Privacy Policy

1. Controller

InterRail Europe GmbH, An der Mainkur 9a, 60386 Frankfurt am Main, Germany, represented by its managing directors Igor Maiorov and Birgit Dehner (Amtsgericht Frankfurt am Main, HRB 35828) — see our imprint.
E-mail: pickup@interrail-europe.de
External data protection officer: Dragon Data Solutions GmbH, dsb@dragondata.de

2. What we process, and why

a) The pick-up request you submit

• company details: company name, street, postal code, city, country, VAT ID;
• contact details: contact name, phone number, e-mail address, invoice e-mail address;
• request details: container number(s), planned pick-up date, your remarks, and the calculated storage charges, additional costs and service fee.

We use this to check your entitlement to collect the container, to calculate the charges and to process and invoice your request. Where the person using the portal is personally a party to the contract, Art. 6 (1) (b) GDPR applies. Where the portal is used by employees or other representatives of a business customer, their business contact data are processed on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest and that of our customer lies in processing and documenting the business transaction. Where retention is required by tax or commercial law, Art. 6 (1) (c) GDPR applies.

b) Transport and customs details (Malaszewicze terminal only)

For containers at the Malaszewicze terminal the terminal requires additional information before release: the truck driver's name and phone number, the truck and trailer registration plates, the customs clearance type, the customs reference number and your pick-up reference. We use them to arrange the physical handover at the terminal and to complete the customs formalities. Legal basis: Art. 6 (1) (b) and (c) GDPR; as regards the driver's data, Art. 6 (1) (f) GDPR — our legitimate interest and that of our operational partner in a secure, verifiable handover of the goods. Separate information for drivers is in section 6.

c) IP addresses and security logging

During normal use of the portal your IP address is not stored — neither in access logs nor in the portal database. We keep no web access logs at all: no record of which pages you visited, which browser you use or where you came from. For rate limiting, your address is processed temporarily in the server's memory and is automatically discarded when the relevant time window ends.

Only in the event of repeated incorrect access code entries may your address be recorded in a security log, so that an attempt to guess container access codes does not go unnoticed. This happens only when such an attempt is detected, never during ordinary use. The processing serves to detect and prevent unauthorised access and is based on Art. 6 (1) (f) GDPR. The entry is deleted after seven days, unless longer retention is necessary to investigate a specific security incident. The alert we send ourselves when this happens contains no IP address.

3. Cookies and tracking

This website uses no tracking, no analytics and no advertising cookies, and loads no content from third-party servers. The public request form sets no cookies at all. Our staff area sets only strictly necessary cookies: one that keeps an administrator logged in and, while two-factor authentication is switched on, a second one that lasts ten minutes during the sign-in check; under § 25 (2) TDDDG these need no consent. Consequently there is no cookie banner.

4. Who receives your data

• within InterRail Europe GmbH: the container operations team handling your request;
• InterRail-Polcont Sp. z o.o., ul. Wilcza 33 lok. 3, 00-544 Warsaw, Poland, a company of the same group, which handles releases at the Malaszewicze terminal. It receives a copy of the request including the transport and customs details and announces the driver to the terminal operator. Because it decides on its own responsibility what it must report and bills us for the storage itself, it acts as an independent data controller, not as a processor on our behalf. It is established in Poland, so the data stays within the EU;
• you: the contact address you enter receives a copy of your own request;
• Microsoft Ireland Operations Ltd. as our e-mail provider (Microsoft 365), which processes the request e-mails on our behalf as a processor under Art. 28 GDPR. Microsoft may process data outside the EU; such transfers are safeguarded by the EU-US Data Privacy Framework and EU standard contractual clauses;
• Hetzner Online GmbH, Germany, which hosts the application and database as a processor under Art. 28 GDPR;
• public authorities, where we are legally required to disclose data (in particular customs authorities).

We do not sell your data and do not use it for advertising.

5. How long we keep your data

• Driver and vehicle details: in this portal they are erased from the database as soon as the request has been sent to the people who have to act on it — normally a matter of seconds, and within seven days at the latest if a technical fault delayed that message. They remain in the e-mail correspondence about that pick-up, which is kept like other business correspondence.
• Requests in this portal: deleted 24 months after they were submitted. The accounting record is not created here.
• Accounting and correspondence: certain accounting records must be retained for ten years, accounting vouchers for eight years, and commercial and business correspondence generally for six years. Archived e-mails are deleted, or access to them restricted, once that period has run.
• IP addresses: never stored in our database; see section 2 c for the security log entries.

6. Information for truck drivers

If you are a driver whose name and phone number were entered in this form, we received those details from the company that ordered the container pick-up — not from you. What we do with them, who receives them and what rights you have is set out separately in our Privacy Information for Truck Drivers.

7. Your rights

Where applicable, you have the right to request access to your personal data (Art. 15 GDPR), its rectification (Art. 16) or erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and to object to processing based on our legitimate interests (Art. 21). Which of these apply depends on the legal basis of the processing concerned. To exercise them, contact pickup@interrail-europe.de.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany.

8. Is providing the data mandatory?

Most of the information requested in the portal is not required by law but is necessary to process the pick-up request. Certain customs information may be required by applicable law. Without the information required for the respective request, we may be unable to verify entitlement to the container, calculate the charges or arrange the handover.

9. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. The charge shown in the form is a non-binding estimate calculated from the stored tariffs; the final amount is determined by us.

10. Security

Traffic to this site is encrypted (HTTPS/TLS) and enforced by HSTS. Access to the staff area requires a password, stored only as an Argon2id hash. The database is reachable only by the application, never from the internet. Container look-ups are rate-limited to prevent guessing of security codes.