Cookie guidelines

Cookies are small text files or codes, which contain information units. These text files are stored on the hard drive or in the main memory of the users’ browser if they visit one of our websites. Thanks to cookies, the contents of our websites can be structured more easily and devices on which you have previously visited our websites can be identified.

Cookies that are not technically necessary are only stored and transmitted to third parties after the user has given their consent in accordance with their specific selection (consent banner). The selection made can be revoked or adjusted at any time under “My cookie selection”.

For technical reasons, certain cookies are stored when you visit our websites, regardless of the selection made in the consent banner (i.e. the scope of consent). These technically necessary cookies are required for the technical operation of a website and to make it functionally usable for users. The use is based on our legitimate interest in providing a technically flawless website.

Data transfers without consent only take place when the security of the website is at risk, for example to defend against hacker attacks or to enable and maintain the operation of the website.

The use of cookies can also be completely prevented by adjusting the relevant settings in your browser software. This may, however, result in your not being able to fully use all functions provided by our websites.

The provision of animated graphics does not result in any cookies being stored on the user’s computer. These graphics are used on the web and in the app to visualize content. In the hybrid LottieFiles apps (iOS, Android), the animations are not downloaded but delivered with the app. Therefore, no external links are accessed. Our internal consent security policy prevents external access/links for use on the website. This ensures that no personal data is processed in this context.

The cookies used on our websites can be divided into the following categories:

Operationally necessary cookies: These cookies are necessary to allow users to use our websites as intended and make all functions available to them. Without these cookies, it may not be possible to provide or use the requested services in their entirety. These cookies do not record information about users and do not store Internet locations. Technically necessary cookies cannot be deactivated on our site. However, they can be deactivated at any time on the browser that the users use.

Storage period: In the case of technically necessary cookies, the storage period can be viewed at any time under “My cookie selection”.

Functional cookies: These cookies are necessary for certain applications or functions of the website, allowing them to be duly executed. This may for example include cookies, which store implemented settings such as a user’s language setting or even – assuming prior consent – pre-completed forms.

Storage period: in the event of a session cookie for the period of the session, or in the event of prior consent for the period of consent.

Analytical cookies: These cookies collect information about how users use our websites. For example, a record is kept of which websites are most frequently visited and which links are clicked on. All recorded data are stored anonymously together with information for other users. Using data obtained by these cookies, we can compile analytical evaluations on our website using Matomo and thereby continually improve the user experience.

Storage period: in the event of a session cookie for the period of the session, in all other cases (for example for our web analysis service Matomo) for a maximum of three years.

First party cookies: First party cookies are generated by the website operator whose site the users are visiting. These are stored locally on the users’ computers. With a first party cookie, users can only be recognised by the site from which the cookie originates, but not across multiple domains.

Third party cookies : Third party cookies, also called tracking cookies, are a common means of marking a website user so that they can be recognised at a later point in time. These are data records that are stored in the users’ browser when they visit a page with advertising. Third party cookies are used to monitor the users’ browsing behaviour over a longer period of time and across multiple web offerings, and to provide advertisers with useful information such as: user navigation via links, time spent on different sites, different page views and frequency of views.

Currently, we use first party cookies which are either

• technical in nature and are absolutely necessary for the websites and the ticket shop to function, or
• technically necessary for a customer feature (display of recent searches to facilitate/speed up the purchase of frequently searched for trips), or
• are used for analysis and/or marketing purposes with prior consent.

3rd party cookies are not used.

The time that a cookie stays on a user device depends on whether it is a persistent cookie or a session cookie. Session cookies only remain on the device until the browser session is finished. Persistent cookies remain stored on the device, even after users have completed a browser session, until such time as the preset time for the cookie (see cookie banner) has expired or it has been deleted.

The specific storage period for the relevant areas of application is specified in Section 2. and in “My cookie selection”.

Data collected through cookies is stored for three years from the initial collection date, after which it is automatically deleted.

For our websites and our digital dialogue with our customers (e.g. newsletters) we use Matomo, a web analytics service. Matomo uses cookies, which allow us to conduct an analysis of the use of our websites.

If users have given their consent to analysis in the “My cookie selection” section, the usage information generated by the cookie (including the shortened IP address) is transmitted to our server and stored for the purpose of analysing usage, which helps us to optimise our website. During this procedure, the IP address is immediately anonymised, so that users remain anonymous to us.

The information generated by cookies on the usage of our websites is not passed on to third parties.

In order to analyse the behaviour of our customers, improve the user-friendliness of the website and optimise marketing campaigns, we use the services of the contract processor JENTIS GmbH (Schönbrunner Straße 231, 1120 Vienna).

JENTIS collects data on our behalf, provided that users have given their consent in advance. Users can customise the scope of their consent and adjust or withdraw it at any time via the “My cookie selection” link in the website footer.

JENTIS stores consent-related data and assigns a unique user ID to each consent decision. This JENTIS user ID is stored in a cookie on the user's device, which is then read out. The IDs assigned by JENTIS GmbH are random codes designed for anonymous identification.

JENTIS will only share data (which has been enriched with geolocation data by JENTIS’s processors) with its processors or other partners (see below) to the extent that is absolutely necessary.

This includes the following data: user behaviour and interaction on the website, user IDs, IP addresses of users (truncated), technical information about the browser environment, such as browser type, operating system, screen resolution, language selection, and the date and time of the website visit and traffic sources.

The IP address of users is only used to determine the location of users (limited to country/city) and is truncated before storage so that it can no longer be traced back to an individual.

The privacy policy of JENTIS GmbH is available at the following link: https://www.jentis.com/privacy-policy/

JENTIS GmbH uses the following partners (additional processors) for the processing and enrichment of data:

• IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany)
  Purpose: Cloud hosting
• KAPTAGO LTD (N. Nikolaidi and T. Kolokotroni ONISIFOROU CENTER, 8011 Paphos, Cyprus)
  Purpose: Provision of API data for data enrichment with geolocation data

JENTIS GmbH also provides data to the following additional cooperation partners:

• EssenceMediacom Austria GmbH (Vordere Zollamtsstraße 13/5. OG, 1030 Vienna, Austria)
  Purpose: targeted advertising on social media and the Internet on a non-personal basis
• GroupM Kommunikationsagentur GmbH (Vordere Zollamtsstraße 13/7. OG, 1030 Vienna, Austria)
  Purpose: targeted advertising on social media and the Internet on a non-personal basis

Personal data will only be transferred to processors if these companies provide sufficient guarantees for the lawful and secure use of the data. Contracts in accordance with Art. 28 GDPR have been concluded with all processors to ensure that all data protection and data security requirements are met. The declaration of consent specifies the purposes of data processing and the types of cookies used, to which we refer at this point.

The technical operation of the website is carried out by ÖBB’s internal IT service provider, ÖBB Business Competence Centre GmbH (1020 Vienna, Lassallestrasse 5).

Other processors are used for analysis (see Section 4., Matomo) and marketing (see Section 5., JENTIS) purposes.