Privacy Policy

Effective Date: January 1, 2026 • Data Controller: Gridsvaultpilt Rail Logistics BV (CHE-482.910.431)

1. Introduction & Regulatory Framework

Gridsvaultpilt Rail Logistics BV ("Gridsvaultpilt", "we", "our", or "us"), operating under the web domain gridsvaultpilt.motorcycles, is committed to safeguarding personal data in accordance with the Swiss Federal Act on Data Protection (FADP), the European General Data Protection Regulation (Regulation (EU) 2016/679 - GDPR), and applicable regional data protection statutes such as the California Consumer Privacy Act (CCPA/CPRA).

This Privacy Policy provides exhaustive transparency regarding the collection, handling, storage, transfer, and deletion of information gathered when you navigate our route matrices, search station connections, and interact with our dispatch infrastructure.

2. Categories of Information We Collect

We restrict our data processing to information strictly necessary for delivering accurate railway navigation telemetry, customer support, and interface optimization:

• Routing Query Telemetry: Origin station, destination station, preferred departure dates, and transit class parameters submitted through search modules.
• Technical Network Telemetry: Internet Protocol (IP) address, approximate geographic location (country/city level), browser user-agent strings, operating system, device screen resolution, referring URLs, and timestamped log files.
• Communication Data: Name, contact email, inquiry subject, and message contents when you submit messages through our Dispatch / Contact portals.
• Client-Side Preferences: Cookie consent selections, UI theme settings, and cached timetable query states stored locally in your browser's localStorage.

3. Legal Basis for Processing (GDPR Article 6)

We process personal data solely when authorized by lawful grounds:

• Contractual Performance (Art. 6(1)(b)): Delivering requested railway timetable calculations, route dossiers, and station guide materials.
• Legitimate Interests (Art. 6(1)(f)): Maintaining server network integrity, preventing denial-of-service disruptions, analyzing platform traffic patterns, and enhancing user interface responsiveness.
• Consent (Art. 6(1)(a)): Executing non-essential analytics tracking or functional cookie persistence when explicitly granted via our cookie management interface.
• Legal Compliance (Art. 6(1)(c)): Retaining business, tax, and inquiry records as required by Swiss corporate and financial regulations.

4. Data Processors & Third-Party Integrations

We do not sell, rent, or lease personal identifiers. We may share processed technical telemetry with vetted infrastructure sub-processors under strict Data Processing Agreements (DPAs):

• Cloud Hosting & CDN Infrastructure: European data center nodes located in Frankfurt (Germany) and Zürich (Switzerland) with encrypted data-at-rest.
• Railway Aggregation APIs: Anonymized origin-destination queries routed to regional railway operators (SBB, SNCF, DB, ÖBB, Trenitalia) to populate timetable tables.

5. International Data Transfers

Where technical data is transferred across international boundaries outside the European Economic Area (EEA) or Switzerland, we enforce Standard Contractual Clauses (SCCs) approved by the European Commission, alongside supplementary technical safeguards including TLS 1.3 in-transit encryption and AES-256 storage encryption.

6. Data Retention Schedules

We retain technical server access logs for no longer than ninety (90) days, after which logs are permanently scrubbed or anonymized. Customer dispatch correspondence is archived for twenty-four (24) months for audit and support continuity before secure deletion.

7. Your Fundamental Privacy Rights

Under the GDPR and Swiss FADP, you possess actionable rights regarding your personal data:

• Right of Access: Obtain confirmation of whether your data is being processed and receive a readable copy.
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure ("Right to be Forgotten"): Request immediate destruction of personal identifiers where lawful processing grounds cease.
• Right to Restriction of Processing: Limit processing activities under specific dispute circumstances.
• Right to Data Portability: Receive your provided data in a structured, machine-readable format (JSON/CSV).
• Right to Object: Oppose processing based on legitimate interests at any time.

8. Data Protection Officer (DPO) Contact

To exercise any statutory privacy rights or submit formal data processing inquiries, contact our designated privacy compliance team: