Data Protection Declaration

Below, we inform you of how we use your data in accordance with Article 13 of the General Data Protection Regulation (GDPR).

The office named in the address details is the controller with respect to the data processed:

Verkehrsverbund Bremen/Niedersachsen GmbH (VBN)
Am Wall 165–167
28195 Bremen

The company data protection commissioner of VBN will be happy to give you information or ideas on the subject of data protection:

Verkehrsverbund Bremen/Niedersachsen GmbH
Email: datenschutz[at]vbn.de
Telephone: 04 21 / 59 60 0

3.1 Saving the  IP Address

For a period of seven days VBN saves the IP address transmitted by your web browser strictly related to the purpose of detecting, limiting and remedying attacks on our website. After the end of this period we will delete or anonymise the IP address. The legal basis is Article 6 para. 1 f) GDPR. 

3.2 Usage Data

When you visit our website, usage data will be temporarily stored on our web server for statistical purposes as a protocol for improving the quality of our website. This data comprises

• the page from which the file was requested,
• the name of the file,
• the date and time of the request,
• the amount of data transmitted,
• the access status (file transferred, file not found),
• a description of the type of web browser used,
• der the IP address of the requesting computer that is abbreviated in such a way that no personal connection can be made.

The above-mentioned protocol data will be stored only anonymously. 

3.3 Data Security

We undertake technical and organisational measures to protect your data as comprehensively as possible from unwanted attacks. We use an encryption process on our site. Your data is transmitted from your computer to our server and vice versa via the internet using an SSL/TLS encryption. In the status bar of your browser you will see that the padlock symbol is closed and the address line starts with "https://".

3.4 Data Transmission to Third Parties

Within the context of processing an order, VBN transmits your data in accordance with Article 28 GDPR to service providers, who support us in operating our website (for example hosts, internet agencies, web analysis service providers) and the associated processes. Our service providers are strictly bound by instructions to us and are bound by a contract accordingly. 

3.5 Cookies

We use cookies on our website.

Cookies are small text files that are stored on your terminal device and that can be read. A distinction is made between session cookies that are deleted again as soon as you close your browser and permanent cookies that are stored beyond the individual session. Cookies may contain data that make it possible to recognise the device used. But sometimes cookies only contain information on specific settings that cannot be related to a person.

You can set your browser so that it informs you of cookies being set. This makes the use of cookies transparent to you. You can then delete cookies at any time using the relevant browser setting and prevent new cookies from being set. Please note that our website may not be displayed at its best in that case and some technical functions will no longer be available.

3.5.1 Cookies in the category "Functional"

These cookies are always activated because they are required and necessary for the basic function of the website. These necessary cookies include those that are required for reactions to customer queries, e.g. service queries, filling in forms. All of these cookies contribute to the convenient, secure and proper use of the site and cannot be switched off.

You can prevent the use of cookies with appropriate browser settings. However, we must point out that in this case you many not be able to make full use of all of the functions of this website.

3.5.2 Cookies in the category "Statistics"

Statistics cookies enable us to count visits, identify popular and unpopular content and navigation paths on the website. This information can be used to measure the performance of the website and to identify potential for optimisation.

Changing the settings for statistics cookies: Cookie settings

For this, we use Conversion Tracking from the Google Analytics web analytics service. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Visits to the website and anonymised data about the use of the website is recorded via the cookie. We have activated the IP anonymisation function. As a result, your IP address is abbreviated by Google within the member states of the European Union or in other parties to the Agreement on the European Economic Area prior to transmission to the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and abbreviated there.
Google will use this information on our behalf to evaluate use of the website, compile reports o the website activities and to provide other services for us associated with the website use and internet use. The IP address transmitted by your browser within the context of Google Analytics is not brought together with your data by Google.

You can permanently deactivate the use of cookies by Google by following the link below and download and install the plug-in provided there:
https://www.google.com/settings/ads/plugin?hl=de.

You can view more detailed information about Google and Google's data protection declaration at:
https://www.google.com/policies/technologies/ads/.

3.5.3 Cookies in the category "Marketing"

These cookies enable an expanded functionality and personalisation of the website. They can be used by us and third party providers to draw up a profile of your interests and to show you relevant advertising on other websites. If these cookies are not activated, the website visitor may not be able to connect to social networks properly (for example, social media content will not be displayed on the website) and/or contents cannot be shared via social media.

Changing the settings for marketing cookies: Cookie settings

For this, we use the remarketing function of the Google Analytics web analytics service and Google Ads. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

The cookie is used to record visits to the website and anonymised data about use of the website. We have activated the IP anonymisation function. As a result, your IP address is abbreviated by Google within the member states of the European Union or in other parties to the Agreement on the European Economic Area prior to transmission to the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and abbreviated there.
Google will use this information on our behalf to evaluate use of the website, compile reports o the website activities and to provide other services for us associated with the website use and internet use. The IP address transmitted by your browser within the context of Google Analytics is not brought together with your data by Google.

You can permanently deactivate the use of cookies by Google, by following the link below and download and install the plug-in provided there:
https://www.google.com/settings/ads/plugin?hl=de.

You can view more detailed information about Google and Google’s data protection declaration at:
https://www.google.com/policies/technologies/ads/.

3.6 Transferring to Other Websites

Our website includes links to other providers. You can see this with the example of a logo or by the fact that a new browser window opens. If it is not a web offering from VBN GmbH, the data protection regulations of the respective provider apply there. For example, this applies to pages that are linked to with the relevant logos (for examplevon Facebook and YouTube) or references to the websites, for example, of the VBN transport companies, the NITAG OnlineShop and online payment services. 

3.7 Embedded Vimeo Videos

On his website and applications, VBN integrates the video player services of Vimeo, Incorporated, 555 West 18th Street (New York), New York 10011 (www.vimeo.com). The videos are embedded on our page as iFrame. When you activate the video player plug-in, a connection will be made between your browser (terminal device) and the Vimeo servers. In the process, some of your data, such as your IP address and the terminal device you are using to visit the site, as well as your activities, may be processed. By accessing the video and further interaction with the video player service, more information about you may be processed by Vimeo, for example to evaluate the videos you have watched or your interests.

Vimeos uses what is known as web tracking methods on its own site and also within the video player service. This is done regardless of whether you are registered with Vimeo. Unfortunately, we cannot influence Vimeo’s web tracking methods or the connected services.

Please be aware: It cannot be ruled out that Vimeo will use your profile data, for example to evaluate your approximate location, interests, the videos accessed, etc. We have no influence whatsoever on the processing of your data by Vimeo and the services incorporated.

Please also note Vimeo’s data protection regulations (www.vimeo.com) at https://vimeo.com/privacy

3.8 FahrPlaner

On his website and applications VBN incorporates the timetabling services of HaCon Ingenieurgesellschaft mbH, Lister Straße 15, 30163 Hanover. The Trip Planner at https://www.vbn.de/fahrplaner is incorporated into our site with the help of what is known as an iFrame. We also use widgets on all of our pages so that we can access the timetable data more quickly.

When you access these pages, a connection will be made between your browser (terminal device) and the HaCon servers. Some of your data, for example your IP address and the terminal device you are using to visit the site and your interactions within the FahrPlaner apps, is processed.

Please note that in certain applications, for example with the active selection of your current location as a starting point or destination in the mobile timetable information uses your location for the search, after you have given your consent, and the transmitted data is saved. 

3.9 Online Sales (Mobile and OnlineTicket)

On his website and applications VBN incorporates the services of EOS UPTRADE GmbH, Schanzenstraße 70, 20357 Hamburg. The application and the associated sub-pages at https://shop.vbn.de are embedded on our site with the help of a layout loader.

When you access these pages, a connection is made between your browser (terminal device) and the EOS UPTRADE servers. Some of your data, for example your IP address and the terminal device you are using to visit the site and your interactions, is processed.

By sending off the registration form and subsequent use of the MobileTicket and when using without registering, more information about you is processed by EOS UPTRADE GmbH , see 8. Online Sales (Mobile OnlineTicket).  

3.10 Application and Contact Forms

On his website, VBN offers you the opportunity to fill in application and contact forms. They are processed on the basis of Article 6 para. 1 b) GDPR and are used to implement pre-contractual measures (BOB, MIA/MIAplus, Youth-LeisureTicket, TIM, customer card applications and BusSchool).

For BOB, MIA/MIAplus,Youth-LeisureTicket (JFT) and TIM, the data will be passed on to the responsible transport company with which the contract is concluded. Data for the customer card application will not be passed on, but processed by the VBN. Data for the bus school are processed together with the transport companies involved in the project.

For BOB, MIA/MIAplus, Youth-LeisureTicket (JFT) and TIM, the information is stored in the background system of the VBN website and deleted after 28 days. For customer card applications (adults and children, pupils, students and apprentices) and BusSchool, the information is stored in the background system of the VBN website and deleted twice a year, at the latest after 6 or 12 (BusSchool) months.

4.1 Purpose and Legal Basis of Processing

VBN processes the customer’s data, i.e. their name, title and address, their date of birth, their bank details, their email address, preferred method of payment, bank account details with IBAN and/or credit card data, reply to security question and the order processes with the following information: IP address, first name and surname for ticket personalisation and ticket data in accordance with Article 6 para. 1 b) GDPR for the purposes of fulfilling the contract. The user agent/device information/relation information is collected as a legitimate interest in accordance with Article 6 para. 1 f) GDPR. The legitimate interests on the part of the VBN are system optimisation, quality assurance and fraud prevention. This also includes the associated customer support. 

4.2 Recipients of the Personal Data

The data provided by you will be processed and stored on behalf of the VBN by EOS UPTRADE GmbH, Schanzenstraße 70, 20357 Hamburg in accordance with Article 6 para. 1 f). The legitimate interest on the part of the VBN lies in outsourcing the back-office system, ticket creation and hosting to a service provider.

VBN passes on your personal data (first name and surname, date of birth, address, email address, bank account details if provided by you, credit card data, PayPal account information, mobile telephone number and data about your ticket sales) and all changes to LogPay Financial Services GmbH, Schwalbacher Straße 72, 65760 Eschborn for the purposes of sale and assignment of any claims against you that arise in association with your ticket purchase. This is done on the basis of Article 6 para. 1 f) GDPR. The legitimate interest on the part of the VBN lies in outsourcing the payment processing and claims management. The legitimate interest on the part of LogPay Financial Services GmbH lies in collecting data for the purposes of processing payments, claims management, evaluating the reliability of payment types and avoiding defaults.

You can object to transmission of data to EOS UPTRADE GmbH and LogPay Financial Service GmbH at any time, however, you will no longer be able to order using electronic our sales channels.

You can access the data protection legal information of LogPay Financial Services GmbH at https://www.logpay.de/datenschutz.html. 

In the FahrPlaner app VBN offers the option to pay using the PayPal online payment service. The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter referred to as “PayPal”). If you choose PayPal as your payment method, you will be transferred to the PayPal website and the payment data you enter will be transmitted to PayPal in encrypted form. Usually, this comprises your name, address, telephone number, your IP address, email address or other information required to process the order, including your order data.

Your personal data is processed by PayPal as the data controller. Where this is necessary to fulfil the order, PayPal may pass data on to third parties. Moreover, to check your identity and credit-worthiness, PayPal passes on your personal data to credit reference agencies, such as SCHUFA. The legal basis is Article 6 para. 1 f) GDPR. The legitimate interest on the part of PayPal lies in ensuring the customers’ solvency.

You can find more information about data processing by PayPal at https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE.

4.3 Duration of Data Storage

Personal data will be stored only for as long as prescribed by law and for as long as necessary to achieve the purpose in question.

5.1 Purpose and Legal Basis of Processing

VBN processes the customer card holder’s data, and, where applicable, that of the applicant and, where applicable of the legal representative, i.e. their name, address, telephone number, dates of birth (only customer card application for children, pupils, students and apprentices), school/college/training company (only customer card application for children, pupils, students and apprentices) and ticket data in accordance with Article 6 paragraph 1 b) GDPR and number 3.2.1 of the VBN Fare Regulations for the purposes of the pre-contractual measures, i.e. to be able to issue you a customer card. 

5.2 Recipients of the Personal Data

The data is not passed on to third parties.

5.3 Duration of Data Storage 

The information will be deleted after one year at the latest.

6.1 Purpose and Legal Basis of Processing

VBN processes the customer’s data, i.e. their name, address, their email address, their telephone number and their concern (Praise and Criticism) in accordance with Article 6 para. 1 b) GDPR. The legitimate interest of the VBN is to process your concern quickly and effectively and to pass it on to the relevant office. It is processed jointly with the transport companies operating in the network area (https://www.vbn.de/en/vbn/our-partners) and the commissioning authorities. 

6.2 Recipients of the Personal Data

The specific concern will be passed on the the relevant office that is responsible for dealing with your concern. This may be individual transport companies or the commissioning authority, such as Zweckverband Bremen/Niedersachsen and/or the districts or municipalities in the network area.

VBN has commissioned external service providers for hosting and further development of the database. Hosting is the responsibility of Bremer Straßenbahn AG (BSAG), Flughafendamm 12, 28199 Bremen, and for further development has been commissioned SIGNON Deutschland GmbH, Schützenstraße 15-17, 10117 Berlin, which is strictly bound to instructions.

You are entitled to object to processing. You can do this by sending a notification at datenschutz[at]vbn.de or to Verkehrsverbund Bremen/Niedersachsen, Am Wall 165-167, 28195 Bremen. Your personal data will be deleted when if it may not be further processed to ensure legitimate interests. 

6.3 Duration of Data Storage

The data required for the answer will be deleted 18 months after the last contact. The concern will be anonymised.

7.1 Purpose and Legal Basis of Processing

VBN processes the customer’s data, i.e. their name, their address, their email address, their bank details, possibly their telephone number, possibly their card number of the Deutschland-Ticket, MIA Ticket, JobTickets or BOB Ticket and their concern (Guarantee Claim) in accordance with Article 6 para. 1 b) GDPR. The legitimate interest on the part of the VBN is to review and process your guarantee claim. 

7.2 Recipients of the Personal Data

VBN has commissioned external service providers for hosting and further development of the database. Hosting is the responsibility of Bremer Straßenbahn AG (BSAG), Flughafendamm 12, 28199 Bremen, and for further development has been commissioned SIGNON Deutschland GmbH, Schützenstraße 15-17, 10117 Berlin, which is strictly bound to instructions.

In the case of centrally distributed tickets (Deutschland-Ticket, MIA Ticket, JobTickets and BOB Ticket), VBN reserves the right to compare the accuracy of the information with the customer centres of BSAG, BREMERHAVEN BUS and VWG.

You are entitled to object to processing. For example, you can do this at datenschutz[at]vbn.de or by sending a notification to Verkehrsverbund Bremen/Niedersachsen, Am Wall 165-167, 28195 Bremen. Your personal data will be deleted when if it may not be further processed to ensure legitimate interests. 

7.3 Duration of Data Storage

The personal data on your guarantee claim will be stored for 18 months for the purpose of preventing abuse and will then be automatically anonymised without receiving a new guarantee claim request.

Dedicated to the purpose of fulfilling commercial or tax retention periods, the data will be archived for up to 10 years.

8.1 Purpose and Legal Basis of Processing

You can contact VBN by telephone, email and post. VBN processes customer’s data, i.e. their name, address, email address, telephone number, in accordance with Article 6 para. 1 f) GDPR. The legitimate interest of VBN is to process your customer query quickly and effectively and to pass it on to the relevant office. It is processed jointly with the transport companies operating in the network area (https://www.vbn.de/vbn/our-partners). We process only the data you have provided so that we can contact you in line with your wishes.

8.2 Recipients of the Personal Data

The specific concern will be passed on the the relevant office that is responsible for dealing with your concern. This may be individual transport companies in the network area.

You are entitled to object to processing. For example, you can do this at datenschutz[at]vbn.de or by sending a notification to Verkehrsverbund Bremen/Niedersachsen, Am Wall 165-167, 28195 Bremen. Your personal data will be deleted when if it may not be further processed to ensure legitimate interests. 

8.3 Duration of Data Storage

The data will be deleted after one year at the latest.

9.1 Purpose and Legal Basis of Processing

VBN processes the customer’s data, i.e. their name, school, the school’s contact data, in accordance with Article 6 para. 1 f) GDPR wtih a legitimate interest to carry out the BusSchool and train bus escorts. 

9.2 Recipients of the Personal Data

VBN offers BusSchool and training of bus escorts together with the transport companies AllerBus represented by Verden-Walsroder Eisenbahn GmbH (VWE), Moorstraße 2a, 27283 Verden and Verkehrsbetriebe Wesermarsch GmbH (VBW), Arthur-Lückemeyer-Weg 2, 26954 Nordenham. The personal data will be exchange between the partners to process the project.

You are entitled to object to processing. For example, you can do this at datenschutz[at]vbn.de or by sending a notification to Verkehrsverbund Bremen/Niedersachsen, Am Wall 165-167, 28195 Bremen. Your personal data will then be deleted if it cannot be further processed to ensure legitimate interests. 

9.3 Duration of Data Storage

The information will be deleted after one year at the latest. 

10.1 Purpose and Legal Basis of Processing

VBN processes the data of competition entrants, i.e. their names and addresses, in accordance with Article 6 para. 1 f) GDPR with the legitimate interest of being able to run the competition. The winners will be notified in writing. 

10.2 Recipients of the Personal Data

The data is not passed on to third parties.

You are entitled to object to processing. For example, you can do this at datenschutz[at]vbn.de or by sending a notification to Verkehrsverbund Bremen/Niedersachsen, Am Wall 165-167, 28195 Bremen. Your personal data will be deleted if it can no longer be used to ensure legitimate interests. 

10.3 Duration of the Data Storage

We will store winners’ data in line with the tax and commercial law regulations for up to 10 years, and then it will be deleted.

11.1 Purpose and Legal Basis of Processing

VBN processes the applicants’ data, i.e. their names, address and personal data provided by them in accordance with Article 6 para. 1 f) GDPR with the legitimate interest of being able to complete the application process. 

11.2 Recipients of the Personal Data

The data is not passed on to third parties.

You are entitled to object to processing. For example, you can do this at datenschutz[at]vbn.de or by sending a notification to Verkehrsverbund Bremen/Niedersachsen, Am Wall 165-167, 28195 Bremen. Your personal data will be deleted if it can not processed to ensure legitimate interests. 

11.3 Duration of Data Storage

The data will be deleted 6 months after the end of the selection process if the application has not resulted in employment.

GDPR gives you certain rights when your personal data is being processed: 

12.1 Right to Information (Article 15 GDPR):

You have the right to demand confirmation as to whether data concerning you has is being processed; if this is the case, you have a right to information about this personal data and the information listed in detail in Article 15 GDPR. 

12.2 Right to Correction and Deletion (Articles 16 and 17 GDPR):

You have the right to demand immediate correction of incorrect personal data concerning you and, where applicable, the completion of incomplete personal data.

You have the right to demand that personal data concerning you be deleted immediately if one of the reasons listed in detail in Article 17 GDPR applies. 

12.3 Right to Limitation of Processing (Article 18 GDPR):

You have the right to demand limitation of processing if one of the conditions listed in Article 18 GDPR applies. 

12.4 Right to Data Portability (Article 20 GDPR):

In certain cases, which are listed in detail in Article 20 GDPR, you have the right to demand receipt of the personal data concerning you in a structured, commonly used and machine-readable format or transmission of this data to a third party. 

12.5 Right to Object (Article 21 GDPR):

If data is collected on the basis of Article 6 para. 1 f) (Data Processing to Pursue Legitimate Interests), you are entitled to object to processing at any time for reasons arising from your particular situation. We will then no longer process the personal data unless there are demonstrably compelling legitimate grounds for processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims. 

12.6 Right to Lodge a Complaint with a Supervisory Authority

According to Article 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes GDPR. The right to lodge a complaint may be made to a supervisory authority in particular in the member state of your habitual residence, place of work or place of the alleged infringement.

In the Free Hanseatic City of Bremen, the competent supervisory authority is the Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen, Arndtstraße 1, 27570 Bremerhaven.

We do not use automated decision-making or profiling.

Video systems are used to monitor the VBN business premises, in particular the VBN Service Centre in Bremen, Am Wall 165–167, 28195 Bremen. In accordance with Article 6 para. 1 sentence 1 f) of the GDPR, the data is processed in the interest of preventing and investigating criminal offences. Video surveillance specifically serves to prevent criminal offences, to prevent damage to property and personal injury caused by vandalism, to prevent theft and violence and to preserve evidence and support criminal prosecution or the assertion of resulting civil law claims. This also serves to improve employees' sense of security and to protect employees from assaults.
Electronic images are created which, depending on the resolution options of the installations, enable the depiction of persons. If image data is saved, it is automatically deleted no later than 72 hours after recording. If a criminal offence is reported, the stored image data is retained for analysis until the respective proceedings are concluded, after which it is then deleted.

You can object to data processing at any time, for example by sending an email to datenschutz(at)vbn.de, or you can send a message to VBN GmbH, Am Wall 165–167, 28195 Bremen. Your personal data will then be deleted unless further processing is authorised for the protection of legitimate interests.