Privacy policy

Status: May 2026

1. responsible body

The controller responsible for data processing on this website is

Fuchs Fabio, Rieckmann Ben Dierk GbR
Beethovenstrasse 6
63768 Hösbach
Germany
Phone: +49 6021 3274507
e-mail: info@x-crate.com

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2. overview of processing

The following information provides an overview of what types of data we process, for what purposes and on what legal basis:

  • Website visitors: Technical access data (IP address, browser, page views) for the provision of the website
  • booking customers (pay-per-use): Name, e-mail address, booking data, payment data (via Stripe), PIN code, return data and photo
  • Contact enquiries: Name, e-mail, message content
  • Game suggestions: Name, e-mail, transmitted content
3. hosting

This website is hosted by dogado GmbH, Antonio-Segni-Straße 11, 44263 Dortmund, Germany. When you visit the website, technical data (including IP address, browser, operating system, time of access) is automatically stored on the hoster's servers. Processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR (legitimate interest in the secure and stable provision of the website) and Art. 6 para. 1 lit. b GDPR (fulfilment of contract). We have concluded an order processing contract (AVV) with dogado in accordance with Art. 28 GDPR.

4. booking & pay-per-use (contract data)
What data is processed?

When you book an X-Crate Box via our online booking form, we collect and process the following personal data:

  • E-mail address (for booking confirmation, PIN delivery and further communication)
  • Booked location and utilisation period
  • Payment data (processed exclusively via Stripe, see section 5)
  • Generated PIN code for opening the lock
  • Time and status of the return
  • Photo of the condition of the box (uploaded by the user when completing the digital return process)
Purpose & legal basis

The processing is carried out to fulfil the rental contract (booking processing, PIN delivery, return process, deposit processing) on the basis of Art. 6 para. 1 lit. b GDPR. The return photo is processed to document the condition of the box and to secure claims for damages on the basis of Art. 6 para. 1 lit. b and lit. f GDPR (legitimate interest).

Storage duration

Accounting and payment data are stored in accordance with the tax retention obligations pursuant to Section 147 AO and Section 257 HGB for the duration of 10 years stored. Return photos will be deleted after the respective booking process has been completed and any warranty periods have expired, but after 12 months at the latest, provided there are no disputed claims.

5. payment processing via Stripe

Payment processing for pay-per-use bookings takes place via Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (for customers in Europe), and Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA.

What data is transmitted to Stripe?

The following data is transmitted to Stripe as part of payment processing:

  • E-mail address
  • Payment data (credit card or other payment information)
  • Booking amount and time
  • IP address and technical device data (collected directly by Stripe)

At no time does X-CRATE have access to complete payment data (e.g. complete card numbers). These are processed and stored exclusively by Stripe.

Legal basis & purpose

The data is transmitted to Stripe for the fulfilment of the contract (payment processing and deposit management) on the basis of Art. 6 para. 1 lit. b GDPR.

Data transfer to the USA

Stripe, Inc. is based in the USA. The data transfer takes place on the basis of the Standard Contractual Clauses (SCC) approved by the EU Commission in accordance with Art. 46 para. 2 lit. c GDPR. Stripe is also certified under the EU-U.S. Data Privacy Framework.

Further information on data protection at Stripe can be found at: https://stripe.com/de/privacy

6. e-mail communication

As part of the booking and returns process, we will send the following emails to the email address provided at the time of booking:

  • Booking confirmation - with PIN code, booking details and return link (immediately after booking completion)
  • Return reminder - approx. 30 minutes after the end of the booked usage time, if no return has taken place
  • Return confirmation - after successful completion of the return process, including information on the deposit refund
  • Deposit retention notification - if the return obligation is not fulfilled within 48 hours of the end of the booking

The processing of the e-mail address for this purpose is based on Art. 6 para. 1 lit. b GDPR (fulfilment of contract). Separate consent is not required, as the emails are used directly to fulfil the rental contract.

7. contact form & game suggestions

If you contact us via our contact form or the form for submitting game suggestions, we will process the data you provide (name, e-mail address, message content) exclusively for the purpose of processing your enquiry or viewing and evaluating the game suggestion. The data will not be passed on to third parties.

Legal basis: Art. 6 para. 1 lit. a GDPR (consent) for game suggestions; Art. 6 para. 1 lit. b or lit. f GDPR for general contact enquiries. You can revoke your consent at any time with effect for the future by sending an email to info@x-crate.com revoked.

8. SSL & TLS encryption

This website uses SSL or TLS encryption for security reasons. You can recognise an encrypted connection by the „https://“ in the address bar of your browser and the padlock symbol. As long as SSL encryption is active, data that you transmit to us cannot be read by third parties.

9. cookies

Our website uses cookies. Cookies are small text files that are stored on your end device.

Technically necessary cookies are stored on the basis of Art. 6 para. 1 lit. f GDPR and are required for the operation of the website (e.g. session cookies for the booking process).

Analysis and marketing cookies are only set with your consent (Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TDDDG). You can revoke your consent at any time via the cookie settings on our website.

You can configure your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser.

10. analysis tools
WP Statistics

This website uses WP Statistics (provider: Veronalabs, Estonia, veronalabs.com) for the anonymised evaluation of visitor access. IP addresses are anonymised before storage. All data is processed exclusively on our server and not passed on to third parties. Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in improving our offer).

11. plugins and external services
Google Fonts

This website uses Google Fonts for the standardised display of fonts. When the fonts are loaded, a connection is established to the servers of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Your IP address may be transmitted to Google in the process.

Legal basis: Art. 6 para. 1 lit. f GDPR. Further information: https://policies.google.com/privacy

Google Maps

This website uses Google Maps (provider: Google LLC, USA) to display interactive maps. By using Google Maps, personal data (in particular your IP address) may be transmitted to Google servers in the USA. The use is based on Art. 6 para. 1 lit. f GDPR. Google Maps is only loaded after your active consent. Further information: https://policies.google.com/privacy

hCaptcha

We use hCaptcha (provider: Intuition Machines, Inc, 350 Alabama Street, San Francisco, CA 94110, USA) to protect our forms from automated input (bot protection). hCaptcha analyses the behaviour of website visitors based on various characteristics. The processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR (legitimate interest in the security of our website). Further information: https://www.hcaptcha.com/privacy

12. your rights as a data subject

You have the following rights vis-à-vis X-CRATE with regard to your personal data:

  • Right to information (Art. 15 GDPR): You can request information about the data stored by us.
  • Right to rectification (Art. 16 GDPR): You can request the correction of incorrect data.
  • Right to cancellation (Art. 17 GDPR): You can request the erasure of your data, provided that there are no statutory retention obligations to the contrary.
  • Right to restriction of processing (Art. 18 GDPR): You can request the restriction of processing under certain conditions.
  • Right to data portability (Art. 20 GDPR): You can receive your data in a machine-readable format or have it transferred to another controller.
  • Right of objection (Art. 21 GDPR): You can object to the processing of your data, which is carried out on the basis of Art. 6 para. 1 lit. f GDPR, at any time.
  • Revocation of consent (Art. 7 para. 3 GDPR): You can revoke your consent at any time with effect for the future.

To exercise your rights, please contact: info@x-crate.com

13. right of appeal to the supervisory authority

In the event of violations of the GDPR, you have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority of your usual place of residence, your place of work or the place of the alleged infringement is responsible.

Competent supervisory authority for X-CRATE (Bavaria):
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach
www.lda.bayern.de

14. changes to this privacy policy

We reserve the right to amend this privacy policy if legal requirements or our data processing processes change. The current version is available on this page. We recommend that you check the privacy policy regularly.

X-CRATE | Fuchs Fabio, Rieckmann Ben Dierk GbR
Beethovenstraße 6, 63768 Hösbach, Germany
e-mail: info@x-crate.com | Web: www.x-crate.com

Scroll to Top