Privacy Policy

The controller responsible for data processing on this website is:

[PLACEHOLDER — legal name of the operator]
Neukölln, [PLACEHOLDER — street], 12051 Berlin, Germany
E-mail: privacy@mondotrip.de

You can reach our team for any data-protection question at any time via the contact details above or through our contact page.

We process personal data to operate this travel booking platform — for example when you create an account, search for a transfer, request a booking quote, complete a payment, contact us by e-mail or WhatsApp, or post a review. The table below summarises the main purposes and their legal bases (Art. 6 GDPR):

• Provision of the website (hosting, server logs) — Art. 6 (1) (f), legitimate interest in a secure, stable service.
• Account management — Art. 6 (1) (b), performance of the user contract.
• Handling bookings and payments — Art. 6 (1) (b) plus Art. 6 (1) (c) where commercial/tax retention laws apply.
• Address search & route calculation (Google Maps Platform) — Art. 6 (1) (b)/(f); see Sections 6–7.
• Answering enquiries (e-mail, WhatsApp, contact form) — Art. 6 (1) (b) pre-contractual measures / (f).
• Security and fraud prevention (rate limiting, signature verification of payment notifications) — Art. 6 (1) (f), legitimate interest; legal obligation where applicable.
• Publishing reviews you submit — Art. 6 (1) (a), consent given when submitting a review.

Our website is operated on servers of a professional hosting provider with whom a data processing agreement pursuant to Art. 28 GDPR is in place. On every visit, the server automatically stores information in log files: requested page, date/time, amount of data transferred, referrer URL, browser type/version, operating system, and IP address (shortened where technically feasible).

These logs are processed for technical delivery, error diagnosis, and defence against attacks. They are deleted automatically after 30 days unless longer retention is required to investigate specific incidents. The legal basis is Art. 6 (1) (f) GDPR.

When you create an account we store your name, e-mail address, phone number and password (stored only as a modern one-way hash). This data is required to identify you, manage your bookings, and secure your account (Art. 6 (1) (b) GDPR). You can delete your account at any time via your profile settings or by contacting us; statutory retention duties for completed bookings remain unaffected.

To prepare your transfer or tour booking we process the details you enter: pick-up/drop-off addresses, dates and times, passenger counts, vehicle preferences, flight numbers, and contact information. This processing is necessary to perform the transport contract with you (Art. 6 (1) (b) GDPR). Booking data may also include location data derived from the addresses you choose.

Payments are processed by our external payment service provider Paymob. Card data you enter is transmitted directly to Paymob's PCI-DSS-certified systems; MondoTrip does not store full card numbers. We receive and store the transaction status, transaction ID, amount, and masked card information needed for accounting and customer support.

Completed bookings are retained as long as commercial and tax law require (generally 6 to 10 years, § 147 AO, § 257 HGB). Uncompleted draft requests are deleted after 90 days.

When you contact us by e-mail, phone, or WhatsApp, we process the data you disclose (name, contact details, message content) to handle your enquiry (Art. 6 (1) (b)/(f) GDPR). Enquiries are deleted once resolved and no business obligations apply, normally after 12 months.

If you contact us via WhatsApp, Meta Platforms Ireland Ltd. also processes message metadata under its own privacy policy. Please do not send sensitive payment information through chat channels.

For address autocompletion, place selection, and distance/route calculation we load services of Google Maps Platform (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; for users in the EEA: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). When you use these features, Google receives your search terms and your IP address. Google LLC is certified under the EU-U.S. Data Privacy Framework; where data is transferred outside the EEA, EU Standard Contractual Clauses apply additionally.

Details on cookies possibly set by interactive map elements are described in our Cookie Policy.

We use strictly necessary storage only — session management, security tokens, and your currency/language preference. No advertising, analytics, or social-media tracking technologies are used. Full details: Cookie Policy.

• Hosting provider (EEA) — website operation, order processing per Art. 28 GDPR.
• Paymob (Egypt) — card payment processing. Egypt does not hold an EU adequacy decision; transfers are safeguarded by EU Standard Contractual Clauses and additional technical measures such as encryption in transit.
• Google LLC / Google Ireland Ltd. — Maps Platform functions described above.
• Transport and tour partners — only the data required to perform your booked ride or tour (e.g., name, pick-up address, time, passenger count).
• Authorities — solely where legally obliged (Art. 6 (1) (c)).

We never sell your personal data.

You have the following rights regarding your personal data:

• Access (Art. 15), including a copy of the data;
• Rectification (Art. 16) and erasure (“right to be forgotten”, Art. 17);
• Restriction of processing (Art. 18);
• Data portability (Art. 20);
• Objection to processing based on legitimate interests (Art. 21);
• Withdrawal of consent at any time with effect for the future, where processing rests on consent (Art. 7 (3));
• Non-automated decisions: we do not make decisions based solely on automated processing that produce legal effects concerning you (Art. 22).

To exercise any right, e-mail privacy@mondotrip.de. We respond within one month as required by Art. 12 (3) GDPR.

Right to lodge a complaint (Art. 77): you may complain to the supervisory authority for Berlin, Berliner Beauftragte für Datenschutz und Informationsfreiheit (Alt-Moabit 59–60, 10555 Berlin, Germany, datenschutz-berlin.de), or to the authority of your habitual residence.

All traffic between your browser and our servers is encrypted via TLS. Access to personal data internally is restricted to roles that need it, passwords are stored hashed, payment callbacks are verified cryptographically, and common attack classes are mitigated through input sanitisation and rate limiting.

We adapt this policy when our processing or the legal framework changes. The version date appears at the top of this page.