Privacy Policy

Your data protection rights

Effective from: January 1, 2025
Last updated: October 20, 2026
GDPR compliant

Chapter overview

Introduction and controller
Registration and data collection
Legal bases for processing
Disclosure of data to third parties
Disclosure and sharing
International data transfers
Security measures
Storage period and erasure
Your rights as a data subject (GDPR)
Cookies and mobile identifiers
Protection of minors’ privacy
Changes to this privacy policy
Contact and responsibilities

1. Introduction and controller

Protecting your personal data is of the utmost importance to us. This privacy policy explains how Santi Technologies UG (haftungsbeschränkt) (hereinafter “NomadPost”, “we” or “us”) collects, uses and protects your personal data when you use our peer-to-peer platform and the related services.

We process your data exclusively on the basis of statutory provisions, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1.1 Controller for data processing

The controller within the meaning of the GDPR is:

Santi Technologies UG (haftungsbeschränkt)
Schwanseestr.6
81539, München

Represented by the managing directors:
Sergej Scherer

Contact:
Email: info@nomadpost.de
Phone: +49 155 68405230
Website: www.nomadpost.de

2. Registration and data collection

Use of the platform requires registration. The user is obliged to provide the requested basic data (first and last name, email address, telephone number and, where applicable, a profile photo) truthfully. This personal data is stored and processed on the provider’s own servers (hosted by Hetzner Online GmbH, Germany).

2.1 Identity verification

(1) Infrastructure, authentication, push and diagnostics: Account registration and session authentication are handled by NomadPost’s own backend (servers hosted by Hetzner Online GmbH, Germany). Optional sign-in with Google or Apple uses those providers’ authentication services; NomadPost verifies the resulting tokens on its servers. Separately, the app uses Google Firebase (Google Ireland Limited) for push notifications (Firebase Cloud Messaging), crash reporting (Firebase Crashlytics) and, where enabled in a given build, remote configuration. In that context, device and app identifiers, push tokens and diagnostic/crash data may be processed to deliver notifications and improve stability. Firebase is not used as the primary login system for email/password accounts.

(2) Identity verification service provider: To ensure platform security and to carry out the necessary identity checks, Nomad Post uses a specialised identity verification service provider that acts as a processor on our behalf under a data processing agreement (Art. 28 GDPR). During verification you photograph your identity document and record a short selfie video in the app. The service provider checks the authenticity of the document, compares your face with the photo on the document (face match) and checks that a real person is present (liveness check). For this purpose it processes the data on the document (e.g. name, date of birth, nationality, document number, document photo), the selfie recordings and technical device data.

(3) Biometric data and consent: Face matching and the liveness check involve biometric data (Art. 9 GDPR). This processing is carried out only on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give before the verification starts. You can withdraw your consent at any time with effect for the future; without successful verification, however, full use of the service is not possible.

(4) Phone number verification: To confirm your telephone number, we pass it to the identity verification service provider, which sends you a one-time code by SMS or messaging service via telecommunications providers and may check whether the number is a disposable or virtual number. Nomad Post stores the verified number and the time of verification. The number is not shown to other users.

(5) Data separation and storage: Nomad Post (including the servers used at Hetzner) does not at any time store biometric data (e.g. face scans), images or copies of identity documents, or complete financial data. This sensitive information is collected and processed exclusively by the identity verification service provider and, for payments, by Stripe. Nomad Post only receives and stores the verification result (status and date), a reference to the verification process and the transaction IDs required for billing. The identity verification service provider keeps verification data only as long as necessary for the verification and as evidence of it, in accordance with the agreed retention periods.

(6) Duty to cooperate and access protection: The user is obliged to provide truthful information during verification. Successful identity verification is a prerequisite for full use of the service. The user is obliged to protect their login credentials from unauthorised access. The user is liable for abusive actions carried out under their profile if they enabled the abuse by breaching their duty of care and cannot prove that they are not at fault.

2.2 Payment terms

(1) Payment processing: Billing for paid services is handled via the technical payment service provider Stripe Payments Europe, Ltd. (“Stripe”). This may also include processing via services connected to Stripe such as Apple Pay or Google Pay. Stripe’s terms of business apply additionally, available at https://stripe.com/legal/link.

(2) Data separation: Nomad Post does not at any time store the user’s credit card information, account data or other sensitive financial data on its own systems (Hetzner). Entry of this data takes place exclusively via Stripe’s encrypted interface. Nomad Post only collects and stores on its own servers the basic data necessary for user management (name, email, telephone number, profile photo and account settings).

(3) Liability for third-party providers: Nomad Post accepts no liability for the permanent availability, technical faultlessness or correct processing by the external payment service provider Stripe or the technical framework used (Google), unless Nomad Post is itself responsible for the disruption.

(4) User responsibility: The user is responsible for the secure storage of their login credentials (email and password) and for keeping payment methods stored with Stripe up to date.

2.3 Chat messages

Messages you send or receive through the app’s chat function in connection with brokered orders are stored and processed on NomadPost servers (hosted by Hetzner Online GmbH, Germany). The app may also keep a local copy (cache) on your device for faster display; ongoing storage and processing take place on our servers as described. Legal bases: primarily performance of a contract and our legitimate interests in documenting communication in the context of brokerage (Art. 6(1)(b) and (f) GDPR).

Local chat cache: The cache is used to redisplay the conversation (e.g. faster rebuild after restarting the app) and does not replace full, authoritative storage on our servers. We do not receive the local cache solely for caching purposes; content is transmitted when you send and receive messages via our servers as described above. You can remove the local chat cache by clearing app data or uninstalling the app (depending on your operating system).

3. Legal bases for processing

(1) We process your personal data only where a legal basis permits it. In the context of our platform we rely on the following legal bases under the GDPR:

(2) Consent (Art. 6(1)(a) GDPR): Where you have given us explicit consent (e.g. for marketing newsletters or non-essential cookies). This may be withdrawn at any time.

(3) Performance of a contract (Art. 6(1)(b) GDPR): This is the primary basis for use of the app. We process your data (name, email, telephone number, app settings and payment data via Stripe and verification data via our identity verification service provider) to enable registration, identity verification and the brokering and handling of delivery orders.

(4) Legal obligation (Art. 6(1)(c) GDPR): To fulfil statutory duties (e.g. tax retention or sanctions list checks via Stripe).

(5) Legitimate interests (Art. 6(1)(f) GDPR): We process data to safeguard our legitimate interests where your interests do not override ours. This includes fraud prevention, IT security on our Hetzner servers, ongoing service optimisation and displaying a profile photo to build trust within the community.

4. Disclosure of data to third parties

Your personal data is transferred to third parties only for the purposes listed below. Data is not shared for marketing purposes with third parties without your explicit consent.

4.1 Disclosure to other users (peer-to-peer handling)

Because NomadPost is a brokerage platform, certain data must be shared with the respective contracting party (sender or carrier) to perform a delivery order:

Visible data: For preliminary contact, potential contracting parties see your first name as well as travel and package details.

Contact data: Sensitive data such as your telephone number is transmitted to the contracting party only after explicit release or binding conclusion of an order, to enable handover coordination.

4.2 Disclosure to external service providers (processors)

We use external service providers who support us in providing our services:

Payment service provider: As described in Section 2.2, payment data are processed directly by Stripe Payments Europe, Ltd. Any transfer by us occurs only in the context of the technical interface connection.

Identity verification service provider: As described in Section 2.1, identity document, selfie and phone verification data are processed by a specialised identity verification service provider on our behalf. We have a data processing agreement with it pursuant to Art. 28 GDPR.

Infrastructure partners: Our basic data is stored with Hetzner Online GmbH (server location Germany). Push notifications, crash reporting and (where enabled) remote configuration are supported via Google Ireland Limited (Firebase Cloud Messaging / Crashlytics / Remote Config). We have appropriate data processing agreements (DPAs) with these partners pursuant to Art. 28 GDPR.

5. Disclosure and sharing

(1) We disclose your data only where this is technically necessary to provide our services or required by law:

(2) Other users (peer-to-peer): For arranging and performing deliveries, first names, profile photos, verification status and ratings are shared. Sensitive contact data (telephone/email) is transmitted only after a binding contract is concluded or explicit release.

(3) Payment and verification partners: As described in Sec. 2, payments are processed via Stripe Payments Europe, Ltd. (Ireland/USA), and identity and phone verification via our identity verification service provider (Sec. 2.1).

(4) IT service providers: We use infrastructure from Hetzner Online GmbH (server location Germany) and Google Ireland Limited (Firebase for push, crash reporting and optional remote configuration). We have DPAs with these partners.

(5) Authorities: Disclosure occurs where we are legally obliged to do so (e.g. on order of law enforcement or to fulfil tax reporting duties).

6. International data transfers

Where we use service providers whose headquarters are outside the European Economic Area (EEA) (e.g. USA), we ensure an adequate level of data protection. Transfers are based on:

Adequacy decisions of the EU Commission: In particular the EU-U.S. Data Privacy Framework, where the provider (e.g. Google, Stripe) is certified under it.

Standard contractual clauses (SCCs): Additional contractual safeguards for the level of protection pursuant to Art. 46 GDPR.

Explicit consent: Where you have given prior consent to a specific transfer in an individual case.

7. Security measures

To protect your data from unauthorised access, loss or misuse, we implement extensive technical and organisational measures (TOMs):

(1) Server location Germany: Our main databases are operated by Hetzner Online GmbH in ISO 27001-certified data centres in Germany.

(2) Encryption: All data transfers between the app and our servers and to our payment and identity verification service providers use TLS/SSL encryption. Sensitive data is stored encrypted in our databases (encryption at rest).

(3) Access control: Access to user data is internally strictly limited to what is necessary (need-to-know) and secured with multi-factor authentication (MFA).

(4) Monitoring: We conduct regular security reviews of the technical infrastructure.

8. Storage period and erasure

(1) We erase your personal data once the purpose of storage no longer applies, unless statutory retention obligations prevent erasure. In that case, processing is restricted (blocking) instead of erasure.

(2) User profile & identity data: Stored for the duration of active registration. For identity verification, Nomad Post itself stores only the result, not images of documents or selfies. After account deletion these data are erased unless legal evidence or retention duties prevent this.

(3) Tax and commercial records: Invoice and transaction data are retained for 10 years pursuant to Section 147 of the German Fiscal Code (AO).

(4) Contract documents: Documents relating to brokered orders are archived for 6 years under commercial law periods.

(5) Server log files: Technical log data are stored for security reasons for a maximum of 14 to 30 days and then automatically deleted.

(6) How to request account deletion: You can request deletion of your NomadPost account and associated personal data as follows:

In the app: open Profile → Account → Delete profile, confirm by typing the required word, and submit the request. After you submit, you are signed out. A grace period of 30 days applies as shown in the app; during that period you may reactivate your profile; thereafter data are erased subject to statutory retention (see above).
By email: write to info@nomadpost.de from the email address registered on your account and clearly request account deletion. We will process the request under Art. 17 GDPR without undue delay and at the latest within one month.

Uninstalling the app alone does not delete your account on our servers.

9. Your rights as a data subject (GDPR)

As a user of our platform you have comprehensive rights regarding the processing of your personal data. To exercise these rights you may contact us at any time at info@nomadpost.de.

(1) Right of access (Art. 15 GDPR): You have the right to obtain confirmation as to whether we process personal data concerning you, and to receive a copy of that data and further information.

(2) Right to rectification (Art. 16 GDPR): You may request completion or correction of inaccurate data.

(3) Right to erasure (Art. 17 GDPR): You may request erasure of your data unless statutory retention obligations (e.g. 10 years for invoice data) prevent this.

(4) Right to restriction of processing (Art. 18 GDPR): You may request that we process your data only in a restricted manner (e.g. while we verify accuracy).

(5) Right to data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used and machine-readable format or to have it transmitted to another controller.

(6) Right to object (Art. 21 GDPR): You may object to processing of your data on grounds relating to your particular situation where processing is based on our legitimate interests.

(7) Right to withdraw consent (Art. 7(3) GDPR): Consents given (e.g. for marketing) may be withdrawn at any time with effect for the future.

(8) Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (BayLDA).

Processing period: We will handle your requests without undue delay and at the latest within the statutory period of one month.

10. Cookies and mobile identifiers

Our app uses technologies (cookies, local storage and mobile IDs) to ensure the security and functionality of the platform.

(1) Essential technologies: These are strictly necessary to provide basic functions such as login and session management with our backend, secure token storage on the device, push notification delivery (including Firebase Cloud Messaging where used), crash diagnostics (Firebase Crashlytics) and security barriers. Without these technologies, use of the app is not possible.

(2) Analytics and preference technologies: Where you have consented, we use technologies to create anonymised usage statistics and to store your language settings.

(3) Control: In your device settings or in the app settings you can disable non-essential identifiers at any time.

(4) Postal handover address (local device cache): When you save postal handover details for delivery by mail (recipient name, street, house number, postal code, city, country) in your trip settings, the app stores a copy of the last successfully saved values locally on your device (using the platform’s standard app storage mechanisms, e.g. similar to preferences on Android/iOS). This makes it easier to reuse the same address when you configure another trip. This local cache is not sent to us solely for caching; your data is transmitted to our servers only when you explicitly save handover or trip settings in the app, as described elsewhere in this policy. Other users do not receive this cache. You can replace the cached values by saving a new address, or remove them by clearing the app’s data or uninstalling the app (depending on your operating system). Legal bases: performance of a contract and our legitimate interest in a convenient user experience (Art. 6(1)(b) and (f) GDPR).

(5) Fonts: The app uses the typefaces Inter and Outfit. The font files are bundled with the app and are loaded locally from your device. No fonts are downloaded from Google Fonts or any other external server, and no data is transmitted to third parties for this purpose.

11. Protection of minors’ privacy

Our platform is directed exclusively at persons who have reached the age of 18. We do not knowingly collect personal data from minors. If we learn that a minor has submitted data contrary to our terms of use, we will delete it without delay. Please contact us with any such indications at info@nomadpost.de.

12. Changes to this privacy policy

We reserve the right to adapt this policy to reflect changes in the legal situation or technical extensions of our app. Material changes will be communicated to you in good time by email or by a clear notice within the app. Where explicit consent is required for a change, we will obtain it separately. The current version is always available in the app.

13. Contact and responsibilities

If you have questions about data protection or wish to exercise your rights, please contact:

Controller:
Santi Technologies UG (haftungsbeschränkt)
Schwanseestr.6
81539 München, Deutschland
Email: info@nomadpost.de
Phone: +49 155 68405230

Legal representatives:
Sergej Scherer

Data protection officer:
A statutory data protection officer is currently not appointed because the legal requirements (number of employees under Section 38 BDSG) are not met. Requests are handled directly by management at info@nomadpost.de.

Supervisory authority:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach
Postfach 1349, 91504 Ansbach

Additional information on the website nomadpost.de

(1) Hosting and server logs: When you visit our website, our web server (hosted by Hetzner Online GmbH, Germany) automatically processes technical access data: IP address, date and time, requested file, amount of data transferred, browser type and referrer. This is necessary to deliver the website and to keep it secure (Art. 6(1)(f) GDPR). The data is kept only as long as needed for that purpose.

(2) Fonts: The website uses the typefaces Inter and Outfit. The font files are stored on our own server and loaded from there. No connection to Google Fonts or any other third-party font server is made, and no data is transmitted to third parties for this purpose.

(3) Language setting: If you choose a language, we store your choice in a cookie (np_lang, one year) and in your browser’s local storage so that the website is shown in your language on your next visit. This is needed to provide the function you requested (Section 25(2) no. 2 TDDDG). It contains no personal data and is not used for tracking.

(4) No tracking and no third-party content: We do not use analytics, advertising or tracking tools on the website. Videos, images and scripts are served from our own server; no maps, social-media plug-ins or other third-party content are embedded.

(5) Waitlist by e-mail: If you write to us to join the waitlist, we process your e-mail address and your message to inform you when the app is available (Art. 6(1)(a) and (b) GDPR). You can withdraw at any time and ask us to delete your data by writing to info@nomadpost.de.