Data Privacy Statement

Sole controllership by ÖBB-Personenverkehr AG:

If you have any questions regarding data protection or the use of your personal data, please contact the data protection officer of ÖBB-Personenverkehr AG, if the data processing is carried out under our sole controllership.

Contact details for the data protection officer at ÖBB-Personenverkehr AG:

ÖBB-Personenverkehr AG, 1100 Vienna, Am Hauptbahnhof 2

E-mail: datenschutz.personenverkehr@pv.oebb.at

If a customer under the age of 14 uses the following services provided by ÖBB-Personenverkehr AG or its partners under joint controllership (e.g. tickets, newsletter subscriptions, push services), the respective customer must ensure that the necessary consent of his or her legal guardian was obtained in advance.

Personal data is collected for our own purposes in accordance with Article 13 of the GDPR for the following specific processing purposes:

In the following cases and for the following purposes, personal data will not be collected by ourselves but will be disclosed by third parties in accordance with Article 14 GDPR:

If

In the following cases and for the following purposes, personal data is collected under joint controllership and shared between the partners listed in Section 3.:

The data processed for the purposes outlined in Section 6.2. is disclosed to the following categories of recipients as required and depending on the intended use, ensuring that data is only disclosed to the extent absolutely necessary as required:

To

• the responsible bank / payment service provider for the purpose of secure payment processing in accordance with the legal requirements as well as the payment service provider's instructions or for the prevention or clarification of cases of abuse (for the purposes of contract execution, Article 6(1) b) and f) GDPR).

• the regulatory authorities in the case of arbitration (for the purposes of complying with the provisions and rights under railway law, Article 6(1) c) GDPR).

• the assigned legal representative in the event of disputes under civil law (based on our legitimate interests in defending legal claims, Article 6(1) f) GDPR).

• the local, competent administrative authority responsible in the individual case (in particular also financial authorities, driving licence authorities, the Austrian Regulatory Authority for Broadcasting and Telecommunications or trade authorities) for the purposes of complying with legal provisions and entitlements, Article 6 Para. 1 lit. c GDPR.

• the local, competent court responsible in the individual case or other authorities responsible in the individual case (based on our legitimate interests that exist in defence of legal entitlements, Article 6 Para. 1 lit. f GDPR).

• the competent executing contractors providing services in connection with a booked journey to the destination and/or at the destination itself (hotels, airlines, partner railways, bus or taxi companies or car rental agencies as part of an integrated mobility service, local organisers on site, etc.)

• the visa-issuing authorities, as required in the course of long-distance journeys, in which case it should be noted that we provide the service of data collection and transfer to the competent authority in the individual case as a processor within the meaning of Article 28 et seq. GDPR. Visa and passport data are not automatically stored if the procurement of a visa forms part of the order placed by the data subject. Data storage is therefore usually carried out by the respective competent visa-issuing authority, which also assumes sole responsibility for the use of the data it stores.

• the debt collection agency assigned by the controller for the recovery of outstanding debts based on our legitimate interests in the defence of legal claims, Article 6(1) f) GDPR).

• the chartered public accountant for the purpose of auditing (for the purpose of complying with legal provisions, in particular the applicable corporate law regulations, Article 6 Para. 1 lit. c GDPR).

• any affected cooperation partners, as the case may be, in the event of the sale of services provided by the cooperating partner by the controller (for purposes of contract execution, Article 6(1) b) GDPR).

• to other companies of the ÖBB Group or other cooperating partners, in the event that you purchase or use a product or service provided by the parties mentioned above.

• our commissioned data processors, if these process personal data on our behalf. (Based on our legitimate interests, in particular for the improvement, simplification and maintenance of our database systems, Article 6 Para. 1 lit. f GDPR).

• The competent competition authorities for the purpose of conducting antitrust proceedings, on the basis of a legal entitlement or a legitimate interest (Article 6(1) c) and f) GDPR).

• Bundesrechenzentrum GmbH, in the event that you purchase a special product for students from a transport association and an authorisation check is carried out for this purpose in the form of a data comparison (Article 6(1) b) GDPR)

• Wiener Linien GmbH & Co KG for the purpose of verifying the validity of the ticket presented by the data subject in the event that the data subject disputes the accuracy of the penalty fare issued by our train attendants (based on our legitimate interests consisting in the defence of legal claims, Article 6(1) f) GDPR).

• ÖBB-Operative Services in connection with video evaluations and other security incidents (Article 6(1) f) GDPR).

• To the partners within the scope of joint controllership in accordance with Article 6(1) e) GDPR in conjunction with Art 2(1) of the One Mobility Act.

• To our other processors as defined in Section 23..

The joint controllers may have personal data processed by processors. Processors are understood to be contractual partners who process personal data on behalf of the controllers.

ÖBB-Personenverkehr AG and its partners under joint controllership only use processors for lawful data processing. All controllers have always verified in advance the suitability of the individual processor to provide the service, and in particular that the processor provides sufficient guarantees for the secure and lawful use of the data.

The processors selected by the joint controllers receive personal data only to the extent strictly necessary, and the processing is carried out exclusively for the specified purposes.

The joint controllers transfer personal data to the following processors:

• ÖV Ticketshop GmbH for the operation of the ticket shop and error analyses,

• One Mobility Ticketing GmbH for centralised payment processing

• Sales partners for the distribution of products in the joint portfolio

• All other IT service providers and data hosting solution providers, as well as other providers of tools and solutions (e.g. printers and plastic card manufacturers) who assist us in providing our products to you

In addition, the joint controllers transmit personal data to the following recipients (controllers) to the extent necessary:

• ÖBB-Personenverkehr AG for the further development of systems outside the joint controllership

• railway companies for the use of data to process passenger rights based on your consent

• any third parties involved in providing the service to you in order to fulfil our contractual obligations (e.g. banks for payment processing, collection agencies if necessary, payment providers, shipping providers)

• external third parties to the extent necessary on the basis of our legitimate interests (e.g. auditors and tax advisors, insurance companies in the event of a claim, legal representatives where necessary)

• public authorities and other public bodies to the extent required by law (e.g. tax authorities).

Data processing under our sole controllership is carried out in particular on the basis of the following legal framework (as amended from time to time):

• Regulation EU 2016/679 for the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation (GDPR)), in particular Article 6(1) a) (consent), b) (execution of contract), c) GDPR (legal entitlement or obligation), f) (legitimate interests) and (4) (processing for further purposes).

• Regulation (EU) No. 1371/2007 of the European Parliament and of the Council of 23 October 2007 on rail passengers’ rights and obligations;

• Federal Act on Rail Transport and Passenger Rights (Eisenbahn-Beförderungs- und Fahrgastrechtegesetz – EisbBFG)

• Federal Unfair Competition Act of 1984 (UWG)

• Trade Regulations of 1994

• Directive (EU) 2015/2302 of the European Parliament and of the Council of 25 November 2015 on package travel and linked travel arrangements

• Federal Act on Package Travel and Linked Travel Arrangements (Package Travel Act)

• Code of Criminal Procedure of 1975, as required

• Introductory Act to the Administrative Procedures Act of 2008

• Administrative Penal Act of 1991

• General Administrative Procedures Act of 1991

• General Austrian Civil Code of Law for all German hereditary lands of the Austrian monarchy

• Telecommunication Act of 2003

• Federal Act on General Regulations and Procedures for Fees Administered by the Tax Authorities of the Federal Government, Regional States and Municipalities (Federal Fiscal Code, BAO)

• Federal Act on Special Regulations of Civil Law for Companies (Austrian Commercial Code, UGB)

• Fare Conditions and General Terms and Conditions of ÖBB-PV AG, incl. the Guide for travelling with ÖBB in Austria, as well as any other general terms and conditions, contractual agreements and obligations that may apply.

• Terms of participation in the case of projects or special services.

• Federal Act of 21 January 1959 on Liability for the Compensation of Damages from Accidents in the Operation of Railways and the Operation of Motor Vehicles (Railways and Motor Vehicle Liability Act; Eisenbahn- und Kraftfahrzeughaftpflichtgesetz – EKHG) Federal Law Gazette No. 48/1959 as amended.

• Federal Act on distance sales and contracts concluded outside of business premises (FAGG) Federal Law Gazette I No. 33/2014 in this version Federal Law Gazette I No. 83/2015 as amended.

• Federal Act of 8 March 1979 laying down provisions for the protection of consumers (Consumer Protection Act; Konsumentenschutzgesetz – KSchG), Federal Law Gazette No. 140/1979 as amended.

• Federal Act on the Restructuring of the Legal Relationships of the Austrian Federal Railways (Federal Railway Act; Bundesbahngesetz), Federal Law Gazette No. 825/1992 as amended.

• EU Directive on Payment Services in the Internal Market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No. 1093/2010, and repealing Directive 2007/64/EC (PSD2)

• One Mobility Act, Federal Law Gazette I No. 72/2021 as amended

The ÖBB Group not only uses Microsoft Office products, but also Microsoft Cloud Services. In particular, Microsoft Cloud Services and other Microsoft products are used to provide the ÖBB ticket shop, the ÖBB ticket app, the complaints management system, CRM measures and other customer-related systems.

The central processors are ÖBB companies, namely

• ÖV Ticketshop GmbH, 1020 Vienna, Lassallestrasse 5 and
• ÖBB-Business Competence Center GmbH, 1020 Vienna, Lassallestrasse 5.

For the provision of technical services by our ÖBB processors, the use of Microsoft products involves transferring / disclosing data to Microsoft Ireland Operations Limited (Microsoft), 70 Sir John Rogersons’s Quay, Dublin 2, Ireland, whereby Microsoft itself uses sub-processors in individual cases for the provision of individual cloud services or the provision of Microsoft products, some of which are based in third countries.

Microsoft is a recipient in the United States that participates in the EU-US Privacy Framework, which has been found by the European Commission to provide an adequate level of privacy protection.

Please note that in some cases Microsoft uses sub-processors, some of which are located in third countries, to provide its cloud services or to deliver Microsoft products. An up-to-date list of these sub-processors is provided by Microsoft at the following link: https://servicetrust.microsoft.com/DocumentPage/badc200c-02ab-43d9-b092-ed9b93b9b4a8.

Where data is transferred from Microsoft to Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, in the United States, Microsoft relies on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequacy of the level of protection of personal data under the EU-US data privacy framework (the “EU-US Data Privacy Framework”). Microsoft Corporation has been certified under the EU-US Data Privacy Framework.

In addition, Microsoft relies on the standard data protection clauses for the transfer of personal data from processors in the EEA to processors in third countries that do not ensure an adequate level of data protection, as described in Article 46 of the GDPR and approved by the European Commission in Decision 2021/914/EC of 4 June 2021.

You can view the FAQs provided by Microsoft via the following link: GDPR – frequently asked questions, Microsoft Trust Centre

If we transfer data to other recipients outside the EU/EEA in the future, we will give priority to countries for which the EU Commission has issued an adequacy decision. For recipients in third countries without an adequacy decision, we will first enter into standard contractual clauses and implement appropriate security measures to establish an adequate level of data protection to ensure that your rights are protected in accordance with the provisions of the GDPR.

In accordance with legal requirements, personal data will generally not be retained for longer than is necessary to fulfil the purpose for which it was collected. The specific retention period may result from an applicable legal requirement or may be for the duration of your consent. If the purpose for which the personal data was stored no longer applies, or if a legal retention period has expired, the personal data will be routinely blocked or deleted in accordance with statutory provisions.

In particular, the following storage periods apply:

• Data relevant to invoicing due to a ticket purchase or Eurail / Interrail passes (e.g. order data including archived data, customer card data and data for the billing level) and related documents (e.g. invoices, payment receipts, letters regarding contract renewal) will be stored for eleven years in accordance with the statutory provisions for possible obligations to provide evidence as well as possible retroactive determination of tax liabilities pursuant to Section 209 (5) BAO if this data is not transferred to the internal accounting system. If data is additionally processed in the internal accounting system, this data will be stored for a period of 30 years (Section 1478 of the General Civil Code (ABGB)).

• User data for a customer account will be deleted for inactivity three years after the last successful login, provided there are no active vouchers associated with the customer account. Otherwise, the data will be deleted ten years after the last successful login.

• Other than this, we save data that can be assigned to you for a period of three years, such as customer correspondence, use of other services (e.g. mobility service, validation data, push services or any other service forming part of our integrated mobility offering), merely taking part in sweepstakes, campaigns or customer surveys.

• We store timetable connections without tickets as long as you wish to see this information on your home page. If you delete it from the home page, it will also be deleted from our servers.

• App support: When you submit an enquiry by email (oebbapp@pv.oebb.at) or via the “App Support” link, the following information is collected in order to process your enquiry: Name, e-mail address, support ID, device type, app version. This information is required to identify, reproduce or resolve your specific problem in the system. The data will be deleted as soon as it is no longer required for the purposes for which it was collected, at the latest after 6 months.

• We would like you to learn the full scope of functions of our software. For this purpose, we have made sure that you will receive practical tips and information from us at an appropriate spot. We want to provide you with relevant information and not continually repeat this. This is why we store functions used by you for a maximum period of 18 months. As a result, you will always receive the right (not yet known to you) information in different web browsers and on different devices with the ÖBB App.

• Customer master data is deleted six months after all sales, user and billing data relating to that customer has been deleted. Photos are only on file for as long as they are in use for a product.

• Information to customers pursuant to § 20 (3) of the Railway Transport and Passenger Rights Act is retained for a period of 18 months.

• Revocation of a declaration of consent or assertion of an objection to direct marketing pursuant to Article 21 f) GDPR (blacklist): deletion of this information may not occur, since we keep this as a negative list and thereby ensure precisely that you do not receive any advertising offers from us.

• In order to create customised offers, data on mobility and usage behaviour from the last 24 months is used.

• Personal data that you have disclosed to us via the website for the purpose of handling personal injury or property damage shall be stored for a period of one year. A longer storage period shall only be implemented in the event of a longer lasting damage settlement (conducting legal or regulatory disputes).

• Personal data that you disclose to our train attendants for the handling of personal injury or property damage, theft or other incident or concern will be stored for the duration of processing and for an additional three years until completion of case handling.

• In the event that personal data is disclosed when using the chatbot / ÖBB.Bot, it will be stored for a period of 30 days.

• Data processed based on a legal or regulatory dispute will be kept available for a period of 30 years and may only be inspected and processed by certain employees.

• In order to ensure the technical traceability of the transmission of customer communications, including troubleshooting, the e-mail address, mobile phone number, time and subject of the transmission (without content data) will be stored in log files for a period of 21 days.

• In order to process customer enquiries relating to card printing, data relating to contract renewal requests will be stored for a period of three months by our service provider for printed matter (Paul Gerin GmbH & Co KG, A-2120 Wolkersdorf, Gerinstrasse 1-3) and will be deleted by the service provider at the end of this period.

In addition, we may retain your personal information beyond the periods set out above for as long as is necessary to assert any legal claims arising from the relationship between you and us or until a specific matter or legal dispute has been finally resolved. This longer retention period is necessary to protect our legitimate interests in asserting, clarifying and defending legal claims. In the context of business case documentation, legal requirements may also provide for a longer retention period.

In general, data subjects are entitled to assert the following rights against the data controller:

To use all the functionalities of the joint distribution system (both under sole and joint controllership), i.e. the website and the app, you need to register and we will create a customer account for you.

In order to create a customer account, we will need at least the following information about you: e-mail address, password, salutation, your first and last name and your date of birth. When you register, we ask you whether you would like to continue to use the data previously used in the browser (e.g. recent trip searches, customer cards) as part of your customer account.

Following data entry and registration, you will receive an e-mail from us, to confirm your e-mail address and activate the customer account for ÖBB. As soon as you confirm the activation link and log in for the first time, your customer account is active.

In order to use our business services (website and app), business customers can create a business account. For example, you can register your company as a corporate customer and we will create an ÖBB business account for you.

This allows you to use all your stored data independent of devices and browsers and simplifies and accelerates timetable enquiries, ticket purchases, company structure management and the report function.

It’s as simple as this: name an administrator from your area who will handle the initial registration. For an initial registration, we need at least the following information: e-mail address, password, salutation, your first and last name, company name, address and an industry selection.

After entering the data and registering, the named administrator receives an e-mail from us to confirm the e-mail address, initiate the plausibility check and activate the ÖBB business account. Only after a positive plausibility check will the payment on account and the business tariff be activated. As soon as you confirm the activation link, your ÖBB business account is active.

In order to use or manage further advantages of the ÖBB business account, we optionally need additional data, such as: the structure of the company, employee names, e-mail addresses, employee role authorisation, employee discount cards, etc. This enables us to offer your employees or other persons assigned to the ÖBB business account relevant products.

The ÖBB business account also enables a pleasant and fast ticket purchase without repeated data entry by adding payment data in the administration. Payment data will be stored by our payment service provider, who processes your payment data using the international PCI DSS standard. The stored means of payment can be deleted at any time by persons who have received the corresponding authorisations by you.

For existing business customers, ÖBB-Personenverkehr AG offers webinars covering customer safety at the station and on the train. ÖBB-Personenverkehr AG shows what the company does for the safety of passengers and demonstrates how customers can also pay attention to their own safety. In addition, the various options for travel insurance are presented and explained.

The invitation to the webinar, including the invitation link, is sent by e-mail to the e-mail address provided by the business customer. For the avoidance of doubt: this is a training and information event, and the webinar does not include any promotional content.

If you use the Wegfinder app provided by our partner iMoblity GmbH to book a service (e.g. to purchase a ticket to travel to a congress), iMobility GmbH will provide us with your name, date of birth, wheelchair yes/no, discounts, travel preferences, booking details and the organizer’s business account ID, so that we can issue the ticket.

The individual bookings as well as any payments take place in iMobility GmbH’s Wegfinder app. The data on CO² savings is compiled and made available to the respective organizer of the booked service without personal reference.

For selected partners (Easy Tex), the business account can also be used as a service for customers. For this purpose, the partner uses a business account, in which the booking and billing takes place. If the booking is made through an international partner, data will be exchanged as part of an international data transfer for the purpose of completing the ticket purchase within the meaning of Article 49(1) b) GDPR. The data exchanged as part of the international data transfer has been limited to what is strictly necessary (this includes offer and order information, ticket information, billing information, passenger details).

For congress bookings, a separate booking area is created to which only a restricted group of users (organisers, participants as well as employees of the responsible parties) have access. The organiser receives a link and a TAN to the booking area created for the respective individual congress. The rights of access have been restricted so that neither the participants of a congress, nor the organisers themselves, nor participants or organisers of other congresses can access the information. Data is deleted two months after the end of the congress or finalisation of the accounts.

If an organiser assumes payment for participants’ travel to a convention, the organiser will be provided with the relevant participants’ booking details (first and last name, dates of travel, costs) for the purpose of reviewing the invoice.

In certain municipalities throughout Austria, you can book a fast and comfortable shuttle service to your destination (ÖBB Transfer). This service picks you up directly from the train station, takes you to the accommodation selected during the booking process (e.g. hotel, spa) and also takes you back to the train station on your day of departure.

When booking a ticket for a specific train journey (i.e. booking a ticket to your destination and back), you will automatically be offered the ÖBB Transfer Service if this service is available at your destination. If you would like to avail yourself of this service, you can book it together with your train ticket as part of a booking process. Detailed provisions concerning the ÖBB Transfer can also be found in the Guide for travelling with ÖBB in Austria.

You will receive an email with the exact times and locations for the shuttle’s departure and arrival after the purchase is completed as well as prior to the journey.

The transfer service is provided by our cooperating partners (bus or taxi companies).

The driver will wait for you at the main exit of the station or outside your chosen accommodation.

In order to use this transfer service, the following data is collected during the booking process: first and last name, pick-up and drop-off location, number of passengers, train number, data for validation, price and chosen method of payment, e-mail address, mobile phone number, wheelchair, dog, bicycle (to determine whether or not the transfer service allows for the transport of a wheelchair, dog or bicycle).

In order to provide the transfer service, the required data will be passed on to the cooperating partners (bus or taxi companies) in the case of a booking and by the cooperating partner to the third party providing the service (e.g. other local taxi companies at the destination) in the event that the cooperating partner does not provide the transfer service itself.

For the purpose of providing the transfer service, ÖBB-Personenverkehr AG will pass on the following data to the cooperating partners:

• Name of the person making the booking
• Mobile telephone number
• Booking number of the order
• Coordinates and desired time of the trip
• Train number for the train on which the passengers are arriving/to which the passengers are to be taken
• Fare incl. information “Paid”, if it was booked via the ticket shop
• Pick-up location (name of the station or hotel, address and position on map)
• Pick-up time
• Arrival point (name of the station or hotel, address and position on map)
• Arrival time
• Number:
• Persons, children incl. discount cards (for price calculation)
• Wheelchair (to determine if the transfer service allows for the transport of a wheelchair).
• Dog (to determine if the transfer service allows for the transport of a dog).
• Bicycle (to determine if the transfer service allows for the transport of a bicycle)

ÖBB-Personenverkehr AG (as far as the train service is concerned) as well as the individual cooperating partner (as far as the transfer service is concerned) shall carry out this service under their own responsibility under data protection law. As a consequence, you must in particular exercise your claims/rights under data protection law (e.g. a request for information under data protection law) against ÖBB-Personenverkehr AG as well as against the respective cooperating partner.

If you wish, we will also be happy to forward enquiries to the cooperating partner or to the commissioned third party.

In order to enhance the mobility chain within Austria, ÖBB Rail&Drive cars are made available at selected ÖBB train stations. This car sharing offer is available to all registered ÖBB Rail&Drive customers.

Please use the ÖBB Rail&Drive website to register. https://www.railanddrive.at/ The verification process can then be completed at selected sales offices of ÖBB-Personenverkehr AG (i.e. ÖBB ticket counters, ÖBB travel agencies and ÖBB lounges). The applicable sales offices are published on our website and can be accessed via the following link: https://www.oebb.at/de/reiseplanung-services/am-bahnhof/last-mile.html . Alternatively, you can also carry out the entire registration process at these locations. For this purpose we provide computers and tablets at selected sales points. This allows you to start the registration process and/or complete the verification process on site.

Disclosure of the following information is required to use the Rail&Drive service: driving licence data, first name, last name, address, date of birth.

Please make sure that you are able to verify the information you have provided by means of appropriate evidence on site. In particular, it must also be ensured that the driving licence issued to the customer in question was issued in a Member State of the European Union. A physical and/or digital copy of the driving licence is made on site. The collected data is kept for a period of one week and then deleted or destroyed.

ÖBB-Personenverkehr AG will forward the collected data and documents electronically to Rail Equipment GmbH & Co KG, which is responsible for this service under data protection law. In this case, ÖBB-Personenverkehr AG acts as the processor for Rail Equipment GmbH & Co KG.

Your data protection claims with regard to the ÖBB Rail&Drive service must therefore be asserted against Rail Equipment GmbH & Co KG.

Contact details:
Rail Equipment GmbH & Co KG
z.Hd. Datenschutzbeauftragter
Operngasse 24/4,
A-1040 Vienna
info.railanddrive@oebb.at

The data collected at the point of sale is recorded by the data controller, Rail Equipment GmbH, in its own data processing systems and used for the purpose of providing the service. Further information on the use of data can be found in the data privacy statement of Rail Equipment GmbH & Co KG (available at https://www.railanddrive.at/de/datenschutzerklaerung).

As a part of ÖBB 360, ÖBB-Personenverkehr AG, together with its subsidiary iMobility GmbH, offers a service for employees of companies.

Public transport, taxis, sharing services and micro-public transport throughout Austria can be booked using the “wegfinder” app provided by iMobility GmbH. This is an information and booking platform for a wide range of mobility services as alternatives to private cars.

The service offered under ÖBB 360 can be used for business and private purposes.

During the booking process, the employee selects whether it is a private trip or a business trip.

Settlement is made either by private credit or debit card or by the means of payment provided by the employer: “Mobility budget” and/or “Travel expenses”. In order to be able to make use of the “mobility budget” and/or the “travel expenses” options, the company must be linked to the employee’s wegfinder profile.

The mobility budget is a monthly amount provided by the employer at the beginning of each month in the form of vouchers on the wegfinder account. For all bookable mobility services in the app, users have the option to select either the mobility budget for private journeys or the “travel expenses” payment method as the means of payment for business journeys.

The respective company is also provided with your CO2 footprint for the trips made on a monthly basis.

The employer does not receive any information related to employees’ private mobility behaviour, in particular with regard to which means of transport were used for which routes for private purposes. Your employer can only see how much CO2 an employee has saved with the mobility budget they have made available.

ÖBB-Personenverkehr AG and iMobility GmbH each process personal data as independent data controllers pursuant to Article 4(7) GDPR.

ÖBB-Personenverkehr AG processes the following data:

Data collected on the company: company name incl. VAT number and company register number, address data, country, monthly invoice amount, customer number and contact person.

Data collected on the employee: e-mail address

Please be advised that ÖBB-Personenverkehr AG has no insight into the specific bookings of the individual mobility services. Booking and data processing for the mobility services used takes place in the app offered by iMobility GmbH, which operates it under its own responsibility. Further information on this topic can be found in the Data Privacy Statement, which you can access via the following link: https://wegfinder.at/datenschutz/

On our website, you have the opportunity to submit enquiries about corporate mobility and shared mobility via a separate input screen, and to opt in to receive information, news and offers by email, phone and text message.

In particular, the following data will be used: Company, title, first and last name, telephone number, e-mail address and federal state.

You may withdraw your consent at any time

• by sending an email to businesskonto@pv.oebb.at,
• by using the unsubscribe link in any mailing or
• by calling a Key Account Manager

.

We can organise optimal assistance for you at many stations upon free advance notice at ÖBB customer service, at the ÖBB ticket counter, or at an information point at the train station. Please let us know about your desired journey in good time (see https://www.oebb.at/de/reiseplanung-services/barrierefrei-reisen/mobilitaetsservice.html).

We require the following data for advance notice: (1) first and last name and address; (2) phone number for queries and communications; (3) journey date, route (departure/transfer/arrival station); (4) disclosure of whether you are travelling with a companion and/or luggage; (5) type of mobility restriction (wheelchair user, walking disability, visual impairment, other restriction); (6) disclosure of whether any railway aid is required (lifting device, railway wheelchair,...); (7) disclosure of the meeting point at the station; and (8) if already available, carriage and seat number.

Data on a provided service will be stored by ÖBB-Personenverkehr AG on a national level for a maximum period of three years and subsequently automatically deleted.

In combination with a ticket, you can make use of a luggage service for normal luggage items as well special baggage for journeys within Austria (see fare regulations).

The booking can be made through our company (i.e. at the ticket counters or by phone via the customer service). We are at your disposal as a contact for our cooperation partner (GO! Express & Logistics GmbH, 1230 Vienna, Pfarrgasse 81).

The cooperating partner shall perform this service at its own responsibility. In order to allow the cooperating partner to perform its logistical service, the following data - assignable to you - shall be disclosed to such a partner for the performance of the service, which you communicated to us when booking this service: first and last name, telephone number, e-mail address, pick-up and delivery address, date, time and time window of pick-up and delivery.

If you wish, we will be happy to pass on complaints and other queries to the cooperating partner as required.

As part of ÖBB Bike, ÖBB offers two products: ÖBB Bike:Rental (longer rental for day trips) and ÖBB:Bike Sharing (short-term rental for short distances).

The processor Digital Mobility Solutions GmbH, Vaalser Str. 17, 52064 Aachen, Germany, provides a web-based administration backend (MoQo platform) for the digitalisation of the bicycles and the operational processing of the bike rental service.

Bike rental takes place via the wegfinder app provided by our cooperation partner iMobility GmbH, Weyringergasse 5/B4, 1040 Vienna, which provides this service under its own data protection responsibility. You can view our cooperation partner’s privacy statement via this link: https://wegfinder.at/datenschutz/

The rental relationship is established with the respective bike rental service operator. You can review the operator’s respective rental conditions in the wegfinder app.

In the event of a booking, data will be forwarded to the respective bike rental service operator.

The respective bike rental service operators can be found on the ÖBB website via the following link: https://www.oebb.at/de/reiseplanung-services/sharedmobility/oebbbike

Differentiated deletion periods (between 1 year and 10 years, depending on the respective reason for storage) have been defined based on factual aspects. The deletions are carried out independently by the processor. In deviation from this, data may only be stored for a longer period in individual cases if there is a special reason for such storage (e.g. civil court proceedings).

Customers have the option of renting a bicycle parking space by the month or for an entire year via an app. The bike room can be opened/closed via the app (smart door control) using a QR code. Customers will be informed by e-mail / app prior to termination of the rental agreement.

Note: For this service, the controller uses the processor JUHUU BikeBox GmbH, which in turn uses processors located outside the EU. In particular, the processor uses Google Cloud Platform for its cloud computing services and has concluded the necessary data protection agreements and standard contractual clauses with Google Ireland Limited, with registered office at Gordon House, Barrow Street, Dublin 4, Ireland and Google LLC, with registered office at 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

For sending e-mails, the TÜV-approved processor Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin is used, whose processors have either concluded EU standard contractual clauses or have a server location in the EU.

The following personal data will be processed in the context of bike rental services

• The user’s e-mail address incl. password
• Full name of the user
• Telephone number
• Invoice address data (optional): Country, street, house number, postcode, city
• Chosen payment method: Apple Pay or credit/debit card (payment is processed via a certified payment service provider).
• Permission to use the camera: No photo or video material is stored. The camera is only used to scan the QR code.
• Permission to access the user’s location. The location is processed by JUHUU servers in order to find locations of ÖBB and other providers in the vicinity. After processing, the user’s location is deleted again. The location is never associated with the user
• Rental period incl. correspondence (notice of end of rental agreement, information regarding the settlement of the agreement)
• Special authorisations with regard to the rental relationship (duration, price, etc.)
• Rental fees charged
• Information on damage caused

Differentiated deletion periods (between 1 year and 10 years, depending on the respective reason for storage) have been defined based on factual aspects. The deletions are carried out independently by the processor. In deviation from this, data may only be stored for a longer period in individual cases if there is a special reason for such storage (e.g. civil court proceedings).

General

Our timetable information service ÖBB Scotty offers you the opportunity to obtain information about timetables, stations or the current transport situation of ÖBB trains and several other transport operators. With the door-to-door timetable information you can query the fastest route from A to B throughout Austria and use other services. Moreover, additional relevant information is available, such as data on station or train equipment, as well as the opportunity to store journey data in your own calendar or to share it with other persons.

Data storage

ÖBB Scotty is a service which can be used without registration. This service is therefore generally anonymous, because as a matter of principle, ÖBB does not store your contact data, location data, calendar entries, query results, etc. The only exceptions are if you want to use our push notifications or share your connections with other people. As a result, ÖBB cannot and will not use data for any other purposes. Your query results remain completely anonymous and will not be stored, meaning that we cannot and do not create user profiles.

How does ÖBB Scotty work from a technical perspective?

An active internet connection is required to install ÖBB Scotty on your device or to access it via https://fahrplan.oebb.at/webapp and to communicate with our information server, which calculates the connection results for you.

In order to allow you to use all functions of ÖBB Scotty, it is necessary to grant further authorisations/cookies, allowing for access to specific data for your device. These rights can also be withdrawn again in the application or at https://fahrplan.oebb.at/webapp if desired. Depending on your operating system, you can disable them at any time by going to System Preferences/Application Management/Cookie Management.

In detail and depending on the device used, ÖBB Scotty explicitly requests you to grant the following rights:

Contact data: These will only be used to display the transport connection to or from a contact from your address book. Only city names, roads and house numbers are used for the search. We will not store (nor cache) such data.

Device location/location: Your current location can only be identified for an optimal connection search by ÖBB Scotty if you wish, in order to search for travel connections from there or to find stations nearby. No caching is carried out, either, and as a result the creation of movement profiles, etc. is not possible.

Calendar: ÖBB Scotty offers you an additional service to store travel data for your connection in your device’s calendar. This service is not compulsory, but is determined at your personal discretion. However, the actual contents of the calendar will not be read.

Share connection: ÖBB Scotty offers you the additional service of sharing your travel data for your connection with other people. This service is not compulsory, but is determined at your personal discretion. To share connections, the encrypted key data of a selected connection is stored on the server so that the connection can be reconstructed on other devices or by other people. However, the encrypted key data does not reveal who a link was shared with, through which channels it was shared, or how often it was shared.

Notifications: This right is required to receive and display push messages (e.g. information on delays).

How does the “alarm” function in ÖBB Scotty work?

A push alarm is available to you on the ÖBB Scotty app and website.

Registration

• ÖBB Scotty App: In order to set up the push alarm, simply search - as usual - for your connection and then click on the “Alarm” button. You will then receive a corresponding push message on your ÖBB Scotty App.
• ÖBB Scotty Web: you can set e-mail alarms via Scotty Web by selecting a connection and clicking under “Details of the connection”. You can find the “Alarm” button there under the selected connection. After entering/verifying your e-mail address, we will send push notifications to your disclosed e-mail address.

As a result, you can decide whether or not you wish to use the function.

Notifications are completely free of charge to you. We will inform you if we have the necessary information on delays, changed departure platforms, risky connections, train cancellations or deviations and recommendations for the connection selected by you. As soon as there is any change to your connection, you will receive a push notification, provided we hold such information.

Unsubscribing:

In addition, you can deactivate push notifications again at any time.

• ÖBB Scotty App: you can delete your services in the “Alarms” area or deactivate them for a specific period.
• ÖBB Scotty Web: any deviation notification shall be furnished with an unsubscribe link for this purpose, by means of which the service can be cancelled. However, it is also possible to delete your alarms or deactivate them for a certain period of time directly via ÖBB Scotty Web in the “Alarms” menu.

If you use the “Alarms” function, identification parameters, travel connection data, device IDs, relevant intervals and your e-mail address are stored in Scotty Web. Data are stored in case of one-off notification, as long as the selected connection is valid. If you have repeatedly set notifications on certain days, data shall be stored for as long as repeated notification is requested by you.

ÖBB Scotty analytics service

When you use ÖBB Scotty, it records user activity without being able to trace it back to a specific person. The anonymous analysis helps us to further improve ÖBB Scotty and adapt it in a targeted way to the needs of our customers. If you still do not want this analysis, you can disable it in the app or in the device system. In the web browser or in the Scotty web version, this is possible via the “cookie settings”.

The analysis is conducted via an anonymous user ID, which does not allow for traceability or an opportunity to draw conclusions about the identity of a specific person.

Google Firebase Analytics is not used in our analyses and has been deactivated by us.

Integration of the Scotty timetable widget:

If you embed the Scotty widget in your website, the widget generator creates a code and redirects the queries and the display of the query results to Scotty.

The only thing that happens is a query to the Scotty server, so it is not possible to identify the user, not even through logs.

Scotty does not place functional cookies in visitors’ browsers without their consent, and user activity is only recorded anonymously.

In particular, ÖBB-Personenverkehr AG does not create any digital fingerprints. ÖBB-Personenverkehr AG therefore has no personal information about visitors to the timetable enquiries.

Accordingly, the use of cookies does not require consent, since only cookies that are necessary for the operation are set, user activities are only recorded without the possibility of tracing them back to a specific person, and data is not passed on to third parties.

We are legally obliged to inform our passengers about any breakdowns, about activities that are expected to result in breakdowns such as delays or train cancellations from transport services and the anticipated impacts. In case of personal bookings, such as reservations, there is an enhanced information obligation for other information technologies, where contact data are known to us.

As a result, prior to the start of your journey, we will send you an e-mail or text message notification, regardless of whether you have registered for a push service, in the event of a ticket booked online or on a mobile device with a fixed departure data and time, if at the time of booking the timetable for the connection is not yet fixed and therefore the departure and/or arrival time of the booked train can still change and we are aware of new travel information. In the event that you have made a booking via customer service or at a ticket counter, you will only receive a notification if you have disclosed your e-mail address to us.

However, such notifications shall be issued at the earliest 180 days before the booked start of the journey.

If you no longer wish to receive such notifications for a journey, you can simply cancel further notifications by clicking on the link “Cancel notification” in the e-mail notification “New travel information on your booking”. In the event of a cancellation, you will not receive any notifications by e-mail or text message after technical implementation.

There is no option to cancel in the event of a change to the rolling stock on Nightjet connections.

For the purpose of statutory customer information, we also receive data from other railway companies, ticket vendors and transport association organisations for the purpose of providing notifications regarding deviations.

If customers book tickets where the transport service is provided by a third party railway company, we will pass on the relevant data to the competent railway company so that you can be notified by the respective railway company in the event of any deviation.

For the purpose of notification, the following personal data will be processed by the controller:

Email address, telephone number, details of the train connection (starting station, destination station, date and departure time/arrival time, train number, carriage number, service category booked, booking code and reservation number).

Notifications will be deleted 18 months after the date of travel. We use the Microsoft Azure service to send you notifications. With regard to the associated international data transfer, please also refer to Section 6.7..

If connected to WiFi on your train (“OEBB”), the ÖBB onboard portal offers passengers access to service functions related to the train and the journey, to the ORF-TVthek (ORF TV library) as well as free access to over 100 digital Austria Kiosk newspapers and magazines, among other things.

In order to use the WiFi and the onboard portal with all its functions, you as the user must agree to the terms of use when connecting to the WiFi. The terms of use also inform you about the use of cookies on the ÖBB onboard portal.

Cookies are used by the onboard portal in order to allow for the provision of a comprehensive and customer-friendly service. Cookies are used for the following functions: journey preview, ORF TVthek, data analysis by Piwik (Matomo).

Google Maps /Apple Maps are online map services, which show the earth’s surface as a roadmap or an aerial or satellite image, on which locations of institutions or known structures are also displayed.

We use Google Maps for the following purposes:

• To select routes on the home page https://www.nightjet.com/
• To display sights on city pages (for example at: https://www.nightjet.com/reiseziele/oesterreich/innsbruck.html)
• To display connections on country pages (for example at: http://www.nightjet.com/reiseziele/italien.html)

We use Google Maps and Apple Maps to display stops near you when using the SimplyGo! feature.

For these purposes, “Google Maps JavaScript API” or “Google Maps SDK for Android” is used. No personalisation is implemented and no cookies are set by Google Maps-API.

SimplyGo! makes buying tickets with your customer account easier than ever. With the help of GPS location services and smartphone sensors, SimplyGo! automatically recognises your journeys on public transport in Austria and takes care of all the necessary ticket-purchasing steps. SimplyGo! takes care of all further steps after you check in at the start of your trip and check out at your destination, automatically charging your credit or debit card for the trip.

The following information is required from the customer for this optional convenience feature:

• First and last name
• Date of birth,
• E-mail address used for the customer account,
• Federal state and
• the data that you yourself have stored in your customer account.

The following data is automatically collected by the controller during use:

• operating system of the mobile device incl. device ID, model of the mobile device,
• start and end time of a journey,
• automatically detected or manually selected check-in stop,
• check-in time,
• automatically detected check-out stop,
• check-out time (active or passive),
• start and end time and total duration,
• GPS location data along the travel route,
• WiFi access points,
• GSM location data,
• accelerometer data,
• means of transport used,
• any discounts on file,
• assigned journey ID
• assigned tracking ID

This is used to determine reference values and points that help identify the start, course and end of the journey. The ÖBB App assigns a valid public transport timetable to this mobility behaviour and determines the fare.

For technical reasons, we require iOS devices to “always” grant permission to access the location. This is important so that ongoing journeys can also be recorded in cases where the ÖBB App is only running in the background.

Pseudonymised data is transferred to our data processor FAIRTIQ AG Aarbergergasse 29 3006 Bern Switzerland for the further development of SimplyGo! functionality. Our data processor itself is not able to establish a personal connection to you.

If a payment method is registered for the SimplyGo! function, we will store payment information for a period of 12 months, including in the event that the function is deactivated, for the purpose of processing any required corrections.

Data collected as a result of the use of our automatic ticketing will be deleted at different times:

1. Data relating to the processing of ticket purchases (incl. responses to customer enquiries and validation data) will be stored for the duration of the statutory limitation period of three years.

2. Accounting data must be retained for a period of ten years due to statutory retention requirements (§ 209 (5) BAO).

3. Collected data will also be used for the defence of legal claims (for example, fraud cases) and stored for a period of three years from the legally binding conclusion of the legal or regulatory dispute.

We are introducing a new service for you with immediate effect: Consultation and sales talks are now also conducted online.

This procedure not only offers a good alternative for persons with restricted mobility, but also allows you to use the travel agency service of ÖBB-PV AG without restrictions from wherever you are.

Even if the sales and consultation meetings are held online, we will not record any of the conversations.

Online consultations in travel agencies are only provided at your request and are not mandatory. For this purpose, you have the option of booking an online consultation at https://reisebuero.oebb.at/ (registration for appointment). Registration generates an email that is delivered to the inbox of your selected branch.

In the event of an app date at the ticket counter, your registration will be sent by email to an internal central coordination unit for appointment management.

The following data is collected as part of the registration for an appointment at a travel agency: First and last name, e-mail address, telephone number, date on which an appointment is requested, requested branch, time window and comments. This data is used exclusively for online consultation and the sale of travel products.

The following data is collected as part of the registration for an appointment at a ticket counter: First and last name, e-mail address, telephone number, date on which an appointment is requested, requested counter, time window, type of operating system (Apple or Android), areas of interest and comments. This data is used exclusively for on-site consultation.

We use personal data in order to send you general information, offers and recommendations as well as information, offers and recommendations tailored specifically to your mobility needs and user behaviour or to have such information sent to you by our cooperating partners (customised offers). Furthermore, this data is used for the further development and optimisation of services relevant to customers. However, this is only the case if you grant your consent in advance to let us contact you by e-mail, telephone, SMS or other ÖBB channels (e.g. ÖBB account), in order to inform you in a timely manner about interesting offers, new developments and services.

Your personal data will exclusively be used by us in both cases and not transferred to cooperating partners or other affiliated companies.

Depending on the content of the consent granted by you, you will receive offers and other information from us concerning ÖBB-Personenverkehr AG (for example on general services, sweepstakes and customer surveys) and the ÖBB Group, i.e. including other affiliated companies (e.g. information on travel offers from Rail Tours Touristik GmbH or car sharing offers from Rail Equipment GmbH) or other cooperating partners.

If you wish to receive customised information and recommendations adapted to your needs (based on your previous purchasing and travel behaviour or your other personal preferences), we can forward these to you for:

• our products and services;
• current or individually tailored offers;
• vouchers;
• sweepstakes and campaigns;
• customer surveys,
• relevant services (in particular information on the ÖBB account and our apps);
• product and travel recommendations (including travel insurance and additional offers for tourists); or
• other customer loyalty activities, e.g. ÖBB Vorzugspunkte

.

The compilation of these contents is based on evaluation of the following data: first and last name, date of birth, address and contact data, details stored on your person regarding bookings, customer cards and season tickets, discounts, travel and voucher data, geodata, preferences and customer loyalty activities associated with you, device and browser information, including user behaviour assignable to you or data on any mobility preferences or restrictions.

Details on booking data include, for example, your selected travel date and time, the actual booking date, booked tickets or special additional offers for tourists, seat reservations, information on utilised offers or vouchers added to your account, information on the start and end station, the sales channel, selected timetable connections including intermediate stops, train types, wagon classes or compartments, information on booked night or day trains, currency used, vehicle data, bicycles, accompanying dogs, information on booked pieces of luggage, as well as information on whether you are travelling alone, with other people or with a child (or children).

In order to provide you with customized information on customer cards and season tickets, we use details of valid/expired/extended customer cards, such as Vorteilscard, Klimaticket and any SEPA mandates, as well as details of acquired season tickets, e.g. hourly passes, weekly passes, monthly passes.

By discount data, we mean your discounts used in buying tickets, such as indication of a Vorteilscard, Klimaticket, city transport ticket, family pass, etc.

Travel data include information on already commenced or planned (booked) journeys, information on the duration of your journey, any delays, validation details regarding your ticket or your customer card, as well as details of such journeys referred to under booking data.

If (e.g. in the context of a campaign) a voucher was added to your ÖBB account, we will use such information to deliver reminders to you about its use, for example. Moreover, we will use the information once the voucher has been cashed, as well as details of the journey booked or the product purchased with such voucher.

By preferences assigned to you we mean, for example, your connection favourites, your stored payment favourites, timetable connections stored by you (including other passengers, selected timetable filters, 1st class journeys, request for a seat reservation, journeys on specific weekdays).

Customer loyalty activities include information and further details on previously sent sales and campaigns, vouchers, sweepstakes, customer surveys (e.g. ÖBB Vorzugspunkte), recommendations and other information.

Device and browser information including user behaviour assignable to you includes information on your employed devices (computer, laptop, smartphone, etc.) with which you visit our websites and the associated web browsers (e.g. Internet Explorer, Firefox, Safari, etc.). This also includes information on whether you have downloaded and used the ÖBB App. Your assignable user behaviour includes, for example, details on the use of your ÖBB account with relevant devices and the ÖBB App (e.g. account creation details, settings implemented, such as e.g. gender and language, details of logins, added discounts and customer cards, deposited vouchers, ticket purchases and reservations, stored favourites, etc.). In addition, technical information (e.g. IP address, browser type and version, time of access by the visitor’s computer) is collected in order to determine whether an e-mail has reached you, which e-mails you have opened when and which links in the e-mail you have accessed.

We use data on any mobility preferences or restrictions in order to offer you relevant information, recommendations and services in the event of you needing a wheelchair place or if a companion or service dog is travelling along, etc.

We use the technologies of Microsoft Customer Insights (Customer Insights and Contact History | Microsoft Dynamics 365), which act as our contract processors, to create and send out customised offers. The two aforementioned providers support us in the planning, implementation and analysis, especially in the technical implementation and handling of our measures, as follows:

• The technology used by our contract processors allows us to evaluate the use of our e-mail newsletters. Among other things, we receive information as to whether an e-mail has reached the recipient or has been rejected by the server. For the evaluation, the software uses a so-called tracking pixel (web beacon), which is retrieved when the e-mail is opened. The analyses also include determining whether our newsletters are opened, when they are opened and which links were clicked. In the process, technical information (e.g. IP address, browser type and version, time of access by the visitor’s computer) is collected. These evaluations help us to recognise our recipients’ reading habits and to adapt our content to reflect these or to send different content in accordance with our recipients’ interests.

This type of data processing also involves profiling as per Article 4 No. 4 GDPR, to the extent that it concerns the preparation and sending of customised offers.

Profiles are created about our customers, which

• allow conclusions on the probability of their future purchasing, booking and usage behaviour,
• allow for target group selections and aggregated or concrete evaluations regarding products and services.

Our general and customised offers can be sent by mail, e-mail, as a push message, in your ÖBB account or via other ÖBB channels.

This special form of processing is based on your consent in accordance with Article 6(1) a) GDPR, to the extent that we are entitled to carry out such data processing.

We use profiling methods to optimise and personalise our advertising measures. Below, you will find information on the logic involved as well as on the scope and intended effects of these procedures.

• In order to optimise and personalise our advertising measures, we create customer profiles and use these customer profiles to assign customers to specific customer segments. Based on this segmentation, we can control the type, content and frequency of certain advertising measures for specific target groups.

• For profiling, we use data that we receive from you within the scope of our customer relationship, provided that you have given us your consent for “Newsletter and Account+”. Address and contact data, purchase, booking and travel data, information on customer cards and season tickets, discount data, data on mobility preferences and usage data. Profiling can be based in particular on user profiles derived from usage data, which we create with the customer’s consent by measuring and evaluating the customer’s interaction with electronic advertising, in particular by measuring and evaluating the opening and click rate in e-mail newsletters.

• An important factor in the establishment of our customer segments is the so-called scoring, in which we evaluate customers according to scientifically recognised mathematical-statistical procedures based on aspects relevant to advertising.

• The scope and impact of customer segmentation based on profiling is limited to target-group-specific management of the type, content and frequency of our advertising measures and the level and value of potential incentives. This may result in you receiving or not receiving certain measures which may or may not be made available to other customers.

You also have the opportunity to register for special offers and services, for example for the Nightjet newsletter, Scotty push service or information on usability tests.

Please note that any of these services which require separate consent must also be revoked separately. As a result, revocation of any individual consent does not apply automatically to all additionally submitted declarations of consent, but they must also be revoked separately.

If we are aware of your address due to purchases and services, or we are allowed to buy it from third parties (e.g. from Österreichische Post AG), we can send you event-driven information, offers and recommendations by post. You can prevent the sending of such information at any time, by declaring your objection (see explanations below). Following receipt of an objection, we will no longer send you any other announcements.

Postal deliveries will also be made to our stakeholders at regular intervals, for example prior to the annual timetable change as well as ad-hoc for relevant subjects.

Please note that the annual invitation to renew the contract does not constitute a direct advertising measure. Based on existing contractual obligations (see our fare conditions ÖBB Fares – Fare conditions), we will also continue to send you this invitation to renew the contract, and even if you had exercised your right to objection, especially as such a consignment is not subject to the right of objection to direct marketing.

If you no longer wish to be included in our direct marketing activities, you have the right to file an objection thereto (Article 21(2) and Article 22 GDPR) or to revoke your previously granted consent. The following options are available for you to make these declarations:

• If you have declared your consent electronically, you can then declare revocation under “Account & Settings / Newsletter and Account+” in the ÖBB account.
• In a newsletter, simply click on the unsubscribe link and we will stop sending you electronic mail in the future. It may take up to 48 hours for the activation of a revocation to be completed in the systems.
• In all other cases, please contact our ÖBB customer service using the contact form at www.oebb.at/kontakt.

If you have exercised your right and decided against any use of your personal data for advertising purposes (in particular direct advertising), in accordance with your request, you will not receive any information, offers and news and can no longer log onto your ÖBB account for our “Newsletter and Account+” service.

If at a later point in time you wish to reactivate our services in your ÖBB account under “Newsletter and Account+”, please contact our customer service.

See the cookie guideline published on the ÖBB-Personenverkehr AG website (www.oebb.at).

See the cookie guideline published on the ÖBB-Personenverkehr AG website (www.oebb.at).

Social media plugins

We have embedded contents from external providers, such as Facebook, YouTube, Twitter, on individual websites or we may transfer you to the websites of external providers. We could not identify any legal violations at the time of linking. Should we become aware of any such infringement, we will remove the link with immediate effect. In order to be able to recommend and share content on social networks such as Facebook, Twitter and Google+, corresponding buttons are integrated into the platform.

These buttons only transfer data to external providers or other third parties if you press the corresponding button as participant. We have prevented an immediate transfer of data to external providers or other third parties in case of mere access to our websites. As a result, it is completely up to you to activate transfer in the individual case.

Sweepstakes on social media and in the customer magazine

If personal data are recorded by participants within the framework of a sweepstake on social media, they shall exclusively be collected, processed and used for the purposes of implementing the sweepstake, unless you have specifically granted your consent for the use of your personal data for other purposes, or use of data is required in the individual case for legal or other overriding reasons (thus for example in the event of a legal or other regulatory request or in the event of legal or regulatory disputes).

We will delete or anonymise collected and processed data following expiry of the statutory period of limitation (i.e. usually after three years have elapsed). The same applies to any messaging history in social media. We cannot assume any responsibility for the correctness, timeliness and completeness of data that you have disclosed personally. In your own interests, please therefore ensure that data disclosed by you are correct, up-to-date and complete.

For us, information security means:

• Confidentiality of data: Your data is only accessible to those who actually need it.
• Data integrity: We ensure that your data is accurate, complete and consistent.
• Data availability: We protect your data from accidental destruction or loss and ensure that it can be recovered in the event of an emergency.

To ensure information security, we have established organisational frameworks, such as checking the professional qualifications of our employees, as well as their trustworthiness and reliability. Technical measures also ensure the protection of personal data, including access controls, access monitoring and access restrictions.

Concrete technical protective measures are, in particular:

• Load distribution,
• Firewalls,
• Encryption,
• Security tests,
• System inspection and
• Constant monitoring.

Our employees are only granted access rights in accordance with their roles and to an extent that is absolutely necessary. The use of these access rights is recorded.

Your data is protected by a secure online connection (TLS) between your PC, tablet or smartphone and our servers, depending on the browser configuration, with at least 128 Bits.

Security measures for the system in the event of purchase on the ÖBB App or an online purchase were developed based on the following standards:

• ÖNORM A 7700 (standard for the security of web applications);
• PCI DSS (Payment Card Industry Data Security Standard); and
• ASVS (Application Security Verification Standard)
• ISO/IEC 27001 certification

The system therefore fulfils the security standards of the Application Verification Standard 2010 (ASVS) and was also tested by an independent expert. ASVS 2010 represents the leading current standard for IT security. Moreover, the ÖBB App was developed in accordance with requirements of data protection law and continually adjusted to new requirements.