Privacy

Privacy

It is generally possible to use our website without providing personal data. This notice provides information about what data we collect, how we use it and how you can object to the use of your data.

Who is responsible for data collection and processing?
Regionalverkehre Start Deutschland GmbH collects and processes the data as the controller. Questions or suggestions can be addressed as follows:

Regionalverkehre Start Deutschland GmbH
Europa-Allee 70-76
60486 Frankfurt a. M.
T: (069) 9 99 99 36 40
F: (069) 9 99 99 36 69
E-mail: info@startgmbh.com

Who is our data protection officer?
The appointed data protection officer of Regionalverkehre Start Deutschland GmbH is Dr. Marein Müller. For questions and suggestions regarding data protection, please send an e-mail to datenschutz@startgmbh.com

General information on data processing
We collect and process your data exclusively for specific purposes in accordance with the principle of data minimization. The following describes the purposes for which we process which data, the legal basis for this and how long we store your data.

Provision of the website
For the purpose of providing the website, our system automatically collects technical data and information from the accessing computer each time the page is accessed.  These are the so-called server log files that are typically generated when you visit a website. The following data is usually transmitted to us:

  • IP address
  • Date and time of the request
  • Time zone difference to Greenwich Mean Time (GMT)
  • Content of the request
  • Access status/HTTP status code
  • Amount of data transferred
  • Website (from which the request comes)
  • Browser
  • Operating system and its interface
  • Language and version of the browser software

It is not technically possible to use this website without processing this data. The legal basis for the processing is Art. 6 para. 1 lit. f GDPR.

Contact form and recording
If you contact us, we process the personal data provided to us for the purpose of processing the correspondence.

  • Your personal data (surname, first name),
  • Your contact details (address, e-mail address, telephone number, company).

The legal basis for the processing is Art. 6 para. 1 lit. f GDPR. This data includes:

Competitions
In the context of competitions, data is collected for their processing. The details of this, such as which data is collected for which purpose, can be found in the data protection information and conditions of participation of the respective competition. The legal basis for this processing is Art. 6 para. 1 lit. a GDPR.

Offers, information and newsletters
We are also interested in maintaining customer relationships and providing our customers with information and offers that we believe match their interests. We therefore process data on the basis of Article 6(1)(f) GDPR (also with the help of service providers) in order to send information and offers. We use contact data (surname, first name, postal address) for advertising by post and for market research, unless such use has been objected to. The e-mail address we have received from a business relationship may also be used for advertising purposes.
If users register for a newsletter from us, the email address is collected as mandatory information. In this case, it can be used by us for advertising purposes.
When registering for the newsletter, we store the IP address assigned by the Internet service provider (ISP), the computer system used at the time of registration and the date and time of registration. The collection of this data is necessary in order to be able to trace the (possible) misuse of a data subject’s email address at a later date and therefore serves our legal protection. The legal basis for this processing is Art. 6 para. 1 lit. a GDPR.
You can unsubscribe from the newsletter at any time by email or by clicking the unsubscribe link in the newsletter.

Use of video surveillance in our vehicles
Video surveillance is used in some vehicles. This is indicated accordingly in the vehicles.

The purposes of the video technology are

  • Exercise of domiciliary rights
  • Protection of life, health and freedom of employees and customers
  • Investigation and prevention of criminal offenses
  • Prosecution of criminal offenses
  • Preservation of evidence in the event of an incident
  • Protection of property and possessions
  • Automatic passenger counting
  • Self-handling by train drivers
  • The legal basis for processing is Art. 6 para. 1 lit. f) GDPR.

Legitimate interests are the investigation and prevention of criminal offenses and the protection of life, health and freedom of employees and customers, as well as the preservation of evidence in the event of an incident.
Video data is passed on to investigating authorities, in particular the state and federal police, as required. In special individual cases, data is forwarded to the Federal Railway Authority.
The storage period varies between 48 and 72 hours, depending on operational processes and transport contract requirements. After this period, the data is automatically deleted.

Ticket inspection for electronic tickets (eTicket)
Mobile or stationary control devices are used to read the data stored in the chip card and automatically check the electronic ticket and its validity in terms of time and area. Only the result of the check is displayed (ticket valid or invalid with regard to the time and area of validity). In the case of personal tickets, the full or masked name and, if applicable, the date or year of birth and gender of the ticket holder are also displayed on the control device, depending on the network. The data read from the chip card by the control device is only temporarily stored on the device for the purpose of the check and is automatically deleted by the control device immediately after the check has been completed.
Additional fare collection, violation of the conditions of carriage, house ban, exclusion from carriage
We regularly collect and process the following personal data in order to process the process of a subsequent fare collection, to check for repeat offenders and – in certain cases – to file a criminal complaint and to punish violations of the conditions of carriage (e.g. vandalism, damage, dangerous interference with rail operations) and when issuing a house ban or exclusion from carriage:

  • Salutation
  • First name
  • Surname
  • Date of birth, in the case of minors: first name and surname of legal representative
  • Street, house number
  • Zip code, place of residence
  • Part of the ID number
  • Course of the offense or reasons for the punishment or issuing of the ban/exclusion from carriage
  • Data on the increased transportation charge (EBE) or on the violations of the conditions of carriage
  • Payment already made, if applicable

The personal data collected during ticket inspections will be forwarded to Atriga GmbH for processing the transaction and for payment processing. The passenger will be informed in writing of the transfer of data to our collection service provider Atriga on the receipt for the increased transportation charge. We reserve the right to take legal action against EBE debtors who are repeatedly found without valid tickets.
In the context of issuing transport exclusions or house bans, we only store personal data for as long as it is necessary to fulfill the purpose for which it was collected or if this is required by law.
In the event of a subsequent fare collection, the personal data will be deleted after a period of one year following settlement of the claim. However, this only applies if no recurrence has been established. This period shall be extended by a further year from the date of determination if a repeat case is determined within the one-year period.
If the EBE is paid immediately in cash and in full, the following data will be collected:

  • Date
  • Time of day
  • Entry/exit stop
  • Control stop

If the EBE is paid immediately in non-cash form, the payment is processed via the payment service provider Payone. Payone forwards the data in encrypted form to the respective banks and provides feedback as to whether the payment was successful.
The following data is collected:

  • Card number
  • Account number

The legal basis for data processing is Art. 6 para. 1 lit. b GDPR in conjunction with the conditions of carriage.

Use of cookies
Cookies are small text files in which personal data can be stored. We distinguish between cookies that are absolutely necessary for the technical functions of the website and optional cookies.
The use of www.startgmbh.com, www.start-NI-mitte.de, www.start-unterelbe.de, www.start-mitteldeutschland.de, www.start-klar.net and www.erlebe-start.de is generally possible without cookies that are not used for technical purposes. Traceability by cookies can be prevented in the browser (do-not-track, tracking protection list) or the storage of third-party cookies can be prohibited.
We also recommend regularly checking and deleting the stored cookies, unless this is expressly desired. Please note: If all cookies are deleted, any opt-out cookies that have been set will also be deleted, meaning that any declared objections must be declared again.

Legal basis
Cookies that are required to carry out the electronic communication process (necessary cookies) or to provide certain functions that you have requested (functional cookies, e.g. for the shopping cart function) or to optimize the website (e.g. cookies to measure the web audience) are stored on the basis of Art. 6 para. 1 lit. f GDPR, unless another legal basis is specified. The website operator has a legitimate interest in the storage of cookies for the technically error-free and optimized provision of its services. If consent to the storage of cookies has been requested, the cookies in question are stored exclusively on the basis of this consent (Art. 6 para. 1 lit. a GDPR); consent can be revoked at any time.

Purpose
Through the use of cookies, the Regionalverkehre Start GmbH can provide the users of this website with more user-friendly services that would not be possible without the cookie setting.
By means of a cookie, the information and offers on our website can be optimized for the benefit of the user. Cookies enable us to recognize the users of our website. The purpose of this recognition is to make it easier for users to use our website.

Storage period
Cookies are stored on the user’s computer and transmitted by it to our website. The data subject may, at any time, prevent the setting of cookies through our website by means of a corresponding setting of the Internet browser used, and may thus permanently deny the setting of cookies. Furthermore, cookies that have already been set can be deleted at any time via an Internet browser or other software programs. This is possible in all common Internet browsers. If the data subject deactivates the setting of cookies in the Internet browser used, not all functions of our website may be fully usable.

Types of data
The following data is processed by the cookies used

  • Event data
  • Log data
  • Device data
  • Metadata and button click

TikTok Pixel
We use the TikTok pixel of the social media platform TikTok. This is operated under the joint responsibility of TikTok Technology Limited, 10 Earlsfort Terrace, D02 T380, Co. Dublin, Dublin, D02t380, Ireland, and TikTok Information Technologies UK Limited, 1 London Wall, London, EC2Y 5EB, England. When you visit our website, the TikTok pixel sets cookies and transmits hashed information to TikTok. If consent is given when visiting our website and a user profile exists with TikTok, TikTok pixels transmit the information that our website was visited and which specific actions were carried out („events“, for example if a destination was searched for) together with a hashed version of the TikTok ID. We use TikTok pixels exclusively for this website and do not link them to other websites, nor do we transmit any other personal information to TikTok, such as customer information.
We also use conversion information using the TikTok pixel: We receive statistical information from TikTok about how many visitors to TikTok have visited our website via our advertisements placed there, so that we can design our campaigns on TikTok even better for the people who are actually interested in our products.
We do not regularly process any personal data here, as it is not possible for us to assign the hashed version of a TikTok ID to a natural person; only TikTok can do this. We also do not receive any information about the TikTok user, such as name, age or similar.
The data subject can prevent the setting of cookies at any time and thus permanently object to the setting of cookies.  

Further information on the use of data by TikTok, setting and objection options can be found in TikTok’s privacy policy (https://www.tiktok.com/legal/page/eea/privacy-policy/de).

Matomo
We use the web analysis tool „Matomo“ for the needs-based design of our websites. Matomo creates user profiles on the basis of pseudonyms. Cookies are explicitly not set.
It is possible to prevent user actions from being analyzed and linked.

Further information on Matomo’s terms of use and data protection regulations can be found here: https://matomo.org/privacy/

Social media
Regionalverkehre Start Deutschland GmbH has its own presence on various social media. In this way, we want to provide a broad, multimedia offering and exchange information with users on topics that are important to them. In addition to the respective provider of a social network, we also collect and process personal user data on fan pages. In this notice, we also provide information about what data we collect on our social media pages, how we use it and how you can object to the use of your data. The respective data processing purposes and data categories can be found in the respective offer listed in more detail below. The activities in social media operated by us and described in more detail below are carried out on the basis of a balancing of interests in accordance with Art. 6 para. 1 lit. f GDPR.

Facebook
The Facebook pages of Regionalverkehre Start Deutschland GmbH provide tips and information on all aspects of travel.
When you visit our pages, Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland, collects, stores and processes personal data in accordance with its privacy policy. The privacy policy can be found here: https://www.facebook.com/privacy/policy
Beyond this, we only process data to a very limited extent:
We use the Facebook Insights statistics service for the purpose of designing and continuously optimizing our pages in line with requirements. This service records user activities on our site and makes them available to us in anonymized statistics. This provides us with information about the activity of our fan page visitors, the views of our page, the reach of posts, views and average duration of video playbacks, information about the countries and cities from which our visitors come and statistics about the gender ratios of our visitors, among other things.
Conclusions about individual users and access to individual user profiles by the administrator are not possible.
More information about Facebook Insights can be found here: www.facebook.com/legal/terms/information_about_page_insights_data
Facebook and we are jointly responsible for the processing of Insights data. Details of this are set out in the Joint Controller Addendum, which can be found here: www.facebook.com/legal/terms/page_controller_addendum
Facebook Ireland provides data subjects with the essentials of the Page Insights Addendum.
In addition, we store usernames and comments that are deleted due to a breach of netiquette. These are only retained for the purpose of providing any necessary evidence in the event of legal disputes within the limitation period.
We do not store or process any other personal data, with the exception of competitions.  In the case of competitions, the winners are publicly identified by their user name and asked to contact us by email within 14 days. The winners must send their real name and address so that the prizes can be sent. This data will be processed by us exclusively for the purpose of running the competition. The respective conditions of participation apply to competitions. The emails with the addresses are generally deleted after 30 days, as long as they are not required for the prize notification.

Instagram
On the Instagram channels of Regionalverkehre Start Deutschland GmbH, we give a look behind the scenes of a rail transport company, reveal tips and tricks about rail travel and provide inspiration for possible excursion destinations. You can also leave comments and ask questions.
When you visit our channels, personal data is stored and processed by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland, as the provider of Instagram, in accordance with Instagram’s privacy policy. The privacy policy can be found here: https://privacycenter.instagram.com/policy
Beyond this, we only process data to a very limited extent:
We use the Instagram Insights statistics service for the purpose of designing and continuously optimizing our pages in line with requirements. This service records user activities on our site and makes them available to us in anonymized statistics. This provides us with information about, among other things, the interactions of our fan page visitors, the views of our page, the reach of posts, information about the activity of our subscribers and information about the countries and cities from which our visitors come, as well as statistics about the gender ratios of our visitors. It is not possible to draw conclusions about individual users or for the administrator to access individual user profiles.
In addition, we store usernames and comments that are deleted due to a breach of netiquette. These are only retained for the purpose of providing any necessary evidence in the event of legal disputes within the limitation period.
We do not store or process any other personal data, with the exception of competitions.  In the case of competitions, the winners are publicly identified by their user name and asked to contact us by email within 14 days. The winners must send their real name and address so that the prizes can be sent. This data will be processed by us exclusively for the purpose of running the competition. The respective conditions of participation apply to competitions. The e-mails with the addresses are generally deleted after 30 days, as long as they are not required for the prize notification.
We publicly ask users for permission to repost their pictures on the Deutsche Bahn Group Instagram channel after we have asked them publicly and without obligation. We take a screenshot of the declaration of consent and save the image as a file with the user’s details. The photos and the declaration of consent are stored for as long as the photo is posted on the channel or until consent is revoked. For technical reasons, the reposted photo is stored on the Instagram server [Facebook Ltd, 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland]. Revocation is possible at any time (see below for more details). In the event of revocation, the image and the user’s details will be deleted immediately.

Twitter
The Twitter channels of Regionalverkehre Start Deutschland GmbH are used for press and public relations work on all topics relating to our networks, but primarily for communicating delay reports.
When you visit our channels, Twitter Inc, 1355 Market Street, Suite 900, San Fransisco, CA 94103, USA, as the operator of Twitter, stores and processes personal data to the extent described in the privacy policy. The privacy policy can be found here: https://twitter.com/de/privacy We do not store or process any other personal data. Only in the event that users send us a direct message will the user name be stored.
We also store usernames and comments that are deleted due to a breach of netiquette. These are only retained for the purpose of providing any necessary evidence in the event of legal disputes within the limitation period.

YouTube
The YouTube channels of Regionalverkehre Start Deutschland GmbH make it possible to show moving image contributions in an environment with an individual corporate design.  The films are tailored to the target group and report on the latest news, explain complex relationships and help to illustrate diversity. We also answer users‘ questions and comments on YouTube.
When you visit our channels, Google LLC („Google“), Amphitheatre Parkway, Mountain View, CA 94043, USA, as the operator of YouTube, stores and processes personal data in accordance with Google’s privacy policy. YouTube’s privacy policy can be found here: https://policies.google.com/privacy
Beyond this, we only process data to a very limited extent: In the event of a breach of netiquette, we store usernames and those comments that are deleted due to a breach of netiquette. These are only retained for the purpose of providing any necessary evidence in the event of legal disputes within the limitation period.
We include content from YouTube on our websites. This service is inactive by default, but can be activated by the user. By clicking on the link to play the video, a connection to YouTube is established and the external content is displayed. As the operator of YouTube, Google uses cookies and pixel tags to personalize advertising and search results. Google, as the operator of YouTube, is solely responsible for this data processing. We have no knowledge of or control over what data is processed in this context. The company providing the service in the European Economic Area and Switzerland is Google Ireland Limited, a company incorporated and operated under Irish law (registration number: 368047) with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland. Further information on data protection at Google can be found here: https://policies.google.com/privacy
If the checkbox is activated, we will remember this decision and display future videos without having to reactivate the YouTube service. We set a session cookie for this purpose. We do not transmit any data to Google as the operator of YouTube.

TikTok
The TikTok channels of Regionalverkehre Start Deutschland GmbH enable moving image contributions to be shown in an environment with an individual corporate design. The films are tailored to the target group and report on current events, explain complex interrelationships and help to illustrate diversity.
When you visit our channels, TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, collects, stores and processes personal data in accordance with its privacy policy. The privacy policy can be found here: https://www.tiktok.com/legal/page/eea/privacy-policy
Regionalverkehre Start Deutschland GmbH also plays advertising on TikTok. We receive aggregated statistics on advertising playout from TikTok. For the associated control of target groups via TikTok’s Ad Manager, it can be assumed on the basis of the case law of the European Court of Justice that there is joint responsibility between the respective advertising company and TikTok with regard to the data collection and evaluation by TikTok associated with the advertising playout. In this respect, a joint control agreement has been concluded with TikTok in accordance with Art. 26 para. 2 GDPR, which regulates the details of joint responsibility (see Jurisdiction Specific Terms, dated September 2, 2022, https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms, Part B 1, points 3 and 4). TikTok users can control the extent to which they receive personalized advertising on TikTok.

Rights of users on social networks
We would like to point out that when data is processed by Facebook, Instagram, Twitter, YouTube Snapchat, Foursquare and TikTok, user data may be processed outside the European Union. This may result in risks for users because, for example, it could make it more difficult to enforce users‘ rights. Details can be found in the privacy policies of Facebook, Instagram, Twitter, YouTube Snapchat, Foursquare and TikTok.
We do not transfer data to third countries outside the EU/EEA or to an international organization unless appropriate safeguards are in place. These include the EU standard contractual clauses and an adequacy decision by the EU Commission.
With regard to data processing on social networks, we recommend contacting the respective social network directly in the event of requests for information or other questions about user rights, such as a deletion request, as only the social network has full access to user data. If the data processing described here is no longer desired in the future, the connection of a user profile to our site can be removed by using the functions „I no longer like this page“ and/or „No longer subscribe to this page“.
Facebook has assumed primary responsibility for the processing of personal data via the „Insights“ service offered by Facebook. This concerns the processing of Insights data and the implementation of data subject rights. Users can contact Facebook directly regarding all obligations under the GDPR with regard to the processing of Insights data. We will forward any requests we receive in this regard to Facebook.
Users can revoke all consents given at any time and without giving reasons. It should be noted that the revocation does not affect the legality of the data processing up to the time of revocation.
When processing personal data that is required to fulfill a contract, the contract is the legal basis in accordance with Art. 6 para. 1 lit. b GDPR. Art. 6 para. 1 lit. b GDPR also applies to processing operations that are necessary to carry out pre-contractual measures, for example in the case of inquiries about our products or services or in the case of job applications.
If our company is subject to a legal obligation that requires the processing of personal data, such as for the fulfillment of tax obligations, the processing is based on Art. 6 para. 1 lit. c GDPR.
A transfer to third countries outside the EU/EEA or to an international organization does not take place unless there are appropriate guarantees. These include the EU standard contractual clauses and an adequacy decision by the EU Commission.
It may be necessary to transfer data in the following constellations, for example:

  • We regularly use a call center for telephone customer support
  • Credit check by a service provider when processing payments
  • In the event of payment irregularities / payment default, receivables data may be passed on to a debt collection agency

For the provision of sales services (e.g. sale of tickets, fare refunds, payment processing in connection with sales services), DB Vertrieb GmbH acts within the framework of a contract pursuant to Art. 26 GDPR (joint controller). Further information on data protection can be found on the DB Vertrieb GmbH website: https://www.db-fahrpreisnacherhebung.de

What happens with links to external sites?
If you click on a link to an external site, you will be taken outside the Regionalverkehre Start Deutschland GmbH website. Regionalverkehre Start Deutschland GmbH is not responsible for the content, services or products offered on the linked website. Nor is it responsible for data protection and technical security on the linked website.

How long is the data stored?
We only store the data for as long as it is necessary to fulfill the purpose for which it was collected (e.g. as part of a contractual relationship) or if this is required by law.
In the context of a contractual relationship, we store your data at least until the contract is fully terminated. The data will then be stored for the duration of the statutory retention periods.

What rights do users have?
The following rights exist with regard to personal data

  • The right of access under Article 15 GDPR
  • The right to rectification in accordance with Article 16 GDPR
  • The right to erasure in accordance with Article 17 GDPR
  • The right to restriction of processing under Article 18 GDPR
  • The right to object in accordance with Article 20 GDPR

The restrictions under Sections 34 and 35 BDSG apply to the right of access and the right to erasure.
In addition, there is a right of appeal to a competent data supervisory authority (Article 77 GDPR, Section 40 BDSG).

To exercise your personal rights, simply send a letter by post to
Regionalverkehre Start Deutschland GmbH
Europa-Allee 70-76, 60486 Frankfurt a. M.
or by e-mail to info@startgmbh.com

Will data be passed on?
In order to process the contract, it is usually necessary to involve processors who are dependent on instructions, such as data center operators, printing or shipping service providers or other parties involved in the fulfillment of the contract.
External service providers who process data on our behalf are carefully selected by us and strictly bound by contract. The service providers work according to our instructions, which is ensured by strict contractual regulations, technical and organizational measures and additional controls. The involvement of service providers is necessary, for example, for the administration and maintenance of IT systems.
Otherwise, personal data is only transferred if we have been given express consent to do so or on the basis of a legal regulation.

Updating the data protection notice
We adapt the data protection notice to changed functionalities or changed legal situations. We therefore recommend that you read the data protection notice at regular intervals.

Status: August 2024