Privacy notice concerning orders to the HVV Online Shop made via hvv.de
If you want to buy a ticket at the Online Shop on hvv.de, we need personal data from you. These are the data we ask you to enter in the corresponding mandatory fields when registering in our Online Shop system or when you make a purchase. On the following pages we would like to inform you how we treat your data and what rights you have under data protection law.
Why do we process your data (purpose of processing) and who is the responsible entity (data controller)?
Your personal data are collected, processed and used by Hamburger Hochbahn AG, Steinstraße 20, 20095 Hamburg for the purpose of processing your purchase at the Online Shop on hvv.de.
In addition to this, pseudonymised data are used and evaluated to carry out analyses of customer demand and/or our product offers and for the ongoing optimisation of the transport services offered in the HVV.
The responsible data controllers as defined by data protection law given below come into contact with your personal data to differing degrees. This is due to the distribution of roles and responsibilities in the HVV structure:
- Hamburger Hochbahn AG, as your contract partner (customer contract partner) deals with the actual delivery of the ticket. This also includes carrying out advertising and information measures.
- Hamburger Verkehrsverbund GmbH as the umbrella organisation overseeing public transport in the HVV is responsible, among other aspects, for product marketing throughout the association and data processing in connection with this.
Analyses of customer demand and/or our product offers for the ongoing optimisation of the transport services offered in the HVV may be carried out by HVV GmbH or by Hamburger Hochbahn AG either alone or jointly.
Who are my data passed on to during processing?
In order to carry out data processing for the purposes given above, the Hamburger Hochbahn AG employs various categories of contract processors. This involves contract processors for
- the maintenance of the hardware and software needed as well as for providing memory storage capacity,
- the carrying out of advertising and marketing measures and
- the carrying out of data analyses on customer demand and/or our product offers for the ongoing optimisation of the transport services offered in the HVV.
We pass on your personal data (first name, last name, date of birth, address, e-mail address, bank details, and, where needed, mobile phone number as well as data on the respective ticket purchases) as well as any changes to these to LogPay Financial Services GmbH for the purpose of making ticket sales and the assignment of our receivables due from you in connection with such ticket sales. This is done on the basis of Article 6 Par 1 (f) (Overriding Legitimate Interest) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation - GDPR). The legitimate interest on our side is the outsourcing of payment and credit management operations. The legitimate interest on the side of LogPay Financial Services GmbH is the collection of data for the purpose of processing payments, for credit management of receivables, the evaluation of the admissibility of the means of payment used and to avoid payment defaults.
You can object at any time to your data being transmitted to LogPay Financial Services GmbH, but this means that it will no longer be possible for you to order tickets via the electronic distribution channels.
You can find the data privacy notice of LogPay Financial Services GmbH by calling up.
What is the legal basis for processing my data? What legitimate interests are you following by doing this?
The legal basis for processing your personal data is
- Article 6 Par 1 (b) (Contract Processing),
- Article 6 Par 1 (f) (Overriding Legitimate Interest)) and
- Article 6 Par 1 (a) GDPR (Consent) of the Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR).
In particular, the processing of your pseudonymised user data to carry out analyses of customer demand and/or our product offers and for the ongoing optimisation of the transport services offered in the HVV are based on an overriding legitimate interest. Without these data and/or their evaluation, we cannot react speedily enough to developments on the fast-changing transport market and adapt to such changes in the interests of our passengers. Since the data are processed in pseudonymised form, there is no clearly overriding contrary legitimate interest which speaks against this.
The use of your data for advertising purposes is only made after you have explicitly given your consent and only to the extent defined by your consent. After you have given your consent to such use of your data, you can revoke it at any time for the future.
How long are my data stored for?
Hamburger Hochbahn AG as your contract partner processes and stores your personal data only as long as they are needed to fulfil our contractual and legal obligations. We distinguish here between different categories of data. In principle we only hold data of customers registered via MeinHVV. This is done at the request of the customer in order not to have to register their personal data anew every time they use our services.
If data are no longer needed for the direct fulfilment of contractual or legal obligations, for instance because they refer to sales which have already been settled, they are regularly deleted unless it is necessary to store them for a further (limited) period for the following purposes:
- to comply with retention periods prescribed by commercial and tax law: these include, e.g. the German Commercial Code (Handelsgesetzbuch (HGB) and the Fiscal Code (Abgabenordnung). The retention periods prescribed in these for retaining or documentation are up to 10 years.
- to keep as evidence under the regulations on limitation of legal actions: according to §§ 195 ff. of the German Civil Code (Bürgerliches Gesetzbuch (BGB) these periods of limitation are as a rule 3 years, but may in some cases be up to 30 years.
If your personal data are used by Hamburger Verkehrsverbund GmbH to varry out advertising of marketing or in pseudonymised form to carry out analyses of customer demand and/or our product offers and for the ongoing optimisation of the transport services offered in the HVV, the data are only transmitted by Hamburger Hochbahn AG shortly before the measure in question is carried out and deleted again directly after it is completed.
What data protection rights do I have according to the EU GDPR?
We will be happy to inform you on request whether and, if so, which personal data concerning you are stored by Hamburger Hochbahn AG and HVV GmbH (Right to be Informed/Right of Access).
In addition to this you can notify us of incorrect data to have it corrected (Right to Rectification) or have data whose storage is inadmissible or no longer needed deleted (Right to Erasure).
In addition, under certain circumstances you are entitled to require of us that the processing of your personal data be restricted (Right to Restriction of Processing) as well as to object to the processing of your data if and when
- such processing takes place on the legal basis of Overriding Legitimate Interest (Article 6 Par 1 (f) GDPR) or
- for the performance of a task carried out in the public interest (Article 6 Par 1 (e) GDPR) or
- o revoke your Consent (Article 6 Par 1 (a) GDPR) (Right to Object).
In particular, you can object at any time to your personal data being used for advertising purposes or for market research or opinion polling (Right to Object to Data being used for Advertising).
You can further require in principle that personal data applying to you are made available to you by us in a structured, conventional and machine-readable format in order to be able to transmit them to another data controller without us putting obstacles in your way (Right of Data Portability).
The rights described above are guaranteed to you under Articles 15 – 21 of the EU Regulation 2016/679 (GDPR), but are only presented here in very abridged form for reasons of space. If you have questions regarding the exact scope of the rights described and how to exercise them, you can get in touch with the Data Protection Officer given below and/or the Hamburg Representative for Data Protection and Freedom of Information.
Who can I get in touch with if I have questions concerning data protection?
If you have questions concerning the processing of your personal data and/or how to exercise your rights as a user (data subject), you can get in touch directly with the responsible company Data Protection Officer.
Please only use the following contact data for questions and enquiries dealing with the subject of data protection:
Hamburger Hochbahn AG
Data Protection Officer
Tel.: (040) 3288-2316
The fact that only the details of the company Data Protection Officer of Hamburger Hochbahn AG are given here should not be construed as signifying that the entity represented by this Data Protection Officer is solely responsible for data protection. Designating only this particular named Data Protection Officer is done purely to facilitate communication in order to make it easier for you to exercise your rights. It has no effect for the duties and responsibilities of the individual responsible entities (data controllers) - see above - arising out of the type and scope of the actual data processing.
Where can I lodge a complaint?
You have the right, without prejudice to any other administrative or judicial legal remedy, to lodge a complaint with the competent supervisory authority if you are of the opinion that the processing of the personal data concerning you infringes the EU Regulation 2016/679 (GDPR).
The competent supervisory authority for data processing in connection with your purchases made via hvv.de is
The Hamburg Representative for Data Protection and Freedom of Information
Ludwig-Erhard-Straße 22, 7th floor
Telefon: (040) 428 54 4040