1. Controller and contact
The controller for the processing of personal data on x25pronto.at is Management Consulting Mayr, Waldaustrasse 2, 9500 Wil SG, Switzerland. “x25pronto” and “x25pronto.at” are business and service names of the controller and are not separate legal entities. Privacy enquiries may be sent to info@x25pronto.ch or +41 71 554 72 93. For users in Austria, the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act apply where applicable; Swiss data-protection law also remains relevant to the controller in Switzerland.
2. Categories of data processed
Depending on use, we process master and contact data, account and security data, email-verification and activation status, timestamps and technical records of acceptance of terms/privacy notices, billing and company data, application, courier-partner, vehicle, insurance and evidence data, tax and VAT information, payment and payout data, route, appointment and shipment information, prices, booking, order, receipt and complaint data, pickup and delivery evidence including photos, correspondence, and technical access, device, log, analytics and security data. The referral programme may additionally involve referrer data, the recipient address entered, invitation and activation status, reward status, and technical delivery, open and click events.
3. Purposes and legal bases
Processing serves, in particular, operation of the website, app and portals, registration, account activation, authentication and security, documentation of confirmations, address and route checks, price calculation, booking and payment processing, order performance, courier-partner allocation, driver portal, billing and payouts, complaints, the referral programme, contract-related communications, lawful customer communications, accounting, evidence, fraud and misuse prevention, error analysis, audience measurement, legal obligations and the establishment or defence of legal claims. Where the GDPR applies, processing is based, depending on the operation, particularly on performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR), legal obligations (point (c)), legitimate interests in secure and orderly operation, misuse prevention, evidence and legal enforcement (point (f)), or consent (point (a)).
4. Registration, acceptance records and account activation
During registration, the system may record whether the required terms/privacy confirmation was provided and when. New accounts may remain inactive until the email address is confirmed. One-time tokens may be generated for activation, password setup or comparable security procedures, stored only in hashed or otherwise technically protected form, given an expiry time and invalidated after use. Email-verification status is used for account, security, evidence and contract purposes.
5. Account activation is not marketing consent
Activation or verification of an account, a booking, an application or a courier partnership does not by itself constitute consent to advertising. Marketing by electronic mail is sent only where the statutory requirements are met, in particular under section 174 of the Austrian Telecommunications Act 2021 (TKG 2021). Unsubscribes, suppression entries, blocking flags and “do not contact” markers are respected. Contractual, security and strictly necessary account communications are handled separately.
6. Austria as service and billing country
x25pronto.at is directed at Austria. For logged-in accounts and bookings, the billing or service country may be stored server-side using ISO country code AT. The German interface displays “Österreich” and the English interface “Austria”. Server-side contract, tax and invoice data take precedence over manipulated browser values.
7. Bookings, driver portal and courier partners
For the performance of specific transports, independent courier partners are given access only to the order, contact, route, appointment, shipment and evidence information required for that trip. The driver portal may process company, contact, tax/VAT, billing, vehicle, insurance, bank/payout, conditions, order, evidence, complaint and accounting data. System status, timestamps, acceptances, rejections, pickup and delivery evidence and comparable events may be logged for contract performance, quality assurance, billing, tax classification, complaint handling and misuse prevention.
8. Driver-portal fee and tax evidence
For billing driver-portal or partner services, information such as business status, place of establishment, billing address and tax/VAT details may be processed and documented. Where the tax liability for a cross-border B2B service shifts to the recipient, the information required for invoicing, evidence and any necessary correction is processed. Data-protection processing does not itself determine the tax treatment; the actual circumstances and applicable tax rules are decisive.
9. Referral programme
In the referral programme, a logged-in user may enter a recipient address and review or confirm the message before sending. Administration and allocation may involve referrer, recipient, delivery status, account activation and reward status, as well as technical open and click events. Automated retrievals, security scanners or similar technical access may be assessed separately from human interactions. These data serve programme administration, attribution, statistics, security and misuse detection. A referral does not replace any consent that may be required for further advertising to the recipient.
10. Payment data
Card payments are processed through Stripe. x25pronto receives the transaction information required for authorisation, payment status, booking, refunds, invoices and receipts, but not complete card data. Depending on the payment method, Apple Pay or Google Pay may be used as wallets within the Stripe payment flow. Payment and invoice status may be processed to automatically enable contractual portal or service functions.
11. AI Bot
The AI Bot uses approved x25pronto content as its knowledge base. Questions and the chat history required to generate a response are transmitted to the configured AI service and may be logged server-side for operation, quality, misuse prevention and administration. In the browser, the visible AI chat history is kept only in sessionStorage so that it survives page changes and reloads within the same browser session; it is not intended as permanent local history. Additional privacy or functionality switches may be applied to logged-in accounts depending on system status.
12. WhatsApp and electronic communications
When WhatsApp is opened, the message is handed over to the WhatsApp service selected by the user. Until then, the draft remains local in the browser. Contract, account, security, order and partner information may be sent electronically to the contact details stored in the account. Delivery, bounce, open or comparable technical status data may be processed where necessary for operation, security, evidence, deliverability or lawful communications. Further processing by WhatsApp/Meta or other external communications providers is governed by their own terms and privacy notices.
13. First-party statistics, Google Tag Manager and local storage
Data-minimised operational baseline statistics are processed through x25pronto infrastructure without an optional persistent browser identifier. Optional enhanced first-party analytics using visitor and session identifiers is enabled only according to the choice made in cookie settings. With the relevant consent, the Google Tag Manager web container (container ID GTM-5XQMWR58) is also enabled. Release is checked server-side using signed consent information; the GTM bootstrap is delivered only after a successful backend check via the x25pronto.at endpoint /api/privacy/gtm.js. Google Analytics is not configured on x25pronto.at. Advertising and personalisation storage remain blocked by x25pronto by default. Storage of or access to information on terminal equipment is additionally subject to section 165(3) TKG 2021.
14. Recipients and service providers
Data may be disclosed as necessary to hosting, email, payment, mapping/routing, communications, AI and IT service providers and to courier partners engaged for a specific transport. Service providers receive only the data required for the relevant function. Transfers outside the EU/EEA, including to Switzerland or other third countries, are subject where required to the safeguards and conditions provided by the GDPR and applicable Swiss data-protection law.
15. Retention, archiving and deletion
Data is retained only for as long as required for the relevant purpose, evidence, complaint handling, security or statutory retention obligations. Accounting, contract, payment, tax, security and evidence data may therefore be kept for longer periods. For archived or deleted accounts, active access may be blocked and the current contact address technically replaced or suppressed for operational communications. Data still required for legal, accounting, security or evidentiary reasons may be retained in restricted form until the relevant purpose ceases.
16. Data security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or unlawful alteration. These may include access controls, hashed one-time tokens, server-side plausibility and permission checks, logging of security-relevant events and separation of active from archived accounts.
17. Data-subject rights
Where the GDPR applies, data subjects have in particular rights of access, rectification, erasure, restriction of processing, data portability and objection; consent may be withdrawn with effect for the future. Statutory retention and evidence obligations and other overriding legal grounds remain reserved. Data subjects may lodge a complaint with a competent data-protection supervisory authority, including the Austrian Data Protection Authority where it is competent. Privacy enquiries should be sent to info@x25pronto.ch.