Data Privacy Statement
Websites

PTV Planung Transport Verkehr GmbH, Sitz der Gesellschaft / Registered Office:Karlsruhe, Geschäftsführung / Managment Board: Christian U. Haas (Vors./CEO),
Andrew W. Myers (CFO), Handelsregister (HRB Nr.) / Commercial Register (HRBNo.): 743055, USt-ID-Nr. / VAT ID No.: DE 812 666 053, Registergericht / Court ofRegistration: Mannheim.

Data Privacy Statement Websites

Data Privacy Statement Websites

Content
Data Privacy Statement Websites ......................................................................................... 4
1.

Our contact details and general information about how we process data ....................... 4
1.1.
1.2.
1.3.
1.4.
1.5.
1.6.
1.7.
1.8.
1.9.

2.

Scope of personal data processing via our websites ...................................................... 9
2.1.
2.2.
2.3.
2.4.
2.5.
2.6.
2.7.
2.8.
2.9.
2.10.
2.11.
2.12.
2.13.
2.14.
2.15.
2.16.
2.17.
2.18.
2.19.
2.20.
2.21.
2.22.

3.

Name and contact details of the controller .............................................................................. 4
Data protection officer for the controller .................................................................................. 4
General information on the legal basis for the processing of personal data ........................... 4
General information about the deletion of data and the retention period ................................ 5
General information on the sources of personal data ............................................................. 5
General information on the recipients or categories of recipients of personal data ................ 6
General information on the purposes of data processing ....................................................... 6
Contact via e-mail, fax and telephone ..................................................................................... 7
Key information on joint responsibility within the PTV Group .................................................. 8
Website hosting and log file creation ....................................................................................... 9
Use of cookies by us and third parties................................................................................... 10
Data processing for newsletter distribution ........................................................................... 12
Data processing when using the contact forms ..................................................................... 14
Use of the Google Analytics tool ........................................................................................... 16
Use of Google Ads conversion tracking ................................................................................ 17
Use of the Google Tag Manager analysis tool ...................................................................... 19
Use of the Google API interface ............................................................................................ 20
Use of YouTube videos (in enhanced privacy mode)............................................................ 20
Use of the Google Optimize A/B testing tool ..................................................................... 22
Use of the Hotjar analysis tool ........................................................................................... 22
Use of the LinkedIn Analytics tool ..................................................................................... 24
Use of Leadlab................................................................................................................... 24
Use of Google Analytics Remarketing ............................................................................... 25
Use of Oracle’s Eloqua marketing tool .............................................................................. 27
Use of the OptinMonster tool ............................................................................................. 28
Use of Google AdSense (non-personalised) ..................................................................... 29
Conversion pixels from Adform ......................................................................................... 30
Data processing for the operation of a whistleblower platform ......................................... 31
Processing of personal data in the job application process .............................................. 32
Encryption of the website and communication .................................................................. 33
Transfer of personal data to a third country (EU/EEA country) ......................................... 33

Rights of data subjects ..................................................................................................34
3.1.
3.2.
3.3.
3.4.
3.5.
3.6.
3.7.
3.8.
3.9.
3.10.
3.11.

Right of access ...................................................................................................................... 34
Right to rectification ............................................................................................................... 34
Right to erasure ..................................................................................................................... 34
Right to restriction of processing ........................................................................................... 34
Right to notification ................................................................................................................ 34
Right to data portability .......................................................................................................... 34
Right to object to processing on legitimate interest grounds and to direct marketing ........... 34
Right to withdraw consent ..................................................................................................... 35
Automated decision making including profiling ..................................................................... 35
Voluntary nature of data provision ..................................................................................... 35
Right to lodge a complaint with a supervisory authority .................................................... 35© PTV Planung Transport Verkehr GmbH August 2024

Page 2/35

Data Privacy Statement Websites

Shorttitle
Template history© PTV Planung Transport Verkehr GmbH August 2024

Data Privacy Statement Websites

Data Privacy Statement Websites
V1.0.0 dated 2024-08-08

Page 3/35

Data Privacy Statement Websites

Data Privacy Statement Websites

Data Privacy Statement Websites

Below you will find information about what personal data we process, for what purpose, on
what basis and for how long:

1. Our contact details and general information about how weprocess data
1.1.

Name and contact details of the controller

The controller responsible for the collection and use of personal data under data protection law
is
PTV Planung Transport Verkehr GmbHHaid-und-Neu-Str. 15
76131 Karlsruhe, Germany
info@ptvgroup.com

1.2.

Data protection officer for the controller

1.3.

General information on the legal basis for the processing of
personal data

You can contact ourprotection@ptvgroup.com

company

data

protection

officerasfollows:

data-

In general, the following applies to our processing of personal data:
•

•

•

•

•

•

To the extent that we obtain your consent for the processing of personal data, Article 6(1)(a) of the EU General Data Protection Regulation (hereinafter referred to as theGDPR) will serve as the legal basis for the processing of personal data.
For the processing of personal data necessary for the performance of a contract withyou, Article 6 (1)(b) GDPR serves as the legal basis. This also applies if the processing
is necessary to carry out pre-contractual measures, such as orders, quotations,contract negotiations, or even if you have already registered but have not yet accepted
the terms of use on which our services are based.
If the processing of personal data is necessary to fulfil a legal obligation to which weare subject, Article 6 (1)(c) GDPR serves as the legal basis. This is the case, forexample, with existing legal obligations to retain and archive certain data (particularly
for tax and commercial reasons).
In the event that your vital interests or those of another natural person require theprocessing of personal data, Article 6 (1)(d) GDPR will serve as the legal basis.
However, this should not happen with our services.
If the processing of your personal data is necessary for the performance of a task
carried out in the public interest or in the exercise of official authority vested in us, thiswill be done on the legal basis of Article 6 (1)(e) GDPR. This legal basis is not relevant
for our services.
If the processing is necessary for the purposes of the legitimate interests pursued by
us or by a third party and your interests, fundamental rights and freedoms are notoverridden by these interests, Article 6 (1)(f) GDPR serves as the legal basis for theprocessing.

© PTV Planung Transport Verkehr GmbH August 2024

Page 4/35

Data Privacy Statement Websites
process data

1.4.

Our contact details and general information about how weGeneral information about the deletion of data and the retention
periodAs a general rule, we will delete or block personal data as soon as the purpose for which it
was stored no longer applies. Data may also be stored where required by European or national
legislators in EU regulations, laws or other rules to which we are subject as a data controller.
The data will also be blocked or deleted at the end of a retention period prescribed by the
aforementioned standards, unless further storage of the data is necessary for the conclusionor performance of a contract.
In concrete terms, this means that:
If we process the personal data on the basis of consent to data processing (Article 6(1)(a)GDPR), the processing ends with your revocation, unless there is another legal basis forprocessing the data, which is the case, for example, if we are still entitled to process your data
for the purpose of fulfilling the contract at the time of revocation (see below).
If we process the data on the basis of our legitimate interests (Article 6 (1)(f) GDPR) in thecontext of a prior assessment, we will store the data until the legitimate interest ceases to exist,
the assessment comes to a different conclusion or you have effectively objected in accordancewith Article 21 GDPR (see the visually highlighted “Reference to specific right of objection”
under Section 3).
If we process the data to fulfil the contract, we will store the data until the contract has been
finally fulfilled and processed and no further claims can be asserted under the contract, i.e.
until the limitation period has expired. The standard limitation period under Paragraph 195 of
the German Civil Code (BGB) is three (3) years. However, certain claims, such as claims fordamages, only become statute-barred after 30 years (see Paragraph 197 BGB). If there is alegitimate reason to believe that this is relevant in an individual case, we will retain personal
data for that time period. The above limitation periods begin at the end of the year (i.e. 31
December) in which the claim arose and the creditor became aware, or should have becomeaware without gross negligence, of the circumstances giving rise to the claim and the identityof the debtor.
Please note that we are also subject to statutory retention obligations for commercial, tax andaccounting purposes. These require us to retain certain information, which may include
personal information, for a period of six (6) to ten (10) years as proof of our proper
business or accounting practices. These retention periods take precedence over the deletion
requirements set out above. Retention periods also begin at the end of each year, i.e. on 31
December.

1.5.

General information on the sources of personal data

The personal data we process is primarily obtained from the data subjects themselves, forexample when they
•

•
•
•

as users of our website, transmit information, such as the IP address, to us or our web
server via the web browser and their end device (e.g. a PC, smartphone, tablet or
notebook),
have a customer account with us or have a customer relationship with us,
request information material or a quotation from us as an interested party,
request information material, press releases, statements or the like as members of thepress,© PTV Planung Transport Verkehr GmbH August 2024

Page 5/35

Data Privacy Statement Websites
process data

Our contact details and general information about how wesupply us with goods as agreed as suppliers or provide us with services or similar as business
partners.
In exceptional circumstances, the personal data we process may also originate from third
parties, for example where an individual is acting on behalf of a third party.

1.6.

General information on the recipients or categories of recipients ofpersonal dataYour personal information will only be shared or transferred to third parties if this is absolutely
necessary and permitted for the purpose in question. We explain to whom we share data andfor what purposes in connection with the data processing described below or, in the case oftransfers to third countries (other EU or EEA countries), additionally in this Data Privacy
Statement.
•
•
•
•

1.7.

Categories of recipients can generally be:
Service providers,
Suppliers, business partners,
Accounting, tax consultants.

General information on the purposes of data processing

Depending on the category of data involved, we process personal data for the following
purposes and on the basis of the relevant legal basis of the General Data Protection Regulation(GDPR):

1.7.1

User data

1.7.2

Prospect data/data of press representatives

1.7.3

Customer data

We collect and process information from users of our website on a non-personalised basis. It
is not possible for us to associate the information with specific individuals. The IP address isonly processed in anonymised form. If, in exceptional cases, personal data is involved, we
process it to protect our legitimate interests on the basis of Article 6(1)(f) GDPR. Our legitimate
interests in this sense include our interest in the security and integrity of our website and thedata on our web server (in particular fault and error detection and tracking of unauthorised
access), as well as marketing interests and interests in statistical surveys (to improve our
website and our services and offers). If we do engage in such data processing, we will havefirst weighed the interests involved and come to the conclusion that the particular dataprocessing is necessary to safeguard the aforementioned legitimate interests and does notoverride your interests or fundamental rights and freedoms requiring the protection of personal
data.
Where we process data from prospective customers or members of the press, we only do so
if they enter the data in an input field, by e-mail or otherwise and send it to us for the purposeof making an enquiry. This input is always voluntary. We will only use this information toprocess the enquiry. The processing of the data voluntarily provided to us for the purpose of
informing you about our services is carried out as pre-contractual processing pursuant to
Article 6 (1)(b) GDPR and/or on the basis of the consent you have given by transmitting thedata in accordance with Article 6 (1)(a) GDPR.
We process the data of our customers for the purpose of contract initiation and contract
processing in accordance with Article 6 (1)(b) GDPR or, in the case of a customer account or
the existence of consent, (also) in accordance with Article 6 (1)(a) GDPR on the basis ofconsent given, e.g. in the context of registration/login.
© PTV Planung Transport Verkehr GmbH August 2024

Page 6/35

Data Privacy Statement Websites
process data

Our contact details and general information about how we

1.7.4

Supplier data/business partner data

1.8.

Contact via e-mail, fax and telephone

We process the data of our suppliers and business partners for the purposes of contract
fulfilment in accordance with Article 6(1)(b) GDPR and/or on the basis of consent given inaccordance with Article 6(1)(a) GDPR. This also applies to processing that is necessary forthe performance of pre-contractual measures (e.g. in connection with the preparation andnegotiation of offers).
There are a number of ways you can contact us. You can also find an e-mail address,
telephone number and fax number on the website. Even if you e-mail, call or fax us, we will
inevitably process your personal data. This is because at least the personal data transmitted
by e-mail, fax or telephone will be stored by us or our systems.
This data will not be shared with third parties. The data will only be used to process theconversation.

1.8.1

Purposes of data processing

1.8.2

Legal basis for data processing

The processing of personal data sent to us by e-mail, fax or telephone is for the purpose ofprocessing your contact and request. We will need your e-mail address, fax number ortelephone number in order to reply to you. This also constitutes a legitimate interest inprocessing the data.
The legal basis for the processing of the data is your consent pursuant to Article 6 (1)(a) GDPR,
which you have given by actively contacting us, otherwise our legitimate interest incommunicating with you pursuant to Article 6 (1)(f) GDPR. If the purpose of the contact or your request is the conclusion of a contract, the legal
basis for the processing is Article 6 (1)(b) GDPR (taking of pre-contractual measures).

1.8.3

Storage duration

The data will be deleted as soon as it is no longer necessary to fulfil the purpose for which it
was collected.
For personal data sent by e-mail, this is generally the case when the respective conversation
with you has ended and we have waited for a waiting period of up to 6 months to see whether
we may need to revisit your request or the details of the communication. The conversationends when it can be concluded from the circumstances that the matter in question has beenconclusively clarified.
Fax data is stored separately from print data in the fax machine memory. Once the fax has
been printed, the memory is freed up to receive and store the next fax. Parts of the fax can be
temporarily stored in the machine's memory after printing, until they are overwritten by the next
fax received. This usually results in the data being automatically deleted after 1-2 weeks. If it
is a computer fax, we will receive your fax as an e-mail and the information about e-mails will
apply accordingly.
When you make an incoming or outgoing call to us, your telephone number or yourname/company name as registered with your telephone company, together with the date andtime of the call, is stored in our telephone system in what is known as a ring buffer, which
overwrites the oldest data with new data. This usually results in the data being automaticallydeleted from the phone system after approximately 3-4 months.

© PTV Planung Transport Verkehr GmbH August 2024

Page 7/35

Data Privacy Statement Websites
process data

Our contact details and general information about how we

The communication may be subject to a commercial or tax law retention obligation, which willthen take precedence (see above under "Data deletion and retention period").

1.8.4

Right of objection and removal

You may at any time revoke your consent to the processing of your personal data or object tothe further processing of your data on the basis of legitimate interest (see reference to thespecific right of objection in Section 3 of this Data Privacy Statement). In this case, theconversation cannot be continued.
You may revoke your consent or object to further processing of your data by sending us an
informal message (e.g. by e-mail). Any personal data collected in the course of contacting us
will then be deleted, unless it is subject to a specific retention obligation, in which case it willtake precedence.

1.9.

Key information on joint responsibility within the PTV GroupPTV GmbH and its subsidiaries belong to a group of companies within the meaning of Article
4 (19) GDPR (hereinafter referred to as: "PTV Group"). The PTV Group consists primarily of
PTV GmbH and its subsidiaries. You can find all the PTV Group companies relevant to you
here. PTV GmbH is the parent company of the PTV Group and provides a number of central
services (e.g. IT infrastructure, cloud services), products and systems for its subsidiaries. For
such services and systems, PTV GmbH and the respective subsidiary are joint controllers
within the meaning of Article 26 GDPR.
The purpose of the joint data processing is, in particular, to process the data at a central
location by PTV GmbH in order to simplify and standardise internal processes, to avoid
duplicate or multiple data storage and processing and the associated security risks, and thus
to ensure the security and integrity of the data through the possibility of central security
precautions. Another purpose is to be able to provide PTV Group customers with services andproducts faster and better than would be possible for the individual PTV Group companies.
As part of the joint responsibility for data processing, PTV GmbH and the other companies of
the PTV Group have each concluded a contract in accordance with Article 26 GDPR. There, itis essentially agreed that the party that primarily influences and controls the processing of thepersonal data in question is responsible for ensuring that its processing of that personal data
complies with the GDPR (where applicable) or the applicable data protection law. This includes
the responsibility for fulfilling the information obligations towards data subjects and fulfilling therights of data subjects in accordance with Articles 12 to 22 GDPR.
It was also agreed that each party would be solely responsible for the data processing it carriedout, i.e. it would independently assume all rights and obligations arising therefrom, including
the processing of data subjects' rights.
With respect to transfers of personal data to countries outside the European Union/European
Economic Area for which there is no adequacy decision by the EU Commission, the agreementof additional data protection measures - where necessary - will be part of the agreement inaddition to the current EU standard contractual clauses.
Where it is apparent that a party controls and carries out the processing in question, data
subjects may contact that party directly by using the contact options specified and publishedin each case. However, data subjects may exercise their rights under Articles 15 to 22 of the
GDPR against any of the joint controllers.

© PTV Planung Transport Verkehr GmbH August 2024

Page 8/35

Data Privacy Statement Websites

Scope of personal data processing via our websites

2. Scope of personal data processing via our websites

We collect and use users' personal information when they use our website only to the extent
necessary to provide a functional website and our content and services. The collection anduse of personal information from our users is generally only done with the user's consent. An
exception to this is where prior consent cannot be obtained for objective reasons and/or theprocessing of the data is permitted by law.
This website is hosted by an external service provider (hosting provider). Personal datacollected on this website is stored on the host provider’s servers. This may include IP
addresses, contact requests, meta and communication data, contract data, contact details,
names, website access and other data generated through a website.
The hosting provider is used for the purpose of fulfilling the contract with our potential andexisting customers (Article 6 (1)(b) GDPR) and in the interest of a secure, fast and efficient
provision of our online offer by a professional provider (Article 6 (1)(f) GDPR).
Our hosting provider will only process your data insofar as this is necessary to fulfil the service
obligations and to follow our instructions with regard to this data.
The website is hosted in Germany by UEBERBIT GmbH, Rheinvorlandstraße 7, 68159
Mannheim, Germany, https://www.ueberbit.de/.
We have entered into a data processing agreement with the hosting provider pursuant to Article
28 (3) GDPR.

2.1.

Website hosting and log file creation

For technical reasons, our system automatically collects data and information each time youaccess the website. These are stored in the server's log files. These are the following:
•
•
•
•
•
•
•
•
•
•

Date and time of access,
URL (address) of the referring website (referrer),
Pages accessed by the user's system through our website,
User's screen resolution,File(s) retrieved and success message,
The amount of data sent,
The user’s Internet service provider,Browser, browser type and version, browser engine and engine version,Operating system, operating system version, operating system type, andThe anonymised IP address and the user's Internet service provider.

For example, we use the IP address to control the language settings of the website.
The data will be processed separately from other data. This information will not be combinedwith any other personal information about the user. It is not possible for us to associate thisinformation with any particular individual.

2.1.1

Purposes of data processing

The temporary processing of the data by the system is necessary in order to deliver the content
of our website to the user's computer. For technical reasons, the user's IP address must be
stored for the duration of the session.
Log files are kept to ensure the functionality of the website. We also use the information to
improve our services and website and to ensure the security of our information technology
systems.
© PTV Planung Transport Verkehr GmbH August 2024

Page 9/35

Data Privacy Statement Websites

2.1.2

Legal basis for data processing

2.1.3

Storage duration

2.1.4

Right of objection and removal

Scope of personal data processing via our websites

The temporary storage of data and log files is based on Article 6(1)(f) GDPR (legitimate
interest). Our legitimate interest in processing the data is for the purposes set out above.
The data will be deleted as soon as it is no longer necessary to fulfil the purpose for which it
was collected. In the case of the collection of data for the provision of the website, this will be
the case at the end of the session. If the data is stored in log files, it will be deleted after nomore than seven days. Further storage is possible. In this case, users' IP addresses aredeleted or anonymised so that it is no longer possible to identify the calling client.
The collection of data for the provision of the website and the storage of data in log files isabsolutely necessary for the operation of the website. Consequently, there is no possibility ofobjection on the part of the user. However, the user can stop using the website at any time
and thus prevent the further collection of the aforementioned data.

2.2.

Use of cookies by us and third parties

We use cookies when you access individual pages. These are small text files stored on yourdevice (PC, smartphone, tablet, etc.). When you visit a website, your browser may store acookie. This cookie contains a unique string of characters that allows the browser to be
uniquely identified when the website is visited again.
Cookies are used to enable the use of our website or to ensure the security and integrity of thewebsite (essential cookies) or to make the website more user-friendly (non-essential cookies).
Our content management system (Drupal or TYPO3) also uses technically necessary cookies
to enable functions such as logging into the administrator area. The setting of cookies is thennecessary in order to recognise logged-in visitors.
Third-party cookies may also be used. These cookies may also allow analysis of the user's
browsing behaviour. If this is the case, we will inform you separately in this Data Privacy
Statement or in specific Data Privacy Statements directly in the information about the relevant
third-party tools (such as analytics tools, plug-ins, etc.). For example, analysis tools (such as
Google Analytics) set their own cookies for analysis purposes.
When you access our website, you will be informed about the use of cookies and your consent
to the processing of the personal data used in this context by cookies that are not absolutely
necessary will be obtained.
You can find a detailed list of the cookies we use, their storage period, origin and function at
any time at https://www.ptvgroup.com/en/cookies. You can also change your cookie
preferences there at any time.

2.2.1

Purpose of data processing

The purpose of using essential cookies is to enable you to use our website or certain features.
Some functions of our website cannot be offered without the use of cookies. This means, forexample, that the browser must be recognised even after a page change. We do not use theinformation collected by essential cookies to create user profiles.
Non-essential cookies are generally used to improve the quality of our website and its content,
as well as for advertising and market research purposes. Analytical cookies help us understandhow the site is being used and allow us to continually improve our service.

© PTV Planung Transport Verkehr GmbH August 2024

Page 10/35

Data Privacy Statement Websites

2.2.2

Scope of personal data processing via our websites

Legal basis for data processing

The following applies to strictly necessary cookies: The legal basis for the storage of essential
cookies on your end device and their access is Paragraph 25 (2)(2) of the TDDDG (German
Telecommunications Digital Services Data Protection Act). The legal basis for the further
processing of personal data using the information stored in the cookie is Article 6 (1)(f) GDPR,
which is a legitimate interest on our part. Our legitimate interest lies in the purposes mentioned
above.
The following applies to non-essential cookies: The legal basis for the storage of non-essential
cookies on your end device and their access is your consent pursuant to Paragraph 25 (1)TDDDG (German Telecommunications Digital Services Data Protection Act). The legal basis
for the further processing of personal data using non-essential cookies is the consent given at
the same time in accordance with Article 6 (1)(a) GDPR.

2.2.3

Storage duration

Some of the cookies we use are deleted at the end of the browser session, i.e. when you close
your browser (so-called session cookies). Other cookies remain on your device and enable us
or our service providers (third parties) to recognise your browser on your next visit (persistentor static cookies).
If we have stored the cookies on the basis of the user's consent, we will stop processing thedata if the user revokes this consent. Otherwise, we store the data collected on the basis of alegitimate interest until the legitimate interest ceases to exist, the assessment comes to adifferent conclusion or the user has effectively lodged an objection in accordance with Article
21 GDPR (see the visually highlighted "Reference to specific right of objection" under Section
3). We will periodically review whether the legitimate interest still exists. In particular, ourinterest will cease when the data is no longer sufficiently relevant to us for analysis andstatistics on website usage due to the passage of time, which is likely to be after three years
at the latest.

2.2.4

Right of objection and removal

Cookies are stored on your computer and sent from your computer to our website. This gives
you full control over the use of cookies. You can disable or restrict the sending of cookies bychanging the settings on your internet browser. Cookies that have already been stored can bedeleted at any time.
Below are links to typical browsers where you can find more information about managing yourcookie preferences:
•
•
•
•
•
•

Firefox: https://support.mozilla.org/en/kb/cookies-erlauben-und-ablehnen
Chrome:https://support.google.com/chrome/bin/answer.py?hl=de&hlrm=en&answer=95647
Internet Explorer/Edge: https://windows.microsoft.com/de-DE/windows-vista/Block-orallow-cookies
Safari: https://support.apple.com/en-us/guide/safari/sfri11471/mac
Opera: https://help.opera.com/en/latest/web-preferences/#cookies
Yandex: https://browser.yandex.com/help/personal-data-protection/cookies.html

Note: If you disable or delete cookies for our website, you may not be able to take fulladvantage of all the features of the website.
You can prevent the use of non-essential cookies by not giving or revoking your consent.

© PTV Planung Transport Verkehr GmbH August 2024

Page 11/35

Data Privacy Statement Websites

2.3.

Scope of personal data processing via our websites

Data processing for newsletter distribution

It is possible to subscribe to a newsletter on our website or by sending us an enquiry. The datafrom the input screen is transmitted to us when you sign up for the newsletter. This ismandatory information••

Country andE-mail address.

We need the country information to tailor the content of the newsletter to your country andlanguage.
Optionally, you can also enter your name and title so that we can address you by name. You
also have the option of specifying your area of interest and industry, which will help us to refine
our offer.
When registering for the newsletter, the following data is also collected (opt-in verification):••Your IP address, andThe date and time of your registration.

This is to prevent misuse of the service or your e-mail address and to fulfil our legal obligation
to prove that an opt-in, i.e. express consent to receive the newsletter, has actually been givenby the e-mail address.
Subscribing to our newsletter is a double opt-in process. This means that once you haveregistered, you will receive an e-mail asking you to confirm your registration. This confirmationis necessary to ensure that no one can register using someone else's e-mail address. When
you click on the link to confirm your registration, your IP address and the exact time (date andtime) of the click will be recorded. The purpose of this data processing is to fulfil our legal
obligation to prove that an opt-in, i.e. express consent to receive the newsletter, has actually
been given by the e-mail address.
Your consent to the processing of data is obtained as part of the registration process andreference is made to this Data Privacy Statement.
If you purchase goods or services from our website or other services and provide us with youre-mail address, we may subsequently use it to send you a newsletter. In this case, only directadvertising for our own similar goods or services will be sent via the newsletter.
The data will only be used for the purpose of sending the newsletter.

2.3.1

Use of the "Oracle Eloqua" software

Our e-mail newsletters are sent using the Eloqua marketing system from Oracle America, Inc.,
2300 Oracle Way, Austin, TX 78741, USA ("Eloqua" / see further information about Eloqua
below in Section 2.15). The data you provide when registering for the newsletter will be passed
to the Eloqua system for this purpose. Please note that your data will normally be transferred
to and stored on an Oracle server in the USA. Eloqua will use the data to send and analyse
the newsletter on our behalf (see "Statistical data collection and analysis" below).
We have entered into a data processing agreement with Oracle (data processing agreement
pursuant to Article 28(3) GDPR). This is a contract in which Oracle undertakes to protect yourdata, to process it on our behalf in accordance with its Privacy policy and, in particular, not topass it on to third parties. This Data Processing Agreement can be viewed at:https://www.oracle.com/contracts/docs/corporate_data_processing_agreement_062619.pdf?
download=false. In addition, we have agreed additional measures with Oracle that go beyond© PTV Planung Transport Verkehr GmbH August 2024

Page 12/35

Data Privacy Statement Websites

Scope of personal data processing via our websites

the provisions of the EU standard contractual clauses and require Oracle to take steps tofurther enhance the level of data protection.
In addition, Oracle America, Inc. is certified under the EU-U.S. Data Privacy Framework (DPF),
which means that the transfer of data to Oracle is permitted under the EU adequacy decisionbecause it ensures a level of data protection equivalent to that in the EU.
For
more
information
about
privacy
www.oracle.com/legal/privacy/privacy-policy.html.

2.3.2

at

Oracle,pleasevisit:

Statistical data collection and evaluation

E-mails sent via Eloqua contain a recipient ID and a tracking pixel:
The recipient ID enables Oracle Eloqua to associate the opening activity of an e-mail with acontact. The tracking pixel is a 1x1 pixel image embedded in the e-mail that is used to track email openings. The tracking image refers to an endpoint on the Oracle Eloqua servers. Whenthe image loads, the endpoint records the opening of the e-mail. If a user does not load images
when viewing an e-mail, Oracle Eloqua uses click-throughs to assume that an e-mail has been
opened.
Link tracking is also performed for links contained in an e-mail. This means that we collect thefact that you have clicked on a particular link and process this information for marketing
purposes and to improve our offers. We use Google Analytics to track these external links. For
more information about Google Analytics, please see Section 2.5 of this Data Privacy
Statement below.
The data is collected in a pseudonymised form only and is not linked to your other personal
data; no direct personal reference is possible. This information will only be used for statisticalanalysis of newsletter campaigns. We use the analysis only to identify reading habits and to
tailor our content to those habits or to deliver different content according to readers' interests.
The reference to a specific person is not of interest to us and will not be made.

2.3.3

Purpose of data processing

The collection and processing of the user's e-mail address is for the purpose of sending thenewsletter. We use the e-mail address for advertising purposes.
The collection of the IP address and time when the confirmation link in the double opt-in e-mailis clicked is to fulfil our legal obligation to obtain express consent.
Other personal information collected as part of the registration process is used to prevent
misuse of the services or the e-mail address used.
We may retain your information for up to three years after you unsubscribe from our newsletterin order to provide evidence of your prior consent and to defend ourselves against any related
claims.

2.3.4

Legal basis for data processing

The legal basis for the processing of data after registration for the newsletter is your consent
pursuant to Article 6 (1)(a) GDPR. The legal basis for the storage of information (e.g. cookies)
on your terminal and the access to this information, as well as the associated statistical datacollection and analysis, is your consent, which you give at the same time as your consent inaccordance with the GDPR pursuant to Paragraph 25 (1) TDDDG.

© PTV Planung Transport Verkehr GmbH August 2024

Page 13/35

Data Privacy Statement Websites

Scope of personal data processing via our websites

If no consent has been given, data processing within the scope of the newsletter in the caseof previous purchase of similar goods or services is carried out on the legal basis of Paragraph
7 (3) UWG (German Act against Unfair Competition) in conjunction with Article 6 (1)(f) GDPR.
The legal basis for the storage of the IP address and the time when you click on theconfirmation link in the double opt-in e-mail and for possible further storage for up to three
years after you unsubscribe from the newsletter is our legitimate interest pursuant to Article 6(1)(f) GDPR (legitimate interest). In this case, the legitimate interest is to be able to prove thatyou have given your prior consent and to be able to defend against any claims arising from it.

2.3.5

Storage duration

The data is deleted as soon as it is no longer necessary to achieve the purpose for which it
was collected. In particular, your e-mail address will be stored for the duration of yoursubscription to the newsletter.
We may retain unsubscribed e-mail addresses, together with the data collected when
confirming consent to receive the newsletter, for up to three years on the basis of our legitimate
interests, before deleting them in order to be able to prove that consent was previously given.
The processing of this data is limited to the purpose of defending any claims. An individual
request for deletion may be made at any time, provided that the prior consent is confirmed at
the same time.
Other personal information collected during the registration process is generally deleted after
a period of seven days.

2.3.6

Right of objection and removal

You can completely avoid the data processing described here by not subscribing to our
newsletter. You can also unsubscribe from the newsletter at any time, free of charge andwithout formalities. You will find a corresponding link in each newsletter. This also allows you
to withdraw your consent to the storage of personal data collected during the registration
process. You may also object to the processing of your data by Oracle/Eloqua at any time witheffect for the future by using the following link: www.oracle.com/marketingcloud/optstatus.html.

2.4.

Data processing when using the contact forms

Contact forms are available on our website to enable you to contact us electronically on avariety of topics. If you choose to do this, the information you enter in the form will be sent to
us and stored. The subsequent processing of the data will always relate to the specific subject
linked to the contact form.
Mandatory fields are marked with an asterisk. The information we ask you to provide is required
to process your enquiry/request / contact. Information that is not required by a mandatory field
is provided to us on a voluntary basis.
The following data fields are usually available on contact forms:
•
•
•
•
•
•
•
•

E-mail address,
Dear ...,First name and surname:Company name,Country,
Telephone (usually optional),
Area of interest,
Role,© PTV Planung Transport Verkehr GmbH August 2024

Page 14/35

Data Privacy Statement Websites••

Scope of personal data processing via our websites

Industry,
Area of responsibility.

The following data is also stored at the time the message is sent:••

The user’s IP address,
Date and time of sending.

As part of the submission process, i.e. just before you click the "Submit" button, you will be
informed again about the processing of your data and will be referred to this Data Privacy
Statement.

2.4.1

Use of the "Oracle Eloqua" software

2.4.2

Purposes of data processing

The data you send us via a contact form is imported internally into Oracle's Eloqua marketingsystem (see more information on Oracle Eloqua below in Section 2.15).
The processing of personal data from the input mask is used to contact you and process yourrequest. If contact is made, this also constitutes a legitimate interest to process the data.
The other personal data processed during the submission process is used to prevent misuseof the contact form and to ensure the security of our information technology systems.

2.4.3

Legal basis for data processing

The legal basis for the processing of the data is the consent given by filling in and sending thedata of the contact form in accordance with Article 6 (1)(a) GDPR, alternatively our legitimate
interest in the data processing pursuant to Article 6 (1)(f) GDPR. The legitimate interest lies in
the fact that we need to process your data in order to be able to deal with your request or tocontact you in the first place and, if necessary, to respond to you.
If the contact or your inquiry is aimed at the conclusion of a contract or if your inquiry relates
to an existing contractual relationship with us, the legal basis for the processing is Article 6(1)(b) GDPR (implementation of contractual or pre-contractual measures).
The legal basis for the processing of the other personal data processed during the submission
process is our legitimate interest in data processing in accordance with Article 6 (1)(f) GDPR,
which here consists in preventing misuse of the contact form and ensuring the security of our
information technology systems.

2.4.4

Storage duration

2.4.5

Right of objection and removal

The data will be deleted as soon as it is no longer necessary to fulfil the purpose for which it
was collected. In the case of personal data from the input screen, this will be the case where
the relevant conversation with you has clearly ended and we have waited a period of up to 6
months to see if the conversation will be reopened. The conversation is closed when it can beconcluded from the circumstances that the matter in question has been conclusively clarified.
The communication may be subject to a commercial or tax law retention obligation, which willthen take precedence (see above under "Data deletion and retention period"). The additional
personal data collected during the submission process will be deleted after a period of sevendays.
You can opt out of certain data processing by contacting us by other means. You also havethe option at any time to object to further data processing on the grounds of legitimate interest(see reference to specific right of objection under Section 3 of this Data Privacy Statement). In
this case, the conversation cannot be continued.
© PTV Planung Transport Verkehr GmbH August 2024

Page 15/35

Data Privacy Statement Websites

Scope of personal data processing via our websites

You may object to further processing of your data by sending us an informal notice (e.g. by email). In this case, all personal data stored in the course of contacting you will be deleted,
unless there are other legal obligations or rights of retention which take precedence.

2.5.

Use of the Google Analytics tool

Our website uses Google Analytics, a web analytics service provided by Google Inc, 1600
Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google Ireland Limited(Gordon House, Barrow Street Dublin 4, Ireland), an EU-based company, is responsible for all
Google services in Europe.
Google Analytics uses "cookies", text files which are saved on your computer and enable youruse of the website to be analysed (see also the further explanations above under Section 2.2
on “Cookies”).
We would like to point out that on this website Google Analytics has been extended by the"anonymizeIp" code to ensure IP addresses are collected anonymously (IP masking). By
enabling IP anonymisation on this website, your IP address will be abbreviated beforehand by
Google in European Union (EU) Member States or other states party to the European
Economic Area (EEA) Agreement. Only in exceptional cases will the complete IP address besent to a Google server in the USA and abbreviated there. On behalf of the website operator,
Google will use this information to analyse your use of the website in order to compile reports
on website activities for the website operator and to perform other services associated withwebsite and Internet use. When using Google Analytics, the IP address sent by your browser
will not be combined with other Google data.
Google processes personal data in the USA and elsewhere. The EU Commission has issued
an adequacy decision on the transfer of data from the EU or EEA to the US. Google Inc., as
the US parent company of Google Ireland Limited, has joined and is certified under the EU-US
Data Privacy Framework (DPF) on which this adequacy decision is based. The transfer of data
to the USA is therefore permitted (Article 45 (1) GDPR) and the data processing thus
essentially corresponds to the level of data protection in the EU.
As an additional basis for data processing with recipients located in third countries (= countries
outside the EEA, i.e. all countries outside the European Union, Iceland, Liechtenstein and
Norway) or for a data transfer there, Google uses the EU standard contractual clauses (seeArticle 46 (2) and (3) GDPR). These Standard Contractual Clauses (SCCs) are templates
provided by the EU Commission to ensure that your data complies with European dataprotection standards when transferred to and processed in third countries. By agreeing to theseterms, Google agrees to comply with the European data protection level when processing
personal data, even if the data is processed in the US. These clauses are based on an
implementing decision of the EU Commission. You can find the decision and the corresponding
standard
contractual
clauseshere:
https://eur-lex.europa.eu/legalcontent/EN/TXT/PDF/?uri=CELEX:32021D0914&from=ENGoogle has also entered into an order processing agreement with us pursuant to Article 28 (3)GDPR, which serves as the data protection basis for our customer relationship with Google.
This refers to the content of the EU standard contractual clauses. You can find the dataprocessing terms here: https://business.safety.google/intl/en/adsprocessorterms/
You can find more information on Google's terms of use and privacy policy at
http://www.google.com/analytics/terms/de.html or at https://www.google.com/intl/en/policies/.

© PTV Planung Transport Verkehr GmbH August 2024

Page 16/35

Data Privacy Statement Websites

2.5.1

Purpose of data processing

2.5.2

Legal basis for data processing

Scope of personal data processing via our websites

The purpose of using the analytics tool or cookies is to improve the quality of our website andits content. This helps us to understand how the site is being used and to continually improve
our service.
The legal basis for the storage of information (e.g. cookies) on your end device and the accessto this information is your consent in accordance with Paragraph 25 (1) TDDDG. The legal
basis for the further processing of the personal data stored in your end device in this way is
your consent given at the same time in accordance with Article 6 (1)(a) GDPR.
Storage duration
The cookies are stored on the user's device and sent to our website. As a user, you therefore
have full control over the use of cookies. You can disable or restrict the sending of cookies bychanging the settings on your internet browser. Cookies that have already been stored can bedeleted at any time. This can also be automated. If you disable for our website, you may not
be able to take full advantage of all the features of the website.
Otherwise, we will store the data provided on the basis of your consent until you withdraw yourconsent, which you may notify us of.

2.5.3

Right of objection and removal

You may refuse the use of cookies by selecting the appropriate settings on your browser,
however please note that if you do this you may not be able to make full use of all the featuresof this website.
You can also stop data from being collected through the cookies and the data on your use of
the website (including your IP address) from being sent to and processed by Google bydownloading and installing the browser plug-in available at the following link
(http://tools.google.com/dlpage/gaoptout?hl=en).
Once you have given us your consent, you can withdraw it at any time with effect for the future.
You can also opt out of the collection of data by Google Analytics by clicking on the following
link. An opt-out cookie will then be set to prevent your data from being collected when you visit
this website in the future: <a href="javascript:gaOptout()">Disable Google Analytics</a2.6.

Use of Google Ads conversion tracking

This website uses Google Ads, an online advertising program of Google Inc., 1600
Amphitheatre Parkway, Mountain View, CA 94043, USA. In Europe, Google Ireland Limited(Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services and istherefore the service provider.
We use conversion tracking as part of Google Ads. If you click on a Google ad, a conversion
tracking cookie is placed on your computer. Cookies are small text files which an Internet
browser places on your computer. These cookies are not used to personally identify users. If
you visit certain pages on this website and the cookie has not yet expired, we and Google may
be able to tell that the user has clicked on the ad and was taken to that page.
Every Google Ads customer receives a different cookie. Cookies cannot be tracked via thewebsites of Ads customers (i.e. us).
Information obtained with the help of conversion cookies is used to produce conversion
statistics for Ads customers which have opted for conversion tracking. Ads customers learn© PTV Planung Transport Verkehr GmbH August 2024

Page 17/35

Data Privacy Statement Websites

Scope of personal data processing via our websites

the total number of users who have clicked on their ad and been redirected to a page provided
with a conversion tracking tag. However, they do not receive any information allowing them toidentify the user.
More information about Google Ads and Google Conversion Tracking can be found in Google's
data protection regulations: https://www.google.com/policies/privacy/.
Google describes its data processing when using personal data from websites or apps on orinwhich
Googleservices
are
used
more
specificallyhere:
https://www.google.com/policies/technologies/ads. You can also find instructions on how toreset or delete your Google advertising ID, which is used by Google to identify you.
Specific
informationon
cookiessetbyGooglecanbehttps://policies.google.com/technologies/cookies?hl=en#types-of-cookies

found

here:

Google processes personal data in the USA and elsewhere. The EU Commission has issued
an adequacy decision on the transfer of data from the EU or EEA to the US. Google Inc., as
the US parent company of Google Ireland Limited, has joined and is certified under the EU-US
Data Privacy Framework (DPF) on which this adequacy decision is based. The transfer of data
to the USA is therefore permitted without special authorisation (Article 45 (1) GDPR).
As an additional basis for data processing with recipients located in third countries (= countries
outside the EEA, i.e. all countries outside the European Union, Iceland, Liechtenstein and
Norway) or for a data transfer there, Google uses the EU standard contractual clauses (=Article 46 (2) and (3) GDPR). These Standard Contractual Clauses (SCCs) are templates
provided by the EU Commission to ensure that your data complies with European dataprotection standards when transferred to and processed in third countries. By agreeing to theseterms with us, Google agrees to comply with the European data protection level whenprocessing personal data, even if the data is processed in the US. These clauses are basedon an implementing decision of the EU Commission. You can find the decision and thecorresponding standard contractual clauses here: https://eur-lex.europa.eu/legalcontent/EN/TXT/PDF/?uri=CELEX:32021D0914&from=ENGoogle has also entered into an order processing agreement with us pursuant to Article 28 (3)GDPR, which serves as the data protection basis for our customer relationship with Google.
This refers to the content of the EU standard contractual clauses. You can find the dataprocessing terms here: https://business.safety.google/intl/en/adsprocessorterms/

2.6.1

Purpose of data processing

2.6.2

Legal basis for data processing

2.6.3

Storage duration

The information collected by the conversion cookie is used to generate conversion statistics
for us. We find out the total number of users who clicked on our ad and were directed to oursite. We want to use this to improve and optimise our ads. However, we do not receive any
information allowing us to identify the user. This is used to analyse and optimise our advertisingand marketing activities.
Conversion cookies are stored on the user’s end device on the basis of Paragraph 25(1)TDDDG. Further storage and processing of the data takes place on the basis of Article 6 (1)(a)GDPR. Both are based on your consent requested at the start of use.
We do not store any personal data ourselves in connection with the use of Google Ads orconversion tracking. However, Google may store this information using cookies or similar
technologies. Unfortunately, we have no control over whether or how long Google does this.
© PTV Planung Transport Verkehr GmbH August 2024

Page 18/35

Data Privacy Statement Websites

Scope of personal data processing via our websites

Google provides specific information about cookies and their storage period here:
https://policies.google.com/technologies/cookies?hl=en#types-of-cookies
After that, cookies are stored for a maximum of 13 months, and in some cases much less.

2.6.4

Right of objection and removal/opt-out

In general, you can configure your browser to receive notifications about the placement ofcookies and only allow cookies in individual cases, enable the acceptance of cookies in specificcases or generally refuse them and enable automatic deletion of cookies when you close yourbrowser. Disabling cookies may limit the functionality of this website.
You can disable or restrict the sending of cookies by changing the settings on your internet
browser. Cookies that have already been stored can be deleted at any time. This can also be
automated. If you disable for our website, you may not be able to take full advantage of all thefeatures of the website.
If you use the Google Chrome browser, a plugin which deactivates personalised advertising
can be installed on the website https://www.google.com/settings/ads/plugin - in addition to thedecisions made in the "Settings" menu. Please note that you will still receive as many ads as
before - they will just not be tailored to your interests.
If you do not wish to participate in tracking, you can object to such use by disabling the Google
conversion tracking cookie via your Internet browser's user settings. You will then not be
included in conversion tracking statistics.
Alternatively, you can opt out of the use of cookies for interest-based advertising through thead
network
initiative
byfollowingtheinstructionsat
http://www.networkadvertising.org/managing/opt_out.asp.
You can opt out of Google's use of your information for personalised advertising in the futureby opting out of personalised advertising in your Google Account by following this link:
www.google.com/settings/ads/onweb/.

2.7.

Use of the Google Tag Manager analysis tool

Our website uses Google Tag Manager, which is provided by Google Inc., 1600 Amphitheatre
Parkway, Mountain View, CA 94043, USA. In Europe, Google Ireland Limited (Gordon House,
Barrow Street Dublin 4, Ireland) is responsible for all Google services. This service from
Google allows you to manage website tags via an interface. We use Tag Manager to manage
and control the website tags on our platform.
Google Tag Manager only implements tags. This means that no cookies are used and no
personal data is collected. Google Tag Manager triggers other tags that may also collect data.
However, Google Tag Manager does not access this data. If you opt-out at the domain or
cookie level, your opt-out will remain in place for any tracking tags implemented with Google
Tag Manager.
Among other things, it controls the Google Analytics tool mentioned above.
Therefore, Google Tag Manager does not result in any additional data processing, but simply
makes it easier to place tags on your website. Therefore, no additional personal data isprocessed through the use of Google Tag Manager.
Further information on data processing by Google can be found in Google’s privacy policy:
https://policies.google.com/privacy?hl=en. You can also change your settings there in the dataprotection centre (https://myaccount.google.com/privacycheckup) so that you can manage and© PTV Planung Transport Verkehr GmbH August 2024

Page 19/35

Data Privacy Statement Websites

Scope of personal data processing via our websites

protect your data. You can also find more instructions on how to manage your own data whenusing Google products.

2.8.

Use of the Google API interface

Our website uses Google APIs from Google Inc., 1600 Amphitheatre Parkway, Mountain View,
CA 94043, USA. In Europe, Google Ireland Limited (Gordon House, Barrow Street Dublin 4,
Ireland) is responsible for all Google services. This is a program interface provided by Google.
When you use this website, information such as your IP address may be transmitted to Google.
Further information on data processing by Google can be found in Google’s privacy policy.
You can also change your settings there in the data protection centre so that you can manageand protect your data.
You can also find more instructions on how to manage your own data when using Google
products.

2.8.1

Purpose of data processing

2.8.2

Storage duration

2.8.3

Legal basis for data processing

2.8.4

Right of objection and removal

We use the Google API as an interface between our website and the Google products we use(e.g. Analytics and Maps). This information is used for the purposes of analysis, error
correction, optimisation and economic operation of the website, as well as to improve andoptimise the user experience on the website.
The data will be deleted as soon as it is no longer necessary to fulfil the purpose for which it
was collected.
The legal basis for processing personal data using the Google APIs is Article 6 (1)(f) GDPR,
which is a legitimate interest on our part. In particular, our legitimate interest is to analyse,
optimise and commercially operate our website and online services, and to enable
troubleshooting and error correction by analysing and displaying error messages and causesof crashes.
You can object to data processing on the grounds of overriding legitimate interest at any timein accordance with Article 21 GDPR (for more information on the right to object, see Section 3
on the rights of data subjects).
Otherwise, the only way you can avoid this data processing is by not visiting our website.
You may refuse the execution of the Java Script code required for the tool by selecting theappropriate settings on your browser, however please note that if you do this you may not beable to make full use of all the features of this website.
To prevent Java Script code from being executed altogether, you can also install a Java Script
blocker, such as the NoScript browser plug-in. (e.g. www.noscript.net).

2.9.

Use of YouTube videos (in enhanced privacy mode)On our website you can watch YouTube videos (provider: YouTube LLC 901 Cherry Ave.,
94066 San Bruno, CA, USA). In Europe, YouTube is operated by Google Ireland Limited,
Gordon House, Barrow Street, Dublin 4, Ireland. We have placed these YouTube videos in
YouTube's enhanced privacy mode, which blocks YouTube cookies from being set until anactive click is made during playback.

© PTV Planung Transport Verkehr GmbH August 2024

Page 20/35

Data Privacy Statement Websites

Scope of personal data processing via our websites

Therefore, videos will only be reloaded and YouTube cookies will only be set for you if you opt
in to the setting of YouTube cookies by clicking on such a video for the first time. We haveprovided information in the relevant videos.
YouTube is a subsidiary of Google Inc., as is Google Ireland Limited, which is responsible for
operations in Europe. Every time a product that has a YouTube video embedded is accessed,
the website will play the YouTube video. As part of this process, YouTube and Google receive
information about which product is being accessed. If you are also logged in to YouTube,
YouTube will recognise which specific page you are visiting when you visit a page that contains
a YouTube video. This information is collected by YouTube and Google and associated withyour YouTube account.
With respect to any transfer of data to the United States, the information about Google in the
EU-US Privacy Framework, the EU Standard Contractual Clauses, and the Data Processing
Agreement set forth above will apply accordingly.
YouTube's privacy policy provides information about the collection, processing and use of
personal information by YouTube and Google and can be accessed here:
http://www.google.com/intl/en/policies/privacy.

2.9.1

Purpose of data processing

2.9.2

Legal basis for data processing

2.9.3

Storage duration

The purpose of embedding YouTube videos is to provide you with multimedia content on thesite and to enhance and improve your experience on the website. By making our website more
attractive, the use of YouTube also serves our marketing and advertising purposes.
The legal basis for the processing of personal data is your consent pursuant to Article 6 (1)(a)GDPR. The legal basis for embedding the videos themselves is Article 6 (1)(f) GDPR, which
is a legitimate interest on our part. Our legitimate interest lies in the purposes mentioned above.
We do not store any personal information related to the use of YouTube videos. We will
analyse the access and views of individual videos, but without reference to any specificindividual.
We have no control over the storage by YouTube or Google itself. Please see Google's privacy
policy for the exact circumstances in which data is processed there:
http://www.google.com/intl/en/policies/privacy.

2.9.4

Right of objection and removal

YouTube and Google will always receive information that the user has visited our site if theuser is logged in to YouTube at the same time as using the app, whether or not the user clicks
on a YouTube video. If you do not want this information to be transmitted to YouTube and
Google, you can prevent the transmission by signing out of your YouTube account before
visiting the site. You can also find options to minimise Google's data processing in yourYouTube account settings. As the video portal is owned by Google, you can find the settings
in the general settings of your Google account. Under “Activity settings”(https://myactivity.google.com/activitycontrols) you can find options for web and location
history, as well as special privacy features on YouTube. First, you can pause your video searchhistory so that your searches are no longer stored. You can also turn off the video playback
history so that not all the videos you watch are stored.
Otherwise, you can avoid processing the data by not accessing pages containing YouTube
videos.
© PTV Planung Transport Verkehr GmbH August 2024

Page 21/35

Data Privacy Statement Websites

Scope of personal data processing via our websites

2.10. Use of the Google Optimize A/B testing tool

We use Google Optimize, a service provided by Google Inc, 1600 Amphitheatre Parkway,
Mountain View, CA 94043, USA ("Google Optimize"). In Europe, Google Ireland Limited(Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services.
Google Optimize analyses the use of different versions of the website so that we can adapt
the user experience to the behaviour of the website's users. Google Optimize is a tool
integrated with Google Analytics (see above) and uses cookies.
The IP address obtained in this way is anonymised immediately after collection. In exceptional
cases, the full IP address will be transmitted to a Google server in the USA and encrypted
there. Google will not associate the IP address transmitted with any other data held by Google.
With respect to any transfer of data to the United States, the information about Google in the
EU-US Privacy Framework, the EU Standard Contractual Clauses, and the Data Processing
Agreement set forth above will apply accordingly.

2.10.1

Purpose of data processing

2.10.2

Legal basis for data processing

2.10.3Storage duration

2.10.4Right of objection and removal

The purpose of using the tool or cookies is to improve the quality of our website and its content.
This helps us to understand how the site is being used and to continually improve our service.
This use ultimately serves our advertising and marketing interests.
The legal basis for the processing of personal data is your consent pursuant to Article 6 (1)(a)GDPR.
The user's IP address is immediately anonymised. In exceptional cases, the full IP address
will be transmitted to a Google server in the USA and encrypted there. It is not possible torecalculate the IP address. Anonymisation is therefore equivalent to deleting the IP address.
You can stop the cookie from being stored by configuring the relevant setting in your browser.
Please note that if you do this, you may then not be able to make full use of all the features ofthis website. You can also stop data from being collected through the cookie and the data on
your use of the website (your IP address) from being sent to and processed by Google bydownloading and installing the browser plug-in available at the following link
(http://tools.google.com/dlpage/gaoptout?hl=en).

2.11. Use of the Hotjar analysis toolThis website uses Hotjar, analytics software provided by Hotjar Ltd. (http://www.hotjar.com)
based in the EU (Dragonara Business Centre 5th Floor, Dragonara Road, Paceville St Julian's
STJ 3141 Malta). Hotjar allows us to measure and analyse user behaviour (clicks, mouse
movements, scroll heights, etc.) on our website. The information generated by the tracking
code and cookie about your visit to our website is transmitted to and stored by Hotjar's servers
in Ireland.
More information about Hotjar and how it uses and processes data can be found in Hotjar's
Privacy policy: https://www.hotjar.com/legal/policies/privacy or https://www.hotjar.com/privacy.
The following information may be recorded by your device and browser:••

The IP address of your device (collected and stored in an anonymised format),
Screen size of your device,© PTV Planung Transport Verkehr GmbH August 2024

Page 22/35

Data Privacy Statement Websites

•
•
•
•

Scope of personal data processing via our websites

Device type and browser information,
Geographical location (country only),
The preferred language to display our website,
Log data.

The following data is automatically generated by our server when you use Hotjar
•
•
•
•
•

Referring domain,
Pages visited,
Geographical location (country only),
The preferred language to display our website,
Date and time of access to the website.

Hotjar will use this information for the purpose of evaluating your use of the website, compilingreports on website activity for website operators and providing other services relating to
website activity and internet usage. Hotjar also uses third party services such as Google
Analytics and Optimizely to provide its services.
These third parties may store information that your browser sends when you visit the site, suchas cookies or IP requests. For more information about how Google Analytics and Optimizely
store and use data, please see their respective privacy policies.

2.11.1

Purpose of data processing

2.11.2

Legal basis for data processing

2.11.3Storage duration

2.11.4Right of objection and removal

Hotjar is used to improve the quality of our website and its content by showing you ads thatare optimised for your actual individual needs and interests. This helps us to understand how
the site is being used and to continually improve our service. This use ultimately serves ouradvertising and marketing interests.
The legal basis for the use of Hotjar and the necessary storage, reading and access to nonessential cookies on the user's device is your consent pursuant to Paragraph 25 (1) TDDDG.
The legal basis for the further processing of personal data using non-essential cookies is Article
6 (1)(a) GDPR, wjocj is the consent of the user.
Please note that the cookies set by Hotjar are subject to different retention periods; somecookies are retained for up to 365 days, while others are retained only during your current visit
and are deleted when you leave our site. Some cookies are only valid for 30 minutes. All
information on the cookies set by Hotjar, including storage periods, can be found here:
https://help.hotjar.com/hc/en-us/articles/6952777582999-Cookies-Set-by-the-HotjarTracking-Code
The cookies are stored on the user's computer and sent to our website. As a user, you
therefore have full control over the use of cookies. You can disable or restrict the sending of
cookies by changing the settings on your internet browser. Cookies that have already been
stored can be deleted at any time. This can also be automated. If you disable for our website,
you may not be able to take full advantage of all the features of the website.
You can avoid data processing altogether by not giving your consent or by withdrawing yourconsent with effect for the future.

© PTV Planung Transport Verkehr GmbH August 2024

Page 23/35

Data Privacy Statement Websites

Scope of personal data processing via our websites

Opt-out: Hotjar does not store any of your personal data for analysis. You will always have theoption to prevent your information from being collected. To do this, go to the “Opt-out page”
and click on “Deactivate Hotjar”: https://www.hotjar.com/opt-out.

2.12. Use of the LinkedIn Analytics tool

We use the website analytics tool LinkedIn Analytics, a service provided in the EU by LinkedIn
Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

This tool can be used to show personalised ads on LinkedIn to visitors to this website. It is also
possible to generate anonymous reports on the performance of advertisements andinformation on website interaction. To do this, this site uses the LinkedIn Insight tag, whichconnects to the LinkedIn server when you visit this site and are logged into your LinkedIn
account.
Information on the LinkedIn Insight Tag and its functions can be found here:
https://business.linkedin.com/marketing-solutions/insight-tag
LinkedIn’s privacy policy with further information on data processing there can be found here:
https://www.linkedin.com/legal/privacy-policy

2.12.1

Purpose of data processing

2.12.2

Legal basis for data processing

2.12.3Storage duration

2.12.4Right of objection and removal

We use this tool to track who visits our site as a result of a LinkedIn ad, in order to better
understand and optimise these ads and the reach they achieve.
Data is processed on the basis of your consent pursuant to Article 6 (1)(a) GDPR.
LinkedIn states that the cookies set as part of using LinkedIn Analytics are stored for 30 days
(see https://www.linkedin.com/legal/l/cookie-table?#thirdparty).
You may withdraw your consent at any time with immediate effect.
If you are logged in to LinkedIn, you can also opt out of data collection at any time by clicking
on the following link: https://www.linkedin.com/psettings/enhanced-advertising.

2.13. Use of Leadlab

We also use the Leadlab tool on the website, provided by WiredMinds GmbH,
Lindenspürstraße 32, 70176 Stuttgart, Germany.
Leadlab does not process personal data, as it only processes corporate data without reference
to natural persons.
Only fixed IP addresses of companies are checked against a whitelist. No names or otherinformation will be processed.
The tool also works completely without setting cookies, so no information is stored on yourdevice.

2.13.1

Purpose of data processing

We use the tool to anonymously measure reach. This means that we only get positive hits
based on IP address matching when a company's fixed IP address is identified. We only

© PTV Planung Transport Verkehr GmbH August 2024

Page 24/35

Data Privacy Statement Websites

Scope of personal data processing via our websites

receive information about the company and the way our website is used by the company's
employees. This enables us to analyse usage and improve our website.

2.13.2

Legal basis for data processing

Data is processed on the basis of our legitimate interests pursuant to Article 6 (1)(f) GDPR.
As the operator of this website, we would like to be able to anonymously determine andmeasure how many visitors from which companies visit our website. This measurement isbased on company IP addresses only. It is only used to measure the reach of our website
without processing personal data or even playing a role in the profiles or patterns of specificindividuals. Therefore, the balancing of interests showed that our legitimate interests outweighthose of the data subjects.

2.13.3Storage duration

2.13.4Right of objection and removal

The use of Leadlab does not result in the storage of any personal data.
You can object to data processing on the grounds of overriding legitimate interest at any timein accordance with Article 21 GDPR (for more information on the right to object, see Section 3
on the rights of data subjects).
Otherwise, the only way you can avoid this data processing is by not visiting our website. There
are no further removal options. However, no personal information is stored.

2.14. Use of Google Analytics Remarketing

We also use Google Remarketing, an advertising analysis tool, for our website. The service
provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. In
Europe, Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible
for all Google services.
The tool allows us to link Google Analytics Remarketing audiences to the cross-device featuresof Google AdWords and Google DoubleClick. In this way, interest-based, personalised
advertising messages which have been adapted to you depending on your previous usage andsurfing behaviour on an end device (for example, a mobile phone) can also be displayed onanother of your end devices (for example, tablet or PC). If you have given the relevant consent
to Google, Google will associate your web and app browsing history with your Google Accountfor this purpose. In this way, the same personalised advertising messages can be enabled oneach of the devices that you sign in to with your Google Account. To support this feature,
Google Analytics collects Google authenticated user IDs, which are temporarily linked to our
Google Analytics data in order to define and create target groups for cross-device advertising
campaigns.
We use Google Remarketing's Customer Matching feature to create target audiences. For thispurpose, we transfer encrypted lists of certain customer information (such as e-mailaddresses) to Google. If you are a Google user and signed in to your Google account, we willshow you appropriate ads within the Google network (e.g., YouTube, Gmail, or a searchengine).
Google also processes personal data in the USA. The EU Commission has issued anadequacy decision on the transfer of data from the EU or EEA to the US. Google Inc., as the
US parent company of Google Ireland Limited, has joined and is certified under the EU-US
Data Privacy Framework (DPF) on which this adequacy decision is based. The transfer of data
to the USA is therefore permitted without special authorisation (Article 45 (1) GDPR).

© PTV Planung Transport Verkehr GmbH August 2024

Page 25/35

Data Privacy Statement Websites

Scope of personal data processing via our websites

As an additional basis for data processing with recipients located in third countries (= countries
outside the EEA, i.e. all countries outside the European Union, Iceland, Liechtenstein and
Norway) or for a data transfer there, Google uses the EU standard contractual clauses (=Article 46 (2) and (3) GDPR). These Standard Contractual Clauses (SCCs) are templates
provided by the EU Commission to ensure that your data complies with European dataprotection standards when transferred to and processed in third countries. By agreeing to theseterms with us, Google agrees to comply with the European data protection level whenprocessing personal data, even if the data is processed in the US. These clauses are basedon an implementing decision of the EU Commission. You can find the decision and thecorresponding standard contractual clauses here: https://eur-lex.europa.eu/legalcontent/EN/TXT/PDF/?uri=CELEX:32021D0914&from=ENGoogle has also entered into an order processing agreement with us pursuant to Article 28 (3)GDPR, which serves as the data protection basis for our customer relationship with Google.
This refers to the content of the EU standard contractual clauses. You can find the dataprocessing terms here: https://business.safety.google/intl/en/adsprocessorterms/
You can find out more about the data processed through the use of Google Remarketing in
the privacy policy at https://policies.google.com/privacy?hl=en. Google describes its dataprocessing when using personal data from websites or apps on or in which Google services
are used more specifically here: https://www.google.com/policies/technologies/ads. You canalso find instructions on how to reset or delete your Google advertising ID, which is used by
Google to identify you.
Specific
informationon
cookiessetbyGooglecanbehttps://policies.google.com/technologies/cookies?hl=en#types-of-cookies

2.14.1

Purpose of data processing

2.14.2

Legal basis for data processing

2.14.3Storage duration

found

here:

We use Google Remarketing to help us understand your interests across devices and websites
so that we can target our products and services to you on other devices and websites anddisplay ads that are more relevant to your actual, individual needs and interests.
The legal basis for the storage of cookies and similar technologies on your end device andtheir access (reading) is your consent pursuant to Paragraph 25 (1) TDDDG. The legal basis
for the further processing of the personal data stored in your end device in this way is yourconsent given at the same time in accordance with Article 6 (1)(a) GDPR.
We do not store any personal data ourselves in connection with the use of Google Analytics
Remarketing. However, Google may store this information using cookies or similar
technologies. Unfortunately, we have no control over whether or how long Google does this.
Google provides specific information about cookies and their storage period here:
https://policies.google.com/technologies/cookies?hl=en#types-of-cookies
After that, cookies are stored for a maximum of 13 months, and in some cases much less.

2.14.4Right of objection and removal/opt-out

You can configure your browser to receive notifications about the placement of cookies andonly allow cookies in individual cases, enable the acceptance of cookies in specific cases orgenerally refuse them and enable automatic deletion of cookies when you close your browser.
Disabling cookies may limit the functionality of this website.
© PTV Planung Transport Verkehr GmbH August 2024

Page 26/35

Data Privacy Statement Websites

Scope of personal data processing via our websites

You can disable or restrict the sending of cookies by changing the settings on your internet
browser. Cookies that have already been stored can be deleted at any time. This can also be
automated.
If you use the Google Chrome browser, a plugin which deactivates personalised advertising
can be installed on the website https://www.google.com/settings/ads/plugin - in addition to thedecisions made in the "Settings" menu. Please note that you will still receive as many ads as
before - they will just not be tailored to your interests.
If you specifically do not wish to use Google's remarketing feature, you can generally disable
it by making the appropriate settings at http://www.google.com/settings/ads. Alternatively, you
can opt out of the use of cookies for interest-based advertising through the ad network initiativeby following the instructions at http://www.networkadvertising.org/managing/opt_out.asp.
You can opt out of cross-device remarketing/targeting in the future by opting out of
personalised advertising in your Google Account by following this link:
www.google.com/settings/ads/onweb/.

2.15. Use of Oracle’s Eloqua marketing tool

We use the Eloqua marketing system from Oracle America, Inc.
2300 Oracle Way, Austin, TX 78741, USA ("Eloqua") on our website. Eloqua uses persistentcookies to provide these services. These cookies collect information about your use of our
website. The information collected in this way is only visible to us and is not shared with Oracle
or other users of the Eloqua system.
We have entered into a data processing agreement with Oracle (data processing agreement
pursuant to Article 28(3) GDPR). This is a contract in which Oracle undertakes to protect yourdata, to process it on our behalf in accordance with its Privacy policy and, in particular, not topass it on to third parties. This Data Processing Agreement can be viewed at:https://www.oracle.com/contracts/docs/corporate_data_processing_agreement_062619.pdf?
download=false. In addition, we have agreed additional measures with Oracle that go beyond
the provisions of the EU standard contractual clauses and require Oracle to take steps tofurther enhance the level of data protection.

In addition, Oracle America, Inc. is certified under the EU-U.S. Data Privacy Framework (DPF),
which means that the transfer of data to Oracle is permitted under the EU adequacy decisionbecause it ensures a level of data protection equivalent to that in the EU.
For
more
information
about
privacy
www.oracle.com/legal/privacy/privacy-policy.html.

2.15.1at

Oracle,pleasevisit:

Purpose of data processing

Eloqua enables us to use cookies to analyse and evaluate the use of our website in order tocontinually improve the marketing experience and individualised approach to our customers
and prospects. The use of the tool therefore serves our advertising and marketing interests.
We also use Eloqua to send you e-mails if you have signed up for our e-mail marketing (seeB.3 above for information about sending newsletters). E-mails sent from Eloqua, as well as our
website, use Eloqua's tracking technology, which allows us to track your e-mail reading
behaviour, including whether e-mails are opened and which links are clicked.

© PTV Planung Transport Verkehr GmbH August 2024

Page 27/35

Data Privacy Statement Websites

2.15.2

Legal basis for data processing

2.15.3Storage duration

2.15.4Right of objection and removal

Scope of personal data processing via our websites

The data processing described above is carried out on the basis of your consent in accordancewith Article 6 (1)(a) GDPR. We ask for your consent at the beginning of your visit to our website.
Personal data in Eloqua is deleted at least once a month according to defined criteria. As amatter of principle, Eloqua stores personal data until the purpose for which it was collected nolonger exists and a change of purpose is not possible or not carried out. All personal data in
Eloqua will be completely deleted no later than 760 days after the associated contact has been
deleted.
You may object to the collection of your data at any time with effect for the future by using thefollowing link: www.oracle.com/marketingcloud/opt-status.html or by notifying us of yourobjection.

2.16. Use of the OptinMonster toolThis website uses the OptinMonster plugin from Retyp LLC, 3701 Savoy Ln West Palm Beach,FL 33417, USA (OptinMonster). Optinmonster is a marketing tool for creating registration
forms, pop-ups and notifications.
OptinMonster uses cookies. Personal data will only be processed if the user actively chooses
to provide it (e.g. by registering for the newsletter). The data we receive through this tool isalso anonymised and cannot be linked to any specific individual. Neither the provider nor wecollect or process personal data in connection with the use of the tool.
For details on OptinMonster's handling of personal data, please refer to OptinMonster's Privacy
policy: https://optinmonster.com/privacy/
We
have
a
data
processing
agreement
withOptinMonster(see
https://optinmonster.com/gdpr/dpa/). This is a contract in which OptinMonster undertakes,
among other things, to protect the data of our users, to process it on our behalf in accordancewith its privacy policy and, in particular, not to pass it on to third parties.

2.16.1

Purpose of data processing

2.16.2

Legal basis for data processing

2.16.3Storage duration

The plugin allows us to provide visitors to this website with additional offers (e.g. promotions)
via overlays (similar to a pop-up window), making our site more interesting and user-friendly.
These overlays will take you to a specific web address when clicked. No data is collected orprocessed by us or the provider.
The data entered in the form is processed on the basis of your consent (Article 6 (1)(a) GDPR).
The necessary storage of cookies in your end device and access to them is based on theconsent given at the same time in accordance with Paragraph 25 (1) TDDDG. You may
withdraw your consent at any time. The legitimacy of data processing processes that havealready taken place will remain unaffected by the withdrawal.
We do not collect or process any personal data through the tool. We delete aggregated data
immediately as we do not perform any analysis or similar.
In exceptional cases, where personal data is processed as a result of an active action (e.g.
registering for the newsletter), we will process this data until the consent given for this purpose
is withdrawn.
© PTV Planung Transport Verkehr GmbH August 2024

Page 28/35

Data Privacy Statement Websites

2.16.4

Scope of personal data processing via our websites

Right of objection and removal

You have full control over the use of cookies. You can disable or restrict the sending of cookies
by changing the settings on your internet browser. Cookies that have already been stored canbe deleted at any time. This can also be automated. If you disable for our website, you may
not be able to take full advantage of all the features of the website.

2.17. Use of Google AdSense (non-personalised)This website uses Google AdSense, a service that integrates advertisements. The provider isGoogle Inc.1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. In Europe, Google
Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google
services.
We use Google AdSense in 'non-personalised' mode. Unlike personalised mode, this meansthat ads are not based on your past usage and no user profile is created for you. Instead,"contextual information" is used to select ads. The ads you see may be based on your location,
the content of the website you are visiting, or your current search terms. To learn more about
the differences between personalised and non-personalised targeting with Google AdSense,click here: https://support.google.com/adsense/answer/9007336.
Please note that cookies or similar recognition technologies (such as device fingerprinting)
may also be used when using Google AdSense in a non-personalised manner. Google says it
only uses this information to combat fraud and abuse.
Google also processes personal data in the USA. The EU Commission has issued anadequacy decision on the transfer of data from the EU or EEA to the US. Google Inc., as the
US parent company of Google Ireland Limited, has joined and is certified under the EU-US
Data Privacy Framework (DPF) on which this adequacy decision is based. The transfer of data
to the USA is therefore permitted without special authorisation (Article 45 (1) GDPR).
As an additional basis for data processing with recipients located in third countries (= countries
outside the EEA, i.e. all countries outside the European Union, Iceland, Liechtenstein and
Norway) or for a data transfer there, Google uses the EU standard contractual clauses (=Article 46 (2) and (3) GDPR). These Standard Contractual Clauses (SCCs) are templates
provided by the EU Commission to ensure that your data complies with European dataprotection standards when transferred to and processed in third countries. By agreeing to theseterms with us, Google agrees to comply with the European data protection level whenprocessing personal data, even if the data is processed in the US. These clauses are basedon an implementing decision of the EU Commission. You can find the decision and thecorresponding standard contractual clauses here: https://eur-lex.europa.eu/legalcontent/EN/TXT/PDF/?uri=CELEX:32021D0914&from=ENGoogle has also entered into an order processing agreement with us pursuant to Article 28 (3)GDPR, which serves as the data protection basis for our customer relationship with Google.
This refers to the content of the EU standard contractual clauses. You can find the dataprocessing terms here: https://business.safety.google/intl/en/adsprocessorterms/.

2.17.1

Purpose of data processing

2.17.2

Legal basis for data processing

Google AdSense is used to serve appropriate ads to you on our website based on thecontextual information described above, i.e. for advertising purposes.
The legal basis for the storage of cookies and similar technologies on your end device andtheir access (reading) is your consent pursuant to Paragraph 25 (1) TDDDG. The legal basis© PTV Planung Transport Verkehr GmbH August 2024

Page 29/35

Data Privacy Statement Websites

Scope of personal data processing via our websites

for the further processing of the personal data stored in your end device in this way is yourconsent given at the same time in accordance with Article 6 (1)(a) GDPR.

2.17.3Storage duration

We do not store any personal data ourselves in connection with the use of Google AdSense.
However, Google may store this information using cookies or similar technologies.
Unfortunately, we have no control over whether or how long Google does this.
Google provides specific information about cookies and their storage period here:
https://policies.google.com/technologies/cookies?hl=en#types-of-cookies
After that, cookies are stored for a maximum of 13 months, and in some cases much less.

2.17.4Right of objection and removal/opt-out

You can configure your browser to receive notifications about the placement of cookies andonly allow cookies in individual cases, enable the acceptance of cookies in specific cases orgenerally refuse them and enable automatic deletion of cookies when you close your browser.
Disabling cookies may limit the functionality of this website.
You can disable or restrict the sending of cookies by changing the settings on your internet
browser. Cookies that have already been stored can be deleted at any time. This can also be
automated. If you disable for our website, you may not be able to take full advantage of all thefeatures of the website.
If you use the Google Chrome browser, a plugin which deactivates personalised advertising
can be installed on the website https://www.google.com/settings/ads/plugin - in addition to thedecisions made in the "Settings" menu. Please note that you will still receive as many ads as
before - they will just not be tailored to your interests.

2.18. Conversion pixels from Adform

This website uses conversion tracking from Adform from the EU-based provider Adform A/S,
Silkegade 3B, ST. & 1., 1113 Copenhagen, Denmark ("Adform").
The categories of data processed are data on the use of the website and the logging of clicks
on individual elements.
Adform uses cookies to determine which ads are shown to a user. This is based on productsthat a visitor has already viewed on a previous occasion. Neither Adform nor we store personal
information such as e-mail addresses, names or addresses in the cookie or in the cookiebased profile.
A cookie is a small text file that is stored on your end device when you view an Adform client's
advertisements or websites using a browser. The cookie does not collect any names,
addresses, phone numbers, e-mail address or other data identifying the user. Instead, thecookie contains a random identification number (cookie ID). With these random cookie
identification numbers, Adform collects and stores non-personal information such as operating
system, browser version, geographical location, URLs on which Adform displays
advertisements or facts about interactions with advertisements (e.g. number of clicks or views).
IP addresses of Internet users are accessible to our system during web requests on Adform
web servers. However, we do not store or otherwise use this information.
To find out how Adform processes personal data when you use its services, please refer to theprovider's privacy policy: https://site.adform.com/privacy-center/platform-privacy/product-andservices-privacy-policy/© PTV Planung Transport Verkehr GmbH August 2024

Page 30/35

Data Privacy Statement Websites

Scope of personal data processing via our websites

Neither Adform nor we will share this information with third parties. The data will only be used
for the analysis purposes described here.

2.18.1

Purpose of data processing

2.18.2

Legal basis for data processing

2.18.3Storage duration

2.18.4Right of objection and removal/opt-out

Adform is used to show you relevant ads on our website based on the products you havepreviously viewed.
The legal basis for the storage of cookies and similar technologies on your end device andtheir access (reading) is your consent pursuant to Paragraph 25 (1) TDDDG. The legal basis
for the further processing of the personal data stored in your end device in this way is yourconsent given at the same time in accordance with Article 6 (1)(a) GDPR.
The cookies set by Adform on your browser expire 60 days after your last interaction. Adform
does not keep any Cookie-based Information longer than 13 months. In other words, any datathat can be related to your internet devices are deleted after maximum 13 months (seehttps://site.adform.com/privacy-center/platform-privacy/product-and-services-privacypolicy/#HowlongdowestorePersonalInformation).
You can deactivate the storage of the cookie ID on your end device for the delivery ofadvertisements via the Adform advertising platform at any time at the following address (optout): https://site.adform.com/privacy-center/website-privacy/opt-out/.
This will delete all of Adform's cookie data from your device, leaving only a new cookie identifier
on your device that indicates to Adform that your browser should not be tracked when ads are
displayed in your browser. Please note that for technical reasons the opt-out only applies tothe browser and device used to opt out.
You may also withdraw your consent at any time with effect for the future.

2.19. Data processing for the operation of a whistleblower platform

We operate a whistleblower platform that is freely accessible on the Internet and can be used
to report unethical or illegal behaviour within or by our organisation - even completely
anonymously. The platform can be accessed at https://ptvgroup.share-a-hint.com.
The platform is hosted by LegalInnovate Technologies GmbH, Issumer Tor 45, D-47608
Geldern as a sub-processor of our external data protection officer MeinDatenschutzPartner.de
GbR Timo Schutt & Thomas Waetke, Kriegsstraße 37, 76133 Karlsruhe.
All data provided via the platform can only be viewed by a very small circle of authorised
persons of the data controller (need-to-know principle).
There is no obligation for the whistleblower to provide any personal data as part of theinformation provided.

2.19.1

Purpose of data processing

The whistleblower platform enables whistleblowers, whether anonymous or named, to submit
information in a secure area that draws our attention to unacceptable or undesirable behaviour
within our organisation.

© PTV Planung Transport Verkehr GmbH August 2024

Page 31/35

Data Privacy Statement Websites

2.19.2

Scope of personal data processing via our websites

Legal basis for data processing

The data processing is carried out with regard to the establishment of the internal reporting
centre for submitting a report within the material scope of the German Whistleblower Protection
Act (HinSchG),
Paragraph 2 HinSchG, due to the legal obligation to establish an internal reporting centre andcorresponding reporting channels in accordance with Paragraph 12 et seq. HinSchG in
conjunction with the authorisation to process personal data by the reporting offices pursuant
to Paragraph 10 HinSchG and thus within the scope of our legal obligation pursuant to Article
6 (1)(c) GDPR.
Insofar as we enable other reports via the whistleblower platform that go beyond the material
scope of the HinSchG, e.g. those that relate to violations of our internal guidelines, such as
our Code of Conduct or other comparable guidelines, this is done on the basis of our overriding
legitimate interest pursuant to Article 6 (1)(f) GDPR, which can be seen in the fact that we wantto and must fulfil our corporate responsibility to comply with the internal guidelines, which werecreated not least for the protection of our employees. In this case, the interests or fundamental
rights and freedoms of the data subject, which require the protection of personal data, do not
outweigh our legitimate interests.

2.19.3Storage duration

2.19.4Right of objection and removal

In accordance with Paragraph 11(5) HinSchG, all information provided must be documented.
The documentation is deleted three years after the end of the procedure. However, records
may be retained for a longer period in order to comply with the requirements of this Act or otherlegislation, as long as this is necessary and proportionate.
The provision of information and the transmission of personal data to the internal reporting
centre are entirely voluntary. You can avoid the data processing described here by refraining
from entering and submitting personal data in connection with a report.
Where we process data on the basis of our legitimate interests, you have the right to object
under Article 21 GDPR on grounds relating to your particular situation (see our information on
the rights of data subjects).

2.20. Processing of personal data in the job application process

We use the services of the service provider rexx systems GmbH, Süderstrasse 75-79, D-20097
Hamburg for online job advertisements and applicant management (https://www.rexxsystems.com/). The service provider offers recruiting software that enables us to publish
vacancies directly online on a web platform. We have concluded a data processing agreementwith the service provider in accordance with Article 28 (3) GDPR, which grants us the right toissue instructions and in which the service provider undertakes to comply with all dataprotection regulations.
As part of the online application process, you will be asked to provide mandatory informationthat is essential for your participation in the application process. Other voluntary details andinformation are also possible.

2.20.1

Purpose of data processing

The use of recruitment software allows us and the candidates to post and find vacancies
quickly and to manage the application process through to interviews in a standardised, digitaland clear way. The aim is to fill vacancies effectively and quickly.

© PTV Planung Transport Verkehr GmbH August 2024

Page 32/35

Data Privacy Statement Websites

Scope of personal data processing via our websites

2.20.2

Legal basis for data processing

2.20.3

Duration of data storage

2.20.4

Voluntary disclosure/consequences of refusal

2.20.5Right of objection or removal

The data processing in the context of the application process is carried out as a pre-contractual
measure with potential employees of the controller and therefore in accordance with Article 6(1)(b) GDPR.
Candidate data will be retained for a maximum of 4 months after the completion of the specificapplication process and will then be deleted. If the candidate cannot be immediately employed,
but their profile may be considered for future vacancies, we will ask the individual to consent
to further data storage for the purpose of future consideration. The data will be retained for a
maximum period of time until revoked by the applicant.
Data processing is necessary in relation to the mandatory information required to submit anapplication. If you do not provide all the required information, you will not be able to participate
in the application process.
Data processing can be avoided by not participating in the online application process.

2.21. Encryption of the website and communication

All protected areas and forms on the website, and therefore the data transmitted through them,
are encrypted in accordance with the SSL standard (HTTPS).

2.22. Transfer of personal data to a third country (EU/EEA country)

Personal data may also be processed outside the EEA (European Economic Area) in third
countries.
To find out exactly which providers may transfer data to third countries, please refer toParagraph 2 of this Data Privacy Statement, which describes the data processing practices ofeach tool.
In principle, this can also be a country for which there is currently no EU adequacy decision,i.e. where the level of data protection is not recognised as equivalent to that in the EU, although
we always endeavour to transfer data only to safe third countries.
For the USA, there is an EU adequacy decision pursuant to Article 45 (1) GDPR, which certifies
that the USA has an adequate level of data protection, meaning that data transfers to the USA
are generally permitted. This is subject to the US third party being certified under the EUU.S. Data Privacy Framework (DPF). This is generally the case with the US providers we haveselected. This means that the transfer of data to these third parties is readily permitted.
All companies for which a transfer to a third country is being considered and which (may)transfer personal data to a third country for which there is no EU adequacy decision, or US
companies that have not certified themselves under the EU-U.S. Data Privacy Framework(DPF), have provided sufficient safeguards for data transfers within the meaning of the GDPR
and the European Court of Justice (ECJ) by binding themselves to the EU standard contractual
clauses (SCC, see Article 46 (2)(c) GDPR) with us and by agreeing to additional data security
measures, and have committed to a level of data protection comparable to that in the EU. The
transfer of data to these companies is therefore generally permitted (see Article 44 et seq.
GDPR).

© PTV Planung Transport Verkehr GmbH August 2024

Page 33/35

Data Privacy Statement Websites

Rights of data subjects

In addition, in the case of external data processing, appropriate data processing agreements
have been entered into with these companies to safeguard the data and our rights to issue
instructions.

3. Rights of data subjects

If your personal data is being processed, you are the 'data subject' and you havethe following rights in relation to us as the data controller:

3.1.

Right of access

3.2.

Right to rectification

3.3.

Right to erasure

3.4.

Right to restriction of processing

3.5.

Right to notification

You have the right to obtain from us confirmation as to whether or not personal data concerning
you is being processed. If this is the case, you have a right of access to this personal data andfurther information, which you can find in Article 15 GDPR. You can contact us by post or email for this purpose.
You have the right to obtain from us without undue delay the rectification of inaccurate personal
data concerning you. Taking into account the purposes of the processing mentioned above,
you also have the right to have incomplete personal data completed, including by means ofproviding a supplementary statement. You can contact us by post or e-mail for this purpose.
You have the right to obtain from us the erasure of personal data concerning you without undue
delay if one of the requirements of Article 17 GDPR is met. You can contact us by post or email for this purpose.
You have the right to obtain from us restriction of processing if one of the requirements ofArticle 18 GDPR applies. You can contact us by post or e-mail for this purpose.
If you exercise your right to rectification, erasure or restriction of processing against thecontroller, the controller is obliged to notify the rectification, erasure or restriction of processing
to all recipients to whom the personal data concerning you have been disclosed, unless thisproves impossible or involves disproportionate effort.
You are entitled to request that the controller inform you of these recipients.

3.6.

Right to data portability

3.7.

Right to object to processing on legitimate interest grounds and todirect marketing

You have the right to receive the personal data concerning you, which you ahve provided tous, in a structured, commonly used and machine-readable format and you have the right totransmit this data to another controller without hindrance from us if the conditions of Article 20
GDPR are met. You can contact us by post or e-mail for this purpose.

If, in exceptional cases, we process personal data on the basis of Article 6 (1)(f) GDPR (i.e. on
the basis of legitimate interests), you have the right to object to the processing of your personal
data by us at any time on grounds relating to your particular situation. If we cannot demonstratecompelling legitimate grounds for the processing which override your interests, rights andfreedoms, or if we are processing your data for the purposes of direct marketing, we will nolonger process your data (see Article 21 GDPR). You can contact us by post or e-mail for thispurpose.
© PTV Planung Transport Verkehr GmbH August 2024

Page 34/35

Data Privacy Statement Websites

Rights of data subjects

An objection in this sense is also a technical method that you use, such as a clear technicalinformation that your web browser sends to us ("do-not-track" message).
Where personal data is processed for direct marketing purposes, you have the right to object
at any time to the processing of personal data relating to you for such marketing purposes,
including profiling to the extent that it is related to such direct marketing.

3.8.

Right to withdraw consent

3.9.

Automated decision making including profiling

You have the right to withdraw your consent to the collection and use of personal data at any
time with effect for the future. You can contact us by post or e-mail for this purpose. This does
not affect the lawfulness of the processing carried out on the basis of the consent until it isrevoked.
You have the right not to be subject to a decision based solely on automated processing,including profiling, which produces legal effects concerning you or similarly significantly affects
you. Unless the decision is necessary for the conclusion or performance of a contract between
you and us, it is authorised by the law of the Union or of the Member State to which we aresubject and that law contains appropriate measures to safeguard your rights and freedoms
and your legitimate interests, or the decision is taken with your express consent.
We do not make such automated decisions.

3.10. Voluntary nature of data provision

If we are required by law or contract to collect personal data, we will indicate this at the timethe data is collected. Some of the information we collectis necessary for us to enter into a contract with you, i.e. if we cannot or cannot adequately
perform our contractual obligations to you. You are under no obligation to provide the personal
information. However, failure to do so may mean that we are unable to provide or offer aservice, action, measure or similar requested by you or that it is not possible to enter into acontract with you.

3.11. Right to lodge a complaint with a supervisory authority

Without prejudice to other rights, you have the right to lodge a complaint with a data protection
supervisory authority at any time, in particular in the Member State of your habitual residence,place of work or place of the alleged infringement, if you consider that the processing of
personal data relating to you infringes data protection law.

© PTV Planung Transport Verkehr GmbH August 2024

Page 35/35