Privacy Policy · Google Privacy Policy

In addition to the service providers listed above, we disclose data to: tax advisors and auditors (statutory retention and audit obligations, Art. 6(1)(c) GDPR), lawyers and debt collection agencies (assertion of claims, Art. 6(1)(f) GDPR), banks and payment service providers (payment processing, Art. 6(1)(b) GDPR), and public authorities and courts where we are legally required to do so (Art. 6(1)(c) GDPR).

Transfers to third countries: Google (Google Maps Platform) also processes data in the USA. This is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023; Google LLC is certified under the Data Privacy Framework. Sentry processes our data in its EU region (Frankfurt) but also transfers data to the USA for support purposes and via sub-processors. Sentry is certified under the EU-US Data Privacy Framework; EU Standard Contractual Clauses apply in addition. Pipedrive Inc. is based in the USA; the transfer basis is currently being confirmed. Otherwise, data is transferred to countries outside the EU/EEA only on the basis of an adequacy decision by the European Commission or appropriate safeguards (e.g. EU Standard Contractual Clauses pursuant to Art. 46 GDPR).

7. Technical and Organizational Measures

We implement technical and organizational measures (TOMs) to protect your personal data against unauthorized access, loss, or destruction. These include in particular:

• Encrypted transmission between your device and our servers — indicated by "https://" in the address bar and the padlock symbol in your browser.
• Encrypted storage of data on our servers.
• Access restrictions: our data stores are not publicly reachable; access is only possible through authenticated services.
• Processing in data centres within the EU.
• Data minimisation where it matters most: we do not store card data (see 4.2), we transmit only a pseudonymous reference to our payment service provider, and our internal event logs contain no clear-text personal data.

8. Links to Third-Party Websites

Our website and app may contain links to external websites. The operators of those sites are solely responsible for their content and data protection practices. We have no influence over their data processing.

9. Retention Periods

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention obligations:

Upon expiry of the applicable period, we delete or anonymise the data.

10. Your Rights

You have the following rights with regard to your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent (Art. 7(3) GDPR)

To exercise your rights, please contact: privacy@flyyt.app. We will handle your request within one month of receipt (Art. 12(3) GDPR). Should processing exceptionally take longer, we will inform you within that period.

Account and data deletion: You may request full deletion of your account and the personal data we store about you at any time. To do so, please also contact privacy@flyyt.app; we will handle this request as well within one month of receipt (Art. 12(3) GDPR).

11. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for Hamburg is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit

Ludwig-Erhard-Str. 22, 20459 Hamburg

www.datenschutz-hamburg.de

12. Data Protection Officer

We have appointed a Data Protection Officer:

Arne Cornils

FLYYT GmbH

Isekai 1A

20249 Hamburg

Germany

Email: privacy+dpo@flyyt.app

For any data protection related queries, please contact our Data Protection Officer directly. Please indicate the responsible entity (FLYYT GmbH) in your communication.

13. Last Updated

This privacy policy is currently valid as of August 13, 2026. We reserve the right to update this policy if the legal situation or our data processing practices change.