Skip to content
Allgäu Airport Express

Privacy Policy

1. Privacy at a Glance

General Information

This privacy policy informs you in accordance with Art. 13 and 14 GDPR about how personal data is processed when you visit our website. Personal data is any data that can be used to personally identify you.

Data Controller

Allgäu-Airport-Express GmbH
Frühlingstr. 2, 87719 Mindelheim
Phone: +49 (0) 176 13022 352
Email: info@aaexpress.de

Data Protection Officer

Our Data Protection Officer is Melanie Mair. For privacy-related questions, please contact: datenschutz@aaexpress.de

2. Your Rights

You have the right at any time to:

  • Free information about your stored data (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Object to processing (Art. 21 GDPR)
  • Withdraw given consent with effect for the future

Please use the contact details provided above.

Right to Lodge a Complaint with a Supervisory Authority

In the event of violations of the GDPR, you have the right to lodge a complaint with a supervisory authority — in particular with the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA, Bavarian State Office for Data Protection Supervision), Promenade 18, 91522 Ansbach, www.lda.bayern.de .

3. Hosting & Infrastructure

This website is hosted by Cloudflare. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you access our website, technical connection data (IP address, timestamp, user agent) is briefly processed to deliver the page and protect against attacks (Art. 6(1)(f) GDPR — legitimate interest in secure and performant operation).

A Data Processing Addendum including EU Standard Contractual Clauses (SCC) is in place with Cloudflare to ensure an adequate level of data protection for data transfers to third countries. Cloudflare privacy policy: www.cloudflare.com/privacypolicy .

4. Server Log Files

The provider automatically collects the following data in server log files when the page is accessed:

  • IP address
  • Date and time of the request
  • Referrer URL
  • Browser type and version
  • Operating system
  • Hostname of the accessing computer

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technically error-free operation). Data is deleted after 14 days at the latest, unless security-relevant incidents require longer retention.

5. Contact Form

When you use our contact form, the data you provide (name, email address, phone, message) is stored for the purpose of processing your enquiry. Your data will not be passed on to third parties without your consent.

Legal basis: Art. 6(1)(a) GDPR (consent by submitting the form) or Art. 6(1)(b) GDPR (pre-contractual measures for travel enquiries). Data is stored for the duration of processing and deleted after 12 months at the latest, unless statutory retention obligations apply.

6. Applications via the careers page

When you apply using the form on our careers page, we process the details you provide: first and last name, email address, optionally your phone number, the role you are applying for, your answer regarding the category D licence, an optional message and any documents you choose to upload (such as a CV, driving licence or references). We process this data solely to carry out your application procedure. Only those involved in it have access.

Legal basis: Section 26 (1) sentence 1 of the German Federal Data Protection Act (BDSG) in conjunction with Art. 88 GDPR, and Art. 6 (1) (b) GDPR (pre-contractual measures). Optional details are processed on the basis of your consent under Art. 6 (1) (a) GDPR, which you may withdraw at any time with future effect.

If we do not work together, we delete your application data no later than six months after the procedure ends; this period accounts for possible claims under the German General Equal Treatment Act. If we do come to an agreement, the data is transferred to your personnel file. For longer storage we will ask for your separate consent.

Applications reach us by email via our service provider Brevo; uploaded documents are sent as attachments and are not stored on this website. They are not passed on to any other third parties. Decisions about your application are made by people — no automated decision-making takes place.

7. Email Delivery via Brevo

System and contact form emails are sent via the service provider Brevo (sib Brevo Germany GmbH, Köpenicker Str. 126, 10179 Berlin; parent company Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France). The contact data entered in the form and the message content are transmitted.

A Data Processing Agreement pursuant to Art. 28 GDPR is in place with Brevo. Servers are operated within the EU. Legal basis: Art. 6(1)(f) GDPR. Privacy policy: www.brevo.com/de/legal/privacypolicy .

8. Ticket Shop (shop.aae.breos.ai)

For online bookings, we redirect you to our external ticket shop at shop.aae.breos.ai. The shop's privacy policy applies there, as the booking and payment process is handled entirely on that platform. We do not transfer any data to the shop before you click the corresponding link.

9. Cookies and Consent Banner

On this website, we only use cookies that are technically necessary for operation, as well as optional analytics cookies with your consent. The cookie banner on your first visit allows for differentiated consent.

  • Essential Cookies: Technically necessary, no opt-in required (Art. 6(1)(f) GDPR)
  • Analytics Cookies: Only with active consent (Art. 6(1)(a) GDPR)

10. Web analytics

To understand which content on our website is used, we run our own analytics software. It operates on servers of our technical service provider within the European Union; no data is passed to third parties outside this processing relationship.

The software works without cookies and without any identifier stored on your device. It records the pages visited, the referring page, device type and country — your IP address is not stored. On our careers page we additionally record whether the application form was started and submitted, which role was selected, and which of the frequently asked questions are opened. This tells us where applicants drop off and which questions remain unanswered. We also count when you click one of our buttons leading to the ticket shop, and where on the website that button sits — this shows us which entry points are used. Only the click is counted; what you do in the shop afterwards is not part of this measurement. Content you enter — name, email address, message, uploaded documents — is not recorded.

Analytics is loaded only with your consent, given via the cookie banner. If you withdraw it in the cookie settings, the software is deactivated immediately and no further measurement takes place.

The legal basis is your consent under Art. 6 (1) (a) GDPR. The data collected cannot be traced back to you as a person and is evaluated in aggregated form only.

11. SSL/TLS Encryption

This website uses SSL/TLS encryption for security reasons. You can recognise an encrypted connection by the "https://" in the address bar and the lock icon in your browser.

12. No Automated Decision-Making

Automated decision-making including profiling pursuant to Art. 22 GDPR does not take place on this website.

13. Protection of Minors

Our services are not directed at children under 16 years of age. We do not knowingly collect personal data from children.

14. Updates to This Policy

Due to changes in legislation or technical modifications to our website, it may become necessary to amend this privacy policy. The current version can always be found on this page.