Back 

Data Privacy Statement

Valid from 18.10.2023Data Privacy Statement of ÖBB-Personenverkehr AG, effective as of 18 October 2023

to the archive: other versions

Our message

Customer satisfaction is our top priority. This means that protecting your data is particularly important. We would like to thank you for the trust you place in us by submitting your data to us for processing. As a sign that we respect your rights as well as your privacy, we have formulated our policy, which applies when processing your data:

  • We attach great importance to transparency when it comes to processing your data. This is why we have paid special attention to our data protection declaration in order to provide you with the necessary information on how we handle your data.
  • It is important to us that you know for what purposes we use your data and when we store it. In our data protection declaration, we inform you how and to what extent we process your data.
  • We process your data only to the extent necessary and use it exclusively for lawful and justified purposes.
  • In certain cases, we ask you whether you consent to the use of your data. In these cases, you yourself decide how and when we use your data. For example, we will never send you electronic advertising if you do not desire it.
  • In certain cases, we will also ask you on our website and in our app whether you would like to voluntarily store certain information. This may be beneficial to speed up your next ticket purchase.
  • Similarly, we will only send you targeted special offers at your request. The decision is yours.
  • Our goal is to continually improve ourselves. Please get in touch with us if you have concerns.
  • We live our principles to the full, particularly in the area of data protection. In the following sections of this data protection declaration, find out how we process your data in the course of our various data applications.

When does this data privacy statement apply?

Our data privacy statement applies to anyone who makes use of one of our products or services, visits our websites or uses our apps. This includes: buying a ticket, including ancillary services, such as making a reservation, purchase of a customer card or use of our services.

We are constantly continuing the development of our offers and services. This is also why we will constantly adapt our data protection declaration. We will, however, make sure that the latest version will always be available to you.

Who is responsible for the data processing?

ÖBB-Personenverkehr AG (ÖBB-PV AG), FN [company registration number] 248742y, Am Hauptbahnhof 2, 1100 Vienna, tel. +43 1 93000 0, is the controller under data protection law, as defined in Article 4(7) GDPR.

GDPR defines a controller as a natural person or legal entity, authority, institution or other body, which, on its own or in conjunction with others, decides on the purposes and means of processing personal data.

What do we mean by “personal data”?

By personal data we mean all information relating to an identified or identifiable natural person (hereinafter “data subjects”).

A natural person is regarded as identifiable if said person can be identified as precisely this natural person, in particular through allocation of an identifier such as a name, identification number, location data, online identification data or one or more other special features in the particular individual case (e.g. voice). Thus this includes, at the least, the data that can be associated with you as a customer. For example, your name, email address, telephone number, booking code, ticket code or your customer number are personal data.

Occasions, purposes and sources from which personal data originate as well as our legal basis

The legal basis of data processing according to Article 6 GDPR comprises either the fulfilment of the contract, the fulfilment of a statutory obligation, your prior consent or our overriding legitimate interests, which may also include processing for a further purpose.

Data that can be associated with your person can stem from the following occasions, purposes and sources:

  • If you buy a product from ÖBB or a cooperating partner or make use of another service (for example purchasing a ticket, buying a customer card, making a reservation or using the ÖBB mobility service). In general, this can be done at ticket vending machines, on site at ticket counters or in ÖBB lounges, by phone through our customer service, via one of our external sales partners, online in the ticket shop or using our app.
Start of changes to the previous version
  • If you purchase and use a digital discount product in your ÖBB account.
End of changes to the previous version
  • If you use our Nightjet product.
  • If you would like to book a trip via the private ÖBB account or the ÖBB business account and create or already use an ÖBB account / ÖBB business account for this purpose.
  • If you use the SimplyGo! function in the ÖBB App.
  • If your employer (company, school, etc.) or any other third party (e.g. association) has opened an ÖBB business account for you and you have confirmed this account.
  • If you book a journey through our ÖBB travel agency.
  • If you book or take out a cancellation/travel insurance.
  • If you purchase an annual ticket or a single ticket for the Tauern motorail.
  • If you register on our website or in our app and create an ÖBB account.
  • If you use the SimplyGo! function in the ÖBB app.
  • If you use our website shop.oebbtickets.at or our ÖBB app for timetable information, to buy a ticket or a customer card and use our new services.
  • If we validate your ticket or customer card (i.e. scan and check for validity)
  • If you buy a product from ÖBB or a cooperating partner through one of our external sales partners or on the booking platform of one of our third-party sales partners.
  • If you assert your rights as a passenger or if a penalty fare is involved.
  • If there are outstanding debts which have not been paid by a customer.
  • If you contact our ÖBB customer service with any questions, requests, suggestions, complaints, criticism or other comments (e.g. malfunction of a ticket vending machine). This includes, among other things, the processing of complaints in the course of payment processing, in which case data is either provided by the responsible bank / payment service provider or feedback is provided by us to the bank / payment service provider in order to process your request.
  • If you use our Chatbot / ÖBB.Bot for inquiries
  • If we receive feedback from you with regard to our internal quality assurance in order to continually improve our service.
  • If you use SCOTTY timetable information or a push service or any other additional service.
  • If you use a rental car as a daytime user or commuter.
  • If you avail yourself of our integrated mobility services or other services such as transfers to the hotel, a rail and drive service or a bicycle parking space.
  • If customer cards, annual transport association tickets or other employee credentials are misused.
  • For statistical surveys and internal risk analyses in order to improve our services or systems, in which case the results of these analysis under no circumstances allow us to deduce information concerning your person.
  • As required – where possible – if it is necessary to contact you by e-mail or telephone and you have provided us with your contact details when booking a ticket (e.g. large-scale cancellation of trains or other disruptions, delays and other deviations, especially if you have booked a motorail train).
  • Provided that we have received your prior consent: for the electronic distribution of offers and other general news about the ÖBB Group and its cooperating partners as well as information and recommendations tailored to your specific needs for direct marketing purposes. If we do not have your consent, we will only analyse your data anonymously.
  • If you wish, we also offer location-based services, information and offers in our apps.
  • The delivery of offers for the acquisition of new customers by mail, as long as you do not inform us that you do not wish to receive such offers.
  • If you voluntarily participate in pilot projects, usability tests, sweepstakes and other campaigns or other customer loyalty measures.
  • If you use the contact form on our website to assert a claim regarding personal injury or property damage in the event of a train accident.
  • If you disclose your data to our train attendants (for example, due to personal injury or property damage, theft, or any other incident or concern).
  • If a customer under the age of 14 uses ÖBB-Personenverkehr AG services (e.g. tickets, newsletter orders, push services), the respective customer must ensure that the necessary consent of his or her legal guardian was obtained in advance..
  • If we issue a temporary or permanent exclusion from transport services.
  • If you book and receive an online consultation from an ÖBB travel agency or an app date at a ticket counter.
  • If you book and receive a Schulcard webinar.
  • If you participate in one or several pilot projects of the controllers.
  • If, as part of the process of issuing a penalty fare or data collection in connection with the issuance of an emergency ticket for displaced persons from Ukraine, your ID is scanned electronically on the train or at the ticket counter and further processed by means of automated systems. Only the necessary data from the ID card will be transferred (specific details of the ID card, title, name, date of birth, and, if applicable, the name and date of birth of the child, if the child used the train without a ticket). The ID card image is transferred only temporarily and is only displayed to the train attendant until the data has been cross-checked and confirmed to be correct.
    Data is only collected in the event of immediate payment (cash or ATM) on the train if you wish to reserve the right to subsequently lodge an objection and you present your photo ID for this purpose, which is scanned by the train attendants. In this case, we record your first and last name, date of birth, ID card number and voucher number.
  • If you book a bicycle parking place for private bicycles in the separated area of the Bike&Ride facility.
  • If you use our ÖBB Bike App.

Information on data subjects according to Articles 12 et seq. of the General Data Protection Regulation (GDPR)

Pursuant to the provisions of Article 12 et seq. GDPR, we would like to inform you on the following topics:

ÖBB-Personenverkehr AG (ÖBB-PV AG), FN 248742 y, Am Hauptbahnhof 2, 1100 Vienna, telephone +43 1 93000 0 is the controller under data protection law, as defined in Article 4(7) GDPR.

If you have any questions regarding data protection or the use of your personal data, feel free to contact our data protection officer.

Contact details of the data protection officer:

ÖBB-Personenverkehr AG

Am Hauptbahnhof 2

1100 Vienna

E-Mail: datenschutz.personenverkehr@pv.oebb.at

We will collect personal data ourselves, pursuant to Article 13 GDPR, in the following cases and for the following purposes:

If

  • you disclose your data to our train attendants (for example, due to personal injury or property damage, theft, or any other incident or concern). In this case, such data and information will be used for the specific purpose of case management as well as for conducting legal and official disputes.
  • we collect a penalty fare through our train attendants, where we may scan your ID card, or make use of our right to file charges due to non-payment of the amount due;
  • ou assert your statutory passenger rights under Regulation (EU) No. 1371/2007, the Railway Transport and Passenger Rights Act or the Fare Conditions and General Terms and Conditions of ÖBB-PV AG and for this purpose use our written refund application form.
  • you make any other request for reimbursement and compensation
  • you avail yourself of our mobility service;
  • you purchase an ÖBB ticket or customer card in person at a ticket counter, in an ÖBB lounge or from one of our external sales partners, submit a refund application, assert your passenger rights (including receipt of a compensation for delays), submit complaints, make use of any other services that require the collection of personal data (e.g. a change in data or additional data, creation of a customer account, etc.);
  • you contact the ÖBB customer service to book a ticket or any other service (e.g. mobility service, chatbot/ÖBB.Bot) by phone or contact the customer service for other issues (e.g. notification of malfunctions etc.);
  • you open or register for a private ÖBB account or an ÖBB business account..
  • you use the ÖBB Ticket Shop or the ÖBB App to book our products online, in particular the SimplyGo! function in the ÖBB App and trigger an electronic payment process (in this case, data must be transmitted to the payment service provider for the purpose of payment processing and, if necessary, for risk assessment);
  • if there is a special entitlement check for a specific product (e.g. in the form of a data comparison in the case of products for students offered by a transport association)
  • You book a bicycle parking place
  • If you use one of our bike services
  • you purchase a customer card;
  • you contact one of our employees, our customer service, a ticket counter or train attendants with criticism or a concern;
  • you opt for push services or any other service that we provide;
  • you book a service offered by the ÖBB travel agency;
  • you reserve and use the conference rooms of ÖBB Lounges.
  • you participate in sweepstakes and other campaigns;
  • you participate in a customer survey or the customer forum;
  • you are a Rail & Drive customer and use a car;
  • you have registered as a test user for usability testing;
  • you participate in pilot projects
  • you have submitted an affidavit for proceedings by the competition authorities under the Unfair Competition ACT (UWG) and have agreed to act as a witness in the course of a regulatory dispute, where required
  • you have given us your express consent in advance, we will process your data for direct marketing purposes in order to send you general information as well as offers and services tailored to your individual needs and your mobility and usage behaviour by e-mail or SMS or to contact you by telephone.
  • If you use the contact form on our website to assert a claim regarding personal injury or property damage in the event of a train accident. There will be no further use of data for other purposes. Evaluations of a train accident are carried out exclusively in anonymous form so that no conclusion about a specific person is possible.
  • If you present your ticket or customer card for validation purposes.
  • If we issue a permanent or temporary exclusion from transport services.
  • If you book and receive an online consultation from an ÖBB travel agency or an app date at a ticket counter.
  • If you book and receive a Schulcard webinar.

In the following cases and for the following purposes, personal data will not be collected by ourselves but will be disclosed by third parties in accordance with Article 14 GDPR:

If

  • you as a customer with an annual ticket want to participate in ÖBB’s process for compensation for delays, the competent transport association will send us the following personal data in advance every year:
    • Customer data of the buyer and/or user of the annual ticket: salutation, title, first and last name, address, country, date of birth (if available), e-mail address (if available), telephone number (if available), internal customer number with the transport association.
    • Contract data of the annual ticket including areas of validity: fare code of the annual ticket, number of the annual ticket, number of the primary ticket if applicable, number of the old annual ticket, first and last day of validity of the annual ticket, date of the last change of data.
    • The following data is provided by you yourself when you register: boarding station, exit station, bank details and number of an ÖBB customer card.
    • On this basis, we will calculate any compensation for delay, which will be automatically transferred to your designated bank account at the end of the period of validity of your annual ticket.
  • If you as a caregiver and nurse take a special train from Vienna (Schwechat Airport/Vienna Central Station) to Timisoara and back. In this case, BTU Business Travel Unlimited Reisebürogesellschaft mit beschränkter Haftung, the controller under data protection law, will provide us with the following data:
    • Information on the passenger (first and last name, date of birth, nationality and number of the travel document, place of origin/region in Romania and telephone number)
    • Details of the agency and representative in Romania (name and title, address, contact details)
    • Travel details (carriage and train number, seat number, date, departure and arrival railway station in Romania, departure/destination (city) from/to Romania, means of transport from/to Timisoara Nord railway station)

The data processed for these purposes is disclosed to the following categories of recipients as required and depending on the intended use, ensuring that data is only disclosed to the extent absolutely necessary as required:

To

  • the responsible bank / payment service provider for the purpose of secure payment processing in accordance with the legal requirements as well as the payment service provider's instructions or for the prevention or clarification of cases of abuse (for the purposes of contract execution, Article 6(1) b) and f) GDPR).
  • the regulatory authorities in the case of arbitration (for the purposes of complying with the provisions and rights under railway law, Article 6(1) c) GDPR).
  • the assigned legal representative in the event of disputes under civil law (based on our legitimate interests in defending legal claims, Article 6(1) f) GDPR).
  • the local, competent administrative authority responsible in the individual case (in particular also financial authorities, driving licence authorities, the Austrian Regulatory Authority for Broadcasting and Telecommunications or trade authorities) for the purposes of complying with legal provisions and entitlements, Article 6 Para. 1 lit. c GDPR.
  • the local, competent court responsible in the individual case or other authorities responsible in the individual case (based on our legitimate interests that exist in defence of legal entitlements, Article 6 Para. 1 lit. f GDPR).
Start of changes to the previous version
  • the competent executing contractors providing services in connection with a booked journey to the destination and/or at the destination itself (hotels, airlines, partner railways, bus or taxi companies or car rental agencies as part of an integrated mobility service, local organisers on site, etc.)
End of changes to the previous version
  • the competent executing contractors providing services in connection with a booked journey to the destination and/or at the destination itself (hotels, airlines, partner railways, bus or taxi companies or car rental agencies as part of an integrated mobility service, local organisers on site, etc.)
  • the visa-issuing authorities, as required in the course of long-distance journeys, in which case it should be noted that we provide the service of data collection and transfer to the competent authority in the individual case as a processor within the meaning of Article 28 et seq. GDPR. Visa and passport data are not automatically stored if the procurement of a visa forms part of the order placed by the data subject. Data storage is therefore usually carried out by the respective competent visa-issuing authority, which also assumes sole responsibility for the use of the data it stores.
  • the domestic or foreign partner railway, as the case may be, responsible for handling the compensation case or the mobility service or in connection with an international journey (for the purposes of contract execution, Article 6(1) b) GDPR)
  • the debt collection agency assigned by the controller for the recovery of outstanding debts based on our legitimate interests in the defence of legal claims, Article 6(1) f) GDPR).
  • the chartered public accountant for the purpose of auditing (for the purpose of complying with legal provisions, in particular the applicable corporate law regulations, Article 6 Para. 1 lit. c GDPR).
  • any affected cooperation partners, as the case may be, in the event of the sale of services provided by the cooperating partner by the controller (for purposes of contract execution, Article 6(1) b) GDPR).
  • to other companies of the ÖBB Group or other cooperating partners, in the event that you purchase or use a product or service provided by the parties mentioned above.
  • our commissioned data processors, if these process personal data on our behalf. (Based on our legitimate interests, in particular for the improvement, simplification and maintenance of our database systems, Article 6 Para. 1 lit. f GDPR).
  • The competent competition authorities for the purpose of conducting antitrust proceedings, on the basis of a legal entitlement or a legitimate interest (Article 6(1) c) and f) GDPR).
  • Bundesrechenzentrum GmbH, in the event that you purchase a special product for students from a transport association and an authorisation check is carried out for this purpose in the form of a data comparison (Article 6(1) b) GDPR)
  • Wiener Linien GmbH & Co KG for the purpose of verifying the validity of the ticket presented by the data subject in the event that the data subject disputes the accuracy of the penalty fare issued by our train attendants (based on our legitimate interests consisting in the defence of legal claims, Article 6(1) f) GDPR).

Our data processing is therefore carried out in particular based on the legal framework conditions summarised again below (as amended):

  • Regulation EU 2016/679 for the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation (GDPR)), in particular Article 6(1) a) (consent), b) (execution of contract), c) GDPR (legal entitlement or obligation), f) (legitimate interests) and (4) (processing for further purposes).
  • Regulation (EU) No. 1371/2007 of the European Parliament and of the Council of 23 October 2007 on rail passengers’ rights and obligations;
  • Federal Act on Rail Transport and Passenger Rights (Eisenbahn-Beförderungs- und Fahrgastrechtegesetz – EisbBFG)
  • Federal Unfair Competition Act of 1984 (UWG)
  • Trade Regulations of 1994
  • Directive (EU) 2015/2302 of the European Parliament and of the Council of 25 November 2015 on package travel and linked travel arrangements
  • Federal Act on Package Travel and Linked Travel Arrangements (Package Travel Act)
  • Code of Criminal Procedure of 1975, as required
  • Introductory Act to the Administrative Procedures Act of 2008
  • Administrative Penal Act of 1991
  • General Administrative Procedures Act of 1991
  • General Austrian Civil Code of Law for all German hereditary lands of the Austrian monarchy
  • Telecommunication Act of 2003
  • Federal Act on General Regulations and Procedures for Fees Administered by the Tax Authorities of the Federal Government, Regional States and Municipalities (Federal Fiscal Code, BAO)
  • Federal Act on Special Regulations of Civil Law for Companies (Austrian Commercial Code, UGB)
  • Fare Conditions and General Terms and Conditions of ÖBB-PV AG, incl. the Guide for travelling with ÖBB in Austria, as well as any other general terms and conditions, contractual agreements and obligations that may apply.
  • Terms of participation in the case of projects or special services.
  • Federal Act of 21 January 1959 on Liability for the Compensation of Damages from Accidents in the Operation of Railways and the Operation of Motor Vehicles (Railways and Motor Vehicle Liability Act; Eisenbahn- und Kraftfahrzeughaftpflichtgesetz – EKHG) Federal Law Gazette No. 48/1959 as amended.
  • Federal Act on distance sales and contracts concluded outside of business premises (FAGG) Federal Law Gazette I No. 33/2014 in this version Federal Law Gazette I No. 83/2015 as amended.
  • Federal Act of 8 March 1979 laying down provisions for the protection of consumers (Consumer Protection Act; Konsumentenschutzgesetz – KSchG), Federal Law Gazette No. 140/1979 as amended.
  • Federal Act on the Restructuring of the Legal Relationships of the Austrian Federal Railways (Federal Railway Act; Bundesbahngesetz), Federal Law Gazette No. 825/1992 as amended.
  • EU Directive on Payment Services in the Internal Market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No. 1093/2010, and repealing Directive 2007/64/EC (PSD2)
Start of changes to the previous version

The provision of the ÖBB ticket shop, the ÖBB ticket app, the complaints management system and other customer-relevant systems involves, among other things, the use of Microsoft Cloud Services and other Microsoft products.

End of changes to the previous version
Start of changes to the previous version

ÖBB companies, namely ÖV Ticketshop GmbH, 1020 Vienna, Lassallestrasse 5 on the one hand and ÖBB-Business Competence Centre GmbH, 1020 Vienna, Lassallestrasse 5 on the other hand, act as central processors. For the provision of technical services by our ÖBB processors, the use of Microsoft products involves transferring / disclosing data to Microsoft Ireland Operations Limited (Microsoft), 70 Sir John Rogersons’s Quay, Dublin 2, Ireland, whereby Microsoft itself uses sub-processors in individual cases for the provision of individual cloud services or the provision of Microsoft products, some of which are based in third countries.

End of changes to the previous version
Start of changes to the previous version

You can view the FAQs provided by Microsoft via the following link:

GDPR – frequently asked questions, Microsoft Trust Centre

End of changes to the previous version
Start of changes to the previous version

We do not intend to transmit personal data to an international organisation.

End of changes to the previous version

Storage period

In general, personal data are only stored by us to the extent that this is absolutely necessary and in principle are deleted following expiry of the statutory period of limitations under civil law of three years (e.g. customer correspondence) or in the case of invoice-relevant data, after ten years (e.g. booked tickets, customer cards) in accordance with § 212 UGB or §§ 132 et seq. BAO. A longer storage period is only implemented in justified individual cases, for example as a result of an ongoing civil law or regulatory dispute.

Specifically, we would like to emphasise the following various subject areas:

  • For invoice-relevant data based on other ticket purchases, the acquisition of customer cards, booked journeys, applications for reimbursement, fare recovery claims, including scanned ID cards, or the rental of a car, etc., such data shall be stored for a period of ten years. The longer storage period serves to ensure that ÖBB-Personenverkehr AG can fulfil its legal obligations to provide evidence in the event of a possible financial audit (§ 209 (5) BAO).
  • Other than this, we save data that can be assigned to you for a period of three years, such as customer correspondence, use of other services (e.g. mobility service, validation data, push services or any other service forming part of our integrated mobility offering), merely taking part in sweepstakes, campaigns or customer surveys.
  • We will record you as a test user or subscription customer, if you have specifically registered for this. In the event of unsubscribing, such data will continue to be stored for a period of three years.
  • We store timetable connections without tickets as long as you wish to see this information on your home page. If you delete it from the home page, it will also be deleted from our servers.
  • We will remember information relating to relevant tips and information displayed by our software for as long as your ÖBB account exists or until your browser history is deleted. This is the only way we can guarantee that we will not provide you with irrelevant tips or tips that are displayed several times.
  • Revocation of a declaration of consent or assertion of an objection to direct marketing pursuant to Article 21 et seq. GDPR (blacklist): deletion of this information may not occur, since we keep this as a negative list and thereby ensure precisely that you do not receive any advertising offers from us.
  • In order to create customised offers, data on mobility and usage behaviour from the last 24 months is used.
  • Data on the affidavit submitted by you will generally be retained and stored for three years, or as required until completion of the legal dispute.
  • Information to customers pursuant to § 20 (3) of the Railway Transport and Passenger Rights Act is retained for a period of 18 months.
  • Personal data that you have disclosed to us via the website for the purpose of handling personal injury or property damage shall be stored for a period of one year. A longer storage period shall only be implemented in the event of a longer lasting damage settlement (conducting legal or regulatory disputes).
  • Personal data that you disclose to our train attendants for the handling of personal injury or property damage, theft or other incident or concern will be stored for the duration of processing and for an additional three years until completion of case handling.
  • In the event that personal data is disclosed when using the chatbot / ÖBB.Bot, it will be stored for a period of 30 days.
  • Data processed based on a legal or regulatory dispute will be kept available for a period of 30 years and may only be inspected and processed by certain employees.
Start of changes to the previous version
  • In order to ensure the technical traceability of the transmission of customer communications, including troubleshooting, the email address, mobile phone number, time and subject of the transmission (without content data) will be stored in log files for a period of 21 days.
End of changes to the previous version
Start of changes to the previous version
  • In order to process customer enquiries relating to card printing, data relating to contract renewal requests will be stored for a period of three months by our service provider for printed matter (Paul Gerin GmbH & Co KG, A-2120 Wolkersdorf, Gerinstrasse 1-3) and will be deleted by the service provider at the end of this period.
End of changes to the previous version

Your rights

(1) Rights of data subjects

As the data subject in the individual case, you are entitled to assert the following rights of data subjects with us if we are the controller for the data processing:

a. Right of access (Article 15 GDPR)

You have the right to request information on which personal data are collected about you and held by us.

b. Right to rectification and deletion (Article 16 GDPR)

You have the right to rectify any incorrect data concerning your person (e.g. spelling mistakes).

c. Right to erasure (Article 17 GDPR)

You have the right for personal data to be deleted, provided such deletion is covered by the cases set out in Article 17 GDPR, for example if we were to wrongfully process data.

d. Right to restriction (Article 18 GDPR)

You have the right of a data subject to demand that the controller restrict the processing of personal data about you if the requirements under Article 18 GDPR are present.

e. Right to data portability (Article 20 GDPR)

You have the right of a data subject to receive the data provided by you in an interoperable format.

f. Right to object (Article 21 GDPR)

You have the right of a data subject to raise an objection to data processing, provided the requirements of Article 21 GDPR are present.

If you wish to assert a data subject right, please contact us. To do so, the following contact options are available to you:

Contact details customer service:

ÖBB Customer Service

(Subject: assertion of rights of data subjects)

Postfach 222

1020 Vienna

E-Mail: datenschutz.personenverkehr@pv.oebb.at

Please include the following information in your request:

  • A copy / scan of your official photo identification stating your date of birth (e.g. identity card, driver’s licence or passport) and
  • if you have an existing customer account, the email address registered with us.

We require this in order to verify your identity before we are able to answer your request or make the necessary arrangements. This verification of identity means that we can determine your actual characteristic as a data subject, so as to ensure that personal data is not disclosed to unauthorised third parties (risk of abuse).

Once we have received your request and you have proven your identity, we will respond to your request within four weeks.. In the event that we have specific questions as part of the reply, we will contact you and ask you to cooperate and assist.

(2) Complaint

Furthermore, you have the right to submit a complaint to the data protection authority, according to §§ 24 et seq. DSG [Data Protection Act] and Article 77 et seq. GDPR if you believe that we have breached obligations under the General Data Protection Regulation.

Contact data:

Austrian Data Protection Authority,

1030 Vienna, Barichgasse 40-42,

Telephone: +43 1 52 152-0

E-Mail: dsb@dsb.gv.at

www.dsb.gv.at

(3) Withdrawal of consent

If you have granted us your consent to the processing of your data for a specific purpose, you have the right to revoke your consent at any time without providing reasons. We have described the method for exercising the right of withdrawal in the Chapter “Direct marketing – General and personalised advertising offers”.

What personal data is essentially involved when you purchase a ticket or customer card from us online or avail yourself of any other of the services we offer?

With regard to your person we store the following data in particular:

  • Name
  • Date of birth if disclosed to us or if required for our products and services. If you store children as passengers, we will always ask for the date of birth. Given that the age limits are different for our transport association partners and international partner railways, this is the only way we are able to offer you the right ticket.
  • Age of the child, but always only for the current ticket purchase. As soon as you try to bookmark a child locally in the ÖBB app, we will ask for the date of birth. This is the only way the right ticket can be offered again for any subsequent purchase.
  • Colour for bookmarked passengers
  • Colour and personal data for ME, if indicated
  • Discount cards that you have disclosed to us
  • Number of a customer card if a card purchase can be assigned to your ÖBB account. We do not store such information for travel companions.
  • Assignment to a private ÖBB account or ÖBB business account
  • Assignment to a customer type (private or business customer)
  • In the business area: Assignment to a specific legal person or other third party
  • Passenger (adult/child/young person)
  • Information on journeys and mobility restrictions if you wish to save such information. This allows you to search automatically for transport connections for people with reduced mobility in your next ticket purchase
  • If you wish to deliberately bookmark family discount cards for transport authorities, we shall store them. We will also store relevant family relationships, allowing us to apply the family rate of the transport association to the next ticket purchase

We will store the following timetable settings:

  • Request for direct connections
  • Request for extended transfer times
  • Request for accessible connections
  • Request for exclusive use of train or regional train connections
  • Request for transport with option to carry a bike
  • Request for a timetable connection with an indication of an intermediate stop and requested length of stay at the intermediate stop

We store the following other settings:

  • Requested language
  • Request to receive a ticket automatically as a mobile ticket on your mobile device upon purchase
  • Animations on/off

We store the following data centrally:

  • Data concerning the shopping basket
  • Information on the frequent use of our website or app or
  • Information for suggestions on frequently searched connections.

All you need to know about ÖBB customer cards

We have a wide range of customer cards on offer. Whether you are looking to travel at reduced prices, explore Austria all year round without the stress, enjoy regular family excursions or travel for business purposes, there is a customer card to suit you.

When ordering an ÖBB customer card (Vorteilscard, Österreichcard), you will be required to provide your personal data. In particular, this includes personal details such as your name, date of birth and address and, in the case of a SEPA mandate, your bank details (IBAN and BIC). Providing a telephone number is optional and allows us to contact you if we have any questions. The above data will help us to personalise the customer card and are processed by ÖBB-Personenverkehr AG to complete your order. Entering your personal data is mandatory when ordering a customer card. Failure to provide the details mentioned above may result in you being refused a customer card (provision of a telephone number is optional).

Ordering online, via our ÖBB app or at the ticket counter is subject to the existence of an ÖBB account. This requires you to enter an e-mail address and password. This information will be saved. The existence of a customer account is necessary to ensure that a valid e-mail address is stored for the customer, as the e-mail address must be verified again for the creation of the customer account. This ensures that information relevant to the contract is sent to a valid e-mail address and customers can also identify themselves with this e-mail address when submitting requests for information.

Customer cards are produced by a reliable contractor. We take great care to ensure data are transmitted securely to the contractor. Data are exchanged in encrypted form only, and access to them has been reduced to the minimum necessary extent.

All you need to know about the validation of customer cards, as well as annual and other tickets, including boarding passes (Airrail passes)

Start of changes to the previous version

During the journey, our train attendants will validate (i.e. scan and check for validity) your customer card, digital discount products, physical or digital annual ticket and/or ticket or your boarding pass (Airrail pass), for which ÖBB-PV AG or one of our cooperation partners (e.g. Federal Ministry for Climate Protection, Environment, Energy, Mobility, Innovation and Technology (BMK)) is responsible. Due to the temporary recognition of tickets issued by Westbahn Management GmbH, these tickets are also validated by our train attendants.

End of changes to the previous version

When scanning, only those data are visible on the train personnel’s device which can be found on your customer card or the ticket (e.g. card number, card validity, name of card holder, card type and comfort class, departure and arrival time, train number, boarding and exit station). When travelling on a passenger train using an authorisation issued by Westbahn Management GmbH, the URL contained in the QR code and therefore the ticket code and ticket number are scanned. In the case of our customer cards, the date of birth of the card holder is also displayed on the train crew’s device in order to facilitate identification. Our train attendants also receive information on whether the customer card or ticket was valid at the time of validation. The following data is collected when your boarding pass (Airrail pass) is validated: Name, operating carrier’s PNR code (= order number), airport code, operating carrier’s designator (corresponds to the RICS code for railroads, i.e. the identifier of the transport company), flight number, date of the flight, compartment code (travel class) and the document form/serial number (= ticket number)

Scanning allows for an electronic control of cards and the ticket (as opposed to a purely visual inspection) and in particular makes it possible to withdraw manipulated or wrongly used tickets or cards (for example if the validity period has already expired) from circulation.

Moreover, data are collected for our train staff, i.e. which employee performed validation when, where and how. Our train attendants are only able to view validation data for a limited amount of time.

We do not automatically analyse possible movements of our customers. An evaluation of the existing data material is carried out in individual cases if a data subject should request this information as part of his or her request for information under Article 15 DSGVO.

Validation is based on two different legal principles of equal value, i.e. (1) on the contract of carriage concluded with you, i.e. Article 6(1) b) GDPR, and (2) on prevailing legitimate interests, as defined in Article 6(1) f) GDPR, which consist of the performance of a necessary authorisation check, removal from circulation of customer cards and tickets which are no longer valid, as well as preventing additional cases of abuse (general prevention) and compliance with contractual obligations. For the duration of the recognition of their tickets, Westbahn Management GmbH and Schieneninfrastruktur-Dienstleistungsgesellschaft mbH (SCHIG mbH) will pass on the following data for the aforementioned general preventive reasons: Train number, time of validation and details of the scanned QR code.

All you need to know about your customer account

Private ÖBB account

In order to use all functions of our website and app, you can register, and we will create an ÖBB account for you. This means you will use all your stored data independently of devices and browsers, and simplify and accelerate timetable queries and ticket purchase.

In order to create an ÖBB account, we will need at least the following information: e-mail address, password, salutation, your first and last name and your date of birth.

Following data entry and registration, you will receive an e-mail from us, to confirm your e-mail address and activate the ÖBB account. Once you have confirmed the activation link, your ÖBB account will be active. The next time you log on, existing local data will be transferred onto your ÖBB account if you consent to this process.

In order to make use of additional benefits for your ÖBB account or to buy a personalised product, such as a customer card, we need additional personal data from you, i.e. your date of birth and address, optionally also your title and phone number. This allows us to offer you products tailored to you. We will send your ÖBB customer card in credit card format by post and remind you of any renewal in a timely manner prior to expiry.

Your ÖBB account facilitates comfortable and quick ticket purchase without repeated data entry, by storing your payment data as favourite payment methods..

  • Your payment data will be stored by our payment service provider, who processes your payment data using the international PCI DSS standard. If you have stored several favourite payment methods, we recommend the last used favourite payment method for your next ticket purchase. Of course, you can change the method of payment during the ticket purchasing process.
  • You can delete bookmarked payment options at any time.

ÖBB business account

In order to use our business services (website and app), business customers can create a business account. For example, you can register your company as a corporate customer and we will create an ÖBB business account for you.

This allows you to use all your stored data independent of devices and browsers and simplifies and accelerates timetable enquiries, ticket purchases, company structure management and the report function.

It’s as simple as this: name an administrator from your area who will handle the initial registration. For an initial registration, we need at least the following information: e-mail address, password, salutation, your first and last name, company name, address and an industry selection.

After entering the data and registering, the named administrator receives an e-mail from us to confirm the e-mail address, initiate the plausibility check and activate the ÖBB business account. Only after a positive plausibility check will the payment on account and the business tariff be activated. As soon as you confirm the activation link, your ÖBB business account is active.

In order to use or manage further advantages of the ÖBB business account, we optionally need additional data, such as: the structure of the company, employee names, e-mail addresses, employee role authorisation, employee discount cards, etc. This enables us to offer your employees or other persons assigned to the ÖBB business account relevant products.

The ÖBB business account also enables a pleasant and fast ticket purchase without repeated data entry by adding payment data in the administration. Payment data will be stored by our payment service provider, who processes your payment data using the international PCI DSS standard. The stored means of payment can be deleted at any time by persons who have received the corresponding authorisations by you.

For existing business customers, ÖBB-Personenverkehr AG offers webinars covering customer safety at the station and on the train. ÖBB-Personenverkehr AG shows what the company does for the safety of passengers and demonstrates how customers can also pay attention to their own safety. In addition, the various options for travel insurance are presented and explained.

The invitation to the webinar, including the invitation link, is sent by e-mail to the e-mail address provided by the business customer. For the avoidance of doubt: this is a training and information event, and the webinar does not include any promotional content.

If you use the Wegfinder app provided by our partner iMoblity GmbH to book a service (e.g. to purchase a ticket to travel to a congress), iMobility GmbH will provide us with your name, date of birth, wheelchair yes/no, discounts, travel preferences, booking details and the organizer’s business account ID, so that we can issue the ticket.

The individual bookings as well as any payments take place in iMobility GmbH’s Wegfinder app. The data on CO² savings is compiled and made available to the respective organizer of the booked service without personal reference.

For selected partners (Easy Tex), the business account can also be used as a service for customers. For this purpose, the partner uses a business account, in which the booking and billing takes place. If the booking is made through an international partner, data will be exchanged as part of an international data transfer for the purpose of completing the ticket purchase within the meaning of Article 49 Para. 1 lit b GDPR. The data exchanged as part of the international data transfer has been limited to what is strictly necessary (this includes offer and order information, ticket information, billing information, passenger details).

For congress bookings, a separate booking area is created to which only a restricted group of users (organisers, participants as well as employees of the responsible parties) have access. The organiser receives a link and a TAN to the booking area created for the respective individual congress. The rights of access have been restricted so that neither the participants of a congress, nor the organisers themselves, nor participants or organisers of other congresses can access the information. Data is deleted two months after the end of the congress or finalisation of the accounts.

Start of changes to the previous version

If an organiser assumes payment for participants’ travel to a convention, the organiser will be provided with the relevant participants’ booking details (first and last name, dates of travel, costs) for the purpose of reviewing the invoice.

End of changes to the previous version

Personalisation

You have the possibility to personalise your ÖBB account, by bookmarking yourself as ME and choosing a colour for your profile. Your customer account will be displayed in the colour that you have personally selected with immediate effect.

In the event that you no longer want to use your ÖBB account, you have the option of closing the ÖBB accountagain.

  • Your registration will be cancelled and your access data, e-mail address and password deleted.
  • Depending on the intended use, some of this data may have to be stored for up to seven years (due to statutory requirements).
  • Once deleted, your e-mail address or customer number can be immediately used to create a new personal customer account.
  • Stored journeys and settings for the deleted ÖBB account cannot be restored.
  • Every new account is created using default system settings.
  • If you close your ÖBB account, we will advise you separately of stored future journeys for which you have purchased tickets. You can still close your ÖBB account. You will then receive purchased tickets via the link “Receive tickets” in your e-mail confirmation of purchase.

If you do not use your ÖBB account for longer than one year, we will automatically send a reminder to the e-mail address that you have disclosed. You will then have two weeks to log onto your ÖBB account. We can close your ÖBB account automatically if you fail to use this account for a longer period, given that in this case we assume that you no longer want to use it.

KlimaTicket Ö - Data sharing

The controller for the KlimaTicket Ö pursuant to Article 4(7) GDPR is the Federal Ministry of Climate Action, Environment, Energy, Mobility, Innovation and Technology (Ministry of Climate Action). You are invited to review all information on the subject of data protection via the following link to our privacy statement: https://www.klimaticket.at/

ÖBB-Personenverkehr AG provides a joint sales platform based on the One Mobility Act, Federal Law Gazette I No. 75/2021 as amended, in the context of which data related to ÖBB products (e.g. VorteilsCard, upgrades, reservations) as well as to the KlimaTicket Ö are processed. With the exception of the administration and use of common master data in the customer account, data processing is carried out separately.

The legal basis for this joint data processing is Art 6(1) e) GDPR in conjunction with Art 2(1) of the One Mobility Act. The performance of duties in the public interest lies in the creation of a joint distribution system for public passenger transport in order to facilitate access to the public transport network and thereby contribute to climate protection. Any person buying a KlimaTicket Ö or a product offered by ÖBB-Personenverkehr AG is subject to this joint data processing.

Regarding the ÖBB-Personenverkehr AG customer account and the KlimaTicket Ö-Webshop, a special feature is that customers have the possibility to log in to the KlimaTicket Ö web shop with the access data for their customer account with ÖBB-Personenverkehr AG. In this context, data processing is carried out by joint controllers pursuant to Article 26 of the GDPR.

The joint data controllers pursuant to Article 7(7) of the GDPR are

a) the Ministry of Climate Action for data processing in connection with the KlimaTicket Ö,

b) ÖBB-Personenverkehr AG for data processing and the sale of ÖBB products; and

c) One Mobility GmbH for the provision of non-discriminatory access to the joint distribution system pursuant to Article 2 of the One Mobility Act.

A limited amount of your customer data will therefore be processed as part of a joint customer base under the One Mobility Act, with the Ministry of Climate Action, One Mobility GmbH and ÖBB-Personenverkehr AG acting as joint controllers. The following master data is subject to joint processing:

  • Form of address
  • Name
  • Date of birth
  • Address
  • Photo
  • Contact details
  • Bank details
  • Card-related data

The purpose of this joint data processing is that

1. you as a customer only have to register your master data once in the joint sales system and

2. your master data only needs to be changed once with effect for all controllers

Master data is therefore always up to date for all data controllers. On the one hand, this allows for the realisation of possible synergies and improves the use of the distribution system for both customers and data controllers. On the other hand, this also ensures that all data controllers fulfil their obligation under Article 5(1) d) GDPR, according to which each data controller must take reasonable steps to ensure that data is accurate and up to date.

For this reason, the Ministry of Climate Action, One Mobility GmbH and ÖBB-Personenverkehr AG, as joint controllers for this data processing, have concluded a special agreement specifying which of them is responsible for which obligation under the GDPR.

You can exercise your rights as a data subject under Articles 15 to 22 of the GDPR with all three controllers, but you should preferably contact the controller with whom you have a contractual relationship. The processing is carried out by the Ministry of Climate Action and ÖBB-Personenverkehr AG with effect for all data controllers.

Notifications to the supervisory authority or to the data subjects pursuant to Articles 33 and 34 of the GDPR will be made by ÖBB-Personenverkehr AG with effect for all three controllers.

Contact details for submitting a request for information:

Ministry of Climate Action

datenschutz@bmk.gv.at

ÖBB-Personenverkehr AG

datenschutz.personenverkehr@pv.oebb.at

One Mobility GmbH

office@one-mobility.at

All you need to know about the ÖBB Ticket Shop and ÖBB App

We have set ourselves the goal of allowing you to:

  • easily use our Ticket Shop;
  • as a business customer easily make ticket bookings in relation to your respective company structure;
  • quickly receive your timetable and tickets;
  • only receive relevant information on your journey; and
  • gladly use our website and our app.

Our website shop.oebbtickets.at and our ÖBB app offer services customised to your personal needs, which simplify ticket purchase.

Transport association tickets can be purchased throughout Austria based on the timetable. In order to do so, simply enter the start and end point of the journey, and you will receive the right timetable and the associated ÖBB or transport association ticket. You can purchase tickets without needing to know all the individual fares in advance, be it for the bus, railway or tram.

for simple selection of the start and end point bookmarks your most recent entries. Your timetable query will therefore proceed more quickly the next time. Registered users can use this service on all sales channels and devices when logged in. Regardless of whether you book your journey on a computer on the Internet or using the ÖBB app on your mobile phone, with a logged-in ÖBB account we will store your last start and end point entries and offer you them for selection in your top station hits.

Recently searched timetable connections are provided for you in the future timetable search as a personal quick selection.

  • This means you are able to access your regular timetable queries for the next ticket booking without having to enter the start and end point of your journey.
  • If you make a timetable query, we will store the start and destination location (and the intermediate stop, if any) of your travel request for this purpose. In addition, we will store details on whether you have searched for a timetable connection for an offer for individual tickets or day passes, or for weekly or monthly passes, or for a seat reservation without a ticket.
  • This means that you can access your regular timetable queries for the next ticket booking, even without selecting the start and end point of your journey.
  • In this context however, we will not store your current location.

Using the function “bookmark person”.

  • you can store data for all persons with whom you regularly travel. This means you can quickly add them to your journey for the next ticket purchase. This saves you having to re-enter data, such as names or numbers of necessary discount cards for ticket purchase.
  • you can store data for all persons with whom you travel regularly. You can store the name, any discount cards and the date of birth of children and elderly people. This means you can quickly add these persons to your journey for the next ticket purchase without having to enter such data again. If you wish, you can also assign a colour to your passengers.
  • You can store data on your employees or other persons assignable to you and assign them to a business unit. This gives you a better overview of your accounting and makes it easier to book tickets for stored persons.

If you wish, when bookmarking your own travel data, you can then advise us that this person is you. We will then store this information for your next journey as ME.

  • With immediate effect we will give consideration to your “ME” for your future journeys in each bid preparation, with names, discounts, colour, and, if desired, date of birth.
  • Each new journey that you book automatically has “ME” as the passenger. Then all you have to do is add any other passengers.
  • If you ever buy a ticket for someone else, simply remove “ME” as a passenger for this journey.
  • If you have added a discount card, for example a Vorteilscard, to your ME, you will immediately receive pricing information, including the relevant discount, for your future timetable queries.
  • These data will be stored in the local memory of your computer or in the app if you use our applications without an ÖBB account.
  • If you have an ÖBB account and use our services while logged in, these data will be stored centrally and can thereby be used across sales channels.

We store the route for your ticket purchase. This means you can check whether the travel data have changed in the journey preview at any time. If we are aware of a different updated timetable, we will display this. We will delete the planned time from the timetable and replace it with the actually forecast time. We aim to keep you informed as far as possible at all times, allowing you to react to changes in travel data in good time.

Shortly before the start of the journey, the journey preview for your booking will become your personal travel companion. We will then advise you of the next relevant actions to your journey, for example: “Change trains in 10 minutes.”

You can always find the offer with the best price as the first offer on our website and in our app. If there is an additional offer for your travel request, which offers more flexibility in travel time or the refunding of tickets, we will advise you of this alternative. You can decide whether price or flexibility is more important to you for each journey.

You can cancel a purchase within 3 minutes of payment at shop.oebbtickets.at or in the ÖBB app. This is only possible if you have not yet acquired your travel card in the form of a ticket. You can subsequently return to the shopping basket and make retrospective changes to your purchase.

You can buy your ticket quickly with 2 clicks, by registering and storing your payment data in your ÖBB account. Set up a quick display of the requested offer on the home page and this function can already be used. We store your offer request for the requested timetable connection (e.g. best price, reservation request, requested travel class, number of passengers). Then, all you have to do is place it in the shopping basket with a click, and pay with a second click.

Store special timetable connections as favourites if you regularly travel on the same route with the same preferences. This includes:

  • Other passengers
  • Selected timetable filters, such as “only direct connections” or “changed transfer time”
  • 1st class journeys
  • Request for a seat reservation
  • Journeys on certain weekdays

We only bookmark these data at your intentional request. This favourite is located on your personal home page and allows you to directly display timetable or offer information with one click when opening the application, without having to indicate data again for the current purchase or timetable request.

If you place your favourites on the home page, we will store your travel request.

  • You can enter this connection info manually and thereby set timetable filters, passengers and notice days.
  • If you are registered, this connection info for your journey will be visible on all registered devices (regardless of whether mobile phone or Internet browser). This means you will find timetable data on your regular journeys on your home page whenever you open the app or website and you will quickly access the next timetable connections for your individual travel request.

But you can also store connection information as favourites for a specific timetable connection. In this case, you can use an additional practical service with location determination: “Only display if I am near the target destination and display the start if I am near the start location”

We also automatically create a selection for you based on your frequently searched and purchased routes and products, in order to allow you to make purchases faster. If you do not want a particular route or product to appear in this list, you can remove it by clicking on the options menu (three dots).

For a specific journey we always bookmark the name of the person printed on tickets. This means we can be certain that a ticket is not used several times by different persons with fraudulent intent. As a result, please carry your photo ID for the ticket with you, to allow train staff to check on the correct use of the ticket on site.

If you are travelling with children or young people, we will bookmark the age of the children. The children’s age limits differ in individual transport authorities and countries. Only if we know the age of your children can we determine the right price for the ticket purchase and create the best offer for you. We are obliged to store the date of birth for international travel.

We will provide you with all known information about your journey. In this way, you will have the most detailed and current information about your journeys and are able to respond to changes on time. Your travel companion in the ÖBB app and website has the latest information for you at all times:

  • where you have to transfer next;
  • how much time is left for transfer;
  • whether the timetable connection or
  • the platform has changed.

Your location information will only be used in the ÖBB app if you share it with us.

  • By switching on location services, you can save time in the timetable query.
  • This allows you to search for a connection from your current location.
  • f you have stored a timetable or offer favourite, and selected the option that you would like the return journey to be displayed to you based on location, we will only use your calendar in the ÖBB App if you share it with us.
  • If you enter your journey in the calendar, metable data for a booked journey will be imported into your calendar.
  • In order to do so, you will have to allow the ÖBB App access to your calendar in the device settings.

By payment information we mean information that we require for processing the payment. As a matter of principle, we will never store any payment information, such as credit or debit card numbers, expiry date, the card validation code (CVC) or user account and password data. We will only store payment information to a limited extent, namely

  • if we are unable to process a cancellation automatically and instead have to wire the cancelled amount subsequently (in such an event, we store the name of the applicant, IBAN, BIC, the name of the bank as well as the address (postal code, town/city, country, street and street number);
  • in case of a specific booking, we will store the payment method (PayPal) or card type (VISA, MasterCard, etc.) and the last 4 digits.

In all other cases, payment information (e.g. expiry date or the card validation code (CVC)) will be processed and used by a tested and certified payment service provider (Terminal Service Provider and Payment Service Provider).

In order to handle the payment process, we employ tested and PCI-certified payment service providers who process and use the payment information (e.g. CVC code or expiry date) to complete the booking. Data will be processed only for the purposes of completing payments on certified payment terminals (e.g. ticket vending machine, ticket counter, etc.) or at shop.oebbtickets.at or via the ÖBB app. These payment service providers are usually independent entities and therefore process your data in accordance with their own privacy policy.

In order to clearly authorise a payment, the payment service provider will require various pieces of information from us, such as e.g. identification data for browser and operating system type, which are saved by us and forwarded to the payment service provider for processing the payment.

The European Banking Authority (EBA), Regulatory Technical Standards (RTS) and the revised Payment Services Directive (PSD2) prescribe strict authentication methods for combating online fraud. PSD2 aims at preventing online fraud with strict customer authentication rules applied to an increased number of transactions.

o-called Strong Customer Authentication (SCA) is an obligatory part of PSD2 and ensures a high level of customer protection and increased payment security. SCA is therefore required whenever you, the customer, start an electronic payment process or perform a transaction that poses a risk of payment fraud or other misconduct. In this case, you will be required to complete an identification process by providing a password and another identification factor as determined by the payment service provider. In certain exceptional cases, this authentication can be dispensed with. The decision to apply SCA or dispense with authentication rests with the payment service provider.

We are required to provide the payment service provider with the relevant data requested in order to secure your payment transaction.

More information on this can also be found on the payment service provider’s own website.

For the purposes of payment risk management, as required in the specific case and as part of the purchase transaction, personal data may be transmitted in the absolutely necessary extent to the payment service provider, which then uses this data to conduct a risk assessment. Payment-related data will also be consulted for anonymised analyses.

The ÖBB App is distributed via the Apple App Store and the Google Play Store (hereinafter referred to as “Store”). Inclusion, distribution and use of the ÖBB App is therefore additionally subject to the separate conditions of these two stores, over which we have no influence, and which are compiled and asserted at the sole responsibility of the stores.

When using our website shop.oebbtickets.at or our ÖBB App, data on your ticket purchase will be stored by Html storage in the web browser or in local storage on your mobile phone. This ensures that all functions, such as “bookmark person” or personalised fast selection can also be used if you wish to use our software without registration. We will only store personal data for quicker processing of future purchases if you wish us to do so.

We would like you to learn the full scope of functions of our software. For this purpose, we have made sure that you will receive practical tips and information from us at an appropriate spot. We want to provide you with relevant information and not continually repeat this. This is why we store functions used by you for a maximum period of 18 months. As a result, you will always receive the right (not yet known to you) information in different web browsers and on different devices with the ÖBB App.

If you do not want us to store this information about your person, use our website or our ÖBB App without logging on. This means we will not be able to assign this information to your person.

Even if we store this information about your person, we will not conduct any personal analyses. We shall only use this information in anonymised form to identify any need for adjustment in our systems. This allows us to continually improve our applications and provide optimal support to our customers.

Start of changes to the previous version

App support: When you submit an enquiry by email (oebbapp@pv.oebb.at) or via the “App Support” link, the following information is collected in order to process your enquiry: Name, e-mail address, support ID, device type, app version

This information is required to identify, reproduce or resolve your specific problem in the system. The data will be deleted as soon as it is no longer required for the purposes for which it was collected, at the latest after 6 months.

End of changes to the previous version

All you need to know about our Nightjet travel connections

We have set ourselves the goal of allowing you to:

  • use our booking site Nightjet.com easily,
  • quickly receive your timetable and tickets for night trains;
  • only receive relevant information on your journey; and
  • enjoy using our Website.

Our website Nightjet.com offers services customised to your personal needs, which simplify the purchase of tickets. For example, this website uses GeoLite2 data provided by Maxmind. This data uses your IP address to determine approximately from which country you are accessing the website in order to predefine the country of departure when displaying connections under the menu item “Destinations” as well as the country code when booking a ticket in order to increase your user comfort. No personal data is stored during this procedure.

The first offer you will find on our website Nightjet.com is always the one with the lowest current price available. If there is an additional offer for your travel request that offers more flexibility regarding travel time or ticket reimbursement, we will make you aware of this alternative. You can decide whether price or flexibility is more important to you for each journey.

For a specific journey we always bookmark the name of the person printed on tickets. This means we can be certain that a ticket is not used several times by different persons with fraudulent intent. As a result, please carry your photo ID for the ticket with you, to allow train staff to check on the correct use of the ticket on site.

If you are travelling with children or adolescents, we will bookmark the age of the children. The children’s age limits differ in individual transport authorities and countries. Only if we know the age of your children can we determine the right price for the ticket purchase and create the best offer for you. We are obliged to store the date of birth for international travel. Nightjet.com only asks for the children’s exact date of birth when booking a pre-connection and/or onward connection.

We will provide you with all known information about your journey. In this way, you will have the most detailed and current information about your journeys and are able to respond to changes on time. Your travel companion in the ÖBB app and the Nightjet.com website has the latest information for you at all times:

  • where you have to transfer next;
  • how much time is left for transfer;
  • whether the timetable connection or
  • the platform has changed.

You can find detailed information on data processing for the purpose of payment processing via Nightjet.com under the heading “All you need to know about the ÖBB Ticket Shop and the ÖBB App” in the payment information section.

On the nightjet.com website, only technically necessary cookies that serve to ensure the usability of the website are used.

Ticket sales by third parties (via external booking platforms)

We have expanded our distribution channels for you. This means that you can now also find our connections on partner platforms and can, in part, also book your ticket directly on the platform of our partner. If the booking is made through a partner, we exchange only the schedule and ticket information with the partner that is required for the creation of the ticket. The respective partner is responsible for the protection of the data processed on the partner platform of the partner.

All you need to know about the ÖBB mobility services

ÖBB Transfer

In certain municipalities throughout Austria you can book a fast and comfortable shuttle service to your destination (ÖBB Transfer). The ÖBB Shuttle Service picks you up directly from the train station, takes you to the accommodation selected during the booking process (e.g. hotel, spa) and also takes you back to the train station on your day of departure.

When booking a ticket for a specific train journey (i.e. booking a ticket to your destination and back), you will automatically be offered the ÖBB Transfer Service if this service is available at your destination. If you would like to avail yourself of this service, you can book it together with your train ticket as part of a booking process. Detailed provisions concerning the ÖBB Transfer can also be found in the Guide for travelling with ÖBB in Austria.

You will receive an email with the exact times and locations for the shuttle’s departure and arrival after the purchase is completed as well as prior to the journey.

The driver of the transfer vehicle (bus or taxi company) will be waiting for you at the station or, in case of return, in front of the selected accommodation. The transfer service is provided by our cooperating partners (currently Österreichische Postbus AG).

In order to use this transfer service, the following data is collected during the booking process: first and last name, place of collection and destination, number of persons to be transported, data for validation, price and chosen method of payment, e-mail address. wheelchair, dog, bicycle (to determine whether or not the transfer service allows for the transport of a wheelchair, dog or bicycle).

In order to provide the transfer service, the required data will be passed on to the cooperating partner (currently Österreichische Postbus AG) in the case of a booking and by the cooperating partner to the third party providing the service (e.g. local taxi companies at the destination) in the event that the cooperating partner does not provide the transfer service itself.

For the purpose of providing the transfer service, ÖBB-Personenverkehr AG will pass on the following data to Österreichische Postbus Aktiengesellschaft:

  • Name of the person making the booking
  • Booking number of the order
  • Coordinates and desired time of the trip
  • Train number for the train on which the passengers are arriving/to which the passengers are to be taken
  • Number:
  • Persons
    • incl. date of birth for registered customers
    • incl. notional date of birth for seniors and children
    • incl. discount card
      (for price calculation)
  • Wheelchair (to determine if the transfer service allows for the transport of a wheelchair).
  • Dog (to determine if the transfer service allows for the transport of a dog).
  • Bicycle (to determine if the transfer service allows for the transport of a bicycle)

Österreichische Postbus Aktiengesellschaft provides the transfer service booked by you via its partner companies. In this context, the following data is provided to the taxi company by Österreichische Postbus Aktiengesellschaft:

  • Name of the person making the booking
  • Train number for the train on which the passengers are arriving/to which the passengers are to be taken
  • Number of persons
  • Fare incl. information “Paid”, as it was booked via the ticket shop
  • Booking reference
  • Pick-up location (name of the station or hotel, address and position on map)
  • Pick-up time
  • Arrival point (name of the station or hotel, address and position on map)
  • Arrival time

ÖBB-Personenverkehr AG (as far as the train service is concerned) as well as the individual cooperating partner or the third party commissioned by the cooperating partner (as far as the transfer service is concerned) shall carry out this service under their own responsibility under data protection law. As a consequence, you must in particular exercise your claims/rights under data protection law (e.g. a request for information under data protection law) against ÖBB-Personenverkehr AG as well as against the respective cooperating partner and commissioned third parties.

If you wish, we will also be happy to forward enquiries to the cooperating partner or to the commissioned third party.

Rail & Drive service

In order to enhance the mobility chain within Austria, ÖBB Rail&Drive cars are made available at selected ÖBB train stations. This car sharing offer is available to all registered ÖBB Rail&Drive customers.

To register, please use the ÖBB Rail&Drive website https://www.railanddrive.at/ The verification process can then be completed at selected sales offices of ÖBB-Personenverkehr AG (i.e. ÖBB ticket counters, ÖBB travel agencies and ÖBB lounges). The applicable sales offices are published on our website and can be accessed via the following link: https://www.oebb.at/de/reiseplanung-services/am-bahnhof/last-mile.html Alternatively, you can also carry out the entire registration process at these locations. For this purpose we provide computers and tablets at selected sales points. This allows you to start the registration process and/or complete the verification process on site. Disclosure of the following information is required to use the Rail&Drive service: driving licence data, first name, last name, address, date of birth. Please make sure that you are able to verify the information you have provided by means of appropriate evidence on site. In particular, it must also be ensured that the driving licence issued to the customer in question was issued in a Member State of the European Union. A physical and/or digital copy of the driving licence is made on site. The collected data is kept for a period of one week and then deleted or destroyed.

ÖBB-Personenverkehr AG will forward the collected data and documents electronically to Rail Equipment GmbH & Co KG, which is responsible for this service under data protection law. In this case, ÖBB-Personenverkehr AG acts as the processor for Rail Equipment GmbH & Co KG.

Your data protection claims with regard to the ÖBB Rail&Drive service must therefore be asserted against Rail Equipment GmbH & Co KG.

Contact details:
Rail Equipment GmbH & Co KG
z.Hd. Datenschutzbeauftragter
Operngasse 24/4,
A-1040 Vienna
info.railanddrive@oebb.at

The data collected at the point of sale is recorded by the data controller, Rail Equipment GmbH, in its own data processing systems and used for the purpose of providing the service. Further information on the use of data can be found in the data privacy statement of Rail Equipment GmbH & Co KG (available at https://www.railanddrive.at/de/datenschutzerklaerung).

Service for daytime users and commuters (use of rental vehicles)

To improve the commuter situation and make it easier to access public transport and the related economic benefits, we want to do our part to protect the environment and manage resources sustainably. That is why we hire vehicles and make these available to daytime users and commuters as part of a ‘Sharing Model’. They are made available to a limited group of users, and exclusively to persons who are named and authorised in relevant user contracts.

Daytime users can use the vehicle during the day on workdays. In contrast, commuters are authorised to use the vehicles on workdays in the early and evening hours and at weekends and on public holidays.

In addition to personal data (such as name, address, phone number), the duration and data for usage authorisation, ID data (driving licences, proof of ID), data relevant to payment, data on damage caused and traffic violations will be stored in respect of the daytime user or commuter.

The daytime users / commuters will be sent the respective other party’s user data in order to ensure handover of the vehicle. The data to be exchanged have been restricted to the absolutely necessary extent, i.e. name and phone number. We have explicitly prohibited the use of such data for other purposes in the contracts.

Corporate mobility and shared mobility (ÖBB 360)

As a part of ÖBB 360, ÖBB-Personenverkehr AG, together with its subsidiary iMobility GmbH, offers a service for employees of companies.

Public transport, taxis, sharing services and micro-public transport throughout Austria can be booked using the “wegfinder” app provided by iMobility GmbH. This is an information and booking platform for a wide range of mobility services as alternatives to private cars.

The service offered under ÖBB 360 can be used for business and private purposes.

During the booking process, the employee selects whether it is a private trip or a business trip.

Settlement is made either by private credit or debit card or by the means of payment provided by the employer: “Mobility budget” and/or “Travel expenses”. In order to be able to make use of the “mobility budget” and/or the “travel expenses” options, the company must be linked to the employee’s wegfinder profile.

The mobility budget is a monthly amount provided by the employer at the beginning of each month in the form of vouchers on the wegfinder account. For all bookable mobility services in the app, users have the option to select either the mobility budget for private journeys or the “travel expenses” payment method as the means of payment for business journeys.

The respective company is also provided with your CO2 footprint for the trips made on a monthly basis.

The employer does not receive any information related to employees’ private mobility behaviour, in particular with regard to which means of transport were used for which routes for private purposes. Your employer can only see how much CO2 an employee has saved with the mobility budget they have made available.

ÖBB-Personenverkehr AG and iMobility GmbH each process personal data as independent data controllers pursuant to Article 4(7) GDPR.

ÖBB-Personenverkehr AG processes the following data:

Data collected on the company: company name incl. VAT number and company register number, address data, country, monthly invoice amount, customer number and contact person.

Data collected on the employee: e-mail address

Please be advised that ÖBB-Personenverkehr AG has no insight into the specific bookings of the individual mobility services. Booking and data processing for the mobility services used takes place in the app offered by iMobility GmbH, which operates it under its own responsibility. Further information on this topic can be found in the Data Privacy Statement, which you can access via the following link: https://wegfinder.at/datenschutz/

Start of changes to the previous version

On our website, you have the opportunity to submit enquiries about corporate mobility and shared mobility via a separate input screen, and to opt in to receive information, news and offers by email, phone and text message.

End of changes to the previous version
Start of changes to the previous version

In particular, the following data will be used: Company, title, first and last name, telephone number, e-mail address and federal state.

You may withdraw your consent at any time

  • by sending an email to businesskonto@pv.oebb.at,
  • by using the unsubscribe link in any mailing or
  • by calling a Key Account Manager

.

End of changes to the previous version

Provision of mobility services for persons with restricted mobility

We can organise optimal assistance for you at the station upon free advance notice at ÖBB customer service, at the ÖBB ticket counter, or at an information point at the train station. Please let us know about your desired journey in good time (see https://www.oebb.at/de/reiseplanung-services/barrierefrei-reisen/mobilitaetsservice.html).

We require the following data for advance notice: (1) first and last name and address; (2) phone number for queries and communications; (3) journey date, route (departure/transfer/arrival station); (4) disclosure of whether you are travelling with a companion or luggage; (5) type of mobility restriction (wheelchair user, walking disability, visual impairment, other restriction); (6) disclosure of whether any aid is required (lifting device, railway wheelchair,...); (7) disclosure of the meeting point at the station; and (8) carriage and seat number.

Data on a provided service will be stored by ÖBB-Personenverkehr AG on a national level for a maximum period of three years and subsequently automatically deleted in order for data to be available in the event of customer queries.

In the event of cross-border journeys, data are transferred to a database provided by the International Union of Railways (UIC, Union internationale des chemins de fer), to which only relevant partner railways (partner operators) have access for handling the mobility service. This is intended to ensure that appropriate assistance is provided at an international arrival station or stations by the responsible international partner railways (partner operators). The provision of a cross-border mobility service was agreed internationally within the framework of a separate agreement. In particular, the scope of data disclosed in the individual case and the intended use were restricted to the extent that is absolutely necessary. In order to provide a cross-border mobility service, the following data will be disclosed and stored in the UIC database until completion of the journey: journey data, title, first and last name, e-mail, language, type of mobility restriction, aid, other significant information, e.g. companion or service dog, luggage, date of birth in the individual case, depending on the destination. The above data shall therefore be deleted immediately following completion of the journey in the event of cross-border journeys.

Luggage service

In combination with a ticket, you can make use of a luggage service for normal luggage items as well special baggage for journeys within Austria (see fare regulations).

The booking can be made through our company (i.e. at the ticket counters or by phone via the customer service). We are at your disposal as a contact for our cooperation partner (GO! Express & Logistics GmbH, 1230 Vienna, Pfarrgasse 81).

The cooperating partner shall perform this service at its own responsibility. In order to allow the cooperating partner to perform its logistical service, the following data - assignable to you - shall be disclosed to such a partner for the performance of the service, which you communicated to us when booking this service: first and last name, telephone number, e-mail address, pick-up and delivery address, date, time and time window of pick-up and delivery.

If you wish, we will be happy to pass on complaints and other queries to the cooperating partner as required.

ÖBB bike services

As part of ÖBB Bike, ÖBB offers two products: ÖBB Bike:Rental (longer rental for day trips) and ÖBB:Bike Sharing (short-term rental for short distances).

The processor Digital Mobility Solutions GmbH, Vaalser Str. 17, 52064 Aachen, Germany, provides a web-based administration backend (MoQo platform) for the digitalisation of the bicycles and the operational processing of the bike rental service.

Bike rental takes place via the Wegfinder app provided by our cooperation partner iMobility GmbH, Weyringergasse 5/B4, 1040 Vienna, which provides this service under its own data protection responsibility. You can view our cooperation partner’s privacy statement via this link: https://wegfinder.at/datenschutz/

Kirchberg in Tirol is an exception. Here, the separate ÖBB Bike App must be used, for which the data controller employs Business Competence Centers (BCC, Business Compentence Center GmbH, Erdberger Lände 40-48, 1030 Vienna, https://bcc.oebb.at) as a processor.

The rental relationship is established between the respective bike rental service and the operator. You can review the operator’s respective rental conditions in the Wegfinder app and in the ÖBB Bike App.

Prior to first-time use, an account must be created in the ÖBB Bike App or in the Wegfinder app and a means of payment must be registered. In the respective app, select a location, a date and a bike, accept the General Terms and Conditions of the respective bike rental service operator and rent the bicycle. Invoicing is carried out after the bike has been returned to a rental location via ÖBB-Personenverkehr AG, if the ÖBB Bike App is used, or via iMobility GmbH, if the Wegfinder app is used.

Data that is stored

  • Date and time of account creation
  • First and last name
  • Date of birth, if you disclose this to us
  • Discount cards that you have disclosed to us
  • E-mail address
  • Mobile telephone number
  • Postal address
  • Number of bookings made
  • Date of last booking
  • Data of assigned promotion codes, incl. data on utilisation
  • Details of the service used (for example, date and time of the start of the booking period, date and time of the end of the booking period, date and time of the start of rental, date and time of end of rental, date and time of booking, date and time of cancellation of booking (if cancelled), vendor with whom the booking was made, type and size of vehicle booked, price of booking, model of vehicle booked, pick-up location, drop-off location, duration of rental, additional features booked (optional, insurance only)).
  • Declared consent to the GTC
  • CO2 savings from booked services
  • Payment details
  • Invoices issued by the provider of a service

In the event of a booking, data will be forwarded to the respective bike rental service operator.

The respective bike rental service operators can be found on the ÖBB website via the following link: https://www.oebb.at/de/reiseplanung-services/sharedmobility/oebbbike

The data is also transferred to our processors:

  • MoQo platform: Digital Mobility Solutions GmbH, Vaalser Str. 17, 52064 Aachen, MO.Point – Mobilitätsservices GmbH, Niederhofstrasse 30 / 11, A-1120 Vienna
  • ÖBB-Business Competence Center GmbH (Erdberger Lände 40-48, 1030 Vienna, https://bcc.oebb.at).

Differentiated deletion periods (between 1 year and 10 years, depending on the respective reason for storage) have been defined based on factual aspects. The deletions are carried out independently by the processor. In deviation from this, data may only be stored for a longer period in individual cases if there is a special reason for such storage (e.g. civil court proceedings).

Rental of a bicycle parking space

Customers have the option of renting a bicycle parking space by the month or for an entire year via an app. The bike room can be opened/closed via the app (smart door control) using a QR code. Customers will be informed by email / app prior to termination of the rental agreement.

Note: For this service, the controller uses the processor JUHUU BikeBox GmbH, which in turn uses processors located outside the EU. In particular, the processor uses Google Cloud Platform for its cloud computing services and has concluded the necessary data protection agreements and standard contractual clauses with Google Ireland Limited, with registered office at Gordon House, Barrow Street, Dublin 4, Ireland and Google LLC, with registered office at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

For sending e-mails, the TÜV-approved processor Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin is used, whose processors have either concluded EU standard contractual clauses or have a server location in the EU.

The following personal data will be processed in the context of bike rental services

  • The user’s e-mail address incl. password
  • Full name of the user
  • Telephone number
  • Invoice address data (optional): Country, street, house number, postcode, city
  • Chosen payment method: Apple Pay or credit/debit card (payment is processed via a certified payment service provider).
  • Permission to use the camera: No photo or video material is stored. The camera is only used to scan the QR code.
  • Permission to access the user’s location. The location is processed by JUHUU servers in order to find locations of ÖBB and other providers in the vicinity. After processing, the user’s location is deleted again. The location is never associated with the user
  • Rental period incl. correspondence (notice of end of rental agreement, information regarding the settlement of the agreement)
  • Special authorisations with regard to the rental relationship (duration, price, etc.)
  • Rental fees charged
  • Information on damage caused

Differentiated deletion periods (between 1 year and 10 years, depending on the respective reason for storage) have been defined based on factual aspects. The deletions are carried out independently by the processor. In deviation from this, data may only be stored for a longer period in individual cases if there is a special reason for such storage (e.g. civil court proceedings).

All you need to know about online consultations with ÖBB travel agencies and the app dates at the ticket counter

We are introducing a new service for you with immediate effect: Consultation and sales talks are now also conducted online.

This procedure not only offers a good alternative for persons with restricted mobility, but also allows you to use the travel agency service of ÖBB-PV AG without restrictions from wherever you are.

Even if the sales and consultation meetings are held online, we will not record any of the conversations.

Online consultations in travel agencies are only provided at your request and are not mandatory. For this purpose, you have the option of booking an online consultation at https://reisebuero.oebb.at/ (registration for appointment). Registration generates an email that is delivered to the inbox of your selected branch.

In the event of an app date at the ticket counter, your registration will be sent by email to an internal central coordination unit for appointment management.

The following data is collected as part of the registration for an appointment at a travel agency: First and last name, e-mail address, telephone number, date on which an appointment is requested, requested branch, time window and comments. This data is used exclusively for online consultation and the sale of travel products.

The following data is collected as part of the registration for an appointment at a ticket counter: First and last name, e-mail address, telephone number, date on which an appointment is requested, requested counter, time window, type of operating system (Apple or Android), areas of interest and comments. This data is used exclusively for on-site consultation.

All you need to know about the Schulcard webinar

ÖBB-Personenverkehr AG offers webinars for Schulcard customers, in which questions about booking with the Schulcard are answered and topics such as rail & environment, safety at the station and the range of offers for youth group travel with ÖBB are discussed.

Customers have the option of booking a webinar through a form (registration for appointment). The invitation to the webinar, including the invitation link, is then sent by e-mail to the e-mail address provided by the Schulcard customer. The webinar is only provided at your request and is not mandatory.

Registration generates an email that is delivered to the Schulcard Management inbox at www.schulcard.oebb.at.

The following data is collected as part of the registration for an appointment: First and last name, e-mail address, school, date on which an appointment is requested, requested time window. This data is used exclusively for the purposes of the webinar.

All you need to know about other services

Scotty timetable information including push services (app/web)

General

Our timetable information service SCOTTY mobile and web offers you the opportunity to obtain information about timetables, stations or the current transport situation of ÖBB trains and several other transport operators. With the door-to-door timetable information you can query the fastest route from A to B throughout Austria and use other services. Moreover, additional relevant information is available, such as data on station or train equipment, as well as the opportunity to store journey data in your own calendar.

Data storage

SCOTTY mobile and web is a service which can be used without registration. This service is therefore generally anonymous, because storage of your contact data, location data, calendar entries, query results, etc. is not carried out by ÖBB. The only exception is if you make use of our push notifications. As a result, ÖBB cannot and will not use data for any other purposes. Your query results remain completely anonymous and will not be stored, meaning that we cannot and do not create user profiles.

How does SCOTTY mobile function from a technical perspective?

An active Internet connection is required for the installation of SCOTTY mobile on your device and to communicate with our information server, which calculates connection results for you. Depending on the operating system, the authorisation to use the Internet for this is referred to as “data services”, “Internet” or “access to all networks”

Depending on the operating system used, certain platforms (e.g. Android) display standardised security information as required by the operating system when first installing SCOTTY mobile or using the app. However, this explanatory information (e.g. reading confidential information, such as call records) does not refer to SCOTTY but to the operating system’s general default settings and therefore cannot be modified by ÖBB.

In order to allow you to use all functions of SCOTTY mobile, it is necessary to grant further rights, allowing for access to specific data for your device. You can revoke the application’s rights individually at any time. Depending on the operating system used, you can deactivate them yourself in the security or systems settings.

In detail, depending on the operating system used, the granting of the following rights is explicitly requested by SCOTTY mobile:

Contact data: These will only be used to display the transport connection to or from a contact from your address book. Only city names, roads and house numbers are transferred. We will not store (nor cache) such data.

Position or location data: Your current location can only be identified for an optimal connection search by SCOTTY mobile if you wish, in order to search for travel connections from there or to find stations nearby. No caching is carried out, either, and as a result the creation of movement profiles, etc. is not possible.

Movement and direction sensor, compass function: This function makes it easier to search for stations nearby. We will not store (nor cache) such data.

Calendar: SCOTTY mobile offers you an additional service to store travel data for your connection in your device’s calendar. This service is not compulsory, but is determined at your personal discretion. Depending on the operating system, the related security information “Read calendar dates and confidential information” or “Add or change calendar dates without the knowledge of the owners and send e-mails to guests” relate to this function. However, the actual contents of the calendar will not be read.

Amend or delete USB memory contents: This access is only required if you wish to store SCOTTY mobile on the SD card.

Install links: This right is necessary in order to create shortcuts for connections and departure boards.

Read call list: This right is required by the Android operating system by default if address data can be read from contacts. Information in the call list, however, will not be read by SCOTTY mobile.

Photo, music and video libraries: This right is required for technical reasons in order to create live tile graphics (cards). No private data is retrieved in the process and no data that would be visible for other apps is written onto your device.

Camera: Frecord photos and videos: this right is required in order to use augmented reality. No photos or videos will be stored.

Notifications: This right is required to receive and display push messages (e.g. information on delays).

How does the “Notifications” function in Scotty mobile and web work?

A push notification is available to you both with Scotty mobile and with Scotty Web.

Registration

  • Scotty mobile: in order to set up the push notification, simply search - as usual - for your connection and then click on the “Notifications” button. You will then receive a corresponding push message on your Scotty mobile app.
  • Scotty Web: you can order an e-mail notification via Scotty Web by selecting a connection and clicking under “Details of the connection”. You can find the “Notifications” button there under the selected connection. After entering your e-mail address, we will send push notifications to your disclosed e-mail address.

As a result, you can decide whether or not you wish to use the function.

Notifications are completely free of charge to you. We will inform you if we have the necessary information on delays, changed departure platforms, risky connections, train cancellations or deviations and recommendations for the connection selected by you. As soon as there is any change to your connection, you will receive a push notification, provided we hold such information.

Unsubscribing:

In addition, you can deactivate push notifications again at any time.

  • Scotty mobile: you can delete your services in the “Manage notification” area or deactivate them for a specific period.
  • Scotty Web: any deviation notification shall be furnished with an unsubscribe link for this purpose, by means of which the service can be cancelled.

If you use the “Notifications” function, identification parameters, travel connection data, device IDs, relevant intervals and your e-mail address are stored in Scotty web. Data are stored in case of one-off notification, as long as the selected connection is valid. If you have repeatedly set notifications on certain days, data shall be stored for as long as repeated notification is requested by you.

Scotty mobile analytical service

In the event of app usage, it records user activities without the option to draw conclusions on a specific person. The anonymous analysis helps us to further improve the app and adapt it in a targeted way to the needs of our customers. If you still do not request this analysis, you can deactivate the analysis in the app (see menu item “Settings” → “Record anonymous user activities”).

The analysis is conducted via an anonymous user ID, which does not allow for traceability or an opportunity to draw conclusions about the identity of a specific person.

Google Firebase Analytics is not used in our analyses and has been deactivated by us.

Statutory information pursuant to § 20 (3) of the Railway Transport and Passenger Rights Act

We are legally obliged to inform our passengers about any breakdowns, about activities that are expected to result in breakdowns such as delays or train cancellations from transport services and the anticipated impacts. In case of personal bookings, such as reservations, there is an enhanced information obligation for other information technologies, where contact data are known to us.

As a result, prior to the start of your journey, we will send you an e-mail or text message notification, regardless of whether you have registered for a push service, in the event of a ticket booked online or on a mobile device with a fixed departure data and time, if at the time of booking the timetable for the connection is not yet fixed and therefore the departure and/or arrival time of the booked train can still change and we are aware of new travel information. In the event that you have made a booking via customer service or at a ticket counter, you will only receive a notification if you have disclosed your e-mail address to us.

If you have booked a Nightjet connection, we will inform you by telephone in the event of any changes – provided that this is now possible. Therefore, a telephone number is a mandatory requirement when making a booking.

However, such notifications shall be issued at the earliest 180 days before the booked start of the journey.

If you no longer wish to receive such notifications for a journey, you can simply cancel further notifications by clicking on the link “Cancel notification” in the e-mail notification “New travel information on your booking”. In the event of a cancellation, you will not receive any notifications by e-mail or text message after technical implementation.

For the purpose of statutory customer information, we also receive data from other railway companies, ticket vendors and transport association organisations for the purpose of providing notifications regarding deviations.

If customers book tickets where the transport service is provided by a third party railway company, we will pass on the relevant data to the competent railway company so that you can be notified by the respective railway company in the event of any deviation.

For the purpose of notification, the following personal data will be processed by the data controller, if disclosed by you:

First and last name, e-mail address, telephone number, details of the timetable connection (departure stop, destination stop, date and departure time/arrival time, train number).

If you have booked a ticket for a EuroNight train on Swedish Railways SJ (Stockholm – Hamburg), we will pass on the following data that you have provided during the booking process to Swedish Railways: first and last name, e-mail address, telephone number, booking and reservation data. This ensures that Swedish Railways, which provides the rail service, is able to notify you directly of any deviations. This also ensures that, where applicable, you receive the legally required information pursuant to Article 6 Para. 1 lit. c GDPR from all railway companies involved.

Further information on how Swedish Railways handles data can be found at the following link: Terms and Conditions of Data Protection – SJ

ÖBB Alexa Skill on Amazon

Using the ÖBB-Alexa Skill on Amazon, you can search for train connections or query departure information from railway stations (departure board).

Connection information contains detailed information on the journey, including the train number, duration of journey, platforms and the lowest currently available price. You can find further details on the functions of ÖBB-Alexa Skill in the description of the skill on Amazon.

The ÖBB-Alexa Skill can only be used to query connections, pricing and other ÖBB information. Connections of other transport operators are not covered by this service.

In the course of use of the ÖBB-Alexa Skill, no personal data of customers are collected and used by ÖBB-Personenverkehr AG. The ÖBB-Alexa Skill is used anonymously. ÖBB has no knowledge of whether you use the ÖBB-Alexa Skill or which queries you make to the ÖBB-Alexa Skill, because ÖBB is unable to establish any personal reference to you.

In order for the service to be used, certain technical data are collected by ÖBB-Personenverkehr AG, which do not allow for any conclusion to be drawn on your person:

  • Date and duration of use
  • Queries to the ÖBB-Alexa Skill (e.g. timetable connection)
  • Error reports in the use of the ÖBB-Alexa Skill

Only those technical data which are necessary to allow for the use of the ÖBB-Alexa Skill are forwarded to Amazon by ÖBB.

In order to protect your data, the data transmission from ÖBB to Amazon or from Amazon to ÖBB is encrypted by TLS 1.2.

Data collected and processed when using the ÖBB-Alexa Skill are stored for a period of one year and automatically deleted following the lapse of this period. Access to data has been reduced to the extent that is absolutely necessary.

Onboard portal Railnet & Railnet Regio

If connected to WiFi on your train (“OEBB”), the ÖBB onboard portal offers passengers access to service functions related to the train and the journey, to the ORF-TVthek (ORF TV library) as well as free access to over 100 digital Austria Kiosk newspapers and magazines, among other things.

In order to use the WiFi and the onboard portal with all its functions, you as the user must agree to the terms of use when connecting to the WiFi. The terms of use also inform you about the use of cookies on the ÖBB onboard portal.

Cookies are used by the onboard portal in order to allow for the provision of a comprehensive and customer-friendly service. Cookies are used for the following functions: journey preview, ORF TVthek, data analysis by Piwik (Matomo).

When using the ÖBB onboard portal, no personal data about customers will be collected and used by ÖBB-Personenverkehr AG. Therefore, the use of the ÖBB onboard portal is anonymous.

Use of Google Maps and Apple Maps

Google Maps /Apple Maps are online map services, which show the earth’s surface as a roadmap or an aerial or satellite image, on which locations of institutions or known structures are also displayed.

We use Google Maps for the following purposes:

  • To select routes on the home page https://www.nightjet.com/
  • To display sights on city pages (for example at: https://www.nightjet.com/reiseziele/oesterreich/innsbruck.html)
  • To display connections on country pages (for example at: http://www.nightjet.com/reiseziele/italien.html)

We use Google Maps and Apple Maps to display stops near you when using the SimplyGo! feature.

For these purposes, “Google Maps JavaScript API” or “Google Maps SDK for Android” is used. No personalisation is implemented and no cookies are set by Google Maps-API.

Services provided by our various chatbots

In addition to telephone enquiries or requests via the contact form provided on www.oebb.at, you also have the possibility to use our chatbot / ÖBB.Bot. ÖBB.Bot is at your disposal for information and services regarding various topics:

Start of changes to the previous version

a) Information on the subject of passenger rights (further details available at https://www.oebb.at/de/reiseplanung-services/kundenservice/refundierung-chatbot)

b) Information on the Klimaticket Ö (further details available at https://www.oebb.at/de/reiseplanung-services/kundenservice)

c) Information on the Vorteilscard (further details available at https://www.oebb.at/de/reiseplanung-services/kundenservice/vorteilscard-chatbot)

d) Information on ÖBB 360 and our mobility offers https://www.oebb.at/de/reiseplanung-services/sharedmobility/mobilitaetsservices)

e) Information regarding feedback and support (ÖBB Support.Bot) https://www.oebb.at/de/reiseplanung-services/kundenservice/beschwerde-lob-idee

f) Information on our Nightjet offer (ÖBB Nightjet Bot)
https://www.nightjet.com/

End of changes to the previous version

Our ÖBB.Bots are text-based dialogue systems that allow you to chat with a technical system for standard enquiries and routine tasks.

This offers you a further option to get in touch with us quickly and easily. Your request can also be processed faster.

When you use the ÖBB website and the ÖBB.Bot embedded on the website, personal data will be automatically collected to the extent absolutely necessary for technical reasons (i.e. the IP address and device information) if the ÖBB.Bot is only used for information purposes and you do not disclose any additional personal data. In this case, data is processed on the basis of Article 6 Para. 1 lit. f GDPR (legitimate interest of ÖBB-PV AG, which consists in the provision of relevant customer information and the technical provision of the website) as well as on the basis of Article 6 Para. 1 lit. b GDPR, i.e. to process your request.

In the case of pure product information, no customer data is required by us and no such data is therefore collected. Only if you use ÖBB.Bot for data changes, for questions regarding the execution of contracts, or for the assertion of passenger rights or other rights will data – if this is required in individual cases to process your request – be collected and processed to the extent absolutely necessary.

If you wish (consent), a transcript of your chat can be made available to you at the e-mail address you have provided. Alternatively, you can download your chat transcript during the session. This consent is limited in time and only relates to your current enquiry, so that separate consent will be obtained for any subsequent enquiries. This consent can be revoked by closing the chat window.

Should data collection or disclosure be necessary, the following data that is required to process your enquiry in accordance with Article 6 Para. 1 lit b GDPR may be collected, depending on the reason and subject of the enquiry:

Start of changes to the previous version

Enquiries via the ÖBB-Bot regarding passenger rights: First and last name, full address, e-mail address, full bank details, ÖBB ticket codes, subject of the enquiry and the documents provided by the customer.

End of changes to the previous version
Start of changes to the previous version

Enquiries via the ÖBB-Bot regarding customer cards: First and last name, date of birth, complete address, e-mail address, telephone number, card number, period of validity, subject of enquiry.

End of changes to the previous version

Enquiries via the ÖBB-Bot regarding the Klimaticket Ö: first and last name, date of birth, complete address, e-mail address, telephone number, type of customer card, card number, period of validity, complete bank details, ÖBB customer number, ÖBB ticket codes and the subject of enquiry.

Start of changes to the previous version

Enquiries via the ÖBB-Bot on ÖBB 360 and the Nightjet are handled as a pure dialogue system. No customer data is collected. In the event that your request cannot be answered, we will provide you with the contact details of the respective mobility provider. In this case, we have no knowledge of the content of your coordination with the respective mobility provider.

End of changes to the previous version

For enquiries to the ÖBB Support Bot: First and last name, e-mail address, subject of the request and, if necessary for the processing of the request: Bank data, address data, ÖBB ticket code, transaction number, personal message

In ÖBB.Bot itself, this data is available for 30 days and will be automatically deleted following the lapse of this period. Depending on the subject of the request, these will be deleted in the downstream systems after the applicable statutory retention obligations have expired (i.e. either after three years or after ten years). This is due to accounting regulations, limitation periods under civil law or for reasons of preserving evidence.

As part of the development process for new bots, customers have the opportunity to test the chatbot in advance at the controller’s premises. This test is done anonymously. Neither responses nor other feedback are attributed to a specific customer. These tests are solely for the purpose of improving the service.

SimplyGo! function in the ÖBB App

As an additional function in your customer account, SimplyGo! makes it easier to buy tickets. Using GPS location services and smartphone sensors, SimplyGo! automatically detects your journey by public transport. This is also known as automatic ticketing.

Wherever your journey takes you within Austria – we offer you another way to get your ticket with the SimplyGo! function in the ÖBB App. Based on GPS location services and smartphone sensors, this automatic ticketing function autonomously recognises the journeys you have made. Apart from checking in at the start of your journey and checking out when you arrive at your destination stop, SimplyGo! takes care of all the other process steps involved in a classic ticket purchase for you. Depending on the distance travelled, the trip is automatically charged to your credit / debit card.

In this context, it is mandatory to obtain the following information from customers who voluntarily activate the SimplyGo! function in their customer account:

Mandatory disclosure at activation

  • First and last name
  • Date of birth,
  • E-mail address used for the customer account,
  • Federal state and
  • the data that you yourself have stored in your customer account.

The following data is automatically collected by the controller during use:

  • operating system of the mobile device incl. device ID, model of the mobile device,
  • start and end time of a journey,
  • automatically detected or manually selected check-in stop,
  • check-in time,
  • automatically detected check-out stop,
  • check-out time (active or passive),
  • start and end time and total duration,
  • GPS location data along the travel route,
  • WiFi access points,
  • GSM location data,
  • accelerometer data,
  • means of transport used,
  • any discounts on file,
  • assigned journey ID
  • assigned tracking ID

This is used to determine reference values and points that help identify the start, course and end of the journey. The ÖBB App assigns a valid public transport timetable to this mobility behaviour and determines the fare.

For technical reasons, we require iOS devices to “always” grant permission to access the location. This is important so that ongoing journeys can also be recorded in cases where the ÖBB App is only running in the background.

Pseudonymised data is transferred to our data processor FAIRTIQ AG Aarbergergasse 29 3006 Bern Switzerland for the further development of SimplyGo! functionality. Our data processor itself is not able to establish a personal connection to you.

Further information on how data is used in the context of ticket purchases, validation, the customer account as well as the storage of customer cards in the ÖBB App, can be found in particular in the sections “Everything related to my customer account”, “Everything related to the ÖBB ticket shop and the ÖBB app” and “All you need to know about the validation of customer cards, as well as annual and other tickets, including boarding passes (Airrail passes).”

If a payment method is registered for the SimplyGo! function, we will store payment information for a period of 12 months, including in the event that the function is deactivated, for the purpose of processing any required corrections.

Data collected as a result of the use of our automatic ticketing will be deleted at different times:

1. Data relating to the processing of ticket purchases (incl. responses to customer enquiries and validation data) will be stored for the duration of the statutory limitation period of three years.

2. Accounting data must be retained for a period of ten years due to statutory retention requirements (§ 209 (5) BAO).

3. In addition, other data relating to the implementation of the pilot operation and the beta phase were available in a personalised form for a period of 6 months after the end of the overall project in order to implement the necessary improvements, in particular to the algorithm, and to subsequently prepare for regular operation adapted to customer requirements.

4. Collected data will also be used for the defence of legal claims (for example, fraud cases) and stored for a period of three years from the legally binding conclusion of the legal or regulatory dispute.

All you need to know about our pilot projects

General

We conduct pilot projects under our own responsibility in order to improve our services and our product portfolio, in which our customers may participate on a voluntary basis.

Bike sharing

Stationary bike rental for tourists via the BIKE TIROL app

Customers can book and pay for bicycles with Inn-Bike GmbH via the BIKE TIROL app.

The data controller is Inn-Bike GmbH (Salurnerstraße 2, A 6330 Kufstein, Tel: +43 (0)5372 63547, e-mail: info@inn-bike.at

ÖBB-Personenverkehr AG acts as a contract data processor by providing a sales platform for bicycle rental. This sales platform is operated by the contract partner Mo.Point - Mobilitätsservices GmbH, Niederhofstraße 30/13, A-1120 Vienna, www.mopoint.at or Digital Mobility Solutions GmbH, Vaalser Str. 17, D-52064 Aachen, ttp://moqo.de.

Various companies participate in this cooperation, in particular:

  • ÖBB-Personenverkehr AG as the provider of the sales platform,
  • ÖBB-Infrastruktur AG: Provision of space
  • Inn-Bike GmbH: Provision of the infrastructure (e-bikes, bike lounges, locking systems)
  • Tirol Werbung: Advertising in cooperation with ÖBB PV

Direct marketing - General and personalised advertising offers

General and customised electronic offers

We use personal data in order to send you general information, offers and recommendations as well as information, offers and recommendations tailored specifically to your mobility needs and user behaviour or to have such information sent to you by our cooperating partners (customised offers). Furthermore, this data is used for the further development and optimisation of services relevant to customers. However, this is only the case if you grant your consent in advance to let us contact you by e-mail, telephone, SMS or other ÖBB channels (e.g. ÖBB account), in order to inform you in a timely manner about interesting offers, new developments and services.

Your personal data will exclusively be used by us in both cases and not transferred to cooperating partners or other affiliated companies.

Depending on the content of the consent granted by you, you will receive offers and other information from us concerning ÖBB-Personenverkehr AG (for example on general services, sweepstakes and customer surveys) and the ÖBB Group, i.e. including other affiliated companies (e.g. information on travel offers from Rail Tours Touristik GmbH or car sharing offers from Rail Equipment GmbH) or other cooperating partners.

If you wish to receive customised information and recommendations adapted to your needs (based on your previous purchasing and travel behaviour or your other personal preferences), we can forward these to you for:

  • our products and services;
  • current or individually tailored offers;
  • vouchers;
  • sweepstakes and campaigns;
  • customer surveys;
  • relevant services (in particular information on the ÖBB account and our apps);
  • product and travel recommendations (including travel insurance and additional offers for tourists); or
  • other customer loyalty activities.

The compilation of these contents is based on evaluation of the following data: first and last name, date of birth, address and contact data, details stored on your person regarding bookings, customer cards and season tickets, discounts, travel and voucher data, geodata, preferences and customer loyalty activities associated with you, device and browser information, including user behaviour assignable to you or data on any mobility preferences or restrictions.

Details on booking data include, for example, your selected travel date and time, the actual booking date, booked tickets or special additional offers for tourists, seat reservations, information on utilised offers or vouchers added to your account, information on the start and end station, the sales channel, selected timetable connections including intermediate stops, train types, wagon classes or compartments, information on booked night or day trains, currency used, vehicle data, bicycles, accompanying dogs, information on booked pieces of luggage, as well as information on whether you are travelling alone, with other people or with a child (or children).

In order to provide you with customized information on customer cards and season tickets, we use details of valid/expired/extended customer cards, such as Vorteilscard [discount card], Österreichcard [Austria card] and any SEPA mandates, as well as details of acquired season tickets, e.g. hourly passes, weekly passes, monthly passes.

By discount data, we mean your discounts used in buying tickets, such as indication of a Vorteilscard, Österreichcard, city transport ticket, family pass, etc.

Travel data  include information on already commenced or planned (booked) journeys, information on the duration of your journey, any delays, validation details regarding your ticket or your customer card, as well as details of such journeys referred to under booking data.

If (e.g. in the context of a campaign) a voucher was added to your ÖBB account, we will use such information to deliver reminders to you about its use, for example. Moreover, we will use the information once the voucher has been cashed, as well as details of the journey booked or the product purchased with such voucher.

Geodata are used for so-called location-based services. Location-based services provide you with selective information by means of position-dependent data.

By preferences assigned to you we mean, for example, your connection favourites, your stored payment favourites, timetable connections stored by you (including other passengers, selected timetable filters, 1st class journeys, request for a seat reservation, journeys on specific weekdays).

Customer loyalty activities include information and further details on previously sent sales and campaigns, vouchers, sweepstakes, customer surveys, recommendations and other information.

Device and browser information including user behaviour assignable to you includes information on your employed devices (computer, laptop, smartphone, etc.) with which you visit our websites and the associated web browsers (e.g. Internet Explorer, Firefox, Safari, etc.). This also includes information on whether you have downloaded and used the ÖBB App. Your assignable user behaviour includes, for example, details on the use of your ÖBB account with relevant devices and the ÖBB App (e.g. account creation details, settings implemented, such as e.g. gender and language, details of logins, added discounts and customer cards, deposited vouchers, ticket purchases and reservations, stored favourites, etc.). In addition, technical information (e.g. IP address, browser type and version, time of access by the visitor’s computer) is collected in order to determine whether an e-mail has reached you, which e-mails you have opened when and which links in the e-mail you have accessed.

We use data on any mobility preferences or restrictions in order to offer you relevant information, recommendations and services in the event of you needing a wheelchair place or if a companion or service dog is travelling along, etc.

We use the technologies of Emarsys eMarketing Systems AG (Märzstraße 1, 1150 Vienna, www.emarys.com), which acts as our contract processor, to create and send out customised offers. Emarsys supports us in the planning, implementation and analysis, especially in the technical implementation and handling of our measures, as follows:

  • The functionality of Emarsys Smart Insight allows us to tailor customised offers based on the history of your individual purchasing behaviour. Your data is analysed and categorised using mathematical-statistical methods (eRFM scoring parameters) in order to recognise typical purchasing behaviour patterns and to be able to tailor our information, offers and services to your individual interests.
  • Our contract processor’s technology furthermore enables us to evaluate the use of our e-mail newsletters. Among other things, we receive information as to whether an e-mail has reached the recipient or has been rejected by the server. For the evaluation, the software uses a so-called tracking pixel (web beacon), which is retrieved from the Emarsys server when the e-mail is opened. The analyses also include determining whether our newsletters are opened, when they are opened and which links were clicked. In the process, technical information (e.g. IP address, browser type and version, time of access by the visitor’s computer) is collected. These evaluations help us to recognise our recipients’ reading habits and to adapt our content to reflect these or to send different content in accordance with our recipients’ interests.

This type of data processing also involves profiling as per Article 4 No. 4 GDPR, to the extent that it concerns the preparation and sending of customised offers.

Profiles are created about our customers, which

  • allow conclusions on the probability of their future purchasing, booking and usage behaviour,
  • allow for target group selections and aggregated or concrete evaluations regarding products and services.

Our general and customised offers can be sent by mail, e-mail, as a push message, in your ÖBB account or via other ÖBB channels.

This special form of processing is based on your consent in accordance with Article 6(1) a) GDPR, to the extent that we are entitled to carry out such data processing.

We use profiling methods to optimise and personalise our advertising measures. Below, you will find information on the logic involved as well as on the scope and intended effects of these procedures.

  • In order to optimise and personalise our advertising measures, we create customer profiles and use these customer profiles to assign customers to specific customer segments. Based on this segmentation, we can control the type, content and frequency of certain advertising measures for specific target groups.
  • For profiling, we use data that we receive from you within the scope of our customer relationship, provided that you have given us your consent for “Newsletter, Info & Service”. Address and contact data, purchase, booking and travel data, information on customer cards and season tickets, discount data, data on mobility preferences and usage data. Profiling can be based in particular on user profiles derived from usage data, which we create with the customer’s consent by measuring and evaluating the customer’s interaction with electronic advertising, in particular by measuring and evaluating the opening and click rate in e-mail newsletters.
  • An important factor in the establishment of our customer segments is the so-called scoring, in which we evaluate customers according to scientifically recognised mathematical-statistical procedures based on aspects relevant to advertising.
  • The scope and impact of customer segmentation based on profiling is limited to target-group-specific management of the type, content and frequency of our advertising measures and the level and value of potential incentives. This may result in you receiving or not receiving certain measures which may or may not be made available to other customers.

Special additional services and offers

You also have the opportunity to register for special offers and services, for example for the Nightjet newsletter, Scotty push service or information on usability tests.

Please note that any of these services which require separate consent must also be revoked separately. As a result, revocation of any individual consent does not apply automatically to all additionally submitted declarations of consent, but they must also be revoked separately.

Advertising sent by post

If we are aware of your address due to purchases and services, or we are allowed to buy it from third parties (e.g. from Österreichische Post AG), we can send you event-driven information, offers and recommendations by post. You can prevent the sending of such information at any time, by declaring your objection (see explanations below). Following receipt of an objection, we will no longer send you any other announcements.

Postal deliveries will also be made to our stakeholders at regular intervals, for example prior to the annual timetable change as well as ad-hoc for relevant subjects.

Please note that the annual invitation to renew the contract does not constitute a direct advertising measure. Based on existing contractual obligations (see our GTC [General Terms and Conditions] for the Vorteilscard or Österreichcard), we will also continue to send you this invitation to renew the contract, and even if you had exercised your right to objection, especially as such a consignment is not subject to the right of objection to direct marketing.

Revocation of granted consent and objection to direct marketing

If you no longer wish to be included in our direct marketing activities, you have the right to file an objection thereto (Article 21(2) and Article 22 GDPR) or to revoke your previously granted consent. The following options are available for you to make these declarations:

  • If you have declared your consent electronically, you can then declare revocation under “My account/ newsletter, info & service” in the ÖBB account.
  • In a newsletter, simply click on the unsubscribe link and we will stop sending you electronic mail in the future. It may take up to 24 hours for the activation of a revocation to be completed in the systems.
  • In all other cases, please contact our ÖBB customer service using the contact form at www.oebb.at/kontakt.

If you have exercised your right and decided against any use of your personal data for advertising purposes (in particular direct advertising), in accordance with your request, you will not receive any information, offers and news and can no longer log onto your ÖBB account for our “Newsletter, Info & Services” service.

If at a later point in time you wish to reactivate our services in your ÖBB account under “Newsletter, Info & Service”, please contact our customer service at

ÖBB Customer Service

(Subject: Newsletter, Info & Service)

Postfach 222

1020 Vienna

Anonymised data analysis

Statistical analyses shall be conducted for the following purposes in particular:

  • Are functions used regularly in our software? This allows us to check on whether specific functions are important for users of our website or app
  • Which tickets are purchased? This allows us to check on whether our product portfolio meets the demands of our customers.
  • Does navigation comply with the behaviour of software users? This allows us to check on whether we can design the purchase process in a way that is more agreeable for our customers.

We also create anonymised data analyses, in which we evaluate personal data and information about age, gender, region, postcode, products, driving, purchase and user behaviour, in order to draw conclusions on the development of new products and services or to improve our existing service portfolio.

Market and opinion research, customer surveys

Start of changes to the previous version

Market and opinion research, customer surveys

In order to improve our products and services and adapt them to the needs of our customers, we conduct surveys with various target groups:

1. with persons who do not use the railway

2. with persons who use a railway company (regardless of which one) or

3. with persons who use ÖBB.

We use different methods for this:

1. We commission a market research company to carry out a survey.

2. We carry out the surveys ourselves, usually using an online tool, or

3. we or an independent third party conduct an anonymous survey on our passenger trains.

Persons to be surveyed can be selected either completely randomly or based on social statistics or usage-specific factors.

Contact with the participants is established in different ways:

1. Contact is made via the respondent pools of the commissioned market research company (in this case, the selection is made without our involvement and under the sole responsibility of the partner companies).

2. We invite interested persons in general, without individually addressing participation in the survey.

3. For certain survey topics, we also contact selected customers of ÖBB PV AG if they have given us their prior consent.

End of changes to the previous version
Start of changes to the previous version

The survey results never contain any personal references. This is true even if we write to you directly as customer or you have declared your consent in advance to participate in a survey. We only receive or compile an overall evaluation of data, which do not show individual interviews or persons.

End of changes to the previous version
Start of changes to the previous version

If we address our customers directly, we will then exclusively contact people who have given prior consent thereto.

End of changes to the previous version

Should we conduct the survey in cooperation with a market research company in specific cases, we shall conclude a separate confidentiality agreement with said company in advance of a customer survey, laying down the secure handling of your data specifically for the individual case. In particular, this agreement shall ensure that the company will not transfer your data to other market research institutions and other third parties for surveys for their own purposes.

Start of changes to the previous version

If we use our online survey tool, this tool is provided by our service provider enuvo GmbHt, Huobstrasse 10, CH-8808 Pfäffikon SZ https://www.enuvo.ch . We have instructed our processor to use privacy-friendly default settings when using this tool:

1. The use of Google Analytics has been disabled.

2. IP addresses are collected in a privacy-friendly manner by not storing them in conjunction with the survey data. IP addresses are only stored temporarily in server log files. This is done for technical reasons to ensure the functionality and security of the survey tool. Server log files are routinely deleted within a few weeks.

3. Only session cookies and technically necessary cookies are used. These cookies are necessary for the continuous processing of survey participation and also to minimise the possibility of multiple participation.

The following information is collected for the sole purpose of this survey: IP address, browser user agent and session details (started, last updated, completed, duration, subject).

The above data will be deleted after a period of one year at the latest.

You can stop participating in the survey at any time by closing the browser window. In this case, data will only be transmitted until you exit the survey.

End of changes to the previous version
Start of changes to the previous version

In any case, you are never obliged to take part in any of our customer surveys.

End of changes to the previous version

Usability tests

If you apply as a test user, you can take part in usability tests conducted by our company for the further development and improvement of our ticket and timetable tools. Each test is subject to separate conditions of participation (see website). In this case, we will contact you as a possible test user and request your participation in future tests. Naturally, your participation in each individual test is voluntary.

You are entitled to revoke your consent at any time and declare that you no longer want to be contacted for further tests.

Cookies, web analysis and social media

Use of cookies

Cookies are small text files or codes, which contain information units. These text files are stored on your hard drive or in the main memory of your browser if you visit one of our websites. Thanks to cookies, the contents of our websites can be structured more easily and devices on which you have previously visited our websites can be identified. We use cookies to gain a better understanding of the functioning of applications and websites and to analyse and optimise the user experience when using our websites online and on mobile devices.

The cookies we use also allow us to display travel suggestions on the home page based on the customer’s queries and bookings.

Cookie categories

We primarily use cookies from the following categories on our websites:

Operationally necessary cookies

These cookies are necessary to allow you to use our websites as intended and make all functions available to you. Without such cookies the requested services cannot be provided. These cookies do not record information about you and do not store Internet locations. Absolutely necessary cookies cannot be deactivated on our site. However, they can be deactivated at any time on the browser that you use.

Functional Cookies

These cookies are necessary for certain applications or functions of the website, allowing them to be duly executed. This may for example include cookies, which store implemented settings such as a visitor’s language setting or even – assuming your prior consent – pre-completed forms.

Storage period: in the event of a session cookie for the period of the session, or in the event of your prior consent for the period of your consent.

Analytical cookies

These cookies collect information on user behaviour for visitors to our websites. For example, a record is kept of which websites are most frequently visited and which links are clicked on. All recorded data are stored anonymously together with information for other visitors. Using data obtained by these cookies, we can compile analytical evaluations on our website using Piwik and thereby continually improve the user experience.

Storage period: in the event of a session cookie for the period of the session, in all other cases (for example for our web analysis service PIWIK) for a maximum three years.

Preference cookies

These cookies allow us to display travel suggestions on the home page based on the customer’s queries and bookings.

First party cookies

First party cookies are generated by the website operator whose site the user is visiting. These are stored locally on the user’s computer. With a first party cookie, the user can only be recognised by the site from which the cookie originates, but not across multiple domains.

Third party cookies

Third party cookies, also called tracking cookies, are a common means of marking a visitor to a website so that they can be recognised at a later point in time.

These are data records that are stored in the user’s browser when they visit a page with advertising.

Third party cookies are used to monitor a user’s browsing behaviour over a longer period of time, including without explicit registration by the user on a website and across multiple web offerings, and to provide advertisers with useful information such as:

  • User navigation via links
  • Time spent on different sites
  • Different page views and frequency of views

Currently, we only use first party cookies which are either

  • technical in nature and are absolutely necessary for the ticket shop to function, or
  • technically necessary for a customer feature (display of the most recent searches for easier/accelerated purchase for frequently searched journeys (see also explanations in the Section “All you need to know about the ÖBB Ticket Shop and ÖBB App”)).

3rd party cookies are not used.

How long are cookies stored on my device?

The time that a cookie stays on your device depends on whether it is a persistent cookie or a session cookie. Session cookies only remain on your device until your browser session is finished. Persistent cookies remain stored on your device, even after you have completed a browser session, until such time as the preset time for the cookie has expired or it has been deleted.

For consent-based cookies, we retain a consent and revocation history for a period of three years.

Withdrawal of consent

The website provides a revocation option that you can use if you wish to withdraw your consent. Should you have any questions, please don’t hesitate to contact our customer service.

PIWIK (Matomo) web analysis

Our websites and digital dialogue with our customers (e.g. newsletter) use Piwik, a web analysis service. Piwik uses cookies, which allow us to conduct an analysis of the use of our websites.

For this purpose, the usage information generated by the cookie (including your truncated IP address) is transferred to our server and stored for usage analysis purposes. This helps us in optimising our websites. During this procedure, your IP address is immediately anonymised, so that you remain anonymous to us.

The information generated by cookies on the usage of our websites is not passed on to third parties.

You can prevent the use of cookies through according settings in your browser software. This may, however, result in your not being able to fully use all functions provided by our websites.

If you do not agree to the storage and analysis of data in relation to your visit and the use of our websites, you can object to such storage and usage at any time (see terms of use for the website www.oebb.at). In this case, a so-called opt-out cookie will be stored in your browser. As a result, Piwik will not collect any session data.

For technical reasons, we have to collect and store certain data and information of your visit to our website, for instance the used websites, the time and duration of your visit as well as data provided by the browser you are using (e.g. on the operating system and the used system settings). Such data and information is used by us anonymously to allow us to make our offerings even more participant-friendly and to technically optimise them.

Should you provide personal data or information on our websites, we can continue to use them within the framework of the legal requirements of TKG [Telecommunications Act] without your further consent. An exception is the use for advertising or marketing purposes or forwarding data to third parties, which requires prior and separate consent. We will separately inform you about any communications to other ÖBB affiliated companies (e.g. in the event of a concern, complaint, etc.).

Should you access such offerings on our websites or visit these websites, the data provided by your browser will be transferred to the respective operator. We are not responsible for any contents on these websites, neither in terms of data protection nor in terms of the technical security of the data and information made available. In this context, please note that external providers may use ad personalisation technologies where required.

In case we provide a way to contact us via an input form on our website, we will encode this communication via the https protocol. Please note that other types of communication over the internet, in particular via e-mail, do not provide confidentiality. We therefore recommend to refrain from sending confidential data and information via e-mail.

Social media

Social media plugins

We have embedded contents from external providers, such as Facebook, YouTube, Twitter, on individual websites or we may transfer you to the websites of external providers. We could not identify any legal violations at the time of linking. Should we become aware of any such infringement, we will remove the link with immediate effect. In order to be able to recommend and share content on social networks such as Facebook, Twitter and Google+, corresponding buttons are integrated into the platform.

These buttons only transfer data to external providers or other third parties if you press the corresponding button as participant. We have prevented an immediate transfer of data to external providers or other third parties in case of mere access to our websites. As a result, it is completely up to you to activate transfer in the individual case.

Sweepstakes on social media and in the customer magazine

If personal data are recorded by participants within the framework of a sweepstake on social media, they shall exclusively be collected, processed and used for the purposes of implementing the sweepstake, unless you have specifically granted your consent for the use of your personal data for other purposes, or use of data is required in the individual case for legal or other overriding reasons (thus for example in the event of a legal or other regulatory request or in the event of legal or regulatory disputes).

We will delete or anonymise collected and processed data following expiry of the statutory period of limitation (i.e. usually after three years have elapsed). The same applies to any messaging history in social media. We cannot assume any responsibility for the correctness, timeliness and completeness of data that you have disclosed personally. In your own interests, please therefore ensure that data disclosed by you are correct, up-to-date and complete.

Our quality measures

If you contact us by e-mail with requests, suggestions or criticism, we would also like to ensure that we have performed our service to your satisfaction. After replying to your concerns, we will therefore ask how satisfied you were with our service.

This constitutes an internal quality assurance measure. For reasons of objectivity and automated processing, we employ a processor for this purpose, to conduct this automated query on our behalf. In order to do so, we will exclusively hand over your e-mail address and customer number to the processor. We shall not provide this processor with the opportunity to inspect your data, to use your data for other purposes or to transfer them to third parties.

Before employing the processor, we have assured ourselves that it will provide a sufficient guarantee for lawful and secure use of data.

How we protect your data

For us, information security means:

  • Confidentiality of data,
  • Data integrity and
  • Data availability

In order to guarantee information security, we have established organisational framework conditions and protective measures that confirm to the latest state of technology.

These include:

  • Load distribution,
  • Firewalls,
  • Encryption,
  • Security tests,
  • System inspection and
  • Constant monitoring.

Our employees are only granted access rights in accordance with their roles and to an extent that is absolutely necessary. The use of these access rights is recorded.

Your data is protected by a secure online connection (TLS) between your PC and our servers, depending on the browser configuration, with at least 128 Bits.

Security measures for the system in the event of purchase on the ÖBB App or an online purchase were developed based on the following standards:

  • ÖNORM A 7700 (standard for the security of web applications);
  • PCI DSS (Payment Card Industry Data Security Standard); and
  • ASVS (Application Security Verification Standard).

The system therefore fulfils the security standards of the Application Verification Standard 2010 (ASVS) and was also tested by an independent expert. ASVS 2010 represents the leading current standard for IT security. Moreover, the ÖBB App was developed in accordance with requirements of data protection law and continually adjusted to new requirements.

Use of data processors

By processors we mean our contractual partners, who process personal data on our behalf (example: maintenance of our databases).

We currently employ processors, including for the following activities:

  • for customer card production and shipment thereof;
  • for communication related to the contract renewal and the dispatch of other printed forms;
  • for the implementation of quality measures and customer surveys;
  • for ticket sales by cooperating partners distributing ÖBB tickets on our behalf;
  • for the operation and maintenance of our customer databases; and
  • for use in individual cases.

We only employ processors for our lawfully conducted data processing. We always assure ourselves in advance that the individual processor is suited to service performance, in particular that the processor provides a sufficient guarantee of secure and lawful use of data.

Processors that we have selected only receive personal data from us to the extent that is absolutely necessary.

Our processors have contractually undertaken:

  • to solely use personal data for the purpose of the contract;
  • To delete them after completion of the respective contract purpose,
  • Not to forward data to third parties,
  • not to use personal data for their own purposes; and
  • to comply with new obligations under the General Data Protection Regulation (e.g. keeping a register of processing activities, conducting a data protection follow-up assessment as required, etc.).

Before employing a processor, we conclude a written agreement with the processor, in which special obligations are imposed on the processor and its employees, and they again are subject to a separate confidentiality obligation. We impose certain data security measures on the processor to ensure that customer data and data processing are sufficiently protected.

Note on the scope and consequences of incomplete data provision

We have provided you with comprehensive information on the purposes of our data processing, categories of data recipients, the legal basis and legal framework, the storage period as well as the rights you are entitled to and the scope of data processing. In all data processing, we have taken care to ensure that data collection and data scope are limited to the extent that is absolutely necessary. Therefore, if we ask you to provide data, this is necessary in particular so that:

  • you can purchase a product or service of ÖBB-Personenverkehr AG or a cooperating partner (e.g. tickets, customer card, transfer service, timetable query, mobility service, chatbot / ÖBB.Bot etc.)
  • we can verify your eligibility (e.g. as part of validation, identification check for certain requests);
  • you can assert your rights and other claims (e.g. passenger rights, assertion of any personal injury or damage to property, claims for reimbursement, etc.) or contact us with other concerns or complaints; the same applies to ÖBB-Personenverkehr AG;
  • we can contact you in the event of a breakdown or any other event or circumstance of importance to you;
  • we can include you – provided you have given your consent in advance – in our direct advertising measures and data and web analyses or involve you in our quality assurance or customer surveys.

If you do not or not fully comply with our request for data disclosure, it cannot be guaranteed that we will be able to comply with or process your aforementioned purchase or other request(s).