Legal
Privacy notice
Processing of personal data under the GDPR and the German Federal Data Protection Act (BDSG).
Controller
Black Standard, Pfarrer-Benz-Straße 7, 76275 Ettlingen, Germany.
Sole proprietorship, represented by its proprietor Felix Spohn.
Contact for data protection matters: welcome@cargocharternetwork.com, phone +49 172 6111193.
Cargo Charter Network is a brand of Black Standard and not a separate legal entity.
Supervisory authority
The competent authority is the State Commissioner for Data Protection and Freedom of Information Baden-Wuerttemberg, Lautenschlagerstrasse 20, 70173 Stuttgart, Germany.
You may also lodge a complaint with the supervisory authority of the EU member state in which you live or work, or of the place of the alleged infringement.
Who we process data about
Business customers and prospects: name, function, company, business contact details, the content of the enquiry (routing, ready date, commodity, dimensions, weights, dangerous goods classification, temperature requirements) and documents uploaded with it.
Website visitors: a hashed IP address, technical data such as browser type, requested page and time of access and, subject to consent, analytics data.
Portal users: login credentials, company data, requirements entered in the portal, messages exchanged with the desk and the status history of each request.
Suppliers and operator contacts: business contact details of the individuals we deal with at operators, ground handlers and agents.
Applicants: application documents and correspondence relating to a vacancy.
Personal data of third parties provided by customers
Charter work routinely requires personal data of people who are not our customers: contact persons at the shipper and the consignee, staff at handling agents, and grooms or attendants accompanying live animal shipments. This information reaches us from the customer, not from those individuals, which is why this section is provided in accordance with Art. 14 GDPR.
Categories concerned are typically name, function, employer, business phone number and business email address, and for accompanying personnel the travel details needed for the flight.
We use these data only to obtain quotes from operators, to coordinate handling and to carry out the mission requested. Legal basis: Art. 6(1)(f) GDPR, the legitimate interest of the parties involved in performing the transport, and Art. 6(1)(b) GDPR in relation to our customer.
These data are retained for the period that applies to the enquiry or booking they belong to and are then deleted with it.
The customer is responsible for ensuring that the transfer of third-party data to us is lawful and that the individuals concerned have been informed. On request we will support the customer in providing that information.
Where the data come from
Directly from you, for instance through the enquiry form, the portal, email or a phone call.
From our customer, where third-party contact details are supplied as part of an enquiry.
From public sources, such as company registers, operator publications and business directories, where we verify a counterparty or maintain supplier contacts.
Legal bases
Art. 6(1)(b) GDPR — handling enquiries, pre-contractual steps taken at your request, performance of the brokerage agreement and operation of your portal account.
Art. 6(1)(f) GDPR — abuse prevention on public forms, business communication with suppliers and operator contacts, verification of counterparties, documentation of enquiries and defence of legal claims.
Art. 6(1)(c) GDPR — statutory commercial, tax and sanctions-related obligations.
Art. 6(1)(a) GDPR — audience measurement and any advertising technology, exclusively after consent given through the cookie banner and revocable at any time.
IP addresses are stored as a hash only
To prevent abuse of the public enquiry form we apply a rate limit. Your IP address is not stored in plain text at any point: it is converted into a hash value, and only that hash is compared with recent submissions.
The hash cannot be used to contact you or to profile you; it exists solely to recognise repeated automated submissions. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in securing the service.
Enquiry handling
An enquiry is passed to the charter desk, matched against suitable aircraft and put to operators for pricing. Only the operational details required for a quote are shared with an operator; commercial correspondence stays with us.
Providing the data is not a statutory requirement, but without route, dates and cargo data an enquiry cannot be priced.
Account and request portal
If you register a business account we process your name, business email address, phone number, company details and the requirements you enter in the portal, including uploaded documents.
Access is restricted per company at database level. Legal basis: Art. 6(1)(b) GDPR for handling your requirements and Art. 6(1)(f) GDPR for verification and abuse prevention.
Audience measurement with Google Analytics 4
This website uses Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Measurement ID for this site: G-NH6SRP2GGF.
Analytics runs only after you have given consent through the cookie banner. Legal basis: Art. 6(1)(a) GDPR.
We record page views, enquiry funnel steps, clicks on phone and email links and use of the price calculator. Event parameters never contain names, email addresses, phone numbers, company names or reference numbers.
AI tools
AI-assisted tools, including services from OpenAI and Anthropic, are used internally for research, drafting and analysis.
Personal data of customers, prospects or third parties are not entered into these tools. Enquiry data are not processed by AI tools.
Recipients and processors
All-Inkl (Neue Medien Münnich, Friedrichstraße 24, 02826 Görlitz) — hosting and email services, Germany.
Lovable — development and delivery of this web application.
Supabase — database and file storage, data centre in Frankfurt, Germany.
Resend — delivery of transactional email, EU region Ireland.
Zoho — business communication and customer administration.
Google Ireland Limited — Google Analytics 4, only after consent.
Performing air carriers, ground handlers and handling agents, to the extent necessary to quote and carry out your requirement.
Tax advisers, auditors and legal advisers, bound by professional confidentiality.
Public authorities, where we are legally obliged to disclose.
A potential acquirer, in the event of a sale of the business or of parts of it.
Processing therefore takes place predominantly inside the European Union. Each processor is bound by a data processing agreement under Art. 28 GDPR and acts on our instructions only.
Transfers to third countries
The only processing that may involve a transfer to the United States is Google Analytics 4, and it only occurs after you have consented.
That transfer is based on the EU standard contractual clauses and on Google's certification under the EU-US Data Privacy Framework.
Until consent is given, Google Consent Mode v2 keeps ad_storage, ad_user_data, ad_personalization, analytics_storage, functionality_storage and personalization_storage set to "denied" and advertising identifiers are redacted, so no analytics data leaves the site.
Retention and erasure periods
Enquiries that do not result in a booking are deleted automatically 180 days after they were received.
Where a booking results, the record is retained for the applicable statutory commercial and tax retention periods and deleted once those periods expire.
Files uploaded with an enquiry follow the retention period of the enquiry they belong to.
Portal accounts are kept for the duration of the business relationship and deleted on request unless a statutory retention period applies.
Applications are deleted six months after the selection procedure has been concluded, unless you agree to a longer period.
The erasure run is automated, executes daily and is logged without personal data, purely as evidence that the erasure concept is applied.
Technical and organisational measures
Traffic between your browser and our systems is encrypted in transit, as is access to the database and to file storage.
Access is limited to the people who need it for a defined task, with individual accounts and no shared logins.
The database enforces row-level access control, so a portal user can only reach the records of their own company.
Internal commercial data such as supplier rates and margins are held under separate permissions and are never included in responses to customers.
Cookies and consent
Details of every entry stored on your device are set out in our cookie policy.
You can withdraw consent at any time with effect for the future via the "Cookie settings" link in the footer. Withdrawal takes effect immediately and is as simple as giving consent.
Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Consent once given may be withdrawn at any time without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, write to welcome@cargocharternetwork.com or to Black Standard, Pfarrer-Benz-Straße 7, 76275 Ettlingen, Germany.
You also have the right to lodge a complaint with a supervisory authority, as set out above.
United States: California and Virginia
We offer our services worldwide. Where the California Privacy Rights Act (CPRA) or the Virginia Consumer Data Protection Act (VCDPA) applies to a resident of those states, the following applies in addition.
Categories of personal information collected: identifiers (name, business email address, business phone number), commercial information (enquiries, bookings, correspondence), internet activity (pages viewed, subject to consent) and professional information (employer, function). Sensitive personal information is not collected.
Purposes: responding to enquiries, sourcing and coordinating charter capacity, operating accounts, securing our services, complying with legal obligations and, subject to consent, measuring the reach of our website.
We do not sell personal information and we do not share it for cross-context behavioural advertising within the meaning of the CPRA. We have not done so in the preceding twelve months.
Rights: to know and access the personal information held, to correct inaccurate information, to request deletion, to obtain a portable copy, to opt out of any sale or sharing, and to be free from discrimination for exercising these rights. Virginia residents may additionally appeal a refused request.
To exercise these rights, contact welcome@cargocharternetwork.com. We verify requests using the contact details already held for you and respond within the statutory period.
Data protection officer
No data protection officer has been appointed. The conditions of Art. 37 GDPR are not met: the business is not a public authority, its core activities do not consist of large-scale regular and systematic monitoring of data subjects, and it does not process special categories of data on a large scale.
Automated decision-making
No automated decision-making within the meaning of Art. 22 GDPR and no profiling take place. Price indications from the calculator are produced from market ranges and route parameters, not from personal data.
Changes to this notice
We update this notice when our processing, our tools or the legal framework change. The version published here is the one that applies. Where a change materially affects you, we will point it out on the website.