Privacy policy in accordance with the General Data Protection Regulation (GDPR)

In the following, we inform you about the processing of personal data by us as the controller when you use our website. The processing of personal data (e.g. name, address, e-mail address or telephone number of a data subject) is carried out in accordance with the statutory provisions, in particular the requirements of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

I. Responsible

The controller for the purposes of the GDPR and the national data protection laws of the Member States, as well as other data protection regulations, is:

Schlichtungsstelle für den öffentlichen Personenverkehr e.V.
Fasanenstr. 81
10623 Berlin
Deutschland

Telefon: 030 64499330
E-Mail: kontakt@sruv.de

II. Data Protection Officer

The Data Protection Officer of the Controller may be contacted at the above address (for the attention of the Data Protection Officer) or by e-mail (datenschutzbeauftragter@sruv.de) with the subject line “Data Protection”.

III. General information on data processing

Personal data is any information relating to an identified or identifiable natural person, such as your name or email address. The term “data processing” refers in particular to the collection, storage, use and transmission of your data.

Where we obtain the consent of the data subject for the processing of personal data, Art. 6 para. 1 sentence 1 lit. a GDPR serves as the legal basis.

For the processing of personal data necessary for the performance of a contract to which the data subject is a party, Art. 6 para. 1 sentence 1 lit. b GDPR serves as the legal basis. This also applies to processing that is necessary for the performance of pre-contractual measures.

If the processing of personal data is necessary to fulfil a legal obligation to which we are subject, Art. 6 para. 1 sentence 1 lit. c GDPR serves as the legal basis.

If the vital interests of the data subject or of another natural person require the processing of personal data, Art. 6 para. 1 sentence 1 lit. d GDPR serves as the legal basis.

If the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party and such interests are not overridden by the interests or fundamental rights and freedoms of the data subject, the legal basis for the processing is Article 6(1)(f) GDPR.

The personal data of data subjects will be deleted or blocked as soon as the purpose of storage no longer applies. The data may be stored after the purpose of storage no longer applies, if this is provided for by law. The data will also be blocked or erased upon expiry of a retention period prescribed by the aforementioned standards, unless further storage of the data is necessary for the conclusion or performance of a contract.

Further information on the legal basis for processing and the storage period for specific personal data can be found in the relevant subsection.

 

IV. Rights of the data subject

1. If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller (where applicable, subject to other conditions set out in the relevant provisions):

  • Right to information (Art. 15 GDPR),
  • Right to rectification and erasure (Art. 16, 17 GDPR),
  • Right to restriction of processing (Art. 18 GDPR),
  • Recht auf Widerruf, wenn Sie in die Verarbeitung eingewilligt haben,
  • Right to data portability (Art. 20 GDPR).

2. Insofar as we process personal data as explained above in order to safeguard our legitimate interests, which predominate in the context of a balancing of interests, you can object to this processing with effect for the future, but only if there are grounds arising from your particular situation (Art. 21 GDPR). If the processing is carried out for direct marketing purposes, you can exercise this right at any time, even if there are no reasons. Once you have exercised your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defence of legal claims. This restriction does not apply if the processing is for direct marketing purposes.

3.  If you believe that we are not respecting your rights to the extent that we should, you have the right to complain to a data protection authority about our processing of your personal data. However, before you do so, we would be grateful if you would let us know of your complaint in advance so that we can remedy the cause of the complaint ourselves.

V. Website visits and logfiles

1. Scope of personal data processing

Each time our website is accessed, our system automatically collects the following data and information from the computer system of the accessing computer.

  • IP address
  • Date and time of the request
  • Content of the request (specific page)
  • Information about the browser type and version used

This data is stored in the log files of our system.

2. Legal basis for processing personal data

The legal basis for the collection and storage of data is Art. 6 para. 1 lit. f GDPR.

3. Purpose of the data processing


Temporary storage of the IP address is necessary in order to display the website to you. For this purpose, the IP address must be stored for the duration of the session. The other data is collected for technical reasons to ensure stability and security.

This also gives rise to the legitimate interest in processing pursuant to Art. 6 par. 1 lit. f GDPR.

4. Duration of storage

The data is deleted as soon as it is no longer necessary to fulfil the purpose for which it was collected. In the case of data collected for the provision of the website, this will be the case when the relevant session has ended.

If the data is stored in log files, this will be the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or anonymised so that it is no longer possible to identify the accessing client.

VI. Online complaint form

1. Description and scope of data processing

Online complaint forms are available on our website for the flight, rail, coach, public transport and travel sectors, which can be used to contact us electronically to initiate a dispute resolution procedure or in connection with a dispute resolution procedure. When you use this option, the information you enter in the form will be transmitted to us and stored. The specific personal data that will be transmitted to us will be set out in the input mask of the relevant online complaint form. Fields marked with an asterisk (*) are mandatory. Additional information can be entered in the comment fields marked with an asterisk. The information in the online complaint forms includes the following categories of data:

  • Transport company details and correspondence
  • Journey details
  • Your master data
  • Details of journey related incidents

At the same time, the following additional information is collected and stored when the request is submitted:

  • Your IP address
  • Date and time of usage

We process the information collected in order to process your conciliation request.

2. Legal basis for the processing of personal data

The legal basis for the processing of the data transmitted to us via the online complaint forms is Art. 6 para. 1 lit. b GDPR.

3. Purpose of data processing

The processing of personal data from the input screen of the online complaint forms is used to process the complaint and to conduct and manage the conciliation procedure. The other personal data processed when the form is sent is used to prevent misuse of the contact form and to ensure the security of our information technology systems.

4.Duration of storage

Personal data submitted via the online complaint forms or by e-mail and used to conduct the conciliation procedure will be deleted as scheduled five years after the end of the conciliation procedure. The period begins at the end of the year in which the dispute resolution process is completed.

5. Recipient

Beantragen Sie online die Durchführung eines Schlichtungsverfahrens, erfolgt in diesem Zusammenhang eine Weitergabe der insoweit notwendigen Daten an das am Schlichtungsverfahren beteiligte Verkehrsunternehmen, gegen das sich die Beschwerde richtet.

VII. Get in touch

1. Scope of personal data processing

If you contact us by email, post or otherwise, the information you provide (such as your email address, name and telephone number where applicable) will be processed by us in order to process or respond to your request.

2. Legal basis for processing personal data

Übermitteln Sie uns Ihre Daten in einem vorvertraglichen Kontext, also beispielsweise mit der Bitte um Einleitung eines Schlichtungsverfahrens oder mit Fragen zu unseren Dienstleistungsangebot, ist Art. 6 Abs. 1 lit. b DSGVO die Rechtsgrundlage. Sofern sie uns eine Einwilligung zur Kontaktaufnahme erteilt haben ist Art. 6 Abs. 1 lit. a DSGVO die Rechtsgrundlage. In allen anderen Fällen ist Art. 6 Abs. 1 lit. f DSGVO die Rechtsgrundlage.

3. Purpose of data processing

The processing of personal data is solely for the purpose of dealing with the contact. This may also constitute the necessary legitimate interest in processing the data.

4. Duration of storage

Your data will be deleted when it is clear from the circumstances that your request or the matter in question has been conclusively resolved.

VIII. Categories of recipients of personal data

Personal data will only be transferred to third parties in the cases mentioned in this statement or if we expressly inform you of this elsewhere. In addition, we sometimes use external processors (Art. 28 GDPR) to provide our services (e.g. host providers, email providers). However, they only process personal data within the European Union.