Using our websites is generally possible without providing personal data. With this notice, we inform you about the data we collect, how we use it, and how you can object to the data processing.
Who is responsible for data collection and processing?
Regionalverkehre Start Deutschland GmbH collects and processes the data as the data controller. Questions or suggestions can be addressed as follows:
Regionalverkehre Start Deutschland GmbH
Europa-Allee 70-76
60486 Frankfurt a. M.
T: (069) 9 99 99 36 40
F: (069) 9 99 99 36 69
Email: info@startgmbh.com
The appointed data protection officer of Regionalverkehre Start Deutschland GmbH is Dr. Marein Müller. Questions and suggestions regarding data protection can be sent via email to datenschutz@startgmbh.com.
What data do we collect and how and why do we process the data?
When visiting this website, certain device-related data is automatically collected and processed. These are the server log files that typically occur when visiting a website. The following data is usually transmitted to us:
The use of this website without processing this data is not technically possible. The legal basis for processing is Art. 6(1)(f) of the General Data Protection Regulation (GDPR).
When contacting us, we process the personal data provided to us for the purpose of correspondence. The legal basis for processing is Art. 6(1)(f) GDPR.
If we obtain your consent for processing personal data, the legal basis is Art. 6(1)(a) GDPR.
When processing personal data that is necessary for the performance of a contract with you, the contract is the legal basis according to Art. 6(1)(b) GDPR. Article 6(1)(b) GDPR also applies to processing operations that are necessary for the performance of pre-contractual measures, such as inquiries about our products or services or job applications.
If our company is subject to a legal obligation that requires the processing of personal data, such as fulfilling tax obligations, the processing is based on Art. 6(1)(c) GDPR.
We are also interested in maintaining customer relationships and providing our customers with information and offers that we believe are of interest to them. Therefore, we process data based on Art. 6(1)(f) GDPR (also with the help of service providers) to send information and offers. We use contact details (name, first name, postal address) for postal advertising and market research, unless such use has been objected to. The email address that we have obtained from a business relationship may also be used for advertising purposes.
This advertising use of personal data can be objected to at any time with effect for the future. The objection can be sent, for example, by email to info@startgmbh.com (advertising objection).
In the context of competitions, data is collected for their processing. The details, such as which data is collected for what purpose, can be found in the data protection notices and terms and conditions of the respective competition. The legal basis for this processing is Art. 6(1)(b) GDPR.
If users subscribe to a newsletter from us, the email address is collected as a mandatory field. In this case, it may be used by us for advertising purposes.
When registering for the newsletter, we store the IP address assigned by the Internet service provider (ISP), the computer system used at the time of registration, as well as the date and time of registration. The collection of this data is necessary to be able to trace any (possible) misuse of the email address of an affected person at a later date and therefore serves our legal protection. The legal basis for this processing is Art. 6(1)(a) GDPR.
Unsubscribing from the newsletter is possible at any time by email or by clicking the unsubscribe link in the newsletter.
How long will the data be stored?
We only store the data for as long as it is necessary for the fulfillment of the purpose for which it was collected (e.g. within the framework of a contractual relationship) or as required by law.
In the context of a contractual relationship, we store your data for at least until the contract is fully terminated. Afterwards, the data will be retained for the duration of the statutory retention periods.
What rights do users have?
You can request information about which data is stored.
You can request correction, deletion, and restriction of the processing (blocking) of personal data, as long as this is legally permissible and possible within an existing contractual relationship.
You have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for Regionalverkehre Start Deutschland GmbH is: The Hessian Commissioner for Data Protection and Freedom of Information.
You have the right to data portability of the data that has been provided to us based on consent or a contract (data portability).
If consent has been given for data processing, it can be revoked at any time using the same method as it was given. Revoking consent does not affect the lawfulness of processing based on consent before its withdrawal. Data processing can be objected to for reasons arising from a particular personal situation, if the data processing is based on our legitimate interests or is necessary for the performance of a public task.
Users can object to advertising at any time with effect for the future (advertising objection).
To exercise personal rights, a letter can be sent by post to:
Regionalverkehre Start Deutschland GmbH
Hahnstraße 40, 60528 Frankfurt a. M.
or by email to info@startgmbh.com.
Will data be disclosed?
For contract processing, it is usually necessary to involve instruction-dependent contract processors, such as data center operators, printing or mailing service providers, or other parties involved in contract fulfillment.
External service providers who process data on our behalf are carefully selected by us and contractually obligated to comply with strict requirements. The service providers work according to our instructions, which is ensured through strict contractual regulations, technical and organizational measures, and additional controls. The involvement of service providers is necessary, for example, in the administration and maintenance of IT systems.
Personal data will only be disclosed if explicit consent has been given or based on a legal regulation. Disclosure of data may be necessary, for example, in the following situations:
In case of payment irregularities/payment default, debt data may be disclosed to a debt collection agency.
For the provision of sales services (e.g. sale of tickets, fare reimbursement, payment processing in connection with sales services), DB Vertrieb GmbH acts as a joint controller within the meaning of Art. 26 GDPR. Further information on data protection can be found on the website of DB Vertrieb GmbH: https://www.db-fahrpreisnacherhebung.de
Use of Cookies
Cookies are small text files that can store personal data. We distinguish between cookies that are strictly necessary for the technical functions of the website and optional cookies.
The use of www.startgmbh.com, www.start-NI-mitte.de, www.start-unterelbe.de, and www.start-klar.net is generally possible without cookies that serve non-technical purposes. In the browser, tracking can be prevented by cookies (Do-not-track, Tracking-Protection-List) or the storage of third-party cookies can be prohibited.
We also recommend regularly checking and deleting stored cookies if they are not explicitly desired. Attention: When deleting all cookies, any set opt-out cookies will also be deleted, so any declared objections will need to be re-declared.
Cookie-Reset start-ni-mitte.de: https://start-ni-mitte.de/?reset_borlabs_cookie
Matomo
For the needs-based design of our websites, we use the web analysis tool "Matomo" based on Art. 6 para. 1 lit. f GDPR. Matomo creates usage profiles based on pseudonyms. Cookies are not explicitly set.
There is the possibility to prevent user actions from being analyzed and linked.
Further information on the terms of use of Matomo and the data protection regulations can be found here: https://matomo.org/privacy/
Social Media
Regionalverkehre Start Deutschland GmbH is represented in various social media platforms with its own presence. With this, we aim to provide a wide range of multimedia offerings and engage with users on topics that are important to them. In addition to the respective provider of a social network, we also collect and process personal user data on fan pages. With this notice, we also inform about the data we collect on our social media platforms, how we use it, and how data usage can be objected to. The respective purposes of data processing and data categories can be found in the respective offers listed below. The activities we operate and further explain in social media are carried out on the basis of a balancing of interests according to Art. 6 para. 1 lit. f GDPR.
Facebook
Tips and information about traveling can be found on the Facebook pages of Regionalverkehre Start Deutschland GmbH.
When visiting our pages, Meta Platforms Ireland Limited., 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland, collects, stores, and processes personal data in accordance with their privacy policy. The privacy policy can be found here: https://www.facebook.com/privacy/policy
In addition, we only process data to a very limited extent:
For the purpose of customizing and continuously optimizing our pages, we use the statistical service Facebook Insights. This service collects user activities on our page and provides us with anonymized statistics. This allows us to gain insights into the activity of our fan page visitors, the views of our page, the reach of posts, views and average duration of video playback, information about the countries and cities our visitors come from, as well as statistics about the gender distribution of our visitors.
Conclusions about individual users and access to individual user profiles by the administrator are not possible.
Further information about Facebook Insights can be found here: www.facebook.com/legal/terms/information_about_page_insights_data
Regarding the processing of Insights data, Facebook and we share joint responsibility. Details on this can be found in the Joint Controller Addendum, which can be found here: www.facebook.com/legal/terms/page_controller_addendum
Facebook Ireland provides the essential information about the page insights supplement to data subjects.
In addition, we store usernames and comments that are deleted due to violations of netiquette. These are only retained for the necessary evidence in legal disputes within the statute of limitations.
Apart from that, we do not generally store or process personal data except for competitions. In competitions, the winners are publicly identified by their username and asked to contact us by email within a period of 14 days. The winners must provide their full names and addresses so that the prizes can be sent to them. We only process this data for the purpose of administering the competition. The respective terms and conditions apply to competitions. The emails with the addresses are generally deleted after 30 days, unless they are needed beyond that for notifying the winners.
Instagram
On the Instagram channels of Regionalverkehre Start Deutschland GmbH, we provide a behind-the-scenes look at a railway transport company, share tips and tricks about train travel, and provide inspiration for possible destinations. In addition, comments can be left and questions can be asked.
When visiting our channels, personal data is stored and processed by Meta Platforms Ireland Limited., 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland, as the provider of Instagram, in accordance with Instagram's privacy policy. The privacy policy can be found here: https://privacycenter.instagram.com/policy
In addition, we only process data to a very limited extent:
For the purpose of customizing and continuously optimizing our pages, we use the statistical service Instagram Insights. This service collects user activities on our page and provides us with anonymized statistics. This allows us to gain insights into the interactions of our fan page visitors, the views of our page, the reach of posts, information about the activity of our subscribers, as well as information about the countries and cities our visitors come from, and statistics about the gender distribution of our visitors. Conclusions about individual users and access to individual user profiles by the administrator are not possible.
Furthermore, we store usernames and comments that are deleted due to violations of netiquette. These are only retained for the necessary period of limitation for legal disputes.
In addition, we generally do not store or process personal data except for competitions. In competitions, the winners are publicly identified with their usernames and asked to contact us by email within a period of 14 days. The winners must provide their full names and addresses so that the prizes can be sent. We process this data solely for the purpose of conducting the competition. The respective terms and conditions of participation apply to competitions. The emails with the addresses are generally deleted after 30 days, unless they are needed beyond that for the notification of the winners.
After publicly and non-bindingly requesting users, we ask for their permission to repost their pictures on the Instagram channel Deutsche Bahn Konzern. The consent declaration is saved by us as a screenshot and the image as a file with the user's information. The photos and the consent declaration are stored as long as the photo is posted on the channel or until the consent is revoked. The reposted photo is stored on the server of Instagram [Facebook Ltd., 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland] for technical reasons. Revocation is possible at any time (see below for more information). In the event of revocation, the image and the user's information will be deleted immediately.
Twitter
The Twitter channels of Regionalverkehre Start Deutschland GmbH are used for press and public relations work on all topics related to our networks, primarily for communicating delay notifications.
When visiting our channels, Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA, as the operator of Twitter, stores and processes personal data to the extent described in the privacy policy. The privacy policy can be found here: https://twitter.com/de/privacy. In addition, we generally do not store or process personal data. Only in the event that users send us a direct message, the username is stored.
Furthermore, we store usernames and comments that are deleted due to violations of netiquette. These are only retained for the necessary period of limitation for legal disputes.
YouTube
The YouTube channels of Regionalverkehre Start Deutschland GmbH enable the display of moving image contributions in an environment with individual corporate design. The films are tailored to the target group and report on current events, explain complex relationships, and contribute to representing diversity. We also answer the questions and comments of users on YouTube.
When visiting our channels, Google LLC ("Google"), Amphitheatre Parkway, Mountain View, CA 94043, USA, as the operator of YouTube, stores and processes personal data in accordance with Google's privacy policy. The privacy policy of YouTube can be found here: https://policies.google.com/privacy
In addition, we only carry out data processing to a very limited extent: In the event of a violation of netiquette, we store usernames and those comments that are deleted due to a violation of netiquette. These are only retained for the necessary evidence in legal disputes within the statute of limitations.
We embed content from YouTube on our websites. By default, this service is inactive for us, but can be activated by the user. By clicking on the link to play the video, a connection is established with YouTube and the external content is displayed. In doing so, Google as the operator of YouTube uses cookies and pixel tags to personalize advertising and search results. Google as the operator of YouTube is solely responsible for this data processing. We have no knowledge of and no influence on which data is processed in this regard. The company that provides the service in the European Economic Area and Switzerland is Google Ireland Limited, a company registered and operated under Irish law (registration number: 368047) with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland. Further information on data protection at Google can be found here: https://policies.google.com/privacy
If the checkbox is activated, we remember this decision and show future videos without the need to activate the YouTube offer again. For this purpose, we use a so-called session cookie. We do not transmit any data to Google as the operator of YouTube.
TikTok
The TikTok channels of Regionalverkehre Start Deutschland GmbH enable the display of moving image contributions in an environment with individual corporate design. The films are tailored to the target group and report on current events, explain complex relationships, and contribute to representing diversity.
When visiting our channels, TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, collects, stores, and processes personal data in accordance with its privacy policy. The privacy policy can be found here: https://www.tiktok.com/legal/page/eea/privacy-policy
In addition, Regionalverkehre Start Deutschland GmbH plays advertisements on TikTok. In doing so, we receive aggregated statistics on the advertising placement from TikTok. Based on the case law of the European Court of Justice, it can be assumed that there is joint responsibility between the respective advertising company and TikTok with regard to the data collection and evaluation associated with the advertising placement by TikTok. A joint control agreement has been concluded with TikTok in this regard in accordance with Art. 26 (2) GDPR, which regulates the details of joint responsibility (see Jurisdiction Specific Terms, dated September 2, 2022, https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms, Part B 1, Clauses 3 and 4). TikTok users can control to what extent they receive personalized advertising on TikTok.
Rights of users on social networks:
We would like to point out that when processing data by Facebook, Instagram, Twitter, Youtube Snapchat, Foursquare, and TikTok, user data may be processed outside the European Union. This may pose risks for users, as it could make it more difficult to enforce user rights. Please refer to the privacy policy of Facebook, Instagram, Twitter, Youtube Snapchat, Foursquare, and TikTok for details.
We do not transfer data to third countries outside the EU/EEA or to an international organization unless there are adequate safeguards in place. These include the EU Standard Contractual Clauses and an adequacy decision by the European Commission.
Regarding data processing on social networks, we recommend contacting the respective social network directly for inquiries or other questions regarding user rights, such as a deletion request, as only they have full access to user data. If the data processing described here is no longer desired in the future, the connection of a user profile to our page can be terminated by using the "Unlike this page" and/or "Unsubscribe from this page" functions.
Regarding the processing of personal data through the "Insights" service offered by Facebook, Facebook has assumed primary responsibility. This concerns the processing of Insights data and the implementation of data subject rights. For all obligations under the GDPR regarding the processing of Insights data, users can contact Facebook directly. We will forward any related inquiries received by us to Facebook.
What happens with links to external sites?
When a link to an external site is clicked, you will be taken outside the pages of Regionalverkehre Start Deutschland GmbH. Regionalverkehre Start Deutschland GmbH is not responsible for the content, services, or products offered on the linked website. Nor is it responsible for the privacy and technical security on the linked website.
Use of video surveillance in our vehicles
Video surveillance is used in some vehicles. This is indicated accordingly in the cars.
The purposes of the video technology are:
The legal basis for the processing is Art. 6(1)(f) of the GDPR.
Legitimate interests are the investigation and prevention of crimes, as well as the protection of the life, health, and freedom of employees and customers, and the preservation of evidence in the event of an incident.
Video data is disclosed to law enforcement authorities, in particular to state and federal police. In special cases, it is also disclosed to the Federal Railway Authority.
The storage period varies depending on operational processes and contractual traffic requirements, ranging from 48 to 72 hours. After this period, the data is automatically deleted.
Ticket inspection for electronic tickets (eTicket)
The data stored on the chip card is read out and the electronic ticket as well as its temporal and spatial validity are automatically checked using mobile or stationary control devices. Only the inspection result (valid or invalid ticket in terms of temporal and spatial validity) is displayed. In addition, for personal tickets, depending on the association, the full or masked name, if applicable, the date of birth or year of birth, and the gender of the ticket holder are displayed on the control device. The data read from the chip card by the control device is only temporarily stored on the device for the purpose of inspection and is automatically deleted from the control device immediately after the inspection is completed.
Fare surcharge, violation of transport conditions, ban from premises, exclusion from transportation
For the processing of fare surcharge cases, checking for repeat offenders, and, in certain cases, for filing criminal complaints and imposing penalties for violations of transport conditions (e.g. vandalism, damage, dangerous interference with railway operations), as well as for issuing bans from premises or exclusions from transportation, we regularly collect and process the following personal data:
The personal data collected during ticket inspections will be forwarded to Atriga GmbH for processing the case and payment processing. Passengers will be informed in writing on the receipt for the increased transportation fare about the transfer of data to our debt collection service provider, Atriga. We reserve the right to take legal action against EBE debtors who are repeatedly found without a valid ticket.
Regarding the issuance of exclusions from transportation or bans from premises, we only store personal data for as long as it is necessary to fulfill the purpose for which it was collected or as required by law.
In the case of fare surcharges, the personal data will be deleted after a period of one year from the settlement of the claim. However, this only applies if no repeat offense has been identified. This period will be extended by one more year from the date of identification if a repeat offense is identified within the one-year period.
If the EBE is paid immediately in cash and in full, the following data will be collected:
If the EBE is paid immediately by non-cash means, the payment processing will be carried out by the payment service provider Payone. They will transmit the data encrypted to the respective banks and provide feedback on whether the payment was successful.
The following data will be collected in this case:
The legal basis for data processing is Art. 6(1)(b) of the GDPR in conjunction with the transport conditions.
Updating the privacy notice
We update the privacy notice to reflect changes in functionality or changes in legal requirements. Therefore, we recommend reviewing the privacy notice regularly.
As of: December 2023