Controller
The controller within the meaning of Art. 4 no. 7 of the General Data Protection Regulation (GDPR) for the processing of personal data on the "Carrier Space" platform is: Carrier Space Kaiserstraße 1A 53721 Siegburg Germany Phone: +49 16098429799 Email: admin@carrier-space.com
Data Protection Officer
We are not legally required to appoint a data protection officer and have not appointed one (the requirements, in particular of Art. 37 GDPR and sec. 38 BDSG, are not met). Please direct any data protection matters directly to the controller named above.
General information and legal bases
We process personal data in accordance with the principle of data minimization and only to the extent necessary for the respective purposes stated. Depending on the context, the legal basis for the processing is: • Art. 6(1)(b) GDPR, insofar as the processing is necessary for the performance of a contract or for the implementation of pre-contractual measures • Art. 6(1)(a) GDPR, insofar as you have consented to the processing • Art. 6(1)(c) GDPR, insofar as the processing is necessary for compliance with a legal obligation • Art. 6(1)(f) GDPR, insofar as the processing is necessary to safeguard our legitimate interests and your interests do not override them
Access data / server log files
Each time the platform is accessed, technical access data is automatically processed and stored in server log files. This includes in particular: • the IP address of the accessing device • the date and time of access • the requested resource (URL) • the previously visited page (referrer), where transmitted • information about the browser and operating system used (user agent) The processing serves the technical delivery of the pages, the assurance of system stability, and the detection and prevention of misuse; this also includes the logging of login attempts for rate limiting. The legal basis is Art. 6(1)(f) GDPR.
Cookies and session
We use technically necessary cookies, in particular a login or session cookie to maintain your signed-in session, a cookie storing your language preference, and a cookie recording your decision about audience measurement. The legal basis is Art. 6(1)(f) GDPR; storing technically necessary information on your device is permitted without consent under Section 25(2) TDDDG. Any further cookies are set only with your consent. See the section "Audience measurement" for details.
Audience measurement
Our own cookie-free counting To understand which content is used, we count page views ourselves. No cookies are set for this. We store the path called up without query parameters, the host of a referring page, the time spent, and a pseudonymous identifier calculated from your IP address, details of your browser and a secret key, which changes daily. Your IP address itself is not stored; we cannot identify you from this data. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in designing our service according to demand. Google Analytics – only with your consent In addition, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It is used only if you have given your prior consent. Without your consent, no Google service is loaded and no data is transmitted to Google. The data processed includes the pages called up, the time and duration of the visit, the referring page, information on browser, operating system and device type, as well as a shortened IP address and the approximate location at country and region level. Google sets cookies for this purpose with a storage period of up to two years. Advertising features are disabled: we do not use personalised advertising, remarketing, or any merging with advertising data. The corresponding consent types remain permanently switched off. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time with effect for the future by selecting "Privacy settings" in the footer of the website. The lawfulness of processing carried out until withdrawal remains unaffected. A data processing agreement under Art. 28 GDPR is in place with Google. Transfer to Google LLC in the United States cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; by decision of 10 July 2023, the European Commission determined an adequate level of protection for data transferred on this basis. The EU standard contractual clauses under Art. 46 GDPR apply in addition. Usage data stored by Google is deleted automatically after 14 months. For more information on how Google handles user data, see https://policies.google.com/privacy
Registration and account
To set up and maintain a user account, we process the data you provide. The following are stored: • email address • name, first and last name • phone number (optional) • your password exclusively as a cryptographic bcrypt hash (not in plain text) • if activated: information on two-factor authentication (TOTP) • language setting • login timestamp and status of email confirmation • optionally a profile picture The processing serves the provision, administration, and protection of your account. The legal basis is Art. 6(1)(b) GDPR.
Company and billing data
To handle contracts and issue invoices, we process the company data of your organization, in particular company name, VAT identification number, business address and, where applicable, a differing billing address, email domain, and a stored logo. The processing is carried out for the performance of the contract and for compliance with legal obligations, in particular under commercial and tax law. The legal basis is Art. 6(1)(b) and (c) GDPR.
Requests, bookings, and messages
In the course of the mediation and handling, we process the transaction, mission, and payload data you enter, as well as the messages exchanged between customer and provider (in each case content and sender name), and the documents you upload. The processing serves the mediation between customer and provider and the handling of requests and bookings. The legal basis is Art. 6(1)(b) GDPR.
Rideshare Marketplace
If you publish a listing in the Rideshare Marketplace, we process the information you enter about the payload, the target orbit and the time frame, as well as its assignment to your company. Published listings are visible to all signed-in users, including the name of your company; visitors without an account are shown them without the company name, and they may be indexed by search engines. If you contact another company via the marketplace, we process the messages exchanged and make them accessible to the members of the two companies involved. The name of your company is displayed as the sender. We notify the members of the other company about new messages by email; these notifications can be unsubscribed from in the account. The legal basis is Art. 6(1)(b) GDPR insofar as the processing serves to provide the function you use, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in operating the marketplace and in protecting against misuse. Listings and messages are stored until you delete the listing or your company is removed from the platform. After a personal account has been deleted, messages already sent remain available to the companies involved without reference to the person.
Talent Pool
In the Talent Pool, natural persons can publish a profile with details of their professional qualifications. What data we process: When the account is created, we process your email address, the time of your consent to the Terms of Use, their version and your confirmation that you are at least 18 years old. In the profile we process your name, your field of expertise, your highest qualification, your most recent professional position, the length of your professional experience, your country, your statement on interest in assignments in orbit and, if you provide it, the link to an external profile. We do not collect a date of birth, an address, a telephone number, a photo or a curriculum vitae. Please do not enter any information about your health or other particularly sensitive information in the profile or in messages. Sign-in: You sign in with a code that we send to your email address. We do not store a password for this account. To protect against misuse, we log sign-in attempts with time and IP address. Who sees your data: Your professional details, namely field of expertise, qualification, most recent position, professional experience, country and interest in orbit, are publicly visible to all visitors to the platform and may be indexed by search engines. Your name and the link to your external profile are visible only to companies and institutions that we have approved for use of the platform. We do not display your email address to anyone. Messages: Approved companies and institutions can contact you via the messaging function. We store the messages exchanged together with sender and time in order to display the conversation to both sides. We inform you by email about a new message. External profiles: If you provide a link to a profile with another provider, such as LinkedIn, we store only that link. We do not retrieve any data from there. If a company opens the link, the privacy policy of the respective provider applies. Purposes and legal bases: We process the data mentioned in order to provide you with the Talent Pool, that is to publish your profile, to make you findable and to enable contact. The legal basis is Art. 6(1)(b) GDPR. The logging of sign-in attempts and the blocking of abusive profiles are based on our legitimate interest in the secure operation of the platform under Art. 6(1)(f) GDPR. Annual check: Once a year we ask you by email whether your profile is still up to date. If you do not confirm this within 30 days, we hide the profile. It remains stored but is visible to no one but you until you make it visible again or delete it. Storage period and deletion: You can change, hide or delete your profile at any time. On deletion we remove your profile, your account and the messages you have sent. A hidden profile that has not been made visible again for two years is deleted together with the account. Logs of sign-in attempts are deleted after 90 days at the latest. Recipients: Apart from the companies and institutions mentioned above, only our processors for hosting and email delivery have access to your data, to the extent necessary for operation. No data is passed on for advertising purposes. Providing the data is voluntary. Without the information marked as mandatory, we cannot create a profile for you.
Passenger flight: passenger data and aeromedical self-declaration
For passenger flight requests, we process the passenger data required to carry out the flight, in particular name, date of birth, nationality, height, and weight. For reasons of data minimization, the aeromedical self-declaration is stored exclusively as a yes/no confirmation. Diagnoses or other health details are neither collected nor stored. Insofar as the confirmation may have a health-related connection, this constitutes a special category of personal data within the meaning of Art. 9 GDPR. The processing is based on your explicit consent pursuant to Art. 9(2)(a) GDPR and on carrying out the request you have initiated. We limit the processing to the extent strictly necessary for this purpose.
Email dispatch
We send emails to confirm your registration (double opt-in), to reset your password, and to notify you of activities on the platform. For this purpose, we process your email address and keep a dispatch log (recipient address, time, and status of dispatch); time-limited one-time tokens are used for confirmation and reset processes. The legal basis is Art. 6(1)(b) GDPR as well as Art. 6(1)(f) GDPR based on our legitimate interest in a reliable and traceable dispatch of messages.
Hosting and processing on our behalf
The platform is operated by external service providers who process personal data on our behalf and according to our instructions. Data processing agreements under Art. 28 GDPR are in place with them: • Server operation and database: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in the Falkenstein data centre in Germany. • Email delivery and domain management: STRATO AG, Otto-Ostrowski-Strasse 7, 10249 Berlin, Germany Your data is therefore processed exclusively on servers within the Federal Republic of Germany. No transfer to countries outside the EU or the European Economic Area takes place in the context of hosting.
Recipients and disclosure
As part of the mediation, we make the data required for a request or booking accessible to the provider you have selected in each case, so that they can prepare an offer and handle the service. Beyond this, we do not disclose your data to third parties, in particular not for advertising purposes. For the server location and the processors used, see the section "Hosting and data processing"; for audience measurement with Google, see the section "Audience measurement".
Storage period and deletion
We store personal data only for as long as is necessary for the stated purposes or as required by statutory retention periods, in particular those under commercial and tax law. Once the purpose no longer applies and any retention periods have expired, the data is deleted. Your account, including the associated data, can be deleted. Booking records that must be retained for legal reasons are in this case kept without any personal reference.
Your rights
Subject to the statutory requirements, you have the following rights: • access to the data processed about you (Art. 15 GDPR) • rectification of inaccurate or incomplete data (Art. 16 GDPR) • erasure of your data (Art. 17 GDPR) • restriction of processing (Art. 18 GDPR) • data portability (Art. 20 GDPR) • objection to the processing (Art. 21 GDPR) • withdrawal of a consent given, with effect for the future (Art. 7(3) GDPR) To exercise your rights, please contact the contact named under "Controller".
Right to lodge a complaint
Without prejudice to any other remedies, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR (Art. 77 GDPR). Competent supervisory authority: State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
Data security
We take appropriate technical and organizational measures to protect your data against loss, misuse, and unauthorized access. Data transmission between your device and our servers is encrypted via TLS/SSL. Passwords are stored exclusively as a cryptographic bcrypt hash. Our security measures are continuously reviewed and adapted in line with technological developments.
Changes to this privacy policy
We will amend this privacy policy as soon as changes in the legal situation or changes in our processing activities make this necessary. The current version published on the platform applies in each case. As of: 30 July 2026