Data privacy policy

Data privacy policy for visitors to the Schauinslandbahn website

Data privacy policy for visitors to the Schauinslandbahn website

It goes without saying that the protection of your data is extremely important to us. The controller responsible for data processing and contact data:

The Controller as defined by data protection legislation

Freiburger Verkehrs AG
Board: Stephan Bartosch, Oliver Benz
Besançonallee 99
79111 Freiburg
Germany

Telephone: +49 (0)761 45110
Fax: +49 (0)761 4511 139
E-mail: vag(at)vagfr.de

How to contact our data protection officer

Data protection officer
Andreas Sterz
Freiburger Verkehrs AG
Besançonallee 99
79111 Freiburg
Germany

Telephone: 0761/4511-651
E-mail: datenschutz(at)vagfr.de

Data privacy at a glance

No personal data need to be provided to use the Schauinslandbahn Freiburger Verkehrs AG website. However, personal data may need to be processed if a data subject wishes to make use of the special services which our company provides on our website. We always obtain the consent of data subjects before processing personal data where this is necessary and where no other legal grounds for such processing apply.

Our company has issued this Data Privacy Policy to inform the general public about the type, scope and purpose of the processing of personal data.

This Data Privacy Policy also informs data subjects about their rights.

General guidelines

• How do we collect your personal data?

  We collect data that you communicate to us. These data could, e.g., be information which you enter in a contact form.

  Other data are collected automatically by our IT systems when you visit the website. These data are primarily technical data (e.g. Internet browser, operating system or time at which a page is called up). These data are collected automatically as soon as you enter our website.

• What do we use your data for?

  We collect some of your data to ensure that we can provide the website without any errors. Other data may be used to analyse the way you use the website.

• What are your rights concerning your data?

  You have the right to receive information at any time and at no cost about the origin and recipients of as well as the purpose for which your personal data have been stored. You also have the right in relation to these data to rectification, the right to data portability, the right to object, the right to erasure or the right to have the data made unavailable. Article 21 GDPR also gives you the right to object to the processing of your data; we are then required to stop such processing. Subject to the conditions of Article 20 GDPR you have the right to receive your data in a structured, commonly used and machine-readable format and have the right to transmit those data to third party. You may contact us at any time at the address provided under Imprint if you have any other questions about data privacy. You also have the right to lodge a complaint with the responsible supervisory authority.

• Analysis tools and tools used by third-party providers

  Your surfing behaviour on our website may be statistically evaluated. This is primarily done using cookies and so-called analysis programs. Your surfing behaviour is usually analysed anonymously; surfing behaviour cannot be traced back to you. You may object to this analysis or prevent it by not using certain tools. Detailed information is available in the following Data Privacy Policy.

  You can withdraw your consent to such analysis. You are informed about your rights to object in this Data Privacy Policy.

• Data privacy information

  We draw your attention to the fact that security gaps may affect the transfer of data on the Internet (e.g. when communicating by e-mail). It is not possible to guarantee absolute protection of data against access by third parties.

• Withdrawal of your consent to data processing

  Many data processing operations are only possible with your explicit consent. You may revoke any consent you have already given at any time. All you need to do is send an informal message to us by e-mail. Withdrawal of consent does not affect the lawfulness of any processing based on consent before its withdrawal.

• Right to lodge a complaint with the responsible supervisory authority

  The data subject is entitled to lodge a complaint about violations of data protection law with the responsible supervisory authority. The responsible supervisory authority for data protection issues is the state data protection officer for the federal state in which our company is based. A list of data protection officers and their contact information is available at the following link: www.bfdi.bund.de

  Right to data portability (subject to the conditions of Article 20 GDPR)

  You have the right to have data which we automatically process, either on the basis of your consent or to perform contract, released either to you or to a third party in a structured, commonly used machine-readable format. Any request to have personal data transmitted directly from one controller to another will only be complied with where this is technically feasible.

• Information, making unavailable, erasure

  You are entitled by law to obtain information at any time and at no charge about the personal data we have stored on you as well as about where the data have been obtained, by whom they have been received and the purpose for which they are processed; you also have the right to have these data corrected, made unavailable or erased at any time. You may contact us at any time at the address provided under Imprint if you have any other questions about personal data.

• Right to object to direct marketing e-mails (Article 21 GDPR)

  Objection is hereby made to the use of contact data published in accordance with legal requirements for the purpose of sending advertising and information material which has not been explicitly requested. The operators of this website explicitly retain the right to take legal action in the event that unsolicited advertising information, such as spam mail, is sent.

• Effectiveness and version of the Data Privacy Policy

  Our Data Privacy Policy and the information about data protection relating to our data processing under Articles 13, 14 and 21 GDPR may change from time to time. We will publish any changes made here on this website.

Data collected on our website

• Cookies

  The internet web pages use “cookies” in several places. Cookies do not cause any damage to your computer and do not contain viruses. Cookies help us to make our website more user friendly, more effective and more secure. Cookies are small text files which are placed on your computer and stored in your browser.

  Most of the cookies we use are “session cookies” which are automatically deleted as soon as you leave the website. Other cookies remain stored on your terminal device until you delete them. These cookies enable us to recognise your browser the next time you visit our website.

  You can change the settings of your browser so that you are informed every time a cookie is set. This will allow you to permit cookies in specific cases, to exclude them in particular cases or completely, or to have them deleted automatically every time you close your browser. However, if you disable cookies, this may affect the functionality of this website.

  Cookies which are needed for the performance of the electronic communication procedures or to provide certain functions (e.g. shopping cart function) requested by you are stored on the basis of Article 6 (1) f) GDPR. The website operator has a legitimate interest in storing cookies in order to provide technically faultless and optimised services. Any other cookies (e.g. cookies used to analyse your surfing behaviour) which are stored are treated separately in this Data Privacy Policy.

• Server log files

  The website provider automatically collects and stores information in server log files which your browser then sends to us automatically. This information concerns:

  • The browser type and version

  • The operating system used

  • Referrer URL

  • The host name of the accessing computer

  • The time of the server request

  • IP address

  These data are not consolidated with other data sources.

  Data processing is lawful under Article 6 (1) f) GDPR, which permits the processing of data for the purpose of performing a contract or of taking steps prior to entering into a contract.

• Processing of data (customer and contract data)

  We collect, process and use personal data only to the extent necessary for establishing, agreeing the content of or modifying the legal relationship (stock data). The processing of this data is lawful under Article 6 (1) b) GDPR, which permits the processing of data for the purpose of performing a contract or of taking steps prior to entering into a contract. We only collect, process and use personal data about the use made of our website (usage data) to the extent that this is necessary to enable the user to make use of the service or for settlement purposes.

  Any customer data collected in this way are erased after the order has been completed or the business relationship has ended. Statutory retention periods remain unaffected.

• Registration for our tours on bergundbahn.de

  For the appointment registration for our tours, the provider squarespace is used. This provider uses servers in the USA, so that your explicit consent is required for this processing. The processing is therefore based on Art. 6 para.1 lit. a DSGVO (consent) and additionally also Art. 49 para. 1 lit a DSGVO. The purpose of the processing is the organization of the guided tour appointment.

  The input of data on the part of the user takes place on an expressly voluntary basis. The use of the registration is also permitted by providing anonymous data or a pseudonym. We recommend at least the indication of a current telephone number, in order to be able to reach you in case of a breakdown or the like before the tour.

  The registration data will be passed on to the staff of timewalking timetalking in order to be able to contact the tour participants if necessary (control of registration, cancellations or similar). Furthermore, the data could be used for contact tracing according to Corona Regulation §7 of the state of Baden-Württemberg.

• Inquiries sent to Freiburger Verkehrs AG

  If you use the “MailTo” function in your e-mail program to use an e-mail address on our website, the content of this e-mail will be sent directly from your e-mail program via the Internet to our server and then forwarded electronically to the relevant employee. When you use our contact form, the text entered by you is sent directly by e-mail from our Internet server to the relevant employee. Information is not forwarded to external persons or companies.

  You will also receive provisional notification or a final response/clarification of your inquiry by e-mail from the VAG employee who is responsible for dealing with the matter. The e-mails sent in this matter will be stored on our server and on the employee’s e-mail client in compliance with the law and contractual arrangements.

  However, the data created during this process, including but not limited to personal data, will in no case be used for any purposes (e.g. advertising) not related to your inquiry.

• VAG online surveys and competitions

  VAG Freiburg will only ever ask you to participate in opinion surveys (e.g. on customer satisfaction) on a voluntary basis. Surveys will be used to evaluate and publish your responses for statistical purposes; individual users will remain anonymous. Names and personal data are used exclusively for these online surveys. We use software solutions offered by external providers (refer e.g. to the data privacy policy of LamaPoll for survey participants – Link: www.lamapoll.de/Support/Datenschutz/Datenschutz-Teilnehmer). These solutions enable us to create, conduct and evaluate secure online surveys. Anonymous surveys ensure that your data are not linked in any way to your responses or disclosed to third parties.

  If you have to provide your name and personal data in order to take part in a competition, these are only used for the relevant VAG activity and are never disclosed to third parties. Note: Please make sure that the username which you adopt (e.g. in order to take part in the competition) does not reveal any personal data.

• Contents of third-party websites

  The Freiburger Verkehrs AG Schauinslandbahn integrates third-party contents in order to provide you with offers along the entire mobility chain (partner offers). In these cases you enter your data directly in the relevant third-party websites. These are integrated in schauinslandbahn.de and have been adapted to provide the same look and feel. Third-party contents always have their own imprints and data privacy information.

  We integrate content from the following partners:

  
  https://www.diebergstation.de/

  http://holzschlaegermatte.de/

  https://www.halde.com/

  http://www.buckhof.de/

  https://www.rappeneck.com/

  https://www.berggeheimnis.com/

  http://www.kraeuter-erlebnispfad-oberried-hofsgrund.de/

  https://bergundbahn.de/

  http://www.schauinsland.de/

  https://www.vag-onlineticket.de

  https://www.vag-freiburg.de

  http://wetterstationen.meteomedia.de/

• Analysis tools

  Google Analytics for the Schauinslandbahn website

  This website uses the functions provided by the web analysis service Google Analytics from Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

  Google Analytics uses “Cookies”. These are text files which are stored on your computer to analyse the way you use the website. The information about the way you use this website created by the cookie is usually sent to and stored on a Google server in the USA.

  The storage of Google Analytics cookies is lawful under Article 6 (1) f) GDPR. The website operator has a legitimate interest in the analysis of user behaviour for the purpose of optimising its web services and its marketing.

• IP anonymisation

  We have enabled the IP anonymisation function on this website. This means that Google truncates your IP address in Member States of the European Union or in other state parties to the Agreement on the European Economic Area. The full IP address is only sent to and shortened on a Google server in the USA in exceptional circumstances. Google will use this information on behalf of the operator to evaluate the way you use the website, to collate reports on website activities and in order to provide the website operator other services related to website and Internet use. The IP address sent by your browser as part of Google Analytics is not combined with other data held by Google.

• Browser plugin

  You can change your browser settings to prevent cookies from being stored; however, we draw your attention to the fact that, in these circumstances, you may find that you are unable to make full use of functions on the website. You can also prevent the data (including your IP address) relating to your use of the website which are captured by the cookie being sent to or processed by Google by downloading and installing the browser plug-in from the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

• Objection to data collection

  Opt-out cookie solution: You can prevent your data being collected by Google Analytics by clicking the following link. An opt out cookie is then set which prevents your data being collected the next time you visit this website.

  Disable Google Analytics

  More information about the way Google Analytics handles user data can be found in Google’s data privacy statement: https://support.google.com/analytics/answer/6004245?hl=de.

• Order processing

  We have entered a contract with Google for the processing of data; we implement the stringent requirements of the German data protection authorities in full when we use Google Analytics.

• Demographics in Google Analytics

  This website uses the Google Analytics “Demographics” function. This enables reports to be produced with information about the age, gender and interests of website users. These data originate from interest-related advertising from Google and traffic data from third-party providers. These data cannot be assigned to particular people. You can disable this function at any time by changing your display settings in your Google account or prohibit the collection of your data by Google Analytics entirely as explained under “Objection to data collection”.

• Google Web Fonts

  This website uses Web Fonts provided by Google for the purposes of uniform presentation. Whenever you access a page, your browser loads the required web fonts in your browser cache in order to display texts and fonts correctly.

  In order to do this, the browser you are using must make a connection to Google servers. In this way Google receives information that our website has been accessed from your IP address. We use Google Web Fonts in the interest of providing an interesting online website presentation. This is a legitimate interest within the meaning of Article 6 (1) f) GDPR.

  If your browser does not support Web Fonts, your computer will use a standard font.

  More information about Google Web Fonts is available at https://developers.google.com/fonts/faq and in the Google data privacy policy: https://www.google.com/policies/privacy/.

• Google Maps

  This website uses an API to provide the map service of Google Maps from Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

  Your IP address must be stored in order to use the Google Maps function. This information is usually sent to and stored on a Google server in the USA. The provider of this website has no influence on this data transmission.

  Google Maps are used in order to present our online offers in an interesting way and to make it easier to find the locations given on our website. This is a legitimate interest within the meaning of Article 6 (1) f) GDPR.

  More information on what happens to user data can be found in the Google data privacy policy at: https://www.google.de/intl/de/policies/privacy/.

• Misuse of data by phishing

  Confidence tricksters frequently attempt to obtain personal data using forged e-mails. This a scam, which has gained notoriety as “phishing” (i.e. password fishing), involves sending e-mails at random telling recipients to enter certain data, e.g. access data for bank accounts, at a website for fraudulent reasons. Attackers often copy the look and feel of the legitimate websites of banks or other trustworthy companies with extraordinary verisimilitude. It is important to know and observe the following: VAG will never send you an e-mail asking you to enter your account details on the Internet. Account-related data will always be entered in forms (e.g. VAG guarantee) which must be completed by you in person. VAG will never ask for your personal identification number (PIN) for your EC card, your credit card or your home banking account. This also applies to transaction numbers (TAN) or other code words and digits for use with home banking.

Video surveillance – Schauinslandbahn

• Information sheet under Article 13 General Data Protection Regulation (GDPR), video surveillance equipment

  Freiburger Verkehrs AG, Besançonallee 99, 79111 Freiburg

  Board of Managing Directors: Stephan Bartosch, Oliver Benz
  E-mail: vag(at)vagfr.de

  How to contact the data protection officer

  Freiburger Verkehrs AG
  Besanconallee 99
  79111 Freiburger
  Germany
  E-mail: datenschutz(at)vagfr.de

• Reasons for using video surveillance equipment on the Freiburger Verkehrs AG – Schauinslandbahn

  • Monitoring changes of passengers (customer flow), operational flow management

  • Monitoring areas of the installation which are not accessible to the public

  • Increasing the actual security of guests and employees

  • Increasing the sense of security of guests and employees

  • Reducing vandalism

  • Deterring potentially violent persons

  • Controlling access to operational areas

  • Securing the exteriors of operational areas against unauthorised access

  • Advertising (marketing the view, weather information)

  The legitimate interests of the storing function under Article 6 (1) f) of the General Data Protection Regulation are fundamentally identical with the purposes referred to above.

  Legal basis: Section 4 of the German Data Protection Act (BDSG, new) “Video surveillance of publicly accessible spaces”, Article 6 (1) f) General Data Protection Regulation (GDPR)

• Recipients to which data may be communicated

  Data are transferred in real-time (direct transfer of image data to monitors without the data being stored – camera-monitor principle) from the valley and mountain stations.

  Only the mountain station web camera at the “entrance” of the cable car (weather image) stores images for 5 minutes to show the current weather situation on the mountain; after that they are overwritten.

  The cameras near the ticket office area store images for 96 hours; after that they are overwritten.

  The cameras in the stations (mountain and valley) record images without storing them and are only used to monitor the safety of the system.

  Recordings are only issued if this is demanded by police authorities, public prosecutors, courts, for evidence in court cases or by lawyers for out-of-court proceedings.

  The recordings are overwritten automatically unless one of the purposes for its storage applies. If video recordings are used as evidence in criminal or civil proceedings, the data are erased in compliance with limitation period regulations.

• Data subjects

  Customers/passengers, VAG Freiburg employees, employees of contractors, other persons present in the area being surveyed by video.

• Rights of the data subject

  Right of access: Right to send requests for information to the address under No. 1.
  Right to rectification: This right is limited in the sense that it is not technically possible to change the video recordings.
  Right to erasure: Unless the data are stored for specific purposes, the right to erasure is implemented by the data being overwritten automatically.
  Right to restriction of processing: This right is met by the automatic erasure of data by overwriting and circumscribed purposes for which data is stored.
  Right to data portability: This right is technically limited in the sense that data are only stored in encrypted form and can only be decrypted using special software; what is more, transmission may affect the rights of third parties.
  Right to object: This right is met by the automatic erasure of data by overwriting and circumscribed purposes for which data is stored.
  Right to lodge a complaint: Complaints may be addressed to the company’s data protection officer (see contact data under item 1 above). It is also possible to

  Dodge a complaint with the supervisory authority:

  The State Commissioner for Data Protection and Freedom of Information (Landesbeauftragter für den Datenschutz und die Informationsfreiheit)

  Office address:

  Königstrasse 10 a
  70173 Stuttgart
  Germany

  Postal address:

  Postfach 10 29 32
  70025 Stuttgart
  Germany
  Tel.: +49 (0)711 6155 410
  Fax: +49 (0)711 6155 4115

  E-mail: poststelle@lfdi.bwl.de