Customer satisfaction is our top priority. This means that protecting your data is particularly important. We would like to thank you for the trust you place in us by submitting your data to us for processing. As a sign that we respect your rights as well as your privacy, we have formulated our policy, which applies when processing your data:
Our data privacy statement applies to anyone who makes use of one of our products or services, visits our websites or uses our apps. This includes: buying a ticket, including ancillary services, such as making a reservation, purchase of a customer card or use of our services.
We are constantly continuing the development of our offers and services. This is also why we will constantly adapt our data protection declaration. We will, however, make sure that the latest version will always be available to you.
ÖBB-Personenverkehr AG (ÖBB-PV AG), FN [company registration number] 248742y, Am Hauptbahnhof 2, 1100 Vienna, tel. +43 1 93000 0, is the controller under data protection law, as defined in Article 4(7) GDPR.
GDPR defines a controller as a natural person or legal entity, authority, institution or other body, which, on its own or in conjunction with others, decides on the purposes and means of processing personal data.
By personal data we mean all information relating to an identified or identifiable natural person (hereinafter “data subjects”).
A natural person is regarded as identifiable if said person can be identified as precisely this natural person, in particular through allocation of an identifier such as a name, identification number, location data, online identification data or one or more other special features in the particular individual case (e.g. voice). Thus this includes, at the least, the data that can be associated with you as a customer. For example, your name, email address, telephone number, booking code, ticket code or your customer number are personal data.
The legal basis of data processing according to Article 6 GDPR comprises either the fulfilment of the contract, the fulfilment of a statutory obligation, your prior consent or our overriding legitimate interests, which may also include processing for a further purpose.
Data that can be associated with your person can stem from the following occasions, purposes and sources:
Pursuant to the provisions of Article 12 et seq. GDPR, we would like to inform you on the following topics:
ÖBB-Personenverkehr AG (ÖBB-PV AG), FN 248742 y, Am Hauptbahnhof 2, 1100 Vienna, telephone +43 1 93000 0 is the controller under data protection law, as defined in Article 4(7) GDPR.
If you have any questions regarding data protection or the use of your personal data, feel free to contact our data protection officer.
Contact details of the data protection officer:
Am Hauptbahnhof 2
We will collect personal data ourselves, pursuant to Article 13 GDPR, in the following cases and for the following purposes:
In the following cases and for the following purposes, personal data will not be collected by ourselves but will be disclosed by third parties in accordance with Article 14 GDPR:
The data processed for these purposes is disclosed to the following categories of recipients as required and depending on the intended use:
Our data processing is therefore carried out in particular based on the legal framework conditions summarised again below (as amended):
We do not intend to transmit personal data to third countries or to an international organisation.
In general, personal data are only stored by us to the extent that this is absolutely necessary and in principle are deleted following expiry of the statutory period of limitations under civil law of three years (e.g. customer correspondence) or in the case of invoice-relevant data, after ten years (e.g. booked tickets, customer cards) in accordance with § 212 UGB or §§ 132 et seq. BAO. A longer storage period is only implemented in justified individual cases, for example as a result of an ongoing civil law or regulatory dispute.
Specifically, we would like to emphasise the following various subject areas:
(1) Rights of data subjects
As the data subject in the individual case, you are entitled to assert the following rights of data subjects with us if we are the controller for the data processing:
If you wish to assert a data subject right, please contact us. To do so, the following contact options are available to you:
Contact details customer service:
ÖBB Customer Service
(Subject: assertion of rights of data subjects)
Please include the following information in your request:
We require this in order to verify your identity before we are able to answer your request or make the necessary arrangements. This verification of identity means that we can determine your actual characteristic as a data subject, so as to ensure that personal data is not disclosed to unauthorised third parties (risk of abuse).
Once we have received your request and you have proven your identity, we will respond to your request within four weeks. In the event that we have specific questions as part of the reply, we will contact you and ask you to cooperate and assist.
Furthermore, you have the right to submit a complaint to the data protection authority, according to §§ 24 et seq. DSG [Data Protection Act] and Article 77 et seq. GDPR if you believe that we have breached obligations under the General Data Protection Regulation.
Austrian Data Protection Authority,
1030 Vienna, Barichgasse 40-42,
Telephone: +43 1 52 152-0
www.dsb.gv.at(3) Withdrawal of consent
If you have granted us your consent to the processing of your data for a specific purpose, you have the right to revoke your consent at any time without providing reasons. We have described the method for exercising the right of withdrawal in the Chapter “Direct marketing – General and personalised advertising offers”.
Due to special domestic and international legal provisions, ÖBB-Personenverkehr AG is, in certain cases, obliged to collect data of passengers and to forward them to the competent authorities in Austria and abroad upon request. In other cases, ÖBB-Personenverkehr AG tries to contribute to the containment of the COVID-19 pandemic by voluntarily collecting data. We will, of course, treat the data you provide as confidential and use it exclusively for any necessary tracing of infection chains in the event of a request or specific legal obligation. Contact tracing in case of an incident serves the purpose of containing the pandemic, i.e. of protecting your health and that of other passengers.
In all cases, data will be deleted by ÖBB-Personenverkehr AG or any partner involved after 30 days at the latest. The legal basis is Article 6(1) c) and Article 9(2) i) GDPR, i.e. the specific domestic and international special legal provisions which serve to ensure national and international protection and hygiene concepts for the containment of serious health hazards, including transnational health hazards, and, in certain cases, the consent granted by you under Article 6(1) a) GDPR.
A legal obligation exists in the event of a visit to the ÖBB lounges.
Due to specific legal obligations in the Federal Republic of Germany, contact data is also collected on long-distance trains to Germany if the on-board restaurant is used:
With regard to your person we store the following data in particular:
We will store the following timetable settings:
We store the following other settings:
We store the following data centrally:
We have a wide range of customer cards on offer. Whether you are looking to travel at reduced prices, explore Austria all year round without the stress, enjoy regular family excursions or travel for business purposes, there is a customer card to suit you.
When ordering an ÖBB customer card (Vorteilscard, Österreichcard), you will be required to provide your personal data. In particular, this includes personal details such as your name, date of birth and address and, in the case of a SEPA mandate, your bank details (IBAN and BIC). Providing a telephone number is optional and allows us to contact you if we have any questions. The above data will help us to personalise the customer card and are processed by ÖBB-Personenverkehr AG to complete your order. Entering your personal data is mandatory when ordering a customer card. Failure to provide the details mentioned above may result in you being refused a customer card (provision of a telephone number is optional).
You will need an ÖBB account to order online or via our ÖBB app. This requires you to enter an e-mail address and password. This information will be saved.
Customer cards are produced by a reliable contractor. We take great care to ensure data are transmitted securely to the contractor. Data are exchanged in encrypted form only, and access to them has been reduced to the minimum necessary extent.
During the journey, our train attendants will validate (i.e. scan and check for validity) your customer card, annual ticket and/or ticket. Due to the temporary recognition of tickets issued by Westbahn Management GmbH, these tickets are also validated by our train attendants.
When scanning, only those data are visible on the train personnel’s device which can be found on your customer card or the ticket (e.g. card number, card validity, name of card holder, card type and comfort class, departure and arrival time, train number, boarding and exit station). When travelling on a passenger train using an authorisation issued by Westbahn Management GmbH, the URL contained in the QR code and therefore the ticket code and ticket number are scanned. In the case of our customer cards, the date of birth of the card holder is also displayed on the train crew’s device in order to facilitate identification. Our train attendants also receive information on whether the customer card or ticket was valid at the time of validation. Scanning allows for an electronic control of cards and the ticket (as opposed to a purely visual inspection) and in particular makes it possible to withdraw manipulated or wrongly used tickets or cards (for example if the validity period has already expired) from circulation.
Moreover, data are collected for our train staff, i.e. which employee performed validation when, where and how. Our train attendants are only able to view validation data for a limited amount of time.
We do not automatically analyse possible movements of our customers. An evaluation of the existing data material is carried out in individual cases if a data subject should request this information as part of his or her request for information under Article 15 DSGVO.
Validation is based on two different legal principles of equal value, i.e. (1) on the contract of carriage concluded with you, i.e. Article 6(1) b) GDPR, and (2) on prevailing legitimate interests, as defined in Article 6(1) f) GDPR, which consist of the performance of a necessary authorisation check, removal from circulation of customer cards and tickets which are no longer valid, as well as preventing additional cases of abuse (general prevention) and compliance with contractual obligations. For the duration of the recognition of their tickets, Westbahn Management GmbH and Schieneninfrastruktur-Dienstleistungsgesellschaft mbH (SCHIG mbH) will pass on the following data for the aforementioned general preventive reasons: Train number, time of validation and details of the scanned QR code.
In order to use all functions of our website and app, you can register, and we will create an ÖBB account for you. This means you will use all your stored data independently of devices and browsers, and simplify and accelerate timetable queries and ticket purchase.
In order to create an ÖBB account, we will need at least the following information: e-mail address, password, salutation, your first and last name and your date of birth.
Following data entry and registration, you will receive an e-mail from us, to confirm your e-mail address and activate the ÖBB account. Once you have confirmed the activation link, your ÖBB account will be active. The next time you log on, existing local data will be transferred onto your ÖBB account if you consent to this process.
In order to make use of additional benefits for your ÖBB account or to buy a personalised product, such as a customer card, we need additional personal data from you, i.e. your date of birth and address, optionally also your title and phone number. This allows us to offer you products tailored to you. We will send your ÖBB customer card in credit card format by post and remind you of any renewal in a timely manner prior to expiry.
Your ÖBB account facilitates comfortable and quick ticket purchase without repeated data entry, by storing your payment data as favourite payment methods.
In order to use our business services (website and app), business customers can create a business account. For example, you can register your company as a corporate customer and we will create an ÖBB business account for you.
This allows you to use all your stored data independent of devices and browsers and simplifies and accelerates timetable enquiries, ticket purchases, company structure management and the report function.
It’s as simple as this: name an administrator from your area who will handle the initial registration. For an initial registration, we need at least the following information: e-mail address, password, salutation, your first and last name, company name, address and an industry selection.
After entering the data and registering, the named administrator receives an e-mail from us to confirm the e-mail address, initiate the plausibility check and activate the ÖBB business account. Only after a positive plausibility check will the payment on account and the business tariff be activated. As soon as you confirm the activation link, your ÖBB business account is active.
In order to use or manage further advantages of the ÖBB business account, we optionally need additional data, such as: the structure of the company, employee names, e-mail addresses, employee role authorisation, employee discount cards, etc. This enables us to offer your employees or other persons assigned to the ÖBB business account relevant products.
The ÖBB business account also enables a pleasant and fast ticket purchase without repeated data entry by adding payment data in the administration. Payment data will be stored by our payment service provider, who processes your payment data using the international PCI DSS standard. The stored means of payment can be deleted at any time by persons who have received the corresponding authorisations by you.
You have the possibility to personalise your ÖBB account, by bookmarking yourself as ME and choosing a colour for your profile. Your customer account will be displayed in the colour that you have personally selected with immediate effect.
In the event that you no longer want to use your ÖBB account, you have the option of closing the ÖBB account again.
If you do not use your ÖBB account for longer than one year, we will automatically send a reminder to the e-mail address that you have disclosed. You will then have two weeks to log onto your ÖBB account. We can close your ÖBB account automatically if you fail to use this account for a longer period, given that in this case we assume that you no longer want to use it.
We have set ourselves the goal of allowing you to:
Our website tickets.oebb.at and our ÖBB app offer services customised to your personal needs, which simplify ticket purchase.
Transport association tickets can be purchased throughout Austria based on the timetable. In order to do so, simply enter the start and end point of the journey, and you will receive the right timetable and the associated ÖBB or transport association ticket. You can purchase tickets without needing to know all the individual fares in advance, be it for the bus, railway or tram.
Auto-completion for simple selection of the start and end point bookmarks your most recent entries. Your timetable query will therefore proceed more quickly the next time. Registered users can use this service on all sales channels and devices when logged in. Regardless of whether you book your journey on a computer on the Internet or using the ÖBB app on your mobile phone, with a logged-in ÖBB account we will store your last start and end point entries and offer you them for selection in your top station hits.
Recently searched timetable connections are provided for you in the future timetable search as a personal quick selection.
Using the function “bookmark person”:
If you wish, when bookmarking your own travel data, you can then advise us that this person is you. We will then store this information for your next journey as ME.
We store the route for your ticket purchase. This means you can check whether the travel data have changed in the journey preview at any time. If we are aware of a different updated timetable, we will display this. We will delete the planned time from the timetable and replace it with the actually forecast time. We aim to keep you informed as far as possible at all times, allowing you to react to changes in travel data in good time.
Shortly before the start of the journey, the journey preview for your booking will become your personal travel companion. We will then advise you of the next relevant actions to your journey, for example: “Change trains in 10 minutes.”
You can always find the offer with the best price as the first offer on our website and in our app. If there is an additional offer for your travel request, which offers more flexibility in travel time or the refunding of tickets, we will advise you of this alternative. You can decide whether price or flexibility is more important to you for each journey.
You can cancel a purchase within 3 minutes of payment at tickets.oebb.at or in the ÖBB app. This is only possible if you have not yet acquired your travel card in the form of a ticket. You can subsequently return to the shopping basket and make retrospective changes to your purchase.
You can buy your ticket quickly with 2 clicks, by registering and storing your payment data in your ÖBB account. Set up a quick display of the requested offer on the home page and this function can already be used. We store your offer request for the requested timetable connection (e.g. best price, reservation request, requested travel class, number of passengers). Then, all you have to do is place it in the shopping basket with a click, and pay with a second click.
Store special timetable connections as favourites if you regularly travel on the same route with the same preferences. This includes:
We only bookmark these data at your intentional request. This favourite is located on your personal home page and allows you to directly display timetable or offer information with one click when opening the application, without having to indicate data again for the current purchase or timetable request.
If you place your favourites on the home page, we will store your travel request.
But you can also store connection information as favourites for a specific timetable connection. In this case, you can use an additional practical service with location determination: “Only display if I am near the target destination and display the start if I am near the start location”
For a specific journey we always bookmark the name of the person printed on tickets. This means we can be certain that a ticket is not used several times by different persons with fraudulent intent. As a result, please carry your photo ID for the ticket with you, to allow train staff to check on the correct use of the ticket on site.
If you are travelling with children or young people, we will bookmark the age of the children. The children’s age limits differ in individual transport authorities and countries. Only if we know the age of your children can we determine the right price for the ticket purchase and create the best offer for you. We are obliged to store the date of birth for international travel.
We will provide you with all known information about your journey. In this way, you will have the most detailed and current information about your journeys and are able to respond to changes on time. Your travel companion in the ÖBB app and website has the latest information for you at all times:
Your location information will only be used in the ÖBB app if you share it with us.
By payment information we mean information that we require for processing the payment. As a matter of principle, we will never store any payment information, such as credit or debit card numbers, expiry date, the card validation code (CVC) or user account and password data. We will only store payment information to a limited extent, namely
In all other cases, payment information (e.g. expiry date or the card validation code (CVC)) will be processed and used by a tested and certified payment service provider (Terminal Service Provider and Payment Service Provider).
In order to clearly authorise a payment, the payment service provider will require various pieces of information from us, such as e.g. identification data for browser and operating system type, which are saved by us and forwarded to the payment service provider for processing the payment.
The European Banking Authority (EBA), Regulatory Technical Standards (RTS) and the revised Payment Services Directive (PSD2) prescribe strict authentication methods for combating online fraud. PSD2 aims at preventing online fraud with strict customer authentication rules applied to an increased number of transactions.
So-called Strong Customer Authentication (SCA) is an obligatory part of PSD2 and ensures a high level of customer protection and increased payment security. SCA is therefore required whenever you, the customer, start an electronic payment process or perform a transaction that poses a risk of payment fraud or other misconduct. In this case, you will be required to complete an identification process by providing a password and another identification factor as determined by the payment service provider. In certain exceptional cases, this authentication can be dispensed with. The decision to apply SCA or dispense with authentication rests with the payment service provider.
We are required to provide the payment service provider with the relevant data requested in order to secure your payment transaction (see in particular https://doc.wirecard.com/CreditCard.html#CreditCard_PSD2).
More information on this can also be found on the payment service provider’s own website (see, for example, https://www.wirecardbank.de/DSGVO or https://www.wirecardbank.de/datenschutzbestimmungen/).).
For the purposes of payment risk management, as required in the specific case and as part of the purchase transaction, personal data may be transmitted in the absolutely necessary extent to the payment service provider, which then uses this data to conduct a risk assessment. Payment-related data will also be consulted for anonymised analyses.
The ÖBB App is distributed via the Apple App Store and the Google Play Store (hereinafter referred to as “Store”). Inclusion, distribution and use of the ÖBB App is therefore additionally subject to the separate conditions of these two stores, over which we have no influence, and which are compiled and asserted at the sole responsibility of the stores.
When using our website tickets.oebb.at or our ÖBB App, data on your ticket purchase will be stored by Html storage in the web browser or in local storage on your mobile phone. This ensures that all functions, such as “bookmark person” or personalised fast selection can also be used if you wish to use our software without registration. We will only store personal data for quicker processing of future purchases if you wish us to do so.
We would like you to learn the full scope of functions of our software. For this purpose, we have made sure that you will receive practical tips and information from us at an appropriate spot. We want to provide you with relevant information and not continually repeat this. This is why we store functions used by you for a maximum period of 18 months. As a result, you will always receive the right (not yet known to you) information in different web browsers and on different devices with the ÖBB App.
If you do not want us to store this information about your person, use our website or our ÖBB App without logging on. This means we will not be able to assign this information to your person.
Even if we store this information about your person, we will not conduct any personal analyses. We shall only use this information in anonymised form to identify any need for adjustment in our systems. This allows us to continually improve our applications and provide optimal support to our customers.
We have expanded our distribution channels for you. This means that you can now also find our connections on partner platforms and can, in part, also book your ticket directly on the platform of our partner. If the booking is made through a partner, we exchange only the schedule and ticket information with the partner that is required for the creation of the ticket. The respective partner is responsible for the protection of the data processed on the partner platform of the partner.
In certain municipalities throughout Austria you can book a fast and comfortable shuttle service to your destination (ÖBB Shuttle). The ÖBB Shuttle Service picks you up directly from the train station, takes you to the hotel selected during the booking process and also takes you back to the train station on your day of departure.
When booking a ticket for a specific train journey (i.e. booking a ticket to your destination and back), you will automatically be offered the ÖBB Shuttle Service if this service is available at your destination. If you would like to avail yourself of this service, you can book it together with your train ticket as part of a booking process. Detailed provisions concerning the ÖBB Shuttle can also be found in the Guide for travelling with ÖBB in Austria.
The driver of the transfer vehicle (bus or taxi company) will be waiting for you at the station or, in case of return, in front of the selected hotel. The transfer service is provided by our cooperating partners (currently ÖBB-Postbus GmbH).
In order to use this transfer service, the following data is collected during the booking process: first and last name, place of collection and destination, number of persons to be transported, data for validation, price and chosen method of payment.
In order to provide the transfer service, the aforementioned data will be passed on to the cooperating partner (currently ÖBB-Postbus GmbH) in the case of a booking and by the cooperating partner to the third party providing the service (e.g. local taxi companies at the destination) in the event that the cooperating partner does not provide the transfer service itself.
ÖBB-Personenverkehr AG (as far as the train service is concerned) as well as the individual cooperating partner or the third party commissioned by the cooperating partner (as far as the transfer service is concerned) shall carry out this service under their own responsibility under data protection law. As a consequence, you must in particular exercise your claims/rights under data protection law (e.g. a request for information under data protection law) against ÖBB-Personenverkehr AG as well as against the respective cooperating partner and commissioned third parties.
If you wish, we will also be happy to forward enquiries to the cooperating partner or to the commissioned third party.
In order to enhance the mobility chain within Austria, ÖBB Rail&Drive cars are made available at selected ÖBB train stations. This car sharing offer is available to all registered ÖBB Rail&Drive customers.
To register, please use the ÖBB Rail&Drive website https://www.railanddrive.at/. The verification process can then be completed at selected sales offices of ÖBB-Personenverkehr AG (i.e. ÖBB ticket counters, ÖBB travel agencies and ÖBB lounges). The applicable sales offices are published on our website and can be accessed via the following link: https://www.oebb.at/de/reiseplanung-services/am-bahnhof/last-mile.html Alternatively, you can also carry out the entire registration process at these locations. For this purpose we provide computers and tablets at selected sales points. This allows you to start the registration process and/or complete the verification process on site. Disclosure of the following information is required to use the Rail&Drive service: driving licence data, first name, last name, address, date of birth. Please make sure that you are able to verify the information you have provided by means of appropriate evidence on site. In particular, it must also be ensured that the driving licence issued to the customer in question was issued in a Member State of the European Union. A physical and/or digital copy of the driving licence is made on site. The collected data is kept for a period of one week and then deleted or destroyed.
ÖBB-Personenverkehr AG will forward the collected data and documents electronically to Rail Equipment GmbH & Co KG, which is responsible for this service under data protection law. In this case, ÖBB-Personenverkehr AG acts as the processor for Rail Equipment GmbH & Co KG.
Your data protection claims with regard to the ÖBB Rail&Drive service must therefore be asserted against Rail Equipment GmbH & Co KG.
Rail Equipment GmbH & Co KG
The data collected at the point of sale is recorded by the data controller, Rail Equipment GmbH, in its own data processing systems and used for the purpose of providing the service. Further information on the use of data can be found in the data privacy statement of Rail Equipment GmbH & Co KG (available at https://www.railanddrive.at/de/datenschutzerklaerung).
To improve the commuter situation and make it easier to access public transport and the related economic benefits, we want to do our part to protect the environment and manage resources sustainably. That is why we hire vehicles and make these available to daytime users and commuters as part of a ‘Sharing Model’. They are made available to a limited group of users, and exclusively to persons who are named and authorised in relevant user contracts.
Daytime users can use the vehicle during the day on workdays. In contrast, commuters are authorised to use the vehicles on workdays in the early and evening hours and at weekends and on public holidays.
In addition to personal data (such as name, address, phone number), the duration and data for usage authorisation, ID data (driving licences, proof of ID), data relevant to payment, data on damage caused and traffic violations will be stored in respect of the daytime user or commuter.
The daytime users / commuters will be sent the respective other party’s user data in order to ensure handover of the vehicle. The data to be exchanged have been restricted to the absolutely necessary extent, i.e. name and phone number. We have explicitly prohibited the use of such data for other purposes in the contracts.
Our timetable information service SCOTTY mobile and web offers you the opportunity to obtain information about timetables, stations or the current transport situation of ÖBB trains and several other transport operators. With the door-to-door timetable information you can query the fastest route from A to B throughout Austria and use other services. Moreover, additional relevant information is available, such as data on station or train equipment, as well as the opportunity to store journey data in your own calendar.
SCOTTY mobile and web is a service which can be used without registration. This service is therefore generally anonymous, because storage of your contact data, location data, calendar entries, query results, etc. is not carried out by ÖBB. The only exception is if you make use of our push notifications. As a result, ÖBB cannot and will not use data for any other purposes. Your query results remain completely anonymous and will not be stored, meaning that we cannot and do not create user profiles.
An active Internet connection is required for the installation of SCOTTY mobile on your device and to communicate with our information server, which calculates connection results for you. Depending on the operating system, the authorisation to use the Internet for this is referred to as “data services”, “Internet” or “access to all networks”.
Depending on the operating system used, certain platforms (e.g. Android) display standardised security information as required by the operating system when first installing SCOTTY mobile or using the app. However, this explanatory information (e.g. reading confidential information, such as call records) does not refer to SCOTTY but to the operating system’s general default settings and therefore cannot be modified by ÖBB.
In order to allow you to use all functions of SCOTTY mobile, it is necessary to grant further rights, allowing for access to specific data for your device. You can revoke the application’s rights individually at any time. Depending on the operating system used, you can deactivate them yourself in the security or systems settings.
Contact data: These will only be used to display the transport connection to or from a contact from your address book. Only city names, roads and house numbers are transferred. We will not store (nor cache) such data.
Position or location data: Your current location can only be identified for an optimal connection search by SCOTTY mobile if you wish, in order to search for travel connections from there or to find stations nearby. No caching is carried out, either, and as a result the creation of movement profiles, etc. is not possible.
Movement and direction sensor, compass function: This function makes it easier to search for stations nearby. We will not store (nor cache) such data.
Calendar: SCOTTY mobile offers you an additional service to store travel data for your connection in your device’s calendar. This service is not compulsory, but is determined at your personal discretion. Depending on the operating system, the related security information “Read calendar dates and confidential information” or “Add or change calendar dates without the knowledge of the owners and send e-mails to guests” relate to this function. However, the actual contents of the calendar will not be read.
Amend or delete USB memory contents: This access is only required if you wish to store SCOTTY mobile on the SD card.
Install links: This right is necessary in order to create shortcuts for connections and departure boards.
Read call list: This right is required by the Android operating system by default if address data can be read from contacts. Information in the call list, however, will not be read by SCOTTY mobile.
Photo, music and video libraries: This right is required for technical reasons in order to create live tile graphics (cards). No private data is retrieved in the process and no data that would be visible for other apps is written onto your device.
Camera: record photos and videos: this right is required in order to use augmented reality. No photos or videos will be stored.
Notifications: This right is required to receive and display push messages (e.g. information on delays).
A push notification is available to you both with Scotty mobile and with Scotty Web.
As a result, you can decide whether or not you wish to use the function.
Notifications are completely free of charge to you. We will inform you if we have the necessary information on delays, changed departure platforms, risky connections, train cancellations or deviations and recommendations for the connection selected by you. As soon as there is any change to your connection, you will receive a push notification, provided we hold such information.
In addition, you can deactivate push notifications again at any time.
If you use the “Notifications” function, identification parameters, travel connection data, device IDs, relevant intervals and your e-mail address are stored in Scotty web. Data are stored in case of one-off notification, as long as the selected connection is valid. If you have repeatedly set notifications on certain days, data shall be stored for as long as repeated notification is requested by you.
Scotty mobile analytical service
In the event of app usage, it records user activities without the option to draw conclusions on a specific person. The anonymous analysis helps us to further improve the app and adapt it in a targeted way to the needs of our customers. If you still do not request this analysis, you can deactivate the analysis in the app (see menu item “Settings” → “Record anonymous user activities”).
The analysis is conducted via an anonymous user ID, which does not allow for traceability or an opportunity to draw conclusions about the identity of a specific person.
Google Firebase Analytics is not used in our analyses and has been deactivated by us.
We are legally obliged to inform our passengers about any breakdowns, about activities that are expected to result in breakdowns such as delays or train cancellations from transport services and the anticipated impacts. In case of personal bookings, such as reservations, there is an enhanced information obligation for other information technologies, where contact data are known to us.
As a result, we will send you an e-mail notification, regardless of whether you have registered for a push service, in the event of a ticket booked online or on a mobile device with a fixed departure data and time before the start of the journey, if we are aware of new travel information. In the event that you have made a booking via customer service or at a ticket counter, you will only receive a notification if and when you have disclosed your e-mail address to us.
However, such notifications shall be issued at the earliest 3 days before the booked start of the journey.
If you no longer wish to receive such notifications for a journey, you can simply cancel further notifications by clicking on the link “Cancel notification” in the e-mail notification “New travel information on your booking”.
Using the ÖBB-Alexa Skill on Amazon, you can search for train connections or query departure information from railway stations (departure board).
Connection information contains detailed information on the journey, including the train number, duration of journey, platforms and the lowest currently available price. You can find further details on the functions of ÖBB-Alexa Skill in the description of the skill on Amazon.
The ÖBB-Alexa Skill can only be used to query connections, pricing and other ÖBB information. Connections of other transport operators are not covered by this service.
In the course of use of the ÖBB-Alexa Skill, no personal data of customers are collected and used by ÖBB-Personenverkehr AG. The ÖBB-Alexa Skill is used anonymously. ÖBB has no knowledge of whether you use the ÖBB-Alexa Skill or which queries you make to the ÖBB-Alexa Skill, because ÖBB is unable to establish any personal reference to you.
In order for the service to be used, certain technical data are collected by ÖBB-Personenverkehr AG, which do not allow for any conclusion to be drawn on your person:
Only those technical data which are necessary to allow for the use of the ÖBB-Alexa Skill are forwarded to Amazon by ÖBB.
In order to protect your data, the data transmission from ÖBB to Amazon or from Amazon to ÖBB is encrypted by TLS 1.2.
Data collected and processed when using the ÖBB-Alexa Skill are stored for a period of one year and automatically deleted following the lapse of this period. Access to data has been reduced to the extent that is absolutely necessary.
If connected to WiFi on your train (“OEBB”), the ÖBB onboard portal offers passengers access to service functions related to the train and the journey, to the ORF-TVthek (ORF TV library) as well as free access to over 100 digital Austria Kiosk newspapers and magazines, among other things.
Cookies are used by the onboard portal in order to allow for the provision of a comprehensive and customer-friendly service. Cookies are used for the following functions: journey preview, ORF TVthek, data analysis by Piwik (Matomo).
When using the ÖBB onboard portal, no personal data about customers will be collected and used by ÖBB-Personenverkehr AG. Therefore, the use of the ÖBB onboard portal is anonymous.
Google Maps is an online map service, which looks at the earth’s surface as a roadmap or an aerial or satellite image, on which locations of institutions or known structures are also displayed.
We use Google Maps for the following purposes:
We can organise optimal assistance for you at the station upon free advance notice at ÖBB customer service, at the ÖBB ticket counter, or at an information point at the train station. Please let us know about your desired journey in good time (see https://www.oebb.at/de/reiseplanung-services/barrierefrei-reisen/mobilitaetsservice.html).
We require the following data for advance notice: (1) first and last name and address; (2) phone number for queries and communications; (3) journey date, route (departure/transfer/arrival station); (4) disclosure of whether you are travelling with a companion or luggage; (5) type of mobility restriction (wheelchair user, walking disability, visual impairment, other restriction); (6) disclosure of whether any aid is required (lifting device, railway wheelchair,...); (7) disclosure of the meeting point at the station; and (8) carriage and seat number.
Data on a provided service will be stored by ÖBB-Personenverkehr AG on a national level for a maximum period of three years and subsequently automatically deleted in order for data to be available in the event of customer queries.
In the event of cross-border journeys, data are transferred to a database provided by the International Union of Railways (UIC, Union internationale des chemins de fer), to which only relevant partner railways (partner operators) have access for handling the mobility service. This is intended to ensure that appropriate assistance is provided at an international arrival station or stations by the responsible international partner railways (partner operators). The provision of a cross-border mobility service was agreed internationally within the framework of a separate agreement. In particular, the scope of data disclosed in the individual case and the intended use were restricted to the extent that is absolutely necessary. In order to provide a cross-border mobility service, the following data will be disclosed and stored in the UIC database until completion of the journey: journey data, title, first and last name, e-mail, language, type of mobility restriction, aid, other significant information, e.g. companion or service dog, luggage, date of birth in the individual case, depending on the destination. The above data shall therefore be deleted immediately following completion of the journey in the event of cross-border journeys.
In combination with a ticket, you can make use of a luggage service for normal luggage items as well special baggage for journeys within Austria (see fare regulations).
The booking can be made through our company (i.e. at the ticket counters or by phone via the customer service). We are available to you as a contact for our cooperating partner (Q Logistics GmbH, 1120 Vienna, Pottendorfer Strasse 23-25).
The cooperating partner shall perform this service at its own responsibility. In order to allow the cooperating partner to perform its logistical service, the following data - assignable to you - shall be disclosed to such a partner for the performance of the service, which you communicated to us when booking this service: first and last name, phone number, e-mail address, collection and delivery address, date of collection and delivery.
If you wish, we will be happy to pass on complaints and other queries to the cooperating partner as required.
In addition to telephone enquiries or requests via the contact form provided on www.oebb.at, you also have the possibility to use our chatbot / ÖBB.Bot. ÖBB.Bot is at your disposal for information and services regarding the VORTEILSCARD and ÖSTERREICHCARD products. It is a text-based dialogue system that allows chatting with a technical system for standard enquiries and routine tasks.
This offers you a further option to get in touch with us quickly and easily. Your request can also be processed faster.
In the case of pure product information, customer data is not required by us and is therefore not collected. Only if you use ÖBB.Bot for data changes or in case of questions regarding the execution of contracts, data will - if this is necessary in individual cases to process your request - be collected and processed to the extent absolutely necessary.
The use of our ÖBB.Bot requires your prior consent. This consent is limited in time and must be given separately for each new use. Should you decide that you no longer wish to use ÖBB.Bot during a request, please close the chat window. Closing the window will be considered a revocation of your previously given consent.
Should it be necessary to collect data, the following data may be collected, depending on the reason and subject of the request: first and last name, date of birth, complete address, e-mail address, telephone number, type of customer card, card number, period of validity, subject of enquiry.
Should personal data be collected in individual cases in the course of the use of our ÖBB.Bot, they will be stored for a period of 30 days and then automatically deleted, unless there is a special reason for storage in individual cases (e.g. ongoing civil court proceedings) that justifies or requires a longer storage period.
General and customised electronic offers
We use personal data in order to send you general information, offers and recommendations as well as information, offers and recommendations tailored specifically to your mobility needs and user behaviour or to have such information sent to you by our cooperating partners (customised offers). However, this is only the case if you grant your consent in advance to let us contact you by e-mail, telephone, SMS or other ÖBB channels (e.g. ÖBB account), in order to inform you in a timely manner about interesting offers, new developments and services.
Your personal data will exclusively be used by us in both cases and not transferred to cooperating partners or other affiliated companies.
Depending on the content of the consent granted by you, you will receive offers and other information from us concerning ÖBB-Personenverkehr AG (for example on general services, sweepstakes and customer surveys) and the ÖBB Group, i.e. including other affiliated companies (e.g. information on travel offers from Rail Tours Touristik GmbH or car sharing offers from Rail Equipment GmbH) or other cooperating partners.
If you wish to receive customised information and recommendations adapted to your needs (based on your previous purchasing and travel behaviour or your other personal preferences), we can forward these to you for:
The compilation of these contents is based on evaluation of the following data: first and last name, date of birth, address and contact data, details stored on your person regarding bookings, customer cards and season tickets, discounts, travel and voucher data, geodata, preferences and customer loyalty activities associated with you, device and browser information, including user behaviour assignable to you or data on any mobility preferences or restrictions.
Details on booking data include, for example, your selected travel date and time, the actual booking date, booked tickets or special additional offers for tourists, seat reservations, information on utilised offers or vouchers added to your account, information on the start and end station, the sales channel, selected timetable connections including intermediate stops, train types, wagon classes or compartments, information on booked night or day trains, currency used, vehicle data, bicycles, accompanying dogs, information on booked pieces of luggage, as well as information on whether you are travelling alone, with other people or with a child (or children).
In order to provide you with customized information on customer cards and season tickets, we use details of valid/expired/extended customer cards, such as Vorteilscard [discount card], Österreichcard [Austria card] and any SEPA mandates, as well as details of acquired season tickets, e.g. hourly passes, weekly passes, monthly passes.
By discount data, we mean your discounts used in buying tickets, such as indication of a Vorteilscard, Österreichcard, city transport ticket, family pass, etc.
Travel data include information on already commenced or planned (booked) journeys, information on the duration of your journey, any delays, validation details regarding your ticket or your customer card, as well as details of such journeys referred to under booking data.
If (e.g. in the context of a campaign) a voucher was added to your ÖBB account, we will use such information to deliver reminders to you about its use, for example. Moreover, we will use the information once the voucher has been cashed, as well as details of the journey booked or the product purchased with such voucher.
Geodata are used for so-called location-based services. Location-based services provide you with selective information by means of position-dependent data.
By preferences assigned to you we mean, for example, your connection favourites, your stored payment favourites, timetable connections stored by you (including other passengers, selected timetable filters, 1st class journeys, request for a seat reservation, journeys on specific weekdays).
Customer loyalty activities include information and further details on previously sent sales and campaigns, vouchers, sweepstakes, customer surveys, recommendations and other information.
Device and browser information including user behaviour assignable to you includes information on your employed devices (computer, laptop, smartphone, etc.) with which you visit our websites and the associated web browsers (e.g. Internet Explorer, Firefox, Safari, etc.). This also includes information on whether you have downloaded and used the ÖBB App. Your assignable user behaviour includes, for example, details on the use of your ÖBB account with relevant devices and the ÖBB App (e.g. account creation details, settings implemented, such as e.g. gender and language, details of logins, added discounts and customer cards, deposited vouchers, ticket purchases and reservations, stored favourites, etc.). In addition, technical information (e.g. IP address, browser type and version, time of access by the visitor’s computer) is collected in order to determine whether an e-mail has reached you, which e-mails you have opened when and which links in the e-mail you have accessed.
We use data on any mobility preferences or restrictions in order to offer you relevant information, recommendations and services in the event of you needing a wheelchair place or if a companion or service dog is travelling along, etc.
We use the technologies of Emarsys eMarketing Systems AG (Märzstraße 1, 1150 Vienna, www.emarys.com), which acts as our contract processor, to create and send out customised offers. Emarsys supports us in the planning, implementation and analysis, especially in the technical implementation and handling of our measures, as follows:
This type of data processing also involves profiling as per Article 4 No. 4 GDPR, to the extent that it concerns the preparation and sending of customised offers.
Profiles are created about our customers, which
Our general and customised offers can be sent by mail, e-mail, as a push message, in your ÖBB account or via other ÖBB channels.
This special form of processing is based on your consent in accordance with Article 6(1) a) GDPR, to the extent that we are entitled to carry out such data processing.
We use profiling methods to optimise and personalise our advertising measures. Below, you will find information on the logic involved as well as on the scope and intended effects of these procedures.
Special additional services and offers
You also have the opportunity to register for special offers and services, for example for the Nightjet newsletter, Scotty push service or information on usability tests.
Please note that any of these services which require separate consent must also be revoked separately. As a result, revocation of any individual consent does not apply automatically to all additionally submitted declarations of consent, but they must also be revoked separately.
Advertising sent by post
If we are aware of your address due to purchases and services, or we are allowed to buy it from third parties (e.g. from Österreichische Post AG), we can send you event-driven information, offers and recommendations by post. You can prevent the sending of such information at any time, by declaring your objection (see explanations below). Following receipt of an objection, we will no longer send you any other announcements.
Postal deliveries will also be made to our stakeholders at regular intervals, for example prior to the annual timetable change as well as ad-hoc for relevant subjects.
Please note that the annual invitation to renew the contract does not constitute a direct advertising measure. Based on existing contractual obligations (see our GTC [General Terms and Conditions] for the Vorteilscard or Österreichcard), we will also continue to send you this invitation to renew the contract, and even if you had exercised your right to objection, especially as such a consignment is not subject to the right of objection to direct marketing.
Revocation of granted consent and objection to direct marketing
If you no longer wish to be included in our direct marketing activities, you have the right to file an objection thereto (Article 21(2) and Article 22 GDPR) or to revoke your previously granted consent. The following options are available for you to make these declarations:
If you have exercised your right and decided against any use of your personal data for advertising purposes (in particular direct advertising), in accordance with your request, you will not receive any information, offers and news and can no longer log onto your ÖBB account for our “Newsletter, Info & Services” service.
If at a later point in time you wish to reactivate our services in your ÖBB account under “Newsletter, Info & Service”, please contact our customer service at
ÖBB Customer Service
(Subject: Newsletter, Info & Service)
Statistical analyses shall be conducted for the following purposes in particular:
We also create anonymised data analyses, in which we evaluate personal data and information about age, gender, region, postcode, products, driving, purchase and user behaviour, in order to draw conclusions on the development of new products and services or to improve our existing service portfolio.
Market and opinion research, customer surveys
In order to improve our products and services and adapt them to customer requirements, we conduct surveys with different target groups: on the one hand with people who do not use the train and on the other hand with people who use a railway operator (irrespective of which) or people who use ÖBB. In this context, we commission market research companies or conduct the surveys ourselves. Persons to be surveyed can be selected either completely randomly or based on social statistics or usage-specific factors. Contact with participants can be implemented via the pools of respondents for market research companies - carried out without our input at the sole responsibility of partner operators. Or we invite interested persons in general, without individually addressing participation in the survey. In case of specific survey topics, we also address customers of ÖBB PV AG.
Establishing personal reference is not intended for any surveys. All surveys are conducted completely anonymously. This is true even if we write to you directly as customer or you have declared your consent in advance to participate in a survey.
We only receive or compile an overall evaluation of data, which do not show individual interviews or persons.
If we address our customers directly, we will then exclusively contact people who have given consent thereto.
Should we conduct the survey in cooperation with a market research company in specific cases, we shall conclude a separate confidentiality agreement with said company in advance of a customer survey, laying down the secure handling of your data specifically for the individual case. In particular, this agreement shall ensure that the company will not transfer your data to other market research institutions and other third parties for surveys for their own purposes.
In any case, you are not obliged to take part in any of our customer surveys.
If you apply as a test user, you can take part in usability tests conducted by our company for the further development and improvement of our ticket and timetable tools. Each test is subject to separate conditions of participation (see website). In this case, we will contact you as a possible test user and request your participation in future tests. Naturally, your participation in each individual test is voluntary.
You are entitled to revoke your consent at any time and declare that you no longer want to be contacted for further tests.
Operationally necessary cookies
These cookies are necessary to allow you to use our websites as intended and make all functions available to you. Without such cookies the requested services cannot be provided. These cookies do not record information about you and do not store Internet locations. Absolutely necessary cookies cannot be deactivated on our site. However, they can be deactivated at any time on the browser that you use.
These cookies are necessary for certain applications or functions of the website, allowing them to be duly executed. This may for example include cookies, which store implemented settings such as a visitor’s language setting or even – assuming your prior consent – pre-completed forms.
Storage period: in the event of a session cookie for the period of the session, or in the event of your prior consent for the period of your consent.
These cookies collect information on user behaviour for visitors to our websites. For example, a record is kept of which websites are most frequently visited and which links are clicked on. All recorded data are stored anonymously together with information for other visitors. Using data obtained by these cookies, we can compile analytical evaluations on our website using Piwik and thereby continually improve the user experience.
Storage period: in the event of a session cookie for the period of the session, in all other cases (for example for our web analysis service PIWIK) for a maximum three years.
How long are cookies stored on my device?
The time that a cookie stays on your device depends on whether it is a persistent cookie or a session cookie. Session cookies only remain on your device until your browser session is finished. Persistent cookies remain stored on your device, even after you have completed a browser session, until such time as the preset time for the cookie has expired or it has been deleted.
For this purpose, the usage information generated by the cookie (including your truncated IP address) is transferred to our server and stored for usage analysis purposes. This helps us in optimising our websites. During this procedure, your IP address is immediately anonymised, so that you remain anonymous to us.
The information generated by cookies on the usage of our websites is not passed on to third parties.
For technical reasons, we have to collect and store certain data and information of your visit to our website, for instance the used websites, the time and duration of your visit as well as data provided by the browser you are using (e.g. on the operating system and the used system settings). Such data and information is used by us anonymously to allow us to make our offerings even more participant-friendly and to technically optimise them.
Should you provide personal data or information on our websites, we can continue to use them within the framework of the legal requirements of TKG [Telecommunications Act] without your further consent. An exception is the use for advertising or marketing purposes or forwarding data to third parties, which requires prior and separate consent. We will separately inform you about any communications to other ÖBB affiliated companies (e.g. in the event of a concern, complaint, etc.).
Should you access such offerings on our websites or visit these websites, the data provided by your browser will be transferred to the respective operator. We are not responsible for any contents on these websites, neither in terms of data protection nor in terms of the technical security of the data and information made available. In this context, please note that external providers may use ad personalisation technologies where required.
In case we provide a way to contact us via an input form on our website, we will encode this communication via the https protocol. Please note that other types of communication over the internet, in particular via e-mail, do not provide confidentiality. We therefore recommend to refrain from sending confidential data and information via e-mail.
Social media plugins
We have embedded contents from external providers, such as Facebook, YouTube, Twitter, on individual websites or we may transfer you to the websites of external providers. We could not identify any legal violations at the time of linking. Should we become aware of any such infringement, we will remove the link with immediate effect. In order to be able to recommend and share content on social networks such as Facebook, Twitter and Google+, corresponding buttons are integrated into the platform.
These buttons only transfer data to external providers or other third parties if you press the corresponding button as participant. We have prevented an immediate transfer of data to external providers or other third parties in case of mere access to our websites. As a result, it is completely up to you to activate transfer in the individual case.
Sweepstakes on social media and in the customer magazine
If personal data are recorded by participants within the framework of a sweepstake on social media, they shall exclusively be collected, processed and used for the purposes of implementing the sweepstake, unless you have specifically granted your consent for the use of your personal data for other purposes, or use of data is required in the individual case for legal or other overriding reasons (thus for example in the event of a legal or other regulatory request or in the event of legal or regulatory disputes).
We will delete or anonymise collected and processed data following expiry of the statutory period of limitation (i.e. usually after three years have elapsed). The same applies to any messaging history in social media. We cannot assume any responsibility for the correctness, timeliness and completeness of data that you have disclosed personally. In your own interests, please therefore ensure that data disclosed by you are correct, up-to-date and complete.
If you contact us by e-mail with requests, suggestions or criticism, we would also like to ensure that we have performed our service to your satisfaction. After replying to your concerns, we will therefore ask how satisfied you were with our service.
This constitutes an internal quality assurance measure. For reasons of objectivity and automated processing, we employ a processor for this purpose, to conduct this automated query on our behalf. In order to do so, we will exclusively hand over your e-mail address and customer number to the processor. We shall not provide this processor with the opportunity to inspect your data, to use your data for other purposes or to transfer them to third parties.
Before employing the processor, we have assured ourselves that it will provide a sufficient guarantee for lawful and secure use of data.
For us, information security means:
In order to guarantee information security, we have established organisational framework conditions and protective measures that confirm to the latest state of technology.
Our employees are only granted access rights in accordance with their roles and to an extent that is absolutely necessary. The use of these access rights is recorded.
Your data is protected by a secure online connection (TLS) between your PC and our servers, depending on the browser configuration, with at least 128 Bits.
Security measures for the system in the event of purchase on the ÖBB App or an online purchase were developed based on the following standards:
The system therefore fulfils the security standards of the Application Verification Standard 2010 (ASVS) and was also tested by an independent expert. ASVS 2010 represents the leading current standard for IT security. Moreover, the ÖBB App was developed in accordance with requirements of data protection law and continually adjusted to new requirements.
By processors we mean our contractual partners, who process personal data on our behalf (example: maintenance of our databases).
We currently employ processors, including for the following activities:
We only employ processors for our lawfully conducted data processing. We always assure ourselves in advance that the individual processor is suited to service performance, in particular that the processor provides a sufficient guarantee of secure and lawful use of data.
Processors that we have selected only receive personal data from us to the extent that is absolutely necessary.
Our processors have contractually undertaken:
Before employing a processor, we conclude a written agreement with the processor, in which special obligations are imposed on the processor and its employees, and they again are subject to a separate confidentiality obligation. We impose certain data security measures on the processor to ensure that customer data and data processing are sufficiently protected.
We have provided you with comprehensive information on the purposes of our data processing, categories of data recipients, the legal basis and legal framework, the storage period as well as the rights you are entitled to and the scope of data processing. In all data processing, we have taken care to ensure that data collection and data scope are limited to the extent that is absolutely necessary. Therefore, if we ask you to provide data, this is necessary in particular so that:
If you do not or not fully comply with our request for data disclosure, it cannot be guaranteed that we will be able to comply with or process your aforementioned purchase or other request(s).