Source: https://hansecom.com/en/data-policy.html
Timestamp: 2020-02-20 17:49:26
Document Index: 745870321

Matched Legal Cases: ['§ 2', 'Art. 4', '§ 3', '§ 4', '§ 6', 'Art. 6', '§ 7', '§ 8', '§ 10', 'Art. 6', 'Art. 6', '§ 11', '§ 6', '§ 6', 'Art. 6', 'Art. 6', '§ 12', '§ 13', 'Art. 6', '§ 14', '§ 6', 'Art. 6', '§ 15', 'Art. 6', 'Art. 6', '§ 16', 'Art. 6', 'Art. 6', '§ 1', '§ 17', 'Art. 6', '§ 17', '§ 5', 'Art. 15', 'Art. 16', 'Art. 17', 'Art. 18', 'Art. 19', 'Art. 20', 'Art. 7', 'Art. 77', '§ 17', '§ 17', '§ 18']

Data-Policy | HanseCom
The following items provide an explanation of how and for what purpose personal data is collected when you use our website. Personal data includes all data that directly relates to you and can be used to identify you as a person, e.g. your name, address, e-mail addresses and user behavior.
§ 2 Data Controller
The data controller pursuant to Art. 4 Sect. 7 General Data Protection Regulation (GDPR) is HanseCom Public Transport Ticketing Solutions GmbH. The contact details are as follows:
+49 1520 907 3406
§ 3 Data Protection Officer
Mag. Jur. Djoko Lukic
Phone: +49 40 414 313 070
Website: https://datenschutzbuero.hamburg
E-mail: hansecom@datenschutzbuero.hamburg
§ 4 Supervisory Authority
The relevant supervisory authority is:
Phone: +49 40 428 544 040
As regards personal data relating to you, you have the following rights vis-à-vis us:
· Right to rectification or deletion,
· Right to restrict processing,
· Right of objection to processing,
You also have the right to file a complaint with a data protection supervisory authority regarding the processing of your personal data by us.
§ 6 Collection of Personal Data When You Visit Our Website
When you visit the website for the sole purpose of obtaining information, we only collect the personal data that your browser transmits to our server. When you decide to view our website, we collect the following data to obtain the technical information necessary to display our website to you and to guarantee its stable and secure operation (legal basis is Art. 6 Sec. 1 S. 1 lit. f GDPR):
· Operating system and interface used,
§ 7 Disclosure of Your Data
Your data will not be disclosed to third parties. Excluded from this are technical service providers who have been commissioned to provide and maintain the website. These service providers are carefully selected and commissioned by us. If a contractual relationship under data protection law exists, these providers are bound by our instructions and are subject to regular checks.
The service providers listed below, who perform website analysis (Google Analytics) services and ensure the integration of uniform character sets (Google Web Fonts), also receive the data listed above.
If our service providers are based outside the EU, we ensure that they have submitted to the Privacy Shield framework and therefore offer a comparable level of data protection.
§ 8 Objection or Revocation
If you have given your consent to the processing of your data, you can revoke it at any time.
2. Objection based on balancing interests
Insofar as we base the processing of your personal data on a balancing of interests, you may object to the processing. This is the case if the processing is not necessary in particular for the fulfillment of a contract with you. This is indicated by us in each case in the description of the functions below. In the event of such an objection, we ask you to explain the reasons why we should not process your personal data in the way we have done. In the event of your justified objection, we will examine the facts and either discontinue or adapt the data processing or point out our compelling legitimate grounds on the basis of which we will continue the processing.
3. Objection to use for advertising purposes
You naturally have the right to object to the processing of your personal data for advertising and data analysis purposes at any time.
4. Contact address for revocations or objections
In the event of a revocation or objection, please send an e-mail to hello@hansecom.com.
1. What are (http) cookies?
In addition to the aforementioned data, cookies are stored on your computer when you use our website. Cookies are text files used by the opened website to store data (e.g. the time of your last visit, etc.).
2. Expiration date, persistent cookies
Cookies have a predefined expiration date. As soon as the date is reached, the cookie or the information stored with it will be deleted from your browser. These are persistent cookies.
3. What are transient cookies?
Transient cookies are automatically deleted when you close your browser. This includes in particular the session cookies. These store a so-called session ID, which is used to assign different requests of your browser to a session.
4. What does ‘local storage’ mean?
‘Local storage’ refers to the temporary storage of your browser. Web pages can use it to store data. The functionality corresponds to that of (http) cookies, which is why this data is treated the same as cookies.
5. How to reject cookies
You can configure your browser settings according to your wishes and, for example, refuse to accept third-party cookies or all cookies. Please note that in this case you may not be able to use all functions of this website.
§ 10 Specific Processing Activity: Analysis of Website Usage via Google Analytics
1. What is Google Analytics?
Google Analytics is a service provided by Google Inc. (“Google”) to analyze website usage.
We use Google Analytics to analyze the use of our website. The statistics gained through this service allow us to improve our offering and make it more attractive to you as a user.
3. How does Google Analytics work?
Google Analytics stores the website usage behavior, e.g. the duration of the visit, in “cookies” (see above).
4. Where is the data processed?
The information about your use of this website is stored on servers located in both the EU and the USA. Google LLC (USA) has submitted to the EU-US Privacy Shield and protects your data according to European standards.
5. Prevention of processing by Google
You can prevent cookies from being stored on your computer by making the corresponding settings in your browser. Furthermore, you can prevent Google from collecting, transferring and processing the data generated by these cookies about your website utilization (incl. your IP address) by downloading and installing the browser plugin available at this link: http://tools.google.com/dlpage/gaoptout?hl=de.
The legal basis for the use of Google Analytics is your implied consent pursuant to Art. 6 Sec. 1 S. 1 lit. a GDPR and our legitimate interest pursuant to Art. 6 Sec. 1 S. 1 lit. f GDPR.
Third-party information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001.
Terms of use: http://www.google.com/analytics/terms/de.html
Overview of data privacy: http://www.google.com/intl/de/analytics/learn/priv...
§ 11 Addthis
1. What is Addthis?
Addthis is a service that allows you to bookmark and share website addresses. Buttons are used to show different service providers.
We use the Addthis plugin on our website to allow you to share our offer.
3. What data is processed?
By viewing our website, web elements such as images of the service provider (Addthis) are displayed on your browser. In this manner, the personal data which is usually collected when reading web pages (e.g. IP address, time of use, see also § 6), are transmitted to Addthis (Oracle).
The information is usually transferred to and stored on Addthis servers (Oracle, World Headquarters, Redwood Shores, Oracle Corporation, 500 Oracle Parkway, Redwood Shores, CA 94065) in the USA. Oracle has submitted to the EU-US Privacy Shield and protects your data according to European standards. For more information on data processing at Oracle, see the following page: https://www.oracle.com/legal/privacy/Addthis-priva...
In addition, your data will be processed by the service providers listed under Item 5 at the respective locations.
5. Recipients of your data
We use the Add-This plugin to enable you to save or share our Internet address with the following providers:
As soon as you share or store our Internet address with one of these providers, the providers will presumably process the personal data that is generated by the use of Internet addresses (see § 6).
The legal basis for data processing is your implied consent pursuant to Art. 6 Sec. 1 S. 1 lit. a GDPR and our legitimate interest pursuant to Art. 6 Sec. 1 S. 1 lit. f GDPR.
Further information on the purpose and scope of data collection and processing can be found in the privacy statement of the service provider: https://www.oracle.com/legal/privacy/Addthis-privacy-policy.html.
§ 12 Facebook
You can share the content of our website on Facebook. We do not use any plugins for this purpose. You can share our website by clicking Internet links. Once you select the share website feature, you will be using Facebook’s website services. You will leave our website, and Facebook will likely process the personal data that is usually collected when you visit websites.
§ 13 Google Web Fonts
1. What are Google Web Fonts?
Google Web Fonts are free character sets provided by Google that can be used on client computers to display web pages.
We use Google Web Fonts for the uniform presentation of our website.
3. Is personal data processed in this case?
When the website is displayed, the visitor’s computer downloads the character sets from Google. Google registers this process and can identify which website was opened by the user.
The information about your use of this website generated by the retrieval of the character sets is stored on servers located both in the EU and in the USA. Google LLC (USA) has submitted to the EU-US Privacy Shield and protects your data according to European standards.
The legal basis for the use of Google Web Fonts is Art. 6 Sec. 1 S. 1 lit. f GDPR.
Information about Google Web Fonts: https://developers.google.com/fonts/faq
§ 14 Embedded YouTube Videos
1. What Are YouTube Videos?
These are videos embedded in our website. The technology for playing the videos is provided by Google.
We process the data in order to provide you with videos on our website.
3. What data is processed by YouTube?
YouTube videos are provided in ‘Advanced Privacy Mode’. This means that no personal data is processed by YouTube when you access the website on which the YouTube video was integrated. Only when you play videos will YouTube process the personal data that is usually required for the rendering of web services (IP address, time, etc.). For more information on these data categories, please consult § 6 of this declaration. The processing will take place regardless of whether you are logged in with your Google Account.
If you are logged in at Google, your data will be directly associated with your account. If you do not want this action to be associated with your Google profile, you must log out before activating the button. YouTube stores your data in user profiles and uses it for the purposes of advertising, market research and/or the need-based design of its website. This evaluation is carried out in particular (even for users who are not logged in) to provide demand-oriented advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, but you must contact YouTube to exercise this right.
The legal basis is Art. 6 Sec. 1 S. 1 lit. f GDPR.
YouTube is a service offered by Google. The information generated by the retrieval of the videos is stored on servers located both in the EU and in the USA. Google LLC (USA) has submitted to the EU-US Privacy Shield framework and protects your data according to European standards (https://www.privacyshield.gov/EU-US-Framework). Further information on the purpose and scope of data collection and processing can be found in the privacy statement. It also provides you with more information on your rights and setting options to protect your privacy: https://www.google.de/intl/de/policies/privacy.
§ 15 Advertising and Information on Products, Services and More (Newsletter)
Data is processed to inform you about products, services and further marketing measures via e-mail. The basis for this is the digitally granted consent in accordance with Art. 6 I S. 1 lit. a GDPR. Furthermore, we process your data in our own interest in accordance with Art. 6 I S. 1 lit. f GDPR.
2. Data categories
We process your e-mail address in order to be able to send you e-mails. We also process your first name and surname to address you personally.
3. Transmission of your data to our service provider
The data is transmitted to the operators of our IT infrastructure. It is also possible that external IT service providers may have access to this data during troubleshooting activities.
We use the services of the following providers to send out e-mails:
- Orange Marketing (Christian Harms, Schumannstr. 49, 60325 Frankfurt am Main, Germany)
Information on data privacy can be found on the provider’s website under the following link: https://www.orangemarketing.de/impressum/
The service provider integrates a so-called ‘tracking pixel’ into the dispatched newsletters. This tracking pixel enables the provider to analyze user behavior, such as whether the newsletter has been read by the recipient.
4. Access authorization
Your data can only be accessed by employees who are authorized to do so.
5. Voluntary nature and revocation of consent
Your consent is voluntary. The use of our services and offers is not affected by this consent. You can revoke your consent at any time. To do so, use the corresponding link in the e-mail or send an e-mail to hallo@hansecom.com.
If no obligations of retention exist, we will delete your data after you withdraw your consent.
§ 16 E-Mail Server
Data processing is carried out in order to be able to communicate with you via electronic mail. We perform this processing in order to fulfill our agreed obligations defined in Art. 6 I S. 1 lit. b GDPR. Furthermore, the operation of the e-mail server and the communication made possible by it are also in our own interest in accordance with Art. 6 I S. 1 lit. f GDPR.
When operating the e-mail system, all data that you send us via electronic mail is captured. This includes, for example, e-mail addresses, your name, your address and other communication data.
3. Recipient of your data
The data is transmitted to the responsible persons named under § 1 and the operators of our IT infrastructure. It is also possible that external IT service providers may have access to this data during troubleshooting activities. We draw on a service from Microsoft to send out e-mails. Microsoft has adopted the Privacy Shield framework to ensure an appropriate level of protection.
An obligation of retention can result, for example, from Section 147 of the German Fiscal Code. If a separate contract has been concluded or a contract has been initiated with you, we are obliged under this provision to store the data for 10 years.
The e-mail server is operated and maintained by Microsoft. For this reason, e-mails are also stored in Microsoft’s infrastructure. Although Microsoft is a company based outside the EU (USA), it has subjected itself to the Privacy Shield framework and thus guarantees a data protection standard that corresponds to that of the European Union. For more information on this, please use the following link: http://www.microsoftvolumelicensing.com/Downloader...
In order to prevent unauthorized access to your personal data by third parties, our e-mail servers support transport-encrypted transmissions. All synchronizations are carried out in encrypted form. Furthermore, our contact form is provided on an encrypted website.
§ 17 ‘HandyTicket Deutschland’ App
We carry out this processing in order to enable you to purchase tickets and to comply with our obligations defined in Art. 6 I S. 1 lit. b GDPR.
2. Order processing and responsibilities
The processing activities connected with the app are carried out as part of order processing. The transportation operators are responsible for the respective processing activities. The transportation operators are our clients, and we act as a service company working on behalf these clients. The responsible parties are listed under § 17 Item 10 of this data privacy declaration.
Analogous to § 5, you are entitled to the following rights vis-à-vis your transportation company:
 The right to information pursuant to Art. 15 GDPR,
 The right to rectification pursuant to Art. 16 GDPR,
 The right to cancellation pursuant to Art. 17 GDPR,
 The right to limit processing pursuant to Art. 18 GDPR,
 The right to information pursuant to Art. 19 GDPR,
 The right to data portability pursuant to Art. 20 GDPR,
 The right to revoke consent granted pursuant to Art. 7 Sec. 3 GDPR, and
 The right of appeal pursuant to Art. 77 GDPR.
Please note that we are not allowed to process any inquiries regarding data processing within HandyTicket Deutschland. Please contact the relevant transportation operator or their data protection officer. The contact data is listed under § 17 Item 10 of this data privacy declaration.
4. Data categories
The app processes the following data categories: your name, address, payment information, location, mobile phone number, uploaded documents and/or photographs, WLAN connection information, and technical information (such as log data and software information) about your phone.
5. App authorizations
The app used requires different access rights. The access rights and the purpose of the respective data processing are listed below:
Approximate location (network-based) precise location (GPS and network-based)
The location is determined in order to select the correct region. This function is also used to determine and display the nearest railway or bus stations and the travel connections available.
To make it easier for the user to fill out the data fields during registration, the name and telephone number are read from the telephone. This function is only used with Android telephones.
Read the contents of your USB storagemodify or delete the contents of your USB storage
If documents or photographs are required for the registration of certain tickets or subscription cards, they can be uploaded through the app. The above authorizations are necessary for the app to access these photos. Without this authorization, our app will not be able to access the image documents.
Google’s designation ‘USB storage’ is misleading. Rather, the authorization refers to access to additional storage media, such as memory cards. This is where photos are frequently stored.
In order to record and upload documents directly, the software requires access to the camera function.
WLAN connection information
Payments can also be made by the mobile operator. The payments made will then be billed to you by your mobile operator. In order to implement this payment method, mobile operators were required to ensure that the smartphone is not connected to a WLAN during the payment process. In order to meet this requirement, the app needs to check whether an active WLAN connection exists, which is why the corresponding authorization is required.
Within the scope of this authorization, the application checks whether required Google services are available on the phone. If these are not available, essential program components no longer function. Even though it is possible to query the IMEI within the scope of this authorization, we will not do so.
Receive data from Internetview network connectionsfull network access
The purchase of tickets is only possible if the purchase is processed on our technical infrastructure. The data transmission required for this is carried out via the Internet and therefore also requires the authorization to send and receive data via the Internet.
This function is no longer required and will be disabled in future versions. No personal data is processed with this function.
To receive instant messages (push messages), the standby function is temporarily disabled and the phone is activated. This function is relevant, for example, in order to be able to report cancelled routes or delays at short notice.
This authorization, too, is necessary to determine whether required services are provided by the smartphone’s operating system. Without this check, software errors can occur.
6. Recipient of your data
The data is transmitted to the responsible persons (clients) named under § 17 Item 10 of this data privacy declaration and to the operators of our IT infrastructure. It is also possible that external IT service providers may have access to this data during troubleshooting activities.
7. Access authorization
Your data can be accessed by employees who are authorized to do so.
If no obligations of retention exist, we will delete your data. An obligation of retention can result, for example, from Section 147 of the German Fiscal Code. If a separate contract has been concluded or a contract has been initiated with you, we are obliged under this provision to store the data for 10 years.
In order to prevent unauthorized access to your personal data by third parties, the data is transferred in transport-encrypted format.
Postfach 10 09 55
01079 Dresden, Germany
Privacy statement: https://www.dvb.de/en-gb/meta/legal-notice/
Data protection officer: datenschutz@dvbag.de
Verkehrsverbund Mittelsachsen GmbH representing the transportation operators in the VMS
Privacy statement: https://www.vms.de/service/datenschutz/
Data protection officer: datenschutz@vms.de
Göltzschtalstrasse 16
Phone: +49 (0) 3744 8302 – 0
Privacy statement: https://vogtlandauskunft.de/datenschutz.html
Data protection officer: datenschutz@vvvogtland.de
Städtische Nahverkehrsgesellschaft mbH Suhl/ Zella-Mehlis
98527 Suhl, Germany
Privacy statement: https://www.sngonline.de/de/kontakt/
Data protection officer: SNG@Dresden.Brands-Consulting.eu
99086 Erfurt, Germany
Privacy statement: https://www.stadtwerke-erfurt.de/pb/swe/datenschut...
Data protection officer: evag-datenschutz@stadtwerke-erfurt.de
Otto-Brenner-Strasse 242
Privacy statement: https://www.mobiel.de/datenschutz/mobielde/
Data protection officer: Datenschutz@Stadtwerke-Bielefeld.de
Privacy statement: https://www.stadtwerke-muenster.de/privatkunden/so...
Data protection officer: datenschutz@stadtwerke-muenster.de
Bungertstrasse 27
Privacy statement: https://www.dvg-duisburg.de/datenschutz/
Data protection officer: datenschutzbeauftragter@dvv.de
Hagener Versorgungs- und Verkehrs-GmbH
58097 Hagen, Germany
Privacy statement: https://www.strassenbahn-hagen.de/footer/datenschu...
Data protection officer: datenschutz@hvg-hagen.de
Odenkirchener Strasse 201
41236 Mönchengladbach, Germany
Privacy statement: https://www.new-mobil.de/datenschutz/
Data protection officer: datenschutz@new.de
Rheinberger Strasse 95a
Privacy statement: https://www.niag-online.de/kontakt/datenschutz/
Data protection officer: datenschutz@de.rhenus.com
Lierenfelder Strasse 42
Privacy statement: https://www.rheinbahn.de/info/Seiten/Datenschutz-u...
Data protection officer: datenschutzbeauftragter@rheinbahn.de
Zweigertstrasse 34
Privacy statement: https://www.ruhrbahn.de/essen/sonstige-seiten/date...
Data protection officer: datenschutz@ruhrbahn.de
Privacy statement: https://stadtbus-dormagen.de/impressum/index.php
Data protection officer: info@stadtbus-dormagen.de
47804 Krefeld, Germany
Privacy statement: https://www.swk.de/datenschutzerklaerung-sowie-nut...
Data protection officer: datenschutzbeauftragter@swk.de
Moselstrasse 25-27
Privacy statement: https://www.stadtwerke-neuss.de/impressum-datensch...
Data protection officer: datenschutz@stadtwerke-neuss.de
STOAG Stadtwerke Oberhausen GmbH
Max-Eyth-Strasse 62
Privacy statement: https://www.stoag.de/servicenavigation/datenschutz...
Data protection officer: dsb@fox-on.com
Neuenkamper Strasse 81-87
Privacy statement: https://www.stadtwerke-remscheid.de/datenschutz/
Data protection officer: datenschutz@ewr-gmbh.de
Beethovenstrasse 210
Privacy statement: http://www.sobus.net/datenschutz/
Data protection officer: swsg.datenschutz@stadtwerke-solingen.de
Straßenbahn Herne - Castrop-Rauxel GmbH
44627 Herne, Germany
Privacy statement: https://www.hcr-herne.de/de/datenschutzerklaerung....
Data protection officer: datenschutz@hcr-herne.de
Verkehrsgesellschaft Ennepe-Ruhr mbH (VER)
Privacy statement: http://www.ver-kehr.de/33980.html
Data protection officer: datenschutz@ver-kehr.de
Verkehrsgesellschaft der Stadt Velbert mbH (VGV mbH)
42549 Velbert, Germany
Privacy statement: https://www.vgv-velbert.de/datenschutz/
Data protection officer: datenschutz@vgv-velbert.de
Westerholter Strasse 550
45701 Herten, Germany
Privacy statement: https://www.vestische.de/datenschutz.html
Data protection officer: datenschutz@vestische.de
Privacy statement: https://www.wsw-online.de/datenschutzbestimmungen/
Data protection officer: datenschutz@wsw-online.de
Dortmunder Stadtwerke AG (DSW21)
Deggingstrasse 40
Privacy statement: https://www.bus-und-bahn.de/rel2012newp/32707.html
Data protection officer: datenschutz@dsw21.de
Graf-Adolf-Strasse 67-69
Privacy statement: https://www.rheinlandbus.de/rheinlandbus/view/home...
Data protection officer: datenschutz.regio@deutschebahn.com
Daimlerstrasse 10a
Privacy statement: https://www.bahnen-monheim.de/Datenschutz/
Data protection officer: Datenschutz@bahnen-monheim.de
Aachener Straßenbahn- und Energieversorgungs-AG
Neuköllner Strasse 1
Privacy statement: https://www.aseag.de/datenschutz/
Data protection officer: dsb@aseag.de
Verkehrsverbund Pforzheim-Enzkreis GmbH (VPE)
75177 Pforzheim, Germany
Privacy statement: https://www.vpe.de/datenschutz/
Data protection officer https://www.vpe.de/datenschutz/
SWU Verkehr GmbH
Karlstrasse 1-3
Privacy statement: https://www.swu.de/fileadmin/content/mobilitaet/SW...
Data protection officer: datenschutz@swu.de
Privacy statement: https://www.bodo.de/datenschutz.html
Data protection officer: datenschutz@bodo.de
Kornblumenstr. 7/1
Privacy statement: https://www.der-katamaran.de/datenschutz.html
Data protection officer: datenschutz@stadtwerk-am-see.de
Privacy statement: https://www.bahn.de/p/view/home/datenschutz/schutz...
Data protection officer: ecommerce-datenschutz@bahn.de
Privacy statement: https://www.triregio.info/#/impressum_datenschutz
Data protection officer: not provided
Verkehrsverbund Oberlausitz-Niederschlesien GmbH (VON GmbH)
Rosenstrasse 31
Privacy statement: https://www.zvon.de/de/Datenschutz/
Data protection officer: datenschutz@pcs-bz.de
§ 18 Encryption
Other data transmissions will be encrypted, where possible.