Data protection information

§ 1 Information on the collection of personal data

(1) We are very delighted that you have shown interest in our company. Data protection is of a particularly high priority for Rhein Neckar Verkehr GmbH. In the following, we provide information about the collection of personal data. Personal data is all data that can be related to you personally, e.g. name, address, e-mail addresses, user behaviour.

(2) Controller pursuant to Art. 4 (7) EU General Data Protection Regulation (GDPR):
Rhein-Neckar-Verkehr GmbH
Möhlstr. 27
68165 Mannheim
Phone: 0621-465-0
Email: datenschutz(at)rnv-online.de

(3) When you contact us by e-mail or via a contact form, the data you provide (your e-mail address, your name and telephone number if applicable) will be stored by us in order to answer your questions. We delete the data arising in this context after storage is no longer necessary, or restrict processing if there are statutory retention obligations.

(4) If we use contracted service providers for individual functions of our offer or would like to use your data for advertising purposes, we will inform you in detail below about the respective processes. We will also state the specified criteria for the storage period.

§ 2 Contact details

Information on the implementation of the European General Data Protection Regulation (GDPR)

(1) Responsible data protection supervisory authority:
Landesdatenschutzbehörde Baden-Württemberg
Königstraße 10a
70173 Stuttgart
Tel: 0711 61 55 41-0
Email: poststelle(at)lfdi.bwl.de

(2) Our company's data protection officer:
CTM-COM GmbH
Moritz Görmann
Marienburgstraße 27
64297 Darmstadt
Email: datenschutz(at)ctm-com.de

§ 3 Your rights

(1) You have the following rights vis-à-vis us with regard to your personal data:

Right to information,
Right to rectification or erasure,
Right to restriction of processing,
Right to object to processing,
Right to data portability.
Right to a copy of the personal data that is the subject of processing directly when your data is collected.
Right to complain to a data protection supervisory authority about the processing of your personal data by us.

Please note that we store the documents for responding to data subject enquiries and requests for erasure as well as our reply for 3 years for the purpose of providing evidence of proper processing (Art. 5 para. 2 GDPR).

§ 4 Objection or revocation against the processing of your data

(1) If you have given your consent to the processing of your data, you can revoke this at any time. Such a revocation affects the permissibility of the processing of your personal data after you have given it to us.

(2) If we base the processing of your personal data on the balancing of interests, you can object to the processing. This is the case if, in particular, the processing is not necessary for the fulfilment of a contract with you, which is described by us in the following description of the functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we have done. In the event of your justified objection, we will examine the situation and either discontinue or adapt the data processing or point out to you our compelling reasons worthy of protection on the basis of which we will continue the processing.

(3) Of course, you can object to the processing of your personal data for advertising and data analysis purposes at any time. You can inform us of your objection to advertising using the following contact details: datenschutz(at)ctm-com.de

(4) If we process your data to protect legitimate interests, you can object to this processing on grounds relating to your particular situation.

We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the establishment, exercise or defence of legal claims.

I. Website

(1) When using the website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security (legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR):

IP address
Date and time of the request
Content of the request (specific page)
Access status/HTTP status code
Amount of data transferred in each case
Website from which the request originates
browser
Language and version of the browser software.

(2) In addition to the aforementioned data, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive assigned to the browser you are using and through which certain information flows to the body that sets the cookie (in this case us). Cookies cannot execute programmes or transfer viruses to your computer. They serve to make the website more user-friendly and effective overall.

(3) Use of cookies:

We use cookies on this website to analyse access to our website and to enable the display of YouTube videos so that our website functions optimally.

When you visit our website for the first time (using a cookie banner or cookie consent tool), you will be asked which cookies you wish to allow. Cookies that are not essential to provide the services of this website will only be used after you have given your consent. However, this decision is stored in a cookie for verification purposes and to implement your setting.

You can find all further information on the purpose and storage duration of the respective cookies in our "Cookie Consent Tool". You can view and change your cookie settings at any time in the footer of this website under "Cookie settings".

The use of cookies represents a legitimate interest and is justified by Art. 6 para. 1 sentence 1 lit. f GDPR. In the case of non-essential cookies, the processing of personal data concerning you by cookies is based on your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR for the individual cookies. You are entitled to the rights described in Section I. at any time.
By consenting to the use of the respective cookies by US providers such as Google, Facebook, Twitter, YouTube, LinkedIn, etc., you also consent to your data being processed in the USA in accordance with Art. 49 para. 1 sentence 1 lit. a GDPR.

Whether cookies are set in each case and which data is stored in them and under what other circumstances is also explained in more detail in our notes on the tools, plug-ins and services used.

Applicant portal (https://karriere.rnv-online.de/)

Name	Purpose	Duration
JSESSIONID	The purpose of this cookie is to identify your computer during your visit to our website.	Session

You can configure your browser settings according to your wishes and, for example, refuse to accept third-party cookies or all cookies. We would like to point out that you may not be able to use all the functions of this website.

(4) We use Siteimprove Analytics on our website, a web analytics service provided by Siteimprove(www.siteimprove.com). Siteimprove Analytics uses "cookies" - text files that are stored on your computer or smartphone to help us analyse how visitors use the website. The information generated by the cookies about visitors' website usage is stored and processed by Siteimprove on servers in Denmark. IP addresses are completely anonymised before any data collected via the Siteimprove Suite can be viewed by us. It is not possible to reverse the anonymisation of IP addresses or to assign IP addresses to collected data.

We will only use this information to evaluate and report on the user behaviour of our website visitors and ultimately to improve the website experience for our visitors. Siteimprove will not pass this information on to third parties or use it for marketing or advertising purposes of any kind.

(5) In addition to the purely informational use of our website, we offer various services that you can use if you are interested. To do so, you must generally provide additional personal data that we use to provide the respective service and for which the aforementioned data processing principles apply.

(6) In some cases, we use external service providers to process your data. These have been carefully selected and commissioned by us, are bound by our instructions and are regularly monitored.

(7) Furthermore, we may pass on your personal data to third parties if we offer participation in promotions, competitions, contracts or similar services together with partners. You will receive more detailed information on this when you provide your personal data or in the description of the offer below.

(8) If our service providers or partners are based in a country outside the European Economic Area (EEA), we will inform you of the consequences of this circumstance in the description of the offer.

(9) In order to ensure sufficient data security when submitting forms, we use the reCAPTCHA service from Google Inc. in certain cases. This is primarily used to distinguish whether the input is made by a natural person or abusively by machine and automated processing. The service includes sending the IP address and any other data required by Google for the reCAPTCHA service to Google. The deviating data protection provisions of Google Inc. apply here. Further information on the data protection guidelines of Google Inc. can be found at http://www.google.de/intl/de/privacy or https://www.google.com/intl/de/policies/privacy/

II Social media activities

(1) Rhein-Neckar-Verkehr GmbH is active on various social networks. These include Facebook, Instagram, Twitter, Mastodon and YouTube. In addition, rnv operates its own blog at blog.rnv-online.de.

(2) Data protection provisions on the deployment and use of the various social networks

a) Facebook

Facebook is a social network. A social network is a social meeting place operated on the Internet, an online community that generally enables users to communicate with each other and interact in virtual space. A social network can serve as a platform for the exchange of opinions and experiences or enable the Internet community to provide personal or company-related information. Facebook enables users of the social network to create private profiles, upload photos and network via friend requests, among other things.
Facebook's operating company is Facebook, Inc, 1 Hacker Way, Menlo Park, CA 94025, USA. If a data subject lives outside the USA or Canada, the controller for the processing of personal data is Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
The data policy published by Facebook, which is available at de-de.facebook.com/about/privacy/, provides information about the collection, processing and use of personal data by Facebook. It also explains the setting options Facebook offers to protect the privacy of the data subject. In addition, various applications are available that make it possible to suppress the transmission of data to Facebook. Such applications can be used by the data subject to suppress data transmission to Facebook.

b) Instagram

Instagram is a service that qualifies as an audiovisual platform and allows users to share photos and videos and also to redistribute such data in other social networks.
The operating company of Instagram's services is Instagram LLC, 1 Hacker Way, Building 14 First Floor, Menlo Park, CA, USA.
Further information and Instagram's applicable privacy policy can be found at help.instagram.com/155833707900388.

c) Twitter

Twitter is a multilingual, publicly accessible microblogging service on which users can publish and disseminate so-called tweets, i.e. short messages limited to 140 characters. These short messages can be accessed by anyone, including people who are not registered with Twitter. However, the tweets are also displayed to the so-called followers of the respective user. Followers are other Twitter users who follow a user's tweets. Twitter also makes it possible to address a broad audience via hashtags, links or retweets.
Twitter's operating company is Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA.
Twitter's applicable data protection provisions can be found at twitter.com/privacy.

d) YouTube

YouTube is an online video portal. Users of the website have the option of watching or uploading videos.
YouTube is operated by YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA.

Further information on the purpose and scope of data collection and processing by YouTube can be found in the privacy policy: www.google.de/intl/de/policies/privacy.

e) rnv blog

The rnv blog is an online diary. In it, Rhein-Neckar-Verkehr GmbH regularly reports on current topics relating to local public transport in the Rhine-Neckar metropolitan region.

The rnv blog is operated by Rhein-Neckar-Verkehr GmbH, Möhlstr. 27, 68165 Mannheim, Germany.

When you visit our blog (blog.rnv-online.de), the data specified under § 4 I. (3) of this declaration is transmitted.

If you wish to comment on our posts, please enter your name and e-mail address. You will then be sent an e-mail with a confirmation link. The comment will not be published until you click on this link. The e-mail address is collected in order to send the confirmation e-mail and the e-mail notifying you of a comment.

The e-mail addresses are stored for a period of 4 weeks in order to be able to correspond with you regarding your comment if necessary.

In the event that a commenter has to be excluded from the comment function due to repeated breaches of netiquette, their e-mail address will be stored on a block list for one year. In the event of repeated offences, the blocking may be indefinite.

f) Xing

Rhein-Neckar-Verkehr GmbH operates a company page on the XING network. The provider is XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany. Each time our page is accessed, a connection to Xing servers is established. To the best of our knowledge, no personal data is stored in the process. In particular, no IP addresses are stored and usage behaviour is not evaluated.

Further information on data protection and the Xing share button can be found in Xing's privacy policy at https://privacy.xing.com/de/datenschutzerklaerung.

g) LinkedIn

If you visit our company page on LinkedIn, we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. Information on joint responsibility can be found in the LinkedIn data protection information.

Please note that despite the joint responsibility with the social media portal operators, we do not have full influence on the data processing operations of the social media portals. Our options are largely determined by the company policy of the respective provider.

You can access the relevant "Terms of Use" of LinkedIn here: LinkedIn Pages Terms

h) Mastodon

Mastodon is a decentralised microblogging service. Rhein-Neckar-Verkehr GmbH has its profile on the server of the Baden-Württemberg State Commissioner for Data Protection and Freedom of Information bawü.social. Further information on data protection on this server can be found at https://xn--baw-joa.social/privacy-policy.

III Podcast

(1) Rhein-Neckar-Verkehr GmbH operates the podcast "verkehr(t) verhör(t)" at www.rnv-online.de/podcast.

(2) The individual podcast episodes can be listened to via an embedded player. This has no data protection implications for you as a listener.

(3) The player uses various buttons to link to other platforms on which the podcast episodes can also be listened to. If you click on a button and land directly on one of the platforms, the data protection provisions of the respective platform come into force. Here you will find the links to the respective privacy policies:

a) iTunes: https://www.apple.com/de/privacy/
b) Spotify: https://www.spotify.com/de/legal/privacy-policy/
c) Amazon Music/Audible: https://www.amazon.de/gp/help/customer/display.html?nodeId=GX7NJQ4ZB8MHFRNJ
d) Deezer: https://www.deezer.com/legal/personal-datas

IV "Increased carriage fee" (EBE)

(1) We process data that we receive from you exclusively from the ticket inspection. We receive the data directly from you or from the law enforcement authorities (e.g. police).

Specifically, we process the following data

Surname, first name
Date of birth, place of birth
gender
Address (place of residence, postcode, street, house number)
If applicable, telephone number, place of residence when recorded (complete personal data),
Type of ID card, ID card number, issuer, date of issue
Incident data (EBE incident no., date, time, passenger position in the vehicle, complaint, direction, control stop, boarding stop, destination stop, ticket type, ticket number, remark, passenger remark, passenger behaviour, inspector number, inspector name, line)
For minors, the data of the legal representative (e.g. parents) is also collected
Surname, first name
Address (place of residence, postcode, street, house number)
Telephone number, if applicable

(2) We process your personal data in compliance with the relevant data protection provisions of the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and all other relevant laws.

a) as part of the balancing of interests
(Art. 6 para. 1 f GDPR)

We process your data in order to protect our legitimate interests or those of third parties (e.g. authorities). This applies in particular to the investigation of criminal offences (legal basis Art. 6 para. 1 f GDPR in conjunction with Section 24 para. 1 sentence 2 BDSG) or the exchange of data within the Group for administrative purposes.

As a provider of local public transport services, Rhein-Neckar Verkehr GmbH (rnv) has a legitimate interest in ensuring that all customers have a valid ticket in accordance with the currently valid conditions of carriage and fare regulations.

Customers who use a passenger transport service without a valid ticket may be subject to an increased fare in accordance with the existing regulations. Personal data and incident data must be processed in order to levy the increased transport charge.

(3) Within our company, only those persons and departments that require your personal data to fulfil our contractual and legal obligations will receive it.

(4) Processors employed by us (Art. 28 GDPR), in particular in the area of IT services, who process your data for us in accordance with our instructions.
As well as our own lawyers and lawyers of opposing parties, police authorities, public prosecutors, courts, authorities, debt collection companies as part of the sale of receivables.
In the event of non-payment of the increased transport fee, rnv sells the outstanding receivables to the debt collection company Riverty Service GmbH, Gütersloher Str. 123, 33415 Verl. In doing so, we will pass on your personal data: Surname, first name, date of birth, place of birth, gender, legal representative, telephone number, FAX number, e-mail address, address (place of residence, postcode, street, house number), incident data (EBE incident no., date, time, passenger position in the vehicle, complaint, direction, control stop, boarding stop, alighting stop, ticket type, ticket number, remark, passenger remark, passenger behaviour, inspector number, inspector name, line) to the collection company.
This is done on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR. The legitimate interest on our part is the outsourcing of the debt collection business. The legitimate interest on the part of Riverty Service GmbH is the collection of data for the purpose of avoiding payment defaults.

(5) We delete your personal data as soon as it is no longer required for the fulfilment of our terms of carriage/contractual relationship. If necessary, we process your personal data for the duration of our business relationship, which also includes the initiation and fulfilment of a contract.
In addition, we are subject to various retention and documentation obligations (e.g. HBG, BGB, etc.). The retention and documentation periods specified there are up to ten years, and in certain cases up to thirty years.

When a person's data is recorded for the first time in the event of an EBE, the data is stored for a period of 36 months, as rnv files criminal charges and a criminal complaint in the event of a repeated EBE within this period. After a criminal complaint has been filed, the data is stored for a further 36 months in each case; in the event of a repeat offence, criminal charges are filed again and a criminal complaint is filed.
The legal basis for processing in these cases is the relevant statutory provision (e.g. Section 265a of the German Criminal Code) in conjunction with Article 6(1)(e) GDPR.

Payment data from an EBE case will be retained for a period of 10 years, the legal basis for this is Art. 6 para. 1 lit. c GDPR in conjunction with §147 AO

(6) Your personal data will not be transferred to a third country (countries outside the European Economic Area - EEA).

(7) As part of our conditions of carriage, you must provide the personal data that is required to record the incident for the increased carriage charge or that we are legally obliged to collect.

(8) You have the option of contacting our data protection officer or a data protection supervisory authority (see §2).

(9) You have rights vis-à-vis us with regard to the personal data concerning you, which you can read about in §3 and §4 of this privacy policy.

V. Processing and storage of data at rnv in the Mannheim, Heidelberg and Ludwigshafen mobility centres, in telephone customer support, in e-mail processing, in the subscription centre and in sales invoicing

Specifically, we process the following data

Surname, first name
Date of birth, place of birth
Email address
Telephone number
gender
Address (place of residence, postcode, street, house number) and, if applicable, telephone number
(this data may also be provided by the legal guardian)
Bank details
Type of ID card and, if applicable, ID card number
rnv - vehicle no., line, stop, location, ticket machine number etc.
Passport photo
School or training company or similar
Name and address of employer and, if applicable, personnel number for Job-Ticket

When using our chip card:

Usage data (only the ten most recent transactions are stored)
Time
Place
Type of transaction
Terminal number
Ticket/product number
Lines and journey number

(1) We process your personal data in compliance with the relevant data protection provisions of the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and all other relevant laws.

Art. 6 para. 1 lit. b GDPR for contract fulfilment
Art. 6 para. 1 lit. f GDPR in the context of balancing interests

(2) Within our company, only those persons and bodies receive your personal data that need it to fulfil our contractual and legal obligations.
In the case of discounted tickets (e.g. MAXX tickets, social tickets, etc.), data is exchanged with the subsidisers (e.g. cities, district administrations, etc.).

(3) Processors used by us (Art. 28 GDPR), in particular in the area of IT services, who process your data for us in accordance with our instructions.

(4) When uploading a proof of authorisation, an AI checks whether the proof matches the order data and prepares a decision for the person responsible.

(5) We delete your personal data as soon as it is no longer required for the fulfilment of our conditions of carriage/contractual relationship. If necessary, we process your personal data for the duration of our business relationship, which also includes the initiation and execution of a contract. Unsolicited photographs will be destroyed in accordance with the GDPR.
In addition, we are subject to various storage and documentation obligations (e.g. HBG, BGB, etc.). The retention and documentation periods specified therein are up to ten years, but in certain cases also up to thirty years.

(6) Your personal data will not be transferred to a third country (countries outside the European Economic Area - EEA).

(7) Your request or order can only be processed by us if you provide us with your data.

(8) You have the option of contacting our data protection officer or a data protection supervisory authority (see §2).

(9) You have rights vis-à-vis us with regard to the personal data concerning you, which you can read about in §3 and §4 of this privacy policy.

(10) Data protection notice for customers who use the rnv service portal "Abo-Online" via the SWEG homepage

You will be assigned to SWEG Südwestdeutsche Landesverkehrs GmbH on the basis of your routing. No precise location data will be collected and no movement profiles will be created. SWEG Südwestdeutsche Landesverkehrs GmbH has handed over the provision of sales services to Rhein-Neckar-Verkehr GmbH.

All orders, changes and issuing of subscriptions as well as the complete customer service (creating, changing or deactivating customers) are carried out by Rhein-Neckar-Verkehr GmbH on behalf of SWEG Südwestdeutsche Landesverkehrs GmbH.

Further information can be found in the data protection regulations of SWEG Südwestdeutsche Landesverkehrs GmbH: https: //www.sweg.de/de/service/vrn-jahresabo/

(11) Data protection notice for customers who use the rnv service portal "Abo-Online" via the SWE homepage

You will be assigned to Stadtwerke Eberbach GmbH based on your routing. No precise location data will be collected and no movement profiles will be created. SWE Stadtwerke Eberbach GmbH has handed over the provision of sales services to Rhein-Neckar-Verkehr GmbH.

Further information can be found in the data protection regulations of SWE Stadtwerke Eberbach GmbH: https:// https://www.stadtwerke-eberbach.de/verkehr.html

(12) Data protection notice for customers who use the rnv service portal "Abo-Online" via the VTL homepage

You will be assigned to VTL Verkehr und Tourismus Lampertheim Verwaltungsgesellschaft mbH on the basis of your routing. No precise location data is collected and no movement profiles are created. VTL Verkehr und Tourismus Lampertheim Verwaltungsgesellschaft mbH has transferred the provision of sales services to Rhein-Neckar-Verkehr GmbH.

Further information can be found in the privacy policy of VTL Verkehr und Tourismus Lampertheim Verwaltungsgesellschaft mbH https://mobilitätszentrale.com/datenschutz

VI Application

(1) In the following, we provide information about the processing of personal data as part of the application process. Personal data means any information relating to an identified or identifiable natural person (data subject), such as name, address, e-mail address, telephone number, etc.

a) We process your personal data for the following purposes:
Data processing is carried out for the purpose of conducting a selection procedure to fill vacancies at Rhein-Neckar-Verkehr GmbH.

Processing is necessary pursuant to Art. 6 para. 1 lit. b GDPR for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

b) The following categories of data are collected:
Application data (e.g. surname, first name, title, address and contact details, data from the CV, photo data, other data if applicable)

In addition to the option of providing your application data manually in the application form or by uploading it via our website, personal and professional data may be transferred from your Xing or LinkedIn profile. The data will only be available for us to view once you have checked and approved the corresponding social media profile and actively submitted the documents. We are not responsible for the data processing of Xing and LinkedIn.

The application data is processed in our applicant management system, provided by the service provider d.vinci HR-Systems GmbH, Nagelsweg 37-39, 20097 Hamburg, as a processor based in Germany. The commissioning is contractually regulated in accordance with the statutory data protection requirements for order processing (Art. 28 GDPR). Click here to read the data protection provisions of the data processor: https://www.dvinci.de/datenschutz

c) Recipients or categories of recipients of the data:

Internal recipients:
Within Rhein-Neckar-Verkehr GmbH, only those persons and bodies (e.g. HR department, specialist department, works council, representative body for severely disabled employees, if applicable) will receive your personal data that they require for the recruitment decision and to fulfil our pre-contractual/contractual and legal obligations. Your personal data will be treated confidentially in accordance with the statutory provisions.

External recipients:

If applicable, other processors used by us in accordance with Art. 28 GDPR, in particular in the area of IT services, who process your data for us in accordance with our instructions.
Social security institutions and authorities for the fulfilment of legal obligations, e.g. employment agency

d) Duration of data storage
Your personal data will be automatically deleted after the end of the application process, but at the latest after 6 months, unless you expressly consent to storage for a longer period of time upon request.

The legal basis for the processing of your personal data for the purpose described is our legitimate interest (Art. 6 para. 1 lit. f or in conjunction with Art. 9 para. 2 lit. f GDPR). The legitimate interest is to process personal data as evidence for the assertion and defence of legal claims.

(2) Some of your rights as a data subject:

You are entitled at any time to request information about the data stored by us and to demand that inaccurate data about you be corrected or deleted in whole or in part. In addition, you have the right to withdraw your consent at any time with effect for the future. The relevant data will then be deleted immediately if there are no other reasons. In the cases provided for by law, the data may also be blocked instead of deleted.

Further information on your rights and data protection can be found at: https://www.rnv-online.de/datenschutz/

(3) We require your personal data in order to establish an employment relationship.

If you do not provide your personal data, it will not be possible to establish or implement an employment relationship as Rhein-Neckar-Verkehr GmbH will not be able to efficiently fulfil the rights and obligations arising from the employment relationship.

VII. Information obligation for the use of Microsoft 365

With the following information, we provide you with an overview of the processing of your personal data in the context of the use of Microsoft 365 products in accordance with Art. 13 and 14 GDPR. Which data is processed in detail and how it is used depends largely on the individual usage options and uses of the applications.

The declaration on the obligation to provide information on the use of Microsoft 365 can be found here as a PDF.
The impact assessment on data transfer through Microsoft 365 can be found here as a PDF.
The data protection impact assessment based on Microsoft 365 can be found here as a PDF.

VIII. Photo and video recordings at events

(1) We collect this data on the basis of Art. 6 para. 1 lit. f GDPR (legitimate interest of the controller).

The data is collected, processed and used for archiving purposes and for rnv GmbH's public relations work.

(2) Data category: Image and video recordings

(3) Recipients or categories of recipients of the data:

Internal: UK department

External: Press (print and online media), social media (Facebook, Instagram), brochures published as part of public relations work.

(4) The recordings are kept for archiving purposes and will only be deleted upon cancellation.

(5) You have rights vis-à-vis us with regard to the personal data concerning you, which you can read about in §3 and §4 of this privacy policy.

IX. Prize draws and competitions

Art. 6 para. 1 lit. b GDPR for contract fulfilment, participation in competitions and contests.

Specifically, we process the following data Surname, first name, address (place of residence, postcode, street, house number) and, if applicable, a telephone number or email address.

(2) Within our company, only those persons and departments that require your personal data to fulfil our contractual and legal obligations will receive it.

The winners' data will only be forwarded to partner companies for the purpose of sending the non-cash prizes

(3) We delete the data arising in this context after storage is no longer necessary or - in the case of statutory retention obligations - restrict processing.
In addition, we are subject to various retention and documentation obligations (e.g. HBG, BGB, etc.). The retention and documentation periods specified there are up to ten years, and in certain cases up to thirty years.

(4) Your personal data will not be transferred to a third country (countries outside the European Economic Area - EEA).

(5) By calling the competition hotline, completing a competition flyer or entering the competition/contest online, you consent to your personal data (name, address, telephone number or email address, if applicable) being processed and stored for the purposes of the competition/contest.

Without the provision of your personal data, participation in one of our prize draws or competitions is not possible.

(6) You have the option of contacting our data protection officer or a data protection supervisory authority (see §2).

(7) You have rights vis-à-vis us with regard to the personal data concerning you, which you can read about in §3 and §4 of this privacy policy.

X. SEPA mandate

(1) We process the following data

Surname, first name
Date of birth
Address (place of residence, postcode, street, house number)
Telephone number
E-mail address
IBAN
BIC

(2) The data is processed on the basis of a SEPA direct debit mandate issued in accordance with Art. 6 para. 1 lit. a GDPR.

(3) Within our company, only those persons and bodies will receive your personal data that need it to fulfil our contractual and legal obligations.

(4) Processors employed by us (Art. 28 GDPR), in particular in the area of IT services, who process your data for us in accordance with our instructions.

The data is transmitted to credit institutions so that direct debits can be made.

(5) We delete your personal data as soon as it is no longer required for the fulfilment of our contractual relationship.

In addition, we are subject to various retention and documentation obligations (e.g. HBG, BGB, etc.). The retention and documentation periods specified therein are up to ten
years, but in certain cases also up to thirty years.

(6) Your personal data will not be transferred to a third country (countries outside the European Economic Area - EEA).

(7) You have the option of contacting our data protection officer or a data protection supervisory authority (see §2).

(8) You have the following rights under the respective legal requirements of the GDPR, valid from 25 May 2018:

Right of access (Art. 15)
Right to rectification (Art. 16)
Right to erasure (Art. 17)
Right to restriction of processing (Art. 18)
Right to data portability (Art. 20) Right to object (Art. 21)
Right to lodge a complaint with the supervisory authority (Art. 77)
Revocation: Consent can be revoked at any time for the future. The data may no longer be used from this point onwards.

Please note that we will store your request for information and our information for a period of three years for the purpose of providing evidence of proper information.

If we process your data to protect legitimate interests, you can object to this processing on grounds relating to your particular situation.

We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms
or the processing serves the establishment, exercise or defence of legal claims.

XI Video surveillance

(1) Information on the collection of personal data

a) Purposes of processing:

Protection of passengers, employees and property of the company against assaults, vandalism and other criminal offences, ensuring technical security and monitoring of technical systems, supporting authorities in the investigation of perpetrators, investigation of criminal offences, bodily injury, damage, including as a result of accidents. Defence against legal claims.

b) Controller pursuant to Art. 4 No. 7 of the EU General Data Protection Regulation (GDPR):
Rhein-Neckar-Verkehr GmbH (rnv)
Möhlstraße 27
68165 Mannheim
Tel: 0621 465-4444
Email: kundenservice(at)rnv-online.de

c) Data protection officer:

CTM-COM GmbH
Management Mr Görmann
Contact Mr Mentges

Marienburgstraße 27
64297 Darmstadt
E-mail: datenschutz(at)ctm-com.de

d) Responsible data protection supervisory authority:
Landesdatenschutzbehörde Baden-Württemberg
Königstraße 10a
70173 Stuttgart
Tel: 0711 615541-0
E-Mail: poststelle(at)lfdi.bwl.de

e) Legal bases:

Article 6(1)(f) GDPR Legitimate interest.

§ Section 4 BDSG "Video surveillance of publicly accessible areas.

As a public transport provider, we have an obligation and a legitimate interest in ensuring the defence against threats to the safety of our facilities and our customers.

f) Recipients for data transmission:

Records are released to law enforcement authorities (police, public prosecutor's office, court) and courts in civil disputes or granted access if this serves to fulfil the above-mentioned processing purpose.

Service providers are contractually bound for order processing (IT infrastructure, server operation, application operation).

(2) Your rights

a) You have the following rights vis-à-vis us with regard to your

personal data concerning you:

Right to information,
Right to rectification or erasure,
Right to restriction of processing,
Right to object to processing,
right to data portability.

b) You also have the right to complain to a data protection supervisory authority about the processing of your personal data in our company.

(3) Your right to erasure and rectification

a) If you have provided us with personal data, you have the option to have it deleted at any time. (Art. 17 GDPR). To do this, send us an e-mail to videoüberwachung@rnv-online.de or send us a letter to rnv GmbH, Möhlstraße 27,68165 Mannheim.

b) Due to the short storage period (48 hours - deletion by overwriting), separate deletion or correction is not technically possible

(4) Right to information

Rhein-Neckar-Verkehr GmbH will provide the data subject with information about the personal data stored about him/her free of charge on request. The information can be provided in writing or by e-mail at the request of the user. The request for information must be sent to Rhein-Neckar-Verkehr GmbH in writing or by e-mail, enclosing proof of identity (e.g. copy of identity card).

Please note the following points when submitting a copy of your ID card:

Only ID card holders are free to make copies of their ID card. The copy must be clearly and permanently recognisable as a copy.
For identification purposes, however, we only require the name, address, date of birth, photograph and period of validity on the copy of the ID card.
ID card data that is not required for identification purposes can and should be blacked out on the copy by the ID card holder. This applies in particular to the access number printed on the ID card and the document number.
The copy of the ID card is used exclusively for identity verification!

Please note that we will store your request for information and our information for a period of three years for the purpose of providing evidence of proper information.

(5) Objection or cancellation against the processing of your data

a) Insofar as we base the processing of your personal data on the balancing of interests, you can object to the processing. This is the case if, in particular, the processing is not necessary for the fulfilment of a contract with you, which is described by us in the following description of the functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we have done. In the event of your justified objection, we will examine the situation and will either discontinue or adapt the data processing or show you our compelling reasons worthy of protection on the basis of which we will continue the processing.

b) Storage period: 48 hours (ring storage procedure) if there is no incident. In the event of an incident, the video recording may be stored separately. If video recordings are stored as evidence for criminal and/or civil prosecution, they will be deleted in accordance with the statute of limitations.

XII Making contact via chat bot

(1) Definition of terms

Chatbot within the meaning of this data protection notice refers to all service bots offered by rnv GmbH, such as our customer service bot.

(2) Purpose of data processing

The chat bot offers you the opportunity to get your questions answered as quickly as possible around the clock. You can also use digital forms or free input fields in the chat bot to send orders to rnv for processing. Depending on the content of the request or order, the chat bot takes over the direct delivery to the responsible rnv clerk for the fastest possible processing.

When you contact us via chat bot, your conversation with the chat bot is analysed in order to determine the reason for your contact and to be able to help or answer you accordingly and to enable the conversation to be resumed at a later date.

(3) Use of cookies

The chat bot uses cookies (local storage). The lifespan is unlimited.

(4) Processed data

When visiting our chat bot, user data is processed. This includes

IP address
UserID
ConversationID
Any data entered by the user, e.g. telephone number for callback requests or other personal information

The IP addresses of users are not saved.

The first time you use the chat bot, you will be assigned a randomly generated UserID. The UserID remains stored in your browser until you delete your browser history. If you want to use the bot again after deleting your browser history, a new randomly generated UserID will be generated. In this case, you may have to re-enter all previously clicked answers or questions or entries. If you use the bot again, the UserID will be transmitted to it by your browser. This allows you to continue a previously interrupted conversation, search or input in the bot at any time (similar to the setting of cookies on websites). The conversations, searches or entries you have started are also created and saved in the events on your browser. To continuously improve the bot, we record events such as "Bot was displayed" and click events such as "User clicked on answer X". To do this, we use conversation IDs, which are generated in the same way as the user ID within the bot's database. It serves as an object identifier and is required for the construction of the bot, as database entries need a unique identifier.

Any data entered by the user via the chat bot is recorded by our service provider and made available to rnv for analysis.

(5) Processor used in accordance with Art. 28 GDPR

Solvemate GmbH
Friedrichstraße 114A
10117 Berlin
Germany

(6) Relationship between rnv and the data processor

The chat bot is used within the framework of order processing in accordance with Art. 28 GDPR, so that Solvemate may only use your data on our behalf in accordance with our instructions.

(7) Legal basis for data processing, purpose of data processing

(a) Fulfilment of a contract (Art. 6 para. 1 sentence 1 lit. b GDPR): Processing of enquiries from our customers with whom we have contracts.

(b) Legitimate interest (Art. 6 Para. 1 S.1 lit. f GDPR): Legitimate interest in ensuring smooth customer service and that our services function properly and to improve and speed up our processing procedures, e.g. through optimised assignment functionalities.

(8) Duration of data processing

If the legal basis for data processing ceases to apply, all personal data you have entered will be deleted. Data that is required for contract processing or is subject to statutory retention periods (e.g. for tax reasons) remains unaffected by this.

XIII myVRN app

(1) Information on the collection of personal data

(a) The myVRN app is a platform of Verkehrsverbund Rhein Neckar GmbH (hereinafter referred to as VRN) and is developed by MENTZ GmbH, Munich. rnv uses this product for the online sale of public transport tickets.

In the following, we provide information on the collection of personal data when using these digital services. Personal data is all data that can be related to you personally, e.g. name, address, e-mail addresses.

(b) The controller pursuant to Art. 4 No. 7 of the EU General Data Protection Regulation (GDPR) is

Rhein-Neckar Verkehr GmbH (rnv)
Möhlstraße 27
68165 Mannheim
Tel: 0621 465-4444
Email: kundenservice(at)rnv-online.de

Our company's data protection officer is

CTM-COM GmbH

Management Mr Görmann

Marienburgstraße 27
64297 Darmstadt
E-mail: datenschutz(at)ctm-com.de

The competent data protection supervisory authority is

Baden-Württemberg State Data Protection Authority
Königstraße 10a
70173 Stuttgart
Tel: 0711 615541-0
Email: poststelle(at)lfdi.bwl.de

(c) When you contact us by e-mail or via a contact form, your e-mail address and, if you provide it, your name and telephone number will be stored by us in order to answer your questions. We delete the data arising in this context after storage is no longer necessary or - in the case of statutory retention obligations - restrict processing.

(d) Service providers are contractually bound for order processing (IT infrastructure, server operation, application operation).

(e) If we wish to use your data for commercial purposes, we will obtain your consent.

(2) Collection of personal data when using the myVRN app

(a) When you download the myVRN app, the required information is transmitted to the App Store, in particular your user name, email address and customer number of your account, time of download, payment information and the individual device identification number. We have no influence on this data collection and are not responsible for it. We only process the data to the extent necessary for downloading the mobile app to your mobile device.

(b) When using the myVRN app and the purchase function for public transport tickets, we collect the personal data described below to enable convenient use of the functions. If you wish to use our mobile app, we collect the following data, which is technically necessary for us to offer you the functions of our mobile app and to ensure stability and security (legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR):

IP address
Date and time of the enquiry
Time zone difference to Greenwich Mean Time (GMT)
Content of the request (specific page)
Access status/HTTP status code
Amount of data transferred in each case
Website from which the request originates
browser
Operating system and its interface
Language and version of the browser software

(c) We also require your device identification, unique number of the end device (IMEI = International Mobile Equipment Identity), mobile phone number (MSISDN) and e-mail address.

In addition to the aforementioned data, cookies are stored on your mobile device when you use the myVRN app. Cookies are small text files that are stored in the device memory of your mobile device and assigned to the mobile app you are using. Cookies allow certain information to flow to the organisation that sets the cookie (in this case, us). Cookies cannot execute programmes or transfer viruses to your mobile device. They serve to make mobile apps more user-friendly and effective overall.

(d) You can only place an order in the myVRN app with login data. For this purpose, the following personal data is provided during registration:

Title, surname, first name
Full address
date of birth
e-mail address
Account details with IBAN and BIC

The personal data you voluntarily provide when concluding a contract will only be collected, processed and used for the purpose of processing the contract. The data does not have to be entered again to purchase a new ticket. The purchased ticket is also linked to the smartphone. This means that if you lose your smartphone, you will not be able to access your ticket on another device.

(e) If you decide to make a purchase with login data, you can use the myVRN app to its full extent. This means that you only have to enter your data once and can access this data when you make a new purchase. You can also view purchased tickets and the purchased ticket is not linked to your smartphone, but is assigned to your login data. If you lose your smartphone, you can use another device to download the app and log in with your data. The valid ticket will then appear in the app and can be used if it is valid.

aa. When creating login data, the following personal data is collected from you and stored in the background system provided by the service provider MENTZ GmbH:

Title, surname, first name
Date of birth
Full address
e-mail address
password
Security question with answer

In addition to rnv and VRN, MENTZ GmbH also has access to the stored data.

We would like to point out that the e-mail address you enter when logging in is used as an identification feature for the contracts assigned to you. For your security, please ensure that the e-mail address you enter and your password consisting of at least 8 characters are only accessible to you. In the event of a change, you are responsible for changing this data via the app or informing rnv customer service immediately.

bb. With your personal login data, future use of the myVRN app is possible by entering your user name and password. It is not necessary to log in again with your personal data, as the system automatically uses the known data.

The personal data you voluntarily provide when assigning login data is only collected, processed and used to ensure a standardised login procedure and serves as the basis for future orders via the connected services.

cc. You can change the data you have entered at any time after successfully logging in, e.g. if your address or bank details have changed. You can also change the password at any time and set it yourself.

dd. You can deactivate your login data at any time. To do this, please contact our customer service(myvrn(at)rnv-online.de). After an internal check for valid tickets, your data will be anonymised. Please note that deactivating your login does not automatically cancel your subscription. Subscriptions must be cancelled separately. Billing data will be transferred to the financial data archive and blocked in accordance with the statutory retention periods for tax audit purposes.

ee. When ordering with existing login data, you must provide the following personal data:

Title, surname, first name
Full address
date of birth
e-mail address
Valid means of payment (credit card, bank details, PayPal)

The personal data already entered in the login data can be used for this purpose. The personal data voluntarily provided by you when concluding a contract will only be collected, processed and used for the purpose of contract fulfilment.

ff. In the myVRN app, you will also have the opportunity to participate in the best price optimisation from 01.01.2022. To calculate the best ticket price, the following information is requested before the purchase is concluded

Adult (Yes/No)
Passenger (Yes 1 to 4/No)
Railcard holder (Yes/No)
1st class (Yes/No)

Alternatively, you can place an order outside of the best price optimisation so that only the data specified in section 4 e is requested.

(f) After termination of the user contract, the customer master data (surname, first name, address, date of birth, mobile phone number and email address) will be anonymised and retained for statistical purposes. Billing data is transferred to the financial data archive and blocked in accordance with the statutory retention periods for the purposes of tax audits.

(g) The personal data entered (surname, first name, date of birth and address) are used to initiate a credit check. This information is provided in accordance with the provisions of Art. 12 GDPR.

(h) rnv and its service providers use personal data (customer master data and billing data) for the billing of the journeys made.

(i) In the case of personalised tickets, a valid identification document (e.g. student ID, passport, identity card or driving licence) must be presented in the event of a check.

(j) We pass on your personal data (first name and surname, date of birth, address, email address, bank account details, credit card details, mobile phone number if applicable and data on your respective ticket purchases) and any changes to LogPay Financial Services GmbH for the purpose of selling and assigning our claims against you that arise in connection with your ticket purchase. This is done on the basis of Art. 6 para. 1 sentence 1 lit. f GDPR. The legitimate interest on our part is the outsourcing of payment processing and receivables management. The legitimate interest on the part of LogPay Financial Services GmbH is the collection of data for the purpose of processing payments, receivables management, assessing the admissibility of payment methods and avoiding payment defaults.

You can object to the transmission of this data to LogPay Financial Services GmbH at any time, but it will then no longer be possible to place an order via the electronic sales channel.

You can access the data protection information of LogPay Financial Services GmbH at https://www.logpay.de/DE/datenschutzinformationen/.

(3) Use of your address book, calendar and photos when using the mobile phone ticket.

(a) When you start using our mobile app, we will ask you for permission to use the following functions in a pop-up:

Android operating system:

Memory
Location

iOS operating system:

Locations
Mobile data

Location/mobile data:

These functions are required to determine the geo-coordinates of the device and pre-assign the start stop. The app only accesses these functions when using the neighbourhood map and only for as long as you use this function. If you do not grant the app this authorisation, this data must be entered manually.

(b) If you do not grant permission, we will not use this data. In this case, you will not be able to use all the functions of the app. You can grant or revoke permission later in the operating system settings under Settings.

(c) If you authorise access to this data, the mobile app will only access your data and transfer it to our server to the extent necessary to provide the functionality. Your data will be treated confidentially by us and deleted if you revoke the right to use it or if it is no longer required for the provision of the services and there are no legal obligations to retain it. The legal basis for the processing is Art. 6 para. 1 sentence 1 lit. a and Art. 6 para. 1 sentence 1 lit.b GDPR.

(4) Your rights

(a) You have the following rights vis-à-vis us with regard to the personal data concerning you

Right to information,
Right to rectification or erasure,
Right to restriction of processing,
Right to object to processing,
right to data portability.

(b) You also have the right to complain to a data protection supervisory authority about the processing of your personal data in our company.

(c) Please note that we will store your request for information and our information for a period of three years for the purpose of providing evidence of proper information.

a. Your right to erasure and rectification

If you have provided us with personal data, you have the option of having it deleted at any time. (Art. 17 GDPR). To do this, send us an e-mail to myvn@rnv-online.de or send us a letter (rnv GmbH, Möhlstraße 27, 68165 Mannheim).

You can change your data (e.g. change of address) yourself at any time online in your online account or the app or send us an e-mail to myvrn(at)rnv-online.de.

b. Right to information

Rhein-Neckar-Verkehr GmbH will provide the user with information about the personal data stored about him/her free of charge and without delay upon request. The information can be provided in writing or by fax at the user's request. The request for information must be sent to Rhein-Neckar-Verkehr GmbH in writing or by fax, enclosing proof of identity (e.g. copy of identity card). For identification purposes, however, we only require the name, address, date of birth and period of validity on the copy of the ID card. All other data on the copy (e.g. ID card number, photograph, personal characteristics and nationality) can therefore be blacked out. The copy of the ID card is used exclusively for identity verification and is then destroyed.

c. Objection to or cancellation of the processing of your data

If you have given your consent to the processing of your data, you can revoke this at any time. Such a revocation affects the permissibility of the processing of your personal data after you have given it to us.

Insofar as we base the processing of your personal data on the balancing of interests, you can object to the processing. This is the case if, in particular, the processing is not necessary for the fulfilment of a contract with you, which is described by us in the following description of the functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we have done. In the event of your justified objection, we will examine the situation and either discontinue or adapt the data processing or show you our compelling reasons worthy of protection on the basis of which we will continue the processing.

Of course, you can object to the processing of your personal data for advertising and data analysis purposes at any time. You can inform us of your objection using the following contact details: myvrn(at)rnv-online.de.

Version 2024