Privacy Policy applicable to visitors to the websites Schauinslandbahn and Berg & Bahn as well as the online shop
Data privacy policy for visitors to the Schauinslandbahn website
It goes without saying that the protection of your data is extremely important to us. The controller responsible for data processing and contact data:
The Controller as defined by data protection legislation
Freiburger Verkehrs AG
Board: Stephan Bartosch, Oliver Benz
Besançonallee 99
79111 Freiburg
Germany
Telephone: +49 (0)761 45110
Fax: +49 (0)761 4511 139
E-mail: vag(at)vagfr.de
How to contact our data protection officer
Data protection officer
Andreas Sterz
Freiburger Verkehrs AG
Besançonallee 99
79111 Freiburg
Germany
Telephone: 0761/4511-651
E-mail: datenschutz(at)vagfr.de
Data privacy at a glance
No personal data need to be provided to use the Schauinslandbahn Freiburger Verkehrs AG website. However, personal data may need to be processed if a data subject wishes to make use of the special services which our company provides on our website. We always obtain the consent of data subjects before processing personal data where this is necessary and where no other legal grounds for such processing apply.
Our company has issued this Data Privacy Policy to inform the general public about the type, scope and purpose of the processing of personal data.
This Data Privacy Policy also informs data subjects about their rights.
General guidelines
-
How do we collect your personal data?
We collect data that you communicate to us. These data could, e.g., be information which you enter in a contact form.
Other data are collected automatically by our IT systems when you visit the website. These data are primarily technical data (e.g. Internet browser, operating system or time at which a page is called up). These data are collected automatically as soon as you enter our website.
-
What do we use your data for?
We collect some of your data to ensure that we can provide the website without any errors. Other data may be used to analyse the way you use the website.
-
What are your rights concerning your data?
You have the right to receive information at any time and at no cost about the origin and recipients of as well as the purpose for which your personal data have been stored. You also have the right in relation to these data to rectification, the right to data portability, the right to object, the right to erasure or the right to have the data made unavailable. Article 21 GDPR also gives you the right to object to the processing of your data; we are then required to stop such processing. Subject to the conditions of Article 20 GDPR you have the right to receive your data in a structured, commonly used and machine-readable format and have the right to transmit those data to third party. You may contact us at any time at the address provided under Imprint if you have any other questions about data privacy. You also have the right to lodge a complaint with the responsible supervisory authority.
-
Analysis tools and tools used by third-party providers
Your surfing behaviour on our website may be statistically evaluated. This is primarily done using cookies and so-called analysis programs. Your surfing behaviour is usually analysed anonymously; surfing behaviour cannot be traced back to you. You may object to this analysis or prevent it by not using certain tools. Detailed information is available in the following Data Privacy Policy.
You can withdraw your consent to such analysis. You are informed about your rights to object in this Data Privacy Policy.
-
Data privacy information
We draw your attention to the fact that security gaps may affect the transfer of data on the Internet (e.g. when communicating by e-mail). It is not possible to guarantee absolute protection of data against access by third parties.
-
Withdrawal of your consent to data processing
Many data processing operations are only possible with your explicit consent. You may revoke any consent you have already given at any time. All you need to do is send an informal message to us by e-mail. Withdrawal of consent does not affect the lawfulness of any processing based on consent before its withdrawal.
-
Right to lodge a complaint with the responsible supervisory authority
The data subject is entitled to lodge a complaint about violations of data protection law with the responsible supervisory authority. The responsible supervisory authority for data protection issues is the state data protection officer for the federal state in which our company is based. A list of data protection officers and their contact information is available at the following link: www.bfdi.bund.de
Right to data portability (subject to the conditions of Article 20 GDPR)
You have the right to have data which we automatically process, either on the basis of your consent or to perform contract, released either to you or to a third party in a structured, commonly used machine-readable format. Any request to have personal data transmitted directly from one controller to another will only be complied with where this is technically feasible.
-
Information, making unavailable, erasure
You are entitled by law to obtain information at any time and at no charge about the personal data we have stored on you as well as about where the data have been obtained, by whom they have been received and the purpose for which they are processed; you also have the right to have these data corrected, made unavailable or erased at any time. You may contact us at any time at the address provided under Imprint if you have any other questions about personal data.
-
Right to object to direct marketing e-mails (Article 21 GDPR)
Objection is hereby made to the use of contact data published in accordance with legal requirements for the purpose of sending advertising and information material which has not been explicitly requested. The operators of this website explicitly retain the right to take legal action in the event that unsolicited advertising information, such as spam mail, is sent.
-
Effectiveness and version of the Data Privacy Policy
Our Data Privacy Policy and the information about data protection relating to our data processing under Articles 13, 14 and 21 GDPR may change from time to time. We will publish any changes made here on this website.
Data collected on our website
-
Cookies
The internet web pages use “cookies” in several places. Cookies do not cause any damage to your computer and do not contain viruses. Cookies help us to make our website more user friendly, more effective and more secure. Cookies are small text files which are placed on your computer and stored in your browser.
Most of the cookies we use are “session cookies” which are automatically deleted as soon as you leave the website. Other cookies remain stored on your terminal device until you delete them. These cookies enable us to recognise your browser the next time you visit our website.
You can change the settings of your browser so that you are informed every time a cookie is set. This will allow you to permit cookies in specific cases, to exclude them in particular cases or completely, or to have them deleted automatically every time you close your browser. However, if you disable cookies, this may affect the functionality of this website.
Cookies which are needed for the performance of the electronic communication procedures or to provide certain functions (e.g. shopping cart function) requested by you are stored on the basis of Article 6 (1) f) GDPR. The website operator has a legitimate interest in storing cookies in order to provide technically faultless and optimised services. Any other cookies (e.g. cookies used to analyse your surfing behaviour) which are stored are treated separately in this Data Privacy Policy.
-
Server log files
The website provider automatically collects and stores information in server log files which your browser then sends to us automatically. This information concerns:
The browser type and version
The operating system used
Referrer URL
The host name of the accessing computer
The time of the server request
IP address
These data are not consolidated with other data sources.
Data processing is lawful under Article 6 (1) f) GDPR, which permits the processing of data for the purpose of performing a contract or of taking steps prior to entering into a contract.
-
Processing of data (customer and contract data)
We collect, process and use personal data only to the extent necessary for establishing, agreeing the content of or modifying the legal relationship (stock data). The processing of this data is lawful under Article 6 (1) b) GDPR, which permits the processing of data for the purpose of performing a contract or of taking steps prior to entering into a contract. We only collect, process and use personal data about the use made of our website (usage data) to the extent that this is necessary to enable the user to make use of the service or for settlement purposes.
Any customer data collected in this way are erased after the order has been completed or the business relationship has ended. Statutory retention periods remain unaffected.
-
Inquiries sent to Freiburger Verkehrs AG
If you use the “MailTo” function in your e-mail program to use an e-mail address on our website, the content of this e-mail will be sent directly from your e-mail program via the Internet to our server and then forwarded electronically to the relevant employee. When you use our contact form, the text entered by you is sent directly by e-mail from our Internet server to the relevant employee. Information is not forwarded to external persons or companies.
You will also receive provisional notification or a final response/clarification of your inquiry by e-mail from the VAG employee who is responsible for dealing with the matter. The e-mails sent in this matter will be stored on our server and on the employee’s e-mail client in compliance with the law and contractual arrangements.
However, the data created during this process, including but not limited to personal data, will in no case be used for any purposes (e.g. advertising) not related to your inquiry.
-
VAG online surveys and competitions
VAG Freiburg will only ever ask you to participate in opinion surveys (e.g. on customer satisfaction) on a voluntary basis. Surveys will be used to evaluate and publish your responses for statistical purposes; individual users will remain anonymous. Names and personal data are used exclusively for these online surveys. We use software solutions offered by external providers (refer e.g. to the data privacy policy of LamaPoll for survey participants – Link: www.lamapoll.de/Support/Datenschutz/Datenschutz-Teilnehmer). These solutions enable us to create, conduct and evaluate secure online surveys. Anonymous surveys ensure that your data are not linked in any way to your responses or disclosed to third parties.
If you have to provide your name and personal data in order to take part in a competition, these are only used for the relevant VAG activity and are never disclosed to third parties. Note: Please make sure that the username which you adopt (e.g. in order to take part in the competition) does not reveal any personal data.
-
Contents of third-party websites
The Freiburger Verkehrs AG Schauinslandbahn integrates third-party contents in order to provide you with offers along the entire mobility chain (partner offers). In these cases you enter your data directly in the relevant third-party websites. These are integrated in schauinslandbahn.de and have been adapted to provide the same look and feel. Third-party contents always have their own imprints and data privacy information.
We integrate content from the following partners:
https://www.diebergstation.de/https://www.berggeheimnis.com/
http://www.kraeuter-erlebnispfad-oberried-hofsgrund.de/
-
Analytics tools
Statistical analyses with Matomo (formerly Piwik)
Our website www.schauinslandbahn.de uses Matomo. This is a web analytics service that uses “cookies” – text files that are placed on your computer and enable us to analyse how the site is used. The usage information generated by the cookie (including your truncated IP address) is sent to our server, where it is stored to enable usage to be analysed. This helps us optimise the website. Your IP address is immediately anonymised as part of this process, meaning that you remain anonymous to us as a user. The information produced by the cookie about your use of this website is not shared with third parties. Further information about data protection at Matomo can be found here. The legal basis for using the analytics tool is Article 6(1) f) GDPR.
You can prevent the use of cookies by making a corresponding setting in your browser software. However, in this case you may not be able to use the full functionality of this website.
You may revoke any consent you have already given at any time. If you do not consent to the storage and analysis of the data concerning your visit to the website, you can object to such storage and usage at any time with future effect by clicking the links for the specific pages. In this case, a click sets an “opt-out cookie” in your browser with the consequence that Matomo does not collect any session data. Note: If you delete your cookies, this will also delete the opt-out cookie, which you may have to enable again.
There is an option to set an opt-out cookie for www.schauinslandbahn.de at the end of this privacy page.
-
Google Maps
This website uses an API to provide the map service of Google Maps from Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Your IP address must be stored in order to use the Google Maps function. This information is usually sent to and stored on a Google server in the USA. The provider of this website has no influence on this data transmission.
Google Maps are used in order to present our online offers in an interesting way and to make it easier to find the locations given on our website. This is a legitimate interest within the meaning of Article 6 (1) f) GDPR.
More information on what happens to user data can be found in the Google data privacy policy.
-
Misuse of data by phishing
Confidence tricksters frequently attempt to obtain personal data using forged e-mails. This a scam, which has gained notoriety as “phishing” (i.e. password fishing), involves sending e-mails at random telling recipients to enter certain data, e.g. access data for bank accounts, at a website for fraudulent reasons. Attackers often copy the look and feel of the legitimate websites of banks or other trustworthy companies with extraordinary verisimilitude. It is important to know and observe the following: VAG will never send you an e-mail asking you to enter your account details on the Internet. Account-related data will always be entered in forms (e.g. VAG guarantee) which must be completed by you in person. VAG will never ask for your personal identification number (PIN) for your EC card, your credit card or your home banking account. This also applies to transaction numbers (TAN) or other code words and digits for use with home banking.
Video surveillance – Schauinslandbahn
-
Information sheet under Article 13 General Data Protection Regulation (GDPR), video surveillance equipment
Freiburger Verkehrs AG, Besançonallee 99, 79111 Freiburg
Board of Managing Directors: Stephan Bartosch, Oliver Benz
E-mail: vag(at)vagfr.deHow to contact the data protection officer
Freiburger Verkehrs AG
Besanconallee 99
79111 Freiburger
Germany
E-mail: datenschutz(at)vagfr.de -
Reasons for using video surveillance equipment on the Freiburger Verkehrs AG – Schauinslandbahn
Monitoring changes of passengers (customer flow), operational flow management
Monitoring areas of the installation which are not accessible to the public
Increasing the actual security of guests and employees
Increasing the sense of security of guests and employees
Reducing vandalism
Deterring potentially violent persons
Controlling access to operational areas
Securing the exteriors of operational areas against unauthorised access
Advertising (marketing the view, weather information)
The legitimate interests of the storing function under Article 6 (1) f) of the General Data Protection Regulation are fundamentally identical with the purposes referred to above.
Legal basis: Section 4 of the German Data Protection Act (BDSG, new) “Video surveillance of publicly accessible spaces”, Article 6 (1) f) General Data Protection Regulation (GDPR)
-
Recipients to which data may be communicated
Data are transferred in real-time (direct transfer of image data to monitors without the data being stored – camera-monitor principle) from the valley and mountain stations.
Only the mountain station web camera at the “entrance” of the cable car (weather image) stores images for 5 minutes to show the current weather situation on the mountain; after that they are overwritten.
The cameras near the ticket office area store images for 96 hours; after that they are overwritten.
The cameras in the stations (mountain and valley) record images without storing them and are only used to monitor the safety of the system.
Recordings are only issued if this is demanded by police authorities, public prosecutors, courts, for evidence in court cases or by lawyers for out-of-court proceedings.
The recordings are overwritten automatically unless one of the purposes for its storage applies. If video recordings are used as evidence in criminal or civil proceedings, the data are erased in compliance with limitation period regulations.
-
Data subjects
Customers/passengers, VAG Freiburg employees, employees of contractors, other persons present in the area being surveyed by video.
-
Rights of the data subject
Right of access: Right to send requests for information to the address under No. 1.
Right to rectification: This right is limited in the sense that it is not technically possible to change the video recordings.
Right to erasure: Unless the data are stored for specific purposes, the right to erasure is implemented by the data being overwritten automatically.
Right to restriction of processing: This right is met by the automatic erasure of data by overwriting and circumscribed purposes for which data is stored.
Right to data portability: This right is technically limited in the sense that data are only stored in encrypted form and can only be decrypted using special software; what is more, transmission may affect the rights of third parties.
Right to object: This right is met by the automatic erasure of data by overwriting and circumscribed purposes for which data is stored.
Right to lodge a complaint: Complaints may be addressed to the company’s data protection officer (see contact data under item 1 above). It is also possible toDodge a complaint with the supervisory authority:
The State Commissioner for Data Protection and Freedom of Information (Landesbeauftragter für den Datenschutz und die Informationsfreiheit)
E-mail: poststelle@lfdi.bwl.de
Internet: www.baden-wuerttemberg.datenschutz.de
Use of our on-site sales and online shop services
-
Registration
We only use the registration data you have entered for the purpose of enabling you to use the relevant offer or service for which you have registered. The mandatory data requested at the time of registration must be provided in full. If you do not do so, we will reject the registration.
We will use the e-mail address given during registration to inform you of important changes such as regarding the scope of our website or any technical changes.
Data entered during registration is processed exclusively with your consent (Article 6(1) a) GDPR). You may revoke any consent you have given at any time. No formal requirements apply: all that is required is an e-mail to onlineshop@schauinslandbahn.de. Withdrawal of consent does not affect the lawfulness of previous processing.
-
Purpose and legal basis of processing and type of processed data
Data is processed in the web shop for the purpose of purchasing services offered by Schauinslandbahn. The legal basis for this is Article 6(1) b) GDPR.
Depending on the type of offer, the following data is processed: Title, first name and surname, delivery/invoice address, e-mail address, password, date of birth (for voucher top-up or annual-card extension), company (optional), phone number (optional), invoicing details depending on payment type (BIC, IBAN or credit card details), IP addresses, cookies, logs, photo (when setting up an annual card).
-
Recipients with whom the data may be shared
Your personal data will not be shared with, sold to or otherwise transmitted to third parties unless this is necessary for purposes of contractual processing, e.g. performing a credit check with a credit agency or, in the event of payment defaults, with debt-collection and legal-services providers in order to collect the claim.
As the controller, VAG shall forward your personal data (first and surname, date of birth, address, email address, bank details, credit-card details, possibly mobile phone number and details about your respective ticket purchases) and all changes on to Payone GmbH, Lyoner Straße 15, 60528 Frankfurt am Main (hereinafter referred to as Payone) for the purpose of sales and assignment of the claims against you arising in connection with your ticket purchase. This is done on the basis of Article 6(1) f) GDPR.
VAG has a legitimate interest in outsourcing the payment processing and claims management. Payone’s legitimate interest relates to the collection of data for the purpose of processing payment transactions, for claims management, for evaluating the admissibility of payment methods and to prevent default on payment.
You can object to this data being transferred to Payone at any time; however, in this case it will no longer be possible to place orders via the electronic sales channel.
Payone’s information on data protection can be accessed at Payone GDPR.
The recipient is often a dependent data processor or a party involved in the execution and fulfilment of the contract. Any transfer going beyond this contractual relationship shall only take place if you grant to us express consent.
Processor acting on behalf of Freiburger Verkehrs AG:
HKS Systeme GmbH, Friedrich-List-Str. 89, 33100 Paderborn (online shop hosting)
-
Rights of data subjects
Right of access: Requests for information should be addressed to the above address.
Right to rectification: This right is restricted in that it is not technically possible to alter video recordings.
Right to erasure: The right to erasure is realised via the automatic overwriting of the data, unless the data is stored for a specific purpose.
Right to restriction of processing: This right is observed thanks to the automated deletion of data by overwriting and the purpose limitation of storage.
Right to data portability: This right is technically limited because the data is stored in an encrypted form and can only be decrypted using a special software. A transfer may also restrict the rights of third parties.
Right to object: This right is observed thanks to the automated deletion of data by overwriting and the purpose limitation of storage.
Right to lodge a complaint: Complaints may be addressed to the company data protection officer at any time (see point 1 for contact details). It is also possible to raise a
complaint with the supervisory authority for data protection:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
E-mail: poststelle@lfdi.bwl.de
Internet: www.baden-wuerttemberg.datenschutz.de
