DisHub privacy notice

Version: 24 October 2026. Website, web workspace and Telegram bot @mydishub_bot.

Controller and purpose

Volodymyr Bodnarchuk, sole trader (Einzelunternehmer), Bodnarchuk Media Holding, operating DisHub. Am Vogelherd 6, 90547 Stein, Germany. Privacy contact: volodymyrbmh@gmail.com.

DisHub is an information service: we help find transport information, clarify options and respond to enquiries. DisHub does not perform transport. An enquiry or acceptance of a price option does not itself create a booking, payment or transport contract.

Data and legal grounds

We process your name, telephone, optional email, route, date, description, weight/passenger count, request number and status, options and responses. Telegram additionally provides your user/private chat ID, messages, button selections, language, technical update ID and, where applicable, a TikTok referral label. Do not send identity documents, payment details or health data.

Responding to your request: Article 6(1)(b) GDPR. Access protection and abuse prevention: Article 6(1)(f), our interest in a secure service. Legally required business records: Article 6(1)(c). Optional push notifications: permission under Article 6(1)(a). Acknowledging this notice is not marketing consent.

Recipients and infrastructure

The operator and authorised team members have access according to their roles. The operator may receive request alerts in an internal Telegram bot. Contact details are shared with a specific transport provider only after separate agreement with you. We do not sell contacts or send marketing campaigns.

The website uses Cloudflare Workers and a shared Cloudflare D1 database with EU jurisdiction. Workers, support and network metadata, including IP addresses, may be processed internationally, including in the United States. The Cloudflare DPA is incorporated into service terms and provides transfer safeguards, including SCCs. Subprocessors. D1 jurisdiction does not mean all processing takes place in the EU.

Telegram independently processes data under its privacy policy, stating that users who signed up in the EEA/UK have data stored in the Netherlands; the company is based outside the EEA. Bot chats are not end-to-end encrypted; the Cloudflare DPA does not cover Telegram. Email is an alternative contact channel. Contact the controller for information about safeguards for a particular transfer.

Retention

Unfinished conversations: one hour of inactivity; processed technical updates: seven days; completed delivery queue records: 30 days. Cleanup runs while the service operates. Failed deliveries are reviewed manually; their content is cleared within seven days.

Enquiries without a contract, contacts and related history: during handling and up to 90 days after closure, followed by manual deletion. Enquiries inactive for 90 days are reviewed for closure. Where particular evidence is required by law or for a specific legal claim, only the necessary restricted records are kept until the relevant period or dispute ends.

Cloudflare recovery versions and manual backups may retain deleted information for up to 30 days. Deletions are reapplied after restoration before access resumes. Deleting our database records does not delete Telegram or device copies.

Web workspace and your rights

The necessary dh_sid cookie maintains login; preferences and drafts may be stored locally (§25(2) TDDDG). The public page uses no advertising pixels. Optional push subscriptions contain delivery endpoints and keys and use your browser's provider, such as Google, Mozilla or Apple. Revoke permission in browser settings and disable the subscription in the workspace.

Request type, route and contact are needed to respond. No solely automated decisions with legal effects are made. Subject to GDPR conditions, you may request access, correction, deletion, restriction and portability, object to processing and withdraw consent prospectively. Contact volodymyrbmh@gmail.com; normally we respond within one month, verifying identity where necessary. Complaints: BayLDA or another competent authority.

Shared customer account

The website and Mini App use the same operational database. We store a username, display name, personal/business usage type, service preference, language and optional telephone and email. Passwords and personal recovery codes are stored only as cryptographic derivatives, not plaintext. Email is an unverified contact field; it is not used for login, automatic account merging or recovery.

Telegram identity is checked using Telegram's verified signature. Linking an existing web account requires a separate confirmation and that account's username and password. Both entry points then show one history. Two already registered accounts are not automatically merged. Matching names, phone numbers or emails do not prove account ownership. Customer registration does not grant operator, staff or partner permissions.

Web login uses the necessary __Host-dh_customer cookie (up to eight hours), separate from the internal dh_sid cookie. We process session hashes, technical login-attempt counters and registration, linking and access-change events. Expired sessions are cleared after seven days, counters after 24 hours and access events after 90 days. Profiles remain while the account is used; deletion or closure follows a verified request, while associated enquiries follow the retention periods above. The stated grounds for providing the requested service and protecting access apply. Registration does not constitute marketing consent.