Privacy policy

Controller

The controller under the GDPR is ZusammenStromen GmbH, Holzdamm 40, 20099 Hamburg, Germany, email info@zusammenstromen.de. FarePath is a project of ZusammenStromen GmbH. All provider details are in the legal notice.

ZusammenStromen GmbH has appointed an external data protection officer, Dr. Marschall (GDPC – Marschall und Blazy GbR, Ludwig-Erhard-Straße 12, 34131 Kassel). You can reach the data protection officer by email at datenschutz@zusammenstromen.de, or by post with the note “Datenschutzbeauftragter (vertraulich)”.

What this website processes

This website consists of static pages. It loads no JavaScript and stores nothing on your device: no cookies, no local storage. Personal data arises because your browser connects to the server to fetch the pages, and when you send the early-access form or write to us. Our server also counts page requests (see “Visit counting with PostHog”).

Hosting at Northflank

The website is hosted at Northflank (Northflank Ltd., 20-22 Wenlock Road, London N1 7GU, United Kingdom). It runs in Northflank’s Frankfurt region, in a Google Cloud data centre in Germany that Northflank uses for it. Northflank processes data on our behalf as a processor (Art. 28 GDPR).

Every page request passes through Northflank’s network before it reaches our server. To deliver the page, Northflank processes:

• the IP address of the requesting device
• the date and time of the request
• the requested address (URL) and the HTTP status code
• the amount of data transferred
• the page visited before (referrer), if your browser sends it
• browser and operating system (user agent)

Our own server keeps no access log. It logs a page request only when its visit count cannot be sent to PostHog, and that entry holds only the error, nothing about you. Northflank’s platform logs can contain request data, and Northflank keeps those logs for up to 60 days.

The purpose is to deliver the website and to run it securely and reliably, for example to detect and defend against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a functioning and secure website. Without this data the website cannot be delivered.

Northflank Ltd. is based in the United Kingdom. The European Commission has decided that the United Kingdom ensures an adequate level of data protection (Art. 45 GDPR; Implementing Decision (EU) 2021/1772, extended by Implementing Decision (EU) 2025/2574 until 27 December 2031).

Domain name lookups at Cloudflare

The name servers for fare-path.com are run by Cloudflare (Cloudflare, Inc., USA). When your device looks up the website’s address, your DNS resolver, usually run by your internet provider, asks Cloudflare. Cloudflare sees the resolver’s IP address, not yours. Some resolvers also pass on a shortened part of your IP address. Page requests themselves do not pass through Cloudflare. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is that the website can be found under its name. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

Early access form

If you request early access through the form on this website, we process what you enter:

• your name
• your work email address
• the name of your agency
• how many agents handle air servicing
• which GDS you work in
• if you choose to write it, what happened the last time a disruption went badly

and the time you sent it. The purpose is to answer your request and to arrange the call it leads to. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to answer agencies that ask for early access and to prepare a contract with them. Without the required fields we cannot tell whether the early-access offer fits your agency, so the form cannot be sent without them. You can write to us by email instead.

Your request is stored in a database at Northflank in Frankfurt (see “Hosting at Northflank”). Our server’s log records that a request arrived, whether it was stored and whether Slack was notified, never what it contained.

When Slack notifications are switched on, the server sends a copy of each stored request to a channel in our Slack workspace. Slack is provided by Slack Technologies Limited, Dublin, Ireland, which processes the copy on our behalf (Art. 28 GDPR) and stores its data with Slack Technologies, LLC in the USA. That transfer is based on Slack Technologies, LLC’s certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and, in addition, on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

To protect the form from abuse, the server counts requests per IP address and accepts at most five in ten minutes. For this it holds each address that sent the form, for IPv6 only its network part (/64), in memory and never on disk, until the server restarts. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a form that floods of automated requests cannot misuse.

We delete your request, in the database and in Slack, 12 months after our last contact with you, unless it leads to a contract. Twelve months covers an early-access conversation from first call to a decision. If a contract follows, the request and the correspondence about it become business letters, which we keep for six years under § 257 HGB and § 147 AO. Database backups are kept for seven days, so a deleted request is gone from them seven days later. If you ask us to delete your request earlier, we do so unless a legal duty to keep it applies.

Fonts

The fonts on this website (Atkinson Hyperlegible Next, Atkinson Hyperlegible Mono and Archivo) are stored on the same server as the pages and load from there. Your browser opens no connection to third-party servers for them, Google Fonts included.

Visit counting with PostHog

We count how often the pages of this website are visited. Our own server does the counting when it delivers a page. Nothing is stored on your device or read from it for this: no cookies, no local storage, no script. The website therefore needs no consent under § 25 TDDDG.

When our server delivers a page to your browser, it uses data from that request, the same data listed under “Hosting at Northflank”:

• From your IP address (for IPv6 only its network part, /64), your browser’s identification string (user agent) and the website’s host name, it computes a visitor code. The code is a one-way hash (HMAC-SHA-256) with a secret key that our server holds only in its memory, creates at random when it starts and replaces every day at midnight UTC. The old key is not kept anywhere. After the day has passed, nobody, including us, can compute the code again or link it to you or to a later visit.
• Each session gets a random session ID that contains the time the session began. A page view at most 30 minutes after the last one with the same visitor code keeps that session ID. Our server keeps the link between visitor code and session ID in its memory only, for at most 50,000 visitors at a time, and discards all of it with the day’s key at midnight UTC or when the server restarts.

Our server then sends the following to PostHog for each page view:

• the visitor code and the session ID
• the address of the page without its query string, and the website’s host name
• the domain of the website that linked to the page, if your browser sends it (never the full address)
• the campaign tags utm_source, utm_medium and utm_campaign, if the link you followed carried them, each cut to 200 characters
• the time of the request, and whether it was the staging or the live website
• two fixed labels that name the sender: farepath-landing and landing

Your IP address and your browser’s identification string are not passed to PostHog. PostHog receives the request from our server and sees our server’s address, not yours. We tell it not to derive a location and not to create person profiles. Nothing you type into the early-access form is sent. A sent form shows up only as a view of the page that answers it, such as the thank-you page.

We do not count a page view when your browser sends the Global Privacy Control (Sec-GPC: 1) or Do Not Track (DNT: 1) signal, or when it only preloads a page. Requests from programs that are not browsers are usually not counted either, as they lack the headers that a browser sends when you open a page.

We use PostHog’s EU cloud (PostHog Inc., USA), which stores the data on servers in Frankfurt, Germany. PostHog processes it on our behalf as a processor, under a data processing agreement we have concluded with it (Art. 28 GDPR). PostHog Inc. may access the data from the USA. That transfer is based on PostHog Inc.’s certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). We keep the counted page views for at most 25 months and then delete them. That period covers comparing a month with the same month of the year before.

The purpose is to know how many people visit the website, which pages they open and where they come from, so that we can improve the website and judge our campaigns. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is that knowledge. We weighed it against your interests. We build no profiles, do not recognise you on other websites or after the day of your visit, do not identify you, do not pass your IP address on and use a processor that stores the data in the EU.

You can object to this processing at any time under Art. 21(1) GDPR. Switch on Global Privacy Control or Do Not Track in your browser, and we count none of your page views. You can also write to us. Once the day’s key is gone we can no longer tell which counts were yours, so we cannot delete them individually (Art. 11 GDPR).

Logging in to FarePath

The FarePath application, which travel agencies log in to, is a separate service. This policy covers only this website.

Contacting us

If you write to us by email, we process your email address, your name if you give it, and what you write, in order to answer you. Our mailboxes at fare-path.com and zusammenstromen.de are hosted by Google Workspace (Google Cloud EMEA Limited, Dublin, Ireland), which processes the messages on our behalf (Art. 28 GDPR). Google may process data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is answering the messages we receive. We delete your messages on the same schedule as early-access requests.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

No automated decision-making, including profiling under Art. 22 GDPR, takes place.

Right to object. Where we process your data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop, unless we can show compelling legitimate grounds that override your interests, or the processing serves legal claims. An email to info@zusammenstromen.de is enough.

The supervisory authority responsible for ZusammenStromen GmbH is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg, datenschutz-hamburg.de. You may also complain to the authority where you live or work.

This policy was last updated on 7 November 2026.