We appreciate your use of our applications. Below, we would like to inform you about how we handle your data in accordance with Article 13 of the General Data Protection Regulation (GDPR).
The entity named in the legal notice is responsible for the data collection and processing described below:
Verkehrsverbund Bremen/Niedersachsen GmbH (VBN)
Am Wall 165-167
28195 Bremen
Our company data protection officer is available to provide you with information or suggestions on the subject of data protection:
Verkehrsverbund Bremen/Niedersachsen GmbH
E-Mail: datenschutz(at)vbn.de
Telefon: 04 21 / 59 60-0
We store the IP address transmitted by your device for a period of seven days strictly for the purpose of detecting, limiting, and eliminating attacks on our systems. After this period has expired, we delete or anonymize the IP address. The legal basis for this is Article 6(1)(f) GDPR.
When you make queries in our apps, so-called usage data is temporarily stored on our web server as a log for statistical purposes in order to improve the quality of our applications. This data record consists of
We take technical and organizational measures to protect your data from unauthorized access as comprehensively as possible. We use an encryption method in our application. The information you provide is transmitted from your device to our server and vice versa via the Internet using SSL/TLS encryption.
We transfer your data within the scope of order processing in accordance with Article 28 GDPR to service providers who support us in operating our websites (e.g., hosters, internet agencies, web analytics service providers) and the associated processes. Our service providers are strictly bound by our instructions and are contractually obligated accordingly.
In some cases, we transfer personal data to a third country outside the EU. In doing so, we must ensure an adequate level of data protection:
In the case of Google (USA), an adequate level of data protection is ensured by its participation in the Privacy Shield Agreement (Article 45(1) GDPR).
Our apps contain links to websites offered by other providers. You can recognize these, for example, by links from service disruption information to a connection and by the fact that a new browser window opens. Unless these are websites offered by VBN GmbH, the data protection provisions of the respective providers apply. This applies, for example, to links to the websites of our partners.
We integrate the FahrPlaner services of Hacon Ingenieurgesellschaft mbH, Lister Straße 15, 30163 Hannover, into our applications.
When you use the app's functions, a connection is established between your browser (end device) and Hacon's servers. This involves the processing of your data, such as your IP address and the device you are using, as well as your interactions within the FahrPlaner applications. This includes the following app areas: timetable, departures, map, alarm, service area (news), settings/imprint/info.
3.7.1 Tracking
In order to tailor our applications to your needs, we create pseudonymous usage profiles using the Matomo web analysis tool on Hacon's servers. Matomo uses cookies that are stored on your device and can be read by us. This enables us to recognize returning visitors and count them as such. The full IP address is not stored. Data processing is carried out on the basis of Article 6(1)(f) GDPR and Article 15(3) TMG (German Telemedia Act) and in the interest of finding out how often our services have been accessed by different users.
You can object to the processing at any time by selecting the “Record user activities” option in the settings of the FahrPlaner application and confirming the dialog with “No.” In this case, Matomo will not collect any session data. However, if you reinstall our application, this will also delete the tracking setting and you may need to reactivate it.
3.7.2 Praise and criticism
We integrate the services of a web host for the “Praise & Criticism” app section in our applications.
When you access this section, a connection is established between your browser (end device) and the host's servers. This involves the processing of your data, such as your IP address and the device you are using when visiting the site, as well as your interactions within the Praise and Criticism application.
You can also fill out this form without providing any personal data. In this case, a response will not be possible. When submitting the form with personal data, the information under 3.9. Praise and Criticism applies.
3.7.3 Additional permissions and data collection
Please note that when using some app functions, additional permissions are requested and data is subsequently collected and processed.
In order to transfer an address from your device's contacts to the connection search as a start or destination, you must grant the app access to your contacts. Only the selected address (no contact names) is transferred to our servers and used to calculate the timetable information to/from the selected address.
Depending on the operating system, our apps integrate maps from Google Maps (Google Incorporated, USA) for Android and Apple Maps (Apple Incorporated) for iOS. By using these maps, information about your use (in particular the IP address of your device) may be transmitted to a server of the respective third-party company in the USA and stored there. The processing of personal data using technically necessary cookies and your IP address is based on the legal basis of Article 6(1)(f) GDPR and our interest in designing our offering to be as optimal as possible for you. We have no influence on the further processing of data by the respective third-party companies. Please also read the terms of use of Google Maps or Apple Maps if you wish to use the service. If you do not agree to the processing of data by the respective third-party company, please refrain from using the map functions.
The “Camera” permission is required for personalizing the icons in “My Addresses” with your own/captured images. Favorites created in this way are then visible in all areas of the app and can be used quickly and easily for connection searches. Permission is also required to be able to submit your own images/photos in the praise & criticism form. This allows you to better explain your feedback to us with an image.
Based on your location, the app can show you nearby stops, travel options, and service announcements (news). For this purpose, the GPS coordinates determined by your device are transmitted to our servers after you give your consent. This allows you, for example, to query connection requests to/from your current location and display the stops in your vicinity.
When you use the push service, an anonymized device ID is stored on Hacon's servers so that information can be sent to your device. This enables us to notify you of the current traffic situation for the connections you have subscribed to in the event of delays or disruptions.
To provide the push services, Android uses a product from Google Incorporated (USA) called “Google Cloud Messaging” or “Firebase Cloud Messaging,” and iOS uses a product from Apple Incorporated (USA) called “Apple Push Notification service” to send a message to your device when new traffic reports are available. By using these services, information about your use (in particular the IP address of your device) may be transmitted to a server of Google Incorporated or Apple Incorporated in the USA and stored there. We have no influence on the further processing of data by Google Incorporated or Apple Incorporated. Please also read the terms of use of Google or Apple if you wish to use the service. If you do not agree to the processing of data by Google Incorporated or Apple Incorporated, please refrain from using the push functions.
The permissions are not used for any other purposes. You can change your consent at any time in the settings of the app or your device's operating system.
We integrate the services of EOS UPTRADE GmbH, Schanzenstraße 70, 20357 Hamburg, into our applications.
When you use the corresponding functions of the app, a connection is established between your browser (end device) and the servers of EOS UPTRADE. In the process, data about you, such as your IP address and the end device you are using when visiting the site and your interactions, are processed and stored. This includes the following app area: Tickets.
By submitting the registration form and subsequently using the HandyTicket, further information about you will be processed by EOS UPTRADE GmbH. The terms and conditions (https://fahrplaner.de/geschaeftsbedingungen) and the following data protection provisions for HandyTicket apply.
3.8.1 Purposes and legal basis of processing
We process customer data, i.e. your name, title, address, date of birth, email address, preferred payment method, bank account details with IBAN and/or credit card details, answer to security question, and order details with the following information: IP address, first and last name for ticket personalization, and ticket data in accordance with Article 6(1)(b) GDPR for the purpose of contract fulfillment. The user agent/device information is collected in accordance with Article 6(1)(f) GDPR in the legitimate interest. The legitimate interest is system optimization, quality assurance, and fraud prevention.
This also includes the associated customer service.
3.8.2 Recipients of personal data
The data you provide that is necessary for contract processing will be processed and stored on our behalf by EOS UPTRADE GmbH, Schanzenstraße 70, 20357, in accordance with Article 6(1)(f). Our legitimate interest lies in outsourcing the background system, ticket creation, and hosting to a service provider.
We will pass on your personal data (first and last name, date of birth, address, email address, account details, credit card details, mobile phone number if applicable, and data relating to your respective ticket sales) and any changes to LogPay Financial Services GmbH, Schwalbacher Straße 72, 65760 Eschborn for the purpose of selling and assigning our claims against you arising in connection with your ticket purchase. This is done on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in outsourcing payment processing and receivables management. The legitimate interest on the part of LogPay Financial Services GmbH lies in collecting data for the purpose of processing payments, receivables management, assessing the admissibility of payment methods, and avoiding payment defaults.
You can object to the transfer of data to EOS UPTRADE GmbH and LogPay Financial Service GmbH at any time, but then it will no longer be possible to place orders via the electronic sales channel.
You can access LogPay Financial Services GmbH's data protection information at https://www.logpay.de/datenschutz.html.
3.8.3 Duration of data storage
Personal data will only be stored for as long as required by statutory retention obligations and as necessary to achieve the respective purpose.
We process your customer data with our partners in order to issue the Deutschlandticket in the VBN FahrPlaner. We receive customer information such as surname, first name, date of birth, email address, contract number, and ticket information (ticket ID, validity) from the various companies that have concluded a subscription contract with you. The valid Deutschlandticket is then displayed in the VBN's FahrPlaner app and can be checked throughout Germany.
3.9.1 Purposes and legal basis of processing
The transfer of your customer data for the purpose of issuing the Deutschlandticket in the VBN's FahrPlaner app is carried out in accordance with Art. 6 (1) (b) GDPR for contract processing.
The entities responsible for data processing in accordance with the General Data Protection Regulation (GDPR) for the issuance of the Deutschlandticket as a mobile ticket are the subscription companies together with Verkehrsverbund Bremen/Niedersachsen GmbH (VBN) and, in some cases, Niedersachsentarif GmbH (NITAG) as the client of the subscription companies and Verkehrsverbund Bremen/Niedersachsen GmbH.
We have concluded an agreement with the subscription companies and Niedersachsentarif GmbH on joint responsibility for data protection in accordance with Art. 26 GDPR.
List of partners:
The respective partners and Verkehrsverbund Bremen/Niedersachsen GmbH are equally responsible for providing information when collecting data and about the essential contents of the agreement, as well as for processing inquiries from data subjects.
Data subjects may assert their rights under Articles 15 to 22 of the GDPR against the subscription companies and Verkehrsverbund Bremen/Niedersachsen GmbH. You will generally receive your information from the contracting party with whom you have concluded your subscription contract.
3.9.2 Recipients of personal data
The data you provide, which is necessary for the issuance of the Deutschlandticket, will be processed and stored on our behalf by EOS UPTRADE GmbH, Schanzenstraße 70, 20357, in accordance with Article 6(1)(f). Our legitimate interest lies in outsourcing the background system, ticket creation, and hosting to a service provider.
You can object to the transfer of data to EOS UPTRADE GmbH at any time, but this will mean that it will no longer be possible to issue the Deutschlandticket via the electronic sales channel.
3.9.3 Duration of data storage
Personal data will only be stored for as long as required by statutory retention obligations and as necessary to achieve the respective purpose.
3.10.1 Purpose and legal basis of processing
We process customer data, i.e. your name, address, email address, telephone number, and your request (praise and criticism) in accordance with Article 6(1)(f) of the GDPR. Our legitimate interest is to process your request quickly and effectively and forward it to the relevant department.
3.10.2 Recipients of personal data
The specific request will be forwarded to the relevant department responsible for responding to your request. This may be individual transport companies or the responsible authority, such as the Bremen/Lower Saxony Association and/or the districts and municipalities in the association area.
We have commissioned external service providers for the hosting and further development of the database. Hosting is provided by Bremer Straßenbahn AG (BSAG), Flughafendamm 12, 28199 Bremen, and we have commissioned SIGNON Deutschland GmbH, Schützenstraße 15-17, 10117 Berlin, for further development, both of which work strictly in accordance with our instructions.
You have the right to object to the processing of your data. You can do this, for example, by sending an email to datenschutz(at)vbn.de or by sending a message to Verkehrsverbund Bremen/Niedersachsen, Am Wall 165-167, 28195 Bremen. Your personal data will then be deleted, unless it may be further processed to protect legitimate interests.
3.10.3 Duration of data storage
The data required for responding will be deleted 18 months after the last contact. The request will be anonymized.
When processing your personal data, the GDPR grants you certain rights as a website user:
You have the right to request confirmation as to whether personal data concerning you is being processed; if this is the case, you have the right to access this personal data and to the information specified in Article 15 GDPR.
The personal data stored by VBN GmbH will be deleted when it is no longer required for the purpose for which it was collected (sale of mobile phone and online tickets) and when there are no longer any legal obligations to retain it. The data of a registered customer account through which bookings have already been made will be deleted from the corresponding directory ten years after the last booking. Order data is to be treated as a booking receipt and will be stored in accordance with the statutory retention periods, after which it will be deleted.
You have the right to request the restriction of processing if one of the conditions listed in Article 18 GDPR applies, for example if you have objected to the processing, for the duration of any review.
In certain cases, which are listed in detail in Article 20 GDPR, you have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format or to request the transfer of this data to a third party.
If data is collected on the basis of Article 6(1)(f) (data processing to safeguard legitimate interests), you have the right to object to the processing at any time for reasons arising from your particular situation. We will then no longer process the personal data unless there are demonstrable compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or the processing serves to assert, exercise, or defend legal claims.
Pursuant to Article 77 of the GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of data concerning you violates data protection regulations. The right to lodge a complaint may be exercised in particular with a supervisory authority in the Member State of your residence, your place of work, or the place of the alleged infringement.
In the Free Hanseatic City of Bremen, the competent supervisory authority is the Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen, Arndtstraße 1, 27570 Bremerhaven.
We do not use automated decision-making or profiling.