Privacy notice
Stand 27. September 2026.
Structured along article 13 GDPR.
English reading version. Only the German version is legally binding; in case of any difference the German text prevails. German version
1. Controller
Muhlis Karaca, Oberföhringer Straße 246a, 81925 München, info@sostivo.de.
We have not appointed a data protection officer because fewer than twenty people are permanently engaged in the automated processing of personal data (section 38(1) German Federal Data Protection Act).
2. What we process, why, and on what basis
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account: name, email, phone, role | Registration, signing in, communication about the contract | Article 6(1)(b) GDPR | until the account is deleted |
| Property and parking space: address, dimensions, photos | Listing, brokerage, conclusion of the contract | Article 6(1)(b) GDPR | 90 days after the booking ends (photos), otherwise until deletion |
| Request and viewing: vehicle details, licence plate | Fit, appointment, proof of handover | Article 6(1)(b) GDPR | 90 days after the booking ends |
| Contract, payments, dunning notices, ledger | Conclusion of the contract, invoicing, dunning, bookkeeping | Article 6(1)(b) and (c) GDPR (retention for tax purposes) | 3,650 days (section 147 German Fiscal Code) |
| Key box access code | Handing over access to the space | Article 6(1)(b) GDPR | until the contract ends, then withdrawn |
| Outbox of our emails | Proof of messages sent | Article 6(1)(b) GDPR | 3 years (section 195 German Civil Code) |
| Server logs of the host | Operation and defence against attacks | Article 6(1)(f) GDPR | short-term, as specified by the host |
| Self-declaration: private or commercial, with the time of the declaration | Mandatory information under article 246d section 1 nos. 4 and 5 of the Introductory Act to the German Civil Code, tax classification (terms, section 19) | Article 6(1)(c) GDPR (legal obligation) | until the account is deleted |
| For commercial hosts: company, street, postcode, town | Host identification under article 246d section 1 no. 4 of the Introductory Act to the German Civil Code. Recipients: publicly visible in the listing and in the contract PDF of the respective driver. | Article 6(1)(c) GDPR (legal obligation) | until the account is deleted |
| Email address, sign-in code (only as a hash), session identifier (only as a hash) | Signing in without a password using a code by email; session on the website and in the app | Article 6(1)(b) GDPR (contract) | code valid for 10 minutes, session 30 days (web) or 180 days (app), invalid afterwards |
| With "Sign in with Apple": Apple identifier, email address confirmed by Apple, name the first time | Signing in at your request; Apple Distribution International (Ireland) verifies your identity on its own responsibility | Article 6(1)(b) GDPR | until the account is deleted |
| With "Sign in with Google": Google identifier, email address confirmed by Google, name | Signing in at your request; Google Ireland Limited verifies your identity on its own responsibility | Article 6(1)(b) GDPR | until the account is deleted |
| Push token of the device (app only, only if you allow notifications) | Notifications about bookings, messages and payments; delivered via Apple Push Notification service or Firebase Cloud Messaging | Article 6(1)(b) GDPR | until the device signs out or the account is deleted |
| Short-term booking: period, price, payment status, reviews with stars and comment | Carrying out the booking; reviews are visible to other users as an average, the comment is visible to the reviewed side | Article 6(1)(b) GDPR | booking data ten years (section 147 German Fiscal Code), reviews until the account is deleted |
| Reports about listings: reason, your text, your account | Review of unlawful content under article 16 Digital Services Act, confirmation of receipt by email | Article 6(1)(c) GDPR | three years after the review is completed |
| App: location (only while in use, only with your permission), saved list | Showing spaces near you; the saved list stays on your device and is not transmitted | Article 6(1)(a) GDPR (consent, revocable at any time in the iOS settings) | the location is not stored |
| Fraud prevention: irreversible check values (hashes) of Stripe's card fingerprint and of the payout account, never the card or account number itself | Detecting whether several accounts belong to the same person, so nobody books their own space, reviews themselves or evades a suspension with a new account | Article 6(1)(f) GDPR (legitimate interest in a fair, fraud-free marketplace) | until the account is deleted, for suspended accounts up to 3 years |
3. No trackers
We use no trackers, no analytics and no ad networks. Fonts are served from our own server; no font is loaded from a third-party server.
4. Cookies
We set exactly one cookie: for signing in. It is technically necessary, which means no consent is required (section 25(2) no. 2 German Telecommunications Digital Services Data Protection Act), and that is why we show no cookie banner.
5. Recipients
| Name | Location | Task | Basis |
|---|---|---|---|
| Google Cloud (Cloud Run, Firebase Hosting, Cloud Storage) | Ireland, Frankfurt data centre | Running the application, photos and receipts | Processing on our behalf |
| Supabase | USA, Frankfurt data centre | Database | Processing on our behalf |
| Apple (only with "Sign in with Apple") | EU, Ireland | Signing in | own responsibility, at your request |
| Google (only with "Sign in with Google" and for push notifications on Android) | EU, Ireland; transfer to the USA under the EU-US Data Privacy Framework | Signing in, delivering notifications | own responsibility for signing in, otherwise processor |
| Apple (push notifications on iOS) | EU, Ireland; transfer to the USA under the EU-US Data Privacy Framework | Delivering notifications | processor |
| Stripe Payments Europe | EU | Payments | Processing on our behalf; independent controller for Stripe Connect (payout accounts, identity verification), see stripe.com/privacy |
| ALL-INKL.COM | Germany | Sending emails | Processing on our behalf |
| OpenStreetMap Foundation, via Nominatim | United Kingdom | Turning the address you enter into coordinates, server-side, without your IP address | Article 6(1)(b) GDPR |
| FOSSGIS e.V. (Overpass API), app only and only with the "Public parking" filter on | Germany | Loading free public and disabled parking from OpenStreetMap around the map centre; the map centre coordinates and your IP address are sent | Article 6(1)(b) GDPR |
Those are all recipients. For recipients outside the EU: a data processing agreement and standard contractual clauses, checked before going live.
6. How long we store data
Invoicing and booking data for ten years (section 147 German Fiscal Code). Photos for 90 days after the booking ends. Licence plates for 90 days after the booking ends. Messages and sent emails for three years (section 195 German Civil Code). The account until it is deleted, and afterwards only what has to be kept for tax purposes. You can delete the account yourself in the app (Account tab) or on the website under /konto/loeschen. Name, email address, sign-in data and the host address are then removed; booking data remain in the account without a name for the statutory periods.
7. What we protect in particular
The key box code is stored encrypted, every time it is shown this is logged, and the authorisation is withdrawn once the contract ends. The exact address of a parking space only becomes visible after a viewing confirmed by both sides; publicly, a point offset by up to 180 metres is shown.
8. Report to the tax authorities
Sostivo is run by a sole proprietorship and, according to the German Federal Central Tax Office, is therefore not a reporting platform operator under the Platform Tax Transparency Act (sections 3(2) and 6(1)). We do not collect a tax identification number or date of birth and do not report hosts to the Federal Central Tax Office. Such details collected earlier have been deleted.
9. Your rights
Access (article 15 GDPR), rectification (article 16), erasure (article 17), restriction (article 18), data portability (article 20), objection (article 21), and a complaint to the supervisory authority (article 77). The competent authority is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht) in Ansbach.
10. Obligation to provide data
Without an account, an address and payment details no contract can be concluded; without a payout account no payout can run (article 13(2)(e) GDPR).
11. No automated decisions
The vehicle fit calculation compares dimensions; it does not decide anything about a person within the meaning of article 22 GDPR. If you pay with a card that already belongs to the host’s account or to a suspended account, the booking does not go through and you get a full refund; a person reviews every such case, and you can tell us your side at info@sostivo.de.
Our role as a broker
- Sostivo only brokers. The rental agreement for a parking space is concluded exclusively between the driver and the host. Sostivo is not a party to it, not the host and not the representative of either side.
- Each side alone is responsible for the details in its listing, for the condition, access and usability of a parking space and for the behaviour of drivers and hosts. Sostivo does not review listings in advance.
- Damage to a vehicle, to the property or to third parties is settled between driver and host and through their own insurers. Sostivo does not offer insurance cover.
- Whether your own insurance covers renting out or renting a parking space is for you to clarify with your insurer.
- Sostivo does not provide legal or tax advice.
Contact: info@sostivo.de.