Source: http://en.vvs.de/data-protection/
Timestamp: 2020-07-10 09:38:12
Document Index: 399935165

Matched Legal Cases: ['Art. 6', 'Art. 7', 'Art. 6', 'Art. 6', 'Art. 6', '§ 257', '§ 147', 'Art. 6', 'Art. 6']

Data Privacy Statement on VVS Websites and VVS app
The Verkehrs- und Tarifverbund Stuttgart GmbH (VVS) takes the protection of personal data very seriously. Compliance with data protection regulations is for us a matter of course. It is important for us that you know which data we collect and process, and when, and how we make use of them.
As the authority responsible we would like to inform you below about the data processing which occurs when you use the websites accessible under www.vvs.de and www.orange-webseiten.de and the VVS app.
1. Authority Responsible for Data Processing
Email: kontakt@vvs.de
Telephone: 0711 6606-0
Should you have any suggestions or queries regarding data protection, please contact our Data Protection Officer.
On our websites and on the VVS app we offer you a variety of information and services. For this we process your data only when this is sanctioned by an appropriate statutory provision. We rely for the processing of your data on the following legal bases:
Consent (Art. 6 par. 1 sentence 1 a), Art. 7 GDPR: We will process certain data only on the basis of your prior, explicit and voluntary consent. You have the right to withdraw your consent at any time, with future effect.
Performance of a contract / precontractual measures (Art. 6 par. 1 sentence 1 b) GDPR): For the initiation or performance of your contract (e.g. booking a ticket) we need access to certain data.
Fulfilment of a legal obligation (Art. 6 par. 1 sentence 1 c) GDPR).
Protection of legitimate interests (Art. 6 par. 1 sentence 1 f) GDPR): VVS will process certain data for the protection of its interests or the interests of third parties. This applies only in individual cases where your interests do not prevail.
a) Data processing on informational use
On purely informational use of the websites, that is to say when you do not sign in or register for use of the website or otherwise provide us with information, we do not collect any personal data, with the exception of data which your browser transmits to facilitate your visit to the website. These include:
Browser – operating system and interface
Also, cookies are stored on your computer when you use the website. Cookies are small text files that are stored on your hard drive and assigned to the browser that you are using and allow the organisation which sets the cookies (in this case ourselves) to receive certain information. Cookies are incapable of executing programs or transmitting viruses to your computer. They serve to improve the overall user-friendliness and effectiveness of the internet offering.
You may configure your browser settings according to your preferences and, for example, reject the acceptance of cookies. We would draw your attention to the fact that you may not be able to use all functions of this website. Below you will find a description of the various cookies and an explanation of the possibility of selecting or deselecting on an individual basis.
This website uses transient cookies (temporary use) and persistent cookies (time-limited use). Persistent cookies are automatically deleted after a predetermined time, which may differ from cookie to cookie. You may at any time delete the cookies in the security settings of your browser. Transient cookies are automatically deleted when you close the browser. These include, in particular, session cookies. These save a so-called session ID, which allows several requests from your browser to be assigned to the common session. In this way your computer can be recognised when you return to the website. Session cookies are deleted when you log off or exit the browser.
On this website data for marketing and optimisation purposes are collected and stored using technologies from Matomo (www.matomo.org). From these data user profiles can be created under a pseudonym. For this, cookies may be used. Cookies are small text files which are stored locally in the cache memory of the internet browser of the website visitor. The cookies allow recognition of the internet browser. Without the specially granted permission of the person concerned, the data thus collected by Matomo technologies will not be used to personally identify the visitor to this website nor will they be merged with personal data about the bearer of the pseudonym. Permission for data collection and storage may at any time be revoked with future effect. You may at this point decide whether web analysis cookies may be deposited in your browser, in order to enable the operator of the website to collect and analyse various statistical data. All data collected using Matomo are exclusively collected and processed on VVS servers.
Storage period: 13 months. This cookie stores information about the user, such as a specific visitor ID, the visits to the website and the date and time (time stamp) of creation of the cookie.
Storage period: 6 months. This cookie stores information relating to the previously visited website (referrer) via which our website was reached.
Storage period: 30 minutes. This cookie stores data temporarily during use of our website.
Storage period: For the duration of the visit. This cookie is set by Matomo in order to measure the visit to a website in terms of time, as a session.
Storage period: 2 years. This cookie prevents the website visitor from being tracked by Matomo. It is placed when the website visitor unchecks the Opt-In checkbox on the data privacy page.
b) Data privacy friendly incorporation of the ‘Like’ button from Facebook into the website
For the protection of your data on the VVS websites, the ‘Like’ button from Facebook is incorporated using a two-stage solution: By clicking first on the ‘Share on Facebook?’ button, this button is activated and a connection is thereby established to the Facebook servers. Next, by means of a second click on the ‘Like’ button you can recommend the website to your friends.
With this two-stage solution, data exchange with the Facebook operators occurs only with your active consent, which is triggered by your first click on the button. In this way we are able to guarantee enhanced protection of your data.
5. Use of the VVS app
a) Data processing in the app
In addition to our online offering we provide you with the VVS app as a mobile application which you can download onto your mobile terminal.
When downloading the app the relevant information will be transferred to the App Store, in particular the user name, email address and customer number of your account, the time of download, payment information and the individual device code. However, we have no influence on the collection of such data nor are we responsible therefor.
We process the data thus provided insofar as this is necessary for downloading the app onto your smartphone. They will not be further stored beyond this.
When you use the app, and thus not when you are logging onto the website, registering or otherwise transferring information to us, we collect the following further personal data to enable you to use the functions of the app:
Data volume transmitted at any time
Your device code
Unique number of the terminal (IMEI = International Mobile Equipment Identity)
Name of your smart phone
Our offering comprises so-called location-based services, which help us to bring you special offers that are tailored to your location at any time. In order to allow us to offer these functions of the app, we collect your location data by means of GPS and your IP address in anonymised form, when you consent to this via the settings on your mobile terminal.
You may at any time allow or cancel this function in the settings of the app or of your operating system. Your location will only be transferred to us if, when using the app, you avail yourself of functions which we can only offer you if we know your location.
b) Web analysis in the app
Data for marketing and optimisation purposes are collected on the app and stored with Google Analytics for Firebase, a web analysis service of Google Inc. (‘Google’).
Google uses cookies. The information generated by the cookies about use of the app by the user is generally transmitted to and stored on a Google server in the USA. However, Google is certified under the Privacy Shield Agreement and by virtue hereof guarantees its compliance with European data protection law.
Google will use this information on our behalf, in order to evaluate the use of our app by the users, to compile reports on activities occurring within the app and to provide us with further services connected with the use of this app and with internet use in general.
We use Google Analytics for Firebase, but only with activated IP anonymisation. This means that the IP address of the user is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area (EEA). Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there.
The IP address transmitted from the user’s device is not merged with other Google data. Users are able to deactivate Google Analytics for Firebase in VVS Mobil without the functionality of VVS Mobil being thereby restricted. For this you must click on the linked field ‘Authorisations’ in this Data Privacy Statement or on the field ‘Authorisations’ in the app settings and deactivate the corresponding field there in each case.
Further information on the use of data by Google for advertising purposes, on setting options and on the right to object can be found on the Google websites: www.google.com/intl/... (‘Data use by Google when you use our partners’ websites or apps’), www.google.com/policies/... (‘Data use for advertising purposes’), www.google.com/settings/ads (‘Managing information which Google uses to show you advertising’) and www.google.com/ads/... (‘Decide which advertising Google shows you’).
Data stored by us are deleted as soon as any consent is withdrawn, or when the data are no longer required for their intended purpose and no legitimate interests or statutory obligations to store them prevent their deletion.
If the data are not deleted because they are required for other, lawfully permitted purposes, their processing is restricted. This means that the data are blocked and will not be processed for other purposes. This applies, for example, to users’ data which must be stored for commercial or fiscal reasons.
According to current statutory requirements, storage occurs for 6 years according to § 257 par. 1 HGB (German Commercial Code) (e.g. commercial letters, accounting vouchers etc.) and for 10 years according to § 147 par. 1 AO (German Revenue Code) (e.g. commercial and business letters, tax-related documents).
7. Specific Functions
We offer specific functions both on the websites and on our app. If you use the Ticketshop of Stuttgarter Straßenbahnen AG (SSB) Schockenriedstraße 50, 70565 Stuttgart, which is accessible via the websites or the app, or book a ticket there, the corresponding Data Privacy Notices of the SSB also apply.
You have the right to request from us confirmation as to whether your personal data are being processed.
b) Right to rectification/erasure/restriction of processing
You also have the right to request from us that
personal data concerning you are erased without delay (Right to erasure) and
processing is restricted (Right to restriction of processing).
You have the right to receive, in a structured, commonly used and machine-readable format, your personal data which you have provided to us, and to transmit such data to another responsible party.
You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the legitimacy of processing which has by virtue of your consent already occurred, up to the time of withdrawal thereof.
If the processing of your personal data is necessary for the performance of a task which is in the public interest (Art. 6 par. 1 e) GDPR) or for the protection of our legitimate interests (Art. 6 par. 1 f) GDPR), you have a right to object thereto.
If you are of the opinion that the processing of personal data concerning you contravenes the GDPR, you have the right, without prejudice to any other legal remedies, to appeal to a regulatory authority.
9. Amendment of Data Privacy Statement
In the event of any change in the legal situation, the service or the data processing, we reserve the right to amend this Data Privacy Statement. However, this applies only to statements regarding the data processing. If the consent of the user is required, or constituent parts of the Data Privacy Statement contain provisions concerning our contractual relationship with the users, such amendment will only occur with the consent of the user.
Users are able to enquire regularly about any changes to this Data Privacy Statement.