Last version: April 2026
In accordance with applicable data protection regulations, this Privacy Policy aims to help you understand how your personal data is processed depending on the type of data subject.
CARNECT is the trading name of MicroNexus GmbH (hereinafter, “CARNECT”) whose registered number is 4391036 and whose registered address at CS Business Center, 5th Fl, Hohe Bleichen 22, 20354 Hamburg (Germany).
The Data Controller for the processing of the personal data you have provided us is CARNECT.
CARNECT belongs to a group of companies, referred altogether as HBX GROUP (hereinafter, “HBX GROUP”). HBX GROUP, and therefore, CARNECT has a Global Data Protection Officer to respond to any queries, requests or clarifications regarding the processing of personal data that may be made by CARNECT in the following email address dataprotection@carnect.com or at our postal address, mentioned in the paragraph above.
The personal data processed will be that which you provide to us through the various channels that CARNECT makes available to you.
For compliance purposes and Know Your Business (KYB) activities, we may obtain personal data from third parties (such as service providers) for fraud detection and prevention purposes.
When you visit the CARNECT site various technologies are used to collect and store information, which may include the use of cookies or similar technologies to identify your browser or device. You can obtain more information in our Cookie Policy.
The categories of data, purposes and applicable legal basis are detailed below according to each data subject.
a) Performance of a contract or application of pre-contractual measures:
b) Legitimate interests:
c) Consent (where required):
a) Legitimate interest:
a) Consent
b) Necessity
a) Performance of the terms and conditions of the social network
a) Legal obligations
Note on legitimate interest: when legitimate interest is the legal basis, we ensure your interests, fundamental rights and freedoms do not override our legitimate interests through a balancing assessment. You may request more information by contacting our DPO (section 9).
If you fail to provide information that is a statutory or contractual requirement, or required to enter into a contract, we may not be able to provide the requested service or information, or enter into a contract, as applicable.
We may disclose your personal data to the recipient groups below, depending on the services provided and the nature of our relationship with you. All providers acting on our behalf process personal data under our instructions and are bound by appropriate confidentiality and data processing obligations.
a) Screening and compliance data base services
b) For the provision of the services
a) Audit companies
b) Structural changes / business transfers
c) Intra‑group sharing (HBX GROUP entities)
CARNECT shares your personal data only with suppliers and third parties essential for providing contracted services, all under confidentiality agreements and legal requirements. We will not share your data with any other third parties without your consent, except when required by law or contract. If in the future sharing data becomes necessary, CARNECT will notify you promptly.
CARNECT works with suppliers outside the European Economic Area, the UK, and Switzerland if their data protection regulations are deemed equivalent by relevant authorities. If suppliers are in countries without such equivalence, CARNECT ensures all required privacy safeguards are in place after verifying local laws. Sometimes, your data is transferred abroad when necessary for booking or fulfilling contracts, such as sharing details with hotels or partners in your chosen destination.
Safeguards may include contractual clauses, extra guarantees, or binding corporate rules approved by data protection authorities. For EEA citizens, these clauses are available here: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914&from=EN. Regulations also permit us to transfer your data internationally when needed to deliver requested services.
We also inform you that HBX GROUP has companies outside the European Union, the United Kingdom or Switzerland. In such cases, HBX GROUP requires these companies to comply with appropriate measures to protect your personal data in accordance with European regulations.
For more information about your privacy guarantees, or the destination countries to which we need to transfer your data in order to fulfil our contractual obligations to you, you can contact HBX GROUP at the addresses indicated in section 9 of this Privacy Policy.
CARNECT uses automated processing to build a profile of your interests and preferences when we send certain marketing communications. In some cases, this profiling may affect you legally or in a similar way, because it determines the type of offers or marketing content you receive.
What this means in practice: we analyse information such as your interactions with our content and services and, where relevant, booking-related preferences to place you into broad segments. This profiling is general, not specific or exhaustive, and is intended to tailor marketing communications rather than to produce detailed conclusions about you.
You may exercise your rights (including the right to object where applicable) by contacting us via the details in section 9.
We will keep your personal data only for as long as necessary for the purposes for which it was collected and to comply with statutory limitation and retention periods authorised by law, or until you withdraw consent where applicable. We retain personal data for a maximum of 10 years (statutory period referenced in relation to certain tax‑related offences), although shorter retention periods may apply in specific circumstances not linked to our contractual relationship.
In some circumstances, we anonymise personal data so it can no longer be linked to you and may continue to use it in anonymised form. When we no longer need personal data, we securely delete or destroy it.
CARNECT retains data for the duration of your relationship with CARNECT and, thereafter, until the statute of limitations on any legal liability arising from that relationship expires. For more information on specific retention periods, please contact us using the details in section 9.
You may exercise, with respect to the data collected, the rights of access, rectification, object, deletion, limitation and portability of data, in accordance with the regulations on data protection and withdraw your consent, as well as the right to define directives regarding the fate of your data after your death. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
These rights may be exercised by sending a communication:
Furthermore, if you consider that the processing of your personal data violates the regulations or your privacy rights, you can file a complaint:
CARNECT reserves the right to revise this Privacy Policy at any time it deems appropriate, in order to reflect regulatory changes, best practices or to update personal data processing activities. You will be informed of such updates in accordance with regulatory requirements, in the event that your rights are significantly affected as a result of such modification or update.