Hauptnavigation

Titelbild  

Data privacy and protection

Protecting your data privacy is important to us!

Many of the HVV services we make available to you via the internet or the HVV App can only be used, however, if you communicate your personal data for processing to the relevant party (the data controller) responsible for providing them. For this reason we would like to explain to you how your data are treated.

Data controllers in the HVV

Due to the distribution of responsibilities and roles in the HVV structure there is no single central instance which is responsible for all data processing operations as defined by the EU General Data Protection Regulation (GDPR).  

But these distributed or separate areas of responsibility do not mean that you as a user have to get the information on your data privacy in the various HVV services by laboriously gathering it from a mass of different sources. You can find here all the relevant data privacy information on the various HVV services in one place. In each of the different and then specific data privacy declarations you can also find the relevant contact address or institution you can get in touch with if you have further questions.

  • The website, www.hvv.de

    Explanation of data collection and use of data when you use the services provided by the website www.hvv.de
    With this text we would like to inform you concerning what forms of data collection and processing are involved when you use the basic functions of our internet services on hvv.de. This means when you simply use the website as a source of information. You can find information on what forms of data collection and processing are involved when you use further services such as the Online Shop or the HVV Guarantee in the separate sections dealing with the specific data privacy regulations in these HVV services.

    Responsible entities (data controllers) and purposes for which personal data are processed according to the provisions of data protection law
    The data controller responsible for data collection and processing when the HVV website is used as described above on hvv.de is Hamburger Verkehrsverbund (HVV) GmbH, Steindamm 94, 20099 Hamburg.
    In order to secure our website against attacks from outside, we routinely collect the connection information when people use our website. This includes the date of access, the pages you visit on our website and your IP address.
    So-called cookies are used in some areas of the services offered on the HVV website for the purpose of monitoring user behaviour. In this, the web server concerned places information (the cookies) on your computer which can be read out the next time you visit the HVV website.
    Cookies are also used together with analysis tools (adform and etracker). A cookie is automatically placed when you view an advertising offer from HVV. This cookie does not contain any information which could enable users to be identified (pseudonym utilisation profiles). If you do not want your user behavior to be collected in this way, you can declare your objection to this in the section “Your rights as a user” below.
    Data which you have given us when using the contact form will be used exclusively for the purpose of processing your enquiry.   

    Recipients of personal data

    In order to carry out data processing for the purposes given above, the Hamburger Verkehrsverbund GmbH employs various categories of contract processors. This involves contract processors for the maintenance of the hardware and software needed as well as for providing the memory storage capacity and analysis of website utilisation.

    Legal basis for data processing and legitimate interests followed by the responsible data controllers.

    The legal basis for the processing of your personal data described above is Article 6 Par 1 (b) (Contract Processing) and Article 6 Par 1 (f) (Overriding Legitimate Interest) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation - GDPR).
    The collection of user data for the purpose of protection from external attacks and for the analysis of user behaviour is based on an overriding legitimate interest. Without these data or their evaluation we are unable to take appropriate countermeasures when our website is hacked from outside. And without collection and analysis of user behaviour data we have no basis for the permanent process of improving our website which we operate in the interests of our customers. Since the data are processed in pseudonymised form, there is no clearly overriding contrary legitimate interest which speaks against this.

    Period of storage of personal data

    Personal data will only be stored by us or the service providers under contract to us for the period of time necessary to fulfil the specific purpose for which they are needed.
    IP addresses, which we collect as part of the measures against external attacks, are stored by us for a few hours and then automatically deleted again if no irregularities become apparent during that time.
    After user analyses have been completed, the relevant input data is no longer needed and is also deleted.

    Your rights as a user (data subject)

    In compliance with the legal requirements incumbent upon us, we will be happy to inform you on request whether and, if so, which personal data concerning you are stored by Hamburger Verkehrsverbund GmbH (Right to be Informed/Right of Access). In addition to this you can notify us of incorrect data to have it corrected (Right to Rectification) or have data whose storage is inadmissible or no longer needed deleted (Right to Erasure). In addition, under certain circumstances you are entitled to require of us that the processing of your personal data be restricted (Right to Restriction of Processing) as well as to object to the processing of your data if and when such processing takes place on the legal basis of Overriding Legitimate Interest (Article 6 Par 1 (f) GDPR),  or for the performance of a task carried out in the public interest (Article 6 Par 1 (e) GDPR) or to revoke your Consent (Article 6 Par 1 (a) GDPR) (Right to Object). In particular, you can object at any time to your personal data being used for advertising purposes or for market research or opinion polling (Right to Object to Data being used for Advertising). You can further require in principle that personal data applying to you are made available to you by us in a structured, conventional and machine-readable format in order to be able to transmit them to another data controller without us putting obstacles in your way. (Right of Data Portability).
    The rights described above are guaranteed to you under Articles 15 – 21 of the EU Regulation 2016/679 (GDPR), but are only presented here in very abridged form for reasons of space.

    In addition, you also have the right to object to the collection of your user behavior by adform and etracker (see above).
    If you do not want your user behaviour to be collected by adform, you can object to the relevant collection and processing of your data here via an opt-out (new window).

    If you do not want your user behaviour to be collected by etracker, you can object to the relevant collection and processing of your data here. To object, all you need to do is click on the following link:Opt-Out

    You can find more details of the data privacy policy of adform under: www.adform.com (new window)
    You can find more details of the data privacy policy of etracker under www.etracker.com (new window)

    If you have questions regarding the exact scope of the rights described and how to exercise them, you can get in touch with the Data Protection Officer given below and/or the Hamburg Representative for Data Protection and Freedom of Information.

    Contact data for the company Data Protection Officer

    If you have questions concerning the processing of your personal data and/or how to exercise your rights as a user (data subject), you can get in touch directly with the responsible company Data Protection Officer.
    Please only use the following contact data for questions and enquiries dealing with the subject of data protection:

    Kai H. Terschüren
    Data Protection Officer of HVV GmbH
    Steindamm 94
    20099 Hamburg
    Telephone: 040/32 57 75-0
    E-Mail

    Your right of appeal

    As a data subject you have the right, without prejudice to any other administrative or judicial legal remedy, to lodge a complaint with the competent supervisory authority if you are of the opinion that the processing of the personal data concerning you infringes the EU Regulation 2016/679 (GDPR) or, pending this coming into force as of 25.05.2018, the German Data Protection Law (BDSG).
    The competent authority for data processing is:

    The Hamburg Representative for Data Protection and Freedom of Information
    Prof. Dr. Johannes Caspar
    Kurt-Schumacher-Allee 4
    20097 Hamburg
    Tel.: 040 / 428 54 - 4040
    Fax: 040 / 428 54 - 4000
    E-Mail (new window)

  • HVV-Card

    The responsible data controller for data processing in connection with the use of the HVV-Card is the contractual partner you received your HVV-Card from. You can find the contact data of your contractual partner in the letter with which they sent you your HVV-Card. You can find additional information about data storage, data protection and data security in this Information sheet on the HVV-Card (PDF - new window, currently only in German language available).

  • MeinHVV

    Data privacy notice for MeinHVV
    MeinHVV offers HVV clients the option, free of charge, to create an individual customer account on the HVV website. On top of this, the MeinHVV Login provides a portal to identify yourself when using services offered by the various companies in the HVV transport association (so-called single sign-on functionality).
    It is only possible to use the functions available on MeinHVV if you provide us with your personal data to the extent required (the mandatory fields) on the various forms to be filled out. In compliance with the legal requirements, we would therefore like to inform you here how we treat your data and what rights you as a person affected by our processing of your data (the data subject) have.

    Responsible entities (data controllers) and purposes for which personal data are processed according to the provisions of data protection law
    The data controller responsible for data collection and processing when you use MeinHVV in the scope described below is Hamburger Verkehrsverbund (HVV) GmbH, Steindamm 94, 20099 Hamburg.
    The type and scope of the purposes for which we need to process your data depends on what you use your MeinHVV account for. If you only use your MeinHVV account to file individual timetable information or to subscribe to our Newsletter, we will only store and process your data for these purposes. If you use the identification function of MeinHVV to gain access to further services offered by transport companies affiliated to the HVV such as the Online Shop, or to view your HVV-Card account, our data processing also includes whatever is necessary to enable these functions. This means that in such a case we pass on your data from the MeinHVV account to these HVV transport companies who are the competent and responsible data controllers for the service they are offering to you. See the separate privacy notices in connection with the individual service offers to see which company this is. The important thing to realize here is that, while you have the full right of access via MeinHVV to the data generated by using the further service offers of these transport companies (e.g., your sales history in the Online Shop), we as Hamburger Verkehrsverbund GmbH do not. If you decide to make a purchase in the Online Shop via MeinHVV, all that will be registered in our datapool is the corresponding authorisation or an ID allowing you the “transfer” to the Online Shop. Everything you do in the Online Shop remains there and is not passed on to us. This also applies to the administration of a HVV-Card account via MeinHVV.
    On top of this we record certain additional utilisation parameters such as the history of your logins. This enables us to provide active help to our clients in solving any problems they may have in connection with their MeinHVV customer account. 

    Recipients of personal data
    In order to carry out data processing for the purposes given above, the Hamburger Verkehrsverbund GmbH employs various categories of contract processors. This involves contract processors for the maintenance of the hardware and software needed as well as for providing the memory storage capacity and analysis of website utilisation.
    As described above, your data is always passed on to a company in the HVV transport association when you wish to use a service offered by that company, for which it bears the sole responsibility.

    Legal basis for data processing and legitimate interests followed by the responsible data controllers.

    The legal basis for the processing of your personal data described above is Article 6 Par 1 (b) (Contract Processing) and Article 6 Par 1 (f) (Overriding Legitimate Interest) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation - GDPR).
    We base our processing of your data on an overriding legitimate interest in as far as it involves the recording of utilisation parameters such as a history of all login attempts. Without recording such data we are often not in a position to provide active help to our clients in solving any problems they may have in connection with their MeinHVV customer account.

    Period of storage of personal data

    MeinHVV is a personal customer account which is intended to be for the long term. As long as you keep your MeinHVV customer account and do not cancel it yourself, we will store the data collected via the account.
    When you register for MeinHVV, it is necessary to carry out a so-called “activation” step. This is to verify that the e-mail address you have given is authentic, in order to prevent fraud and e.g. to be able to send you confirmation of your purchases in the Online Shop. Accounts which are not activated will be automatically deleted after four weeks. (A one-off reminder will be sent to clients seven days after they register).
    Once they have been activated, customer accounts will only be deleted from our side if we receive a request from the client to do so or in order to clear our data volume (this will be communicated adequately to clients).
    The utilisation parameters collected by us such as the history of login and logout attempts will automatically be deleted after 7 calendar days have passed.

    Your rights as a user
    In compliance with the legal requirements which apply, we will be happy to inform you on request whether and, if so, which personal data concerning you are stored by Hamburger Verkehrsverbund GmbH (Right to be Informed/Right of Access). In addition to this you can notify us of incorrect data to have it corrected (Right to Rectification) or have data whose storage is inadmissible or no longer needed deleted (Right to Erasure). In addition, under certain circumstances you are entitled to require of us that the processing of your personal data be restricted (Right to Restriction of Processing) as well as to object to the processing of your data if and when such processing takes place on the legal basis of Overriding Legitimate Interest (Article 6 Par 1 (f) GDPR),  or for the performance of a task carried out in the public interest (Article 6 Par 1 (e) GDPR) or to revoke your Consent (Article 6 Par 1 (a) GDPR) (Right to Object). In particular, you can object at any time to your personal data being used for advertising purposes or for market research or opinion polling (Right to Object to Data being used for Advertising). You can further require in principle that personal data applying to you are made available to you by us in a structured, conventional and machine-readable format in order to be able to transmit them to another data controller without us putting obstacles in your way. (Right of Data Portability).
    The rights described above are guaranteed to you under Articles 15 – 21 of the EU Regulation 2016/679 (GDPR), but are only presented here in very abridged form for reasons of space.
    If you have questions regarding the exact scope of the rights described and how to exercise them, you can get in touch with the Data Protection Officer given below and/or the Hamburg Representative for Data Protection and Freedom of Information.

    Contact data for the company Data Protection Officer

    If you have questions concerning the processing of your personal data and/or how to exercise your rights as a user (data subject), you can get in touch directly with the responsible company Data Protection Officer.
    Please only use the following contact data for questions and enquiries dealing with the subject of data protection:

    Kai H. Terschüren
    Data Protection Officer of HVV GmbH
    Steindamm 94
    20099 Hamburg
    Telephone: 040/32 57 75-0
    E-Mail

    Your right of appeal

    As a data subject you have the right, without prejudice to any other administrative or judicial legal remedy, to lodge a complaint with the competent supervisory authority if you are of the opinion that the processing of the personal data concerning you infringes the EU Regulation 2016/679 (GDPR) or, pending this coming into force as of 25.05.2018, the German Data Protection Law (BDSG).
    The competent authority for data processing is:

    The Hamburg Representative for Data Protection and Freedom of Information
    Prof. Dr. Johannes Caspar
    Kurt-Schumacher-Allee 4
    20097 Hamburg
    Tel.: 040 / 428 54 - 4040
    Fax: 040 / 428 54 - 4000
    E-Mail (new window)

  • HVV Guarantee

    Privacy notice for the HVV Guarantee
    It is only possible to make a claim under the HVV Guarantee if you provide us with your personal data to the extent required (the mandatory fields) on the various forms to be filled out. In compliance with the legal requirements, we would therefore like to inform you here how we treat your data and what rights you as a person affected by our processing of your data (data subject) have.

    Responsible entities (data controllers) and purposes for which personal data are processed according to the provisions of data protection law
    Your personal data will be collected, processed and used by Hamburger Verkehrsverbund GmbH, Steindamm 94, 20099 Hamburg for the purposes of fulfilling the contractual obligations under the HVV Guarantee, safeguarding the HVV Guarantee against fraud, carrying out statistical evaluations and for advising and informing in general about the HVV Guarantee, including customer surveys.

    Recipients of personal data
    In order to carry out data processing for the purposes given above, the Hamburger Verkehrsverbund GmbH employs various categories of contract processors. This involves contract processors for the maintenance of the hardware and software needed as well as for providing the memory storage capacity and analysis of website utilisation.

    Legal basis for data processing and legitimate interests followed by the responsible data controllers.
    The legal basis for the processing of your personal data described above is Article 6 Par 1 (b) (Contract Processing) and Article 6 Par 1 (f) (Overriding Legitimate Interest) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation - GDPR).
    We base our processing of your data on an overriding legitimate interest in as far as it involves the safeguarding of the HVV Guarantee against fraud, carrying out statistical evaluations and for carrying out customer surveys. Safeguarding against fraud means specifically that we retain the data in connection with the individual guarantee claims after the processing of the individual claim is completed. It is only in this way that we can detect whether there is an unusual accumulation of claims, which could be a red flag for fraud. Carrying out such statistical evaluations to determine the type and frequency of guarantee claims is ultimately in the interests of our customers, since we can find out in this way where the hot spots for increased delays in the HVV area are. This facilitates taking steps to counteract the relevant factors causing this. We consider customer surveys an appropriate method, since only in this way can we collect a sufficient quantity of feedback from customers who have actually taken advantage of the guarantee and can therefore give criticisms based on experience. We try to ensure in this that our customer surveys do not have the character of an advertising campaign.

    Period of storage of personal data
    The personal data in connection with your guarantee claim will be stored after the period actually needed to process your claim for the purpose of preventing fraud. Following the generation of statistical evaluations for the financial year in question, the data will subsequently be archived for up to 10 years in order to comply with the retention periods required by commercial and tax law.  

    Your rights as a user

    In compliance with the legal requirements incumbent upon us, we will be happy to inform you on request whether and, if so, which personal data concerning you are stored by Hamburger Verkehrsverbund GmbH (Right to be Informed/Right of Access). In addition to this you can notify us of incorrect data to have it corrected (Right to Rectification) or have data whose storage is inadmissible or no longer needed deleted (Right to Erasure). In addition, under certain circumstances you are entitled to require of us that the processing of your personal data be restricted (Right to Restriction of Processing) as well as to object to the processing of your data if and when such processing takes place on the legal basis of Overriding Legitimate Interest (Article 6 Par 1 (f) GDPR),  or for the performance of a task carried out in the public interest (Article 6 Par 1 (e) GDPR) or to revoke your Consent (Article 6 Par 1 (a) GDPR) (Right to Object). In particular, you can object at any time to your personal data being used for advertising purposes or for market research or opinion polling (Right to Object to Data being used for Advertising). You can further require in principle that personal data applying to you are made available to you by us in a structured, conventional and machine-readable format in order to be able to transmit them to another data controller without us putting obstacles in your way (Right of Data Portability).

    The rights described above are guaranteed to you under Articles 15 – 21 of the EU Regulation 2016/679 (GDPR), but are only presented here in very abridged form for reasons of space.
    If you have questions regarding the exact scope of the rights described and how to exercise them, you can get in touch with the Data Protection Officer given below and/or the Hamburg Representative for Data Protection and Freedom of Information.

    Contact data for the company Data Protection Officer

    If you have questions concerning the processing of your personal data and/or how to exercise your rights as a user (data subject), you can get in touch directly with the responsible company Data Protection Officer.
    Please only use the following contact data for questions and enquiries dealing with the subject of data protection:

    Kai H. Terschüren
    Data Protection Officer of HVV GmbH
    Steindamm  94
    20099 Hamburg
    Telephone: 040/32 57 75-0
    E-Mail

    Your right of appeal
    As a data subject you have the right, without prejudice to any other administrative or judicial legal remedy, to lodge a complaint with the competent supervisory authority if you are of the opinion that the processing of the personal data concerning you infringes the EU Regulation 2016/679 (GDPR) or, pending this coming into force as of 25.05.2018, the German Data Protection Law (BDSG).
    The competent authority for data processing is:

    The Hamburg Representative for Data Protection and Freedom of Information
    Prof. Dr. Johannes Caspar
    Kurt-Schumacher-Allee 4
    20097 Hamburg
    Tel.: 040 / 428 54 - 4040
    Fax: 040 / 428 54 - 4000
    E-Mail (new window)

  • HVV Newsletter

    The competent and responsible authority for data processing for the HVV Newsletter is Hamburger Verkehrsverbund GmbH. Since registering with TiM always involves opening a MeinHVV customer account, you can find the applicable information on data protection in the Privacy Notice concerning MeinHVV above.

  • TiM

    The competent and responsible authority for data processing for the Tip of the Month for holders of all-year season tickets and ProfiTickets (TiM) is Hamburger Verkehrsverbund GmbH. Since registering with TiM always involves opening a MeinHVV customer account, you can find the applicable information on data protection in the Privacy Notice concerning MeinHVV above.

  • Online Shop

    Privacy notice concerning orders to the HVV Online Shop made via hvv.de and in the HVV App

    If you want to buy a ticket at the Online Shop on hvv.de or in the HVV App, we need personal data from you. These are the data we ask you to enter in the corresponding mandatory fields when registering in our Online Shop system or when you make a purchase. On the following pages we would like to inform you how we treat your data and what rights you have under data protection law.

    Why do we process your data (purpose of processing) and who is the responsible entity (data controller)?
    Your personal data are collected, processed and used by Hamburger Hochbahn AG, Steinstraße 20, 20095 Hamburg for the purpose of processing your purchase in the HVV App or at the Online Shop on hvv.de.

    In addition to this, pseudonymised data are used and evaluated to carry out analyses of customer demand and/or our product offers and for the ongoing optimisation of the transport services offered in the HVV.

    The responsible data controllers as defined by data protection law given below come into contact with your personal data to differing degrees. This is due to the distribution of roles and responsibilities in the HVV structure:

    • Hamburger Hochbahn AG, as your contract partner (customer contract partner) deals with the actual delivery of the ticket. This also includes carrying out advertising and information measures.
    • Hamburger Verkehrsverbund GmbH as the umbrella organisation overseeing public transport in the HVV is responsible, among other aspects, for product marketing throughout the association and data processing in connection with this.

    Analyses of customer demand and/or our product offers for the ongoing optimisation of the transport services offered in the HVV may be carried out by HVV GmbH or by Hamburger Hochbahn AG either alone or jointly.

    Who are my data passed on to during processing?
    In order to carry out data processing for the purposes given above, the Hamburger Hochbahn AG employs various categories of contract processors. This involves contract processors for

    • the maintenance of the hardware and software needed as well as for providing memory storage capacity,
    • the carrying out of advertising and marketing measures and
    • the carrying out of data analyses on customer demand and/or our product offers for the ongoing optimisation of the transport services offered in the HVV.

    We pass on your personal data (first name, last name, date of birth, address, e-mail address, bank details, and, where needed, mobile phone number as well as data on the respective ticket purchases) as well as any changes to these to LogPay Financial Services GmbH for the purpose of making ticket sales and the assignment of our receivables due from you in connection with such ticket sales. This is done on the basis of Article 6 Par 1 (f) (Overriding Legitimate Interest) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation - GDPR). The legitimate interest on our side is the outsourcing of payment and credit management operations. The legitimate interest on the side of LogPay Financial Services GmbH is the collection of data for the purpose of processing payments, for credit management of receivables, the evaluation of the admissibility of the means of payment used and to avoid payment defaults.

    You can object at any time to your data being transmitted to LogPay Financial Services GmbH, but this means that it will no longer be possible for you to order tickets via the electronic distribution channels.

    You can find the data privacy notice of LogPay Financial Services GmbH by calling up (new window).

    What is the legal basis for processing my data? What legitimate interests are you following by doing this?
    The legal basis for processing your personal data is  

    • Article 6 Par 1 (b) (Contract Processing),
    • Article 6 Par 1 (f) (Overriding Legitimate Interest)) and
    • Article 6 Par 1 (a) GDPR (Consent) of the Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR).

    In particular, the processing of your pseudonymised user data to carry out analyses of customer demand and/or our product offers and for the ongoing optimisation of the transport services offered in the HVV are based on an overriding legitimate interest. Without these data and/or their evaluation, we cannot react speedily enough to developments on the fast-changing transport market and adapt to such changes in the interests of our passengers. Since the data are processed in pseudonymised form, there is no clearly overriding contrary legitimate interest which speaks against this.

    The use of your data for advertising purposes is only made after you have explicitly given your consent and only to the extent defined by your consent. After you have given your consent to such use of your data, you can revoke it at any time for the future.

    How long are my data stored for?
    Hamburger Hochbahn AG as your contract partner processes and stores your personal data only as long as they are needed to fulfil our contractual and legal obligations. We distinguish here between different categories of data. In principle we only hold data of customers registered via MeinHVV. This is done at the request of the customer in order not to have to register their personal data anew every time they use our services.  

    If data are no longer needed for the direct fulfilment of contractual or legal obligations, for instance because they refer to sales which have already been settled, they are regularly deleted unless it is necessary to store them for a further (limited) period for the following purposes:

    • to comply with retention periods prescribed by commercial and tax law: these include, e.g. the German Commercial Code (Handelsgesetzbuch (HGB) and the Fiscal Code (Abgabenordnung). The retention periods prescribed in these for retaining or documentation are up to 10 years.  
    • to keep as evidence under the regulations on limitation of legal actions: according to §§ 195 ff. of the German Civil Code (Bürgerliches Gesetzbuch (BGB) these periods of limitation are as a rule 3 years, but may in some cases be up to 30 years.

    If your personal data are used by Hamburger Verkehrsverbund GmbH to varry out advertising of marketing or in pseudonymised form to carry out analyses of customer demand and/or our product offers and for the ongoing optimisation of the transport services offered in the HVV, the data are only transmitted by Hamburger Hochbahn AG shortly before the measure in question is carried out and deleted again directly after it is completed.

    What data protection rights do I have according to the EU GDPR?
    We will be happy to inform you on request whether and, if so, which personal data concerning you are stored by Hamburger Verkehrsverbund GmbH and HVV GmbH (Right to be Informed/Right of Access).
    In addition to this you can notify us of incorrect data to have it corrected (Right to Rectification) or have data whose storage is inadmissible or no longer needed deleted (Right to Erasure).
    In addition, under certain circumstances you are entitled to require of us that the processing of your personal data be restricted (Right to Restriction of Processing) as well as to object to the processing of your data if and when  

    • such processing takes place on the legal basis of  Overriding Legitimate Interest (Article 6 Par 1 (f) GDPR) or
    • for the performance of a task carried out in the public interest (Article 6 Par 1 (e) GDPR) or
    • o revoke your Consent (Article 6 Par 1 (a) GDPR) (Right to Object).

    In particular, you can object at any time to your personal data being used for advertising purposes or for market research or opinion polling (Right to Object to Data being used for Advertising).

    You can further require in principle that personal data applying to you are made available to you by us in a structured, conventional and machine-readable format in order to be able to transmit them to another data controller without us putting obstacles in your way (Right of Data Portability).

    The rights described above are guaranteed to you under Articles 15 – 21 of the EU Regulation 2016/679 (GDPR), but are only presented here in very abridged form for reasons of space. If you have questions regarding the exact scope of the rights described and how to exercise them, you can get in touch with the Data Protection Officer given below and/or the Hamburg Representative for Data Protection and Freedom of Information.  


    Who can I get in touch with if I have questions concerning data protection?
    If you have questions concerning the processing of your personal data and/or how to exercise your rights as a user (data subject), you can get in touch directly with the responsible company Data Protection Officer.

    Please only use the following contact data for questions and enquiries dealing with the subject of data protection:
    Hamburger Hochbahn AG
    Data Protection Officer
    Steinstraße 20
    20095 Hamburg
    Telephone: (040) 3288-2316
    E-Mail (new window)

    The fact that only the details of the company Data Protection Officer of Hamburger Hochbahn AG are given here should not be construed as signifying that the entity represented by this Data Protection Officer is solely responsible for data protection. Designating only this particular named Data Protection Officer is done purely to facilitate communication in order to make it easier for you to exercise your rights. It has no effect for the duties and responsibilities of the individual responsible entities (data controllers) - see above - arising out of the type and scope of the actual data processing.

    Where can I lodge a complaint?
    You have the right, without prejudice to any other administrative or judicial legal remedy, to lodge a complaint with the competent supervisory authority if you are of the opinion that the processing of the personal data concerning you infringes the EU Regulation 2016/679 (GDPR).

    The competent supervisory authority for data processing in connection with your purchases made via hvv.de or in the HVV App is
    The Hamburg Representative for Data Protection and Freedom of Information 

    Prof. Dr. Johannes Caspar
Kurt-Schumacher-Allee 4
    
20097 Hamburg
    
Tel.: 040 / 428 54 - 4040

    E-Mail (new window)

  • Online Shop for Companies

    Data privacy notice concerning the Online Shop for companies
    It is only possible to use the Online Shop for Companies if you provide us with your personal data to the extent required (the mandatory fields) on the various forms to be filled out. In compliance with the legal requirements, we would therefore like to inform you here how we treat your data and what rights you as a person affected by our processing of your data (the data subject) have.

    Responsible entities (data controllers) and purposes for which personal data are processed according to the provisions of data protection law
    Your personal data are used and processed for the purpose of fulfilling the contractual obligations arising out of the contract for buying tickets in the Online Shop for Companies by S-Bahn Hamburg GmbH (S-Bahn), Hammerbrookstraße 44, 20097 Hamburg.

    Recipients of personal data
    In order to carry out data processing for the purposes given above, the data controller specified above employs various categories of contract processors. This involves contract processors for the maintenance of the hardware and software needed as well as for providing memory storage capacity.
     
    Legal basis for data processing
    The legal basis for the processing of your personal data described above is Article 6 Par 1 (b) (Contract Processing) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation - GDPR).

    Period of storage of personal data
    Your data will only be stored for the period of time necessary to fulfil the purpose for which they were collected or are needed or if this is prescribed by law. Older data, e.g. concerning already settled billing transactions, will remain stored in order to comply with legal retention periods, but will be archived and removed in this way from direct access. Even after the termination of your contractual relationship with S-Bahn, your data will remain archived for the legally prescribed retention period of 10 years and will be destroyed on the expiry of this.

    Your rights as a user
    In compliance with the legal requirements which apply, we will be happy to inform you on request whether and, if so, which personal data concerning you are stored by S-Bahn (Right to be Informed/Right of Access). In addition to this you can notify us of incorrect data to have it corrected (Right to Rectification) or have data whose storage is inadmissible or no longer needed deleted (Right to Erasure). In addition, under certain circumstances you are entitled to require of us that the processing of your personal data be restricted (Right to Restriction of Processing) as well as to object to the processing of your data if and when such processing takes place on the legal basis of Overriding Legitimate Interest (Article 6 Par 1 (f) GDPR),  or for the performance of a task carried out in the public interest (Article 6 Par 1 (e) GDPR) or to revoke your Consent (Article 6 Par 1 (a) GDPR) (Right to Object). In particular, you can object at any time to your personal data being used for advertising purposes or for market research or opinion polling (Right to Object to Data being used for Advertising). You can further require in principle that personal data applying to you are made available to you by us in a structured, conventional and machine-readable format in order to be able to transmit them to another data controller without us putting obstacles in your way. (Right of Data Portability).
    The rights described above are guaranteed to you under Articles 15 – 21 of the EU Regulation 2016/679 (GDPR), but are only presented here in very abridged form for reasons of space. If you have questions regarding the exact scope of the rights described and how to exercise them, you can get in touch with the Data Protection Officer given below and/or the Hamburg Representative for Data Protection and Freedom of Information. You have the right, if you consider it necessary, to lodge a complaint with the Hamburg Representative for Data Protection and Freedom of Information. Please see in this context also the section “Your right of appeal”.

    Contact data for the company Data Protection Officer
    If you have questions concerning the processing of your personal data and/or how to exercise your rights as a user (data subject), you can get in touch directly with the responsible Company Data Protection Officer. Please only use the following contact data for questions and enquiries dealing with the subject of data protection:

    The entity responsible for data processing is
    S-Bahn Hamburg GmbH,
    Hammerbrookstraße 44,
    20097 Hamburg
    The appointed Data Protection Officer is Ms Chris Newiger 
    E-Mail (new window)

    You can also address any questions you may have about data protection to the S-Bahn Corporate Client Subscription advisory service:
    Tel. 040 3918 – 3900
    E-Mail (new window)

    Your right of appeal
    As a data subject you have the right, without prejudice to any other administrative or judicial legal remedy, to lodge a complaint with the competent supervisory authority if you are of the opinion that the processing of the personal data concerning you infringes the EU Regulation 2016/679 (GDPR) or, pending this coming into force as of 25.05.2018, the German Data Protection Law (BDSG).

    The competent authority for data processing is:
    The Hamburg Representative for Data Protection and Freedom of Information
    Prof. Dr. Johannes Caspar
    Kurt-Schumacher-Allee 4
    20097 Hamburg
    Tel.: 040 / 428 54 - 4040
    Fax: 040 / 428 54 - 4000
    E-Mail (new window)

  • HVV Skill on Amazon Alexa

    Data privacy notice for HVV Skill on Amazon Alexa
    Protecting the privacy of your personal data is important to us. For this reason we would like to explain to you what data we collect on you and what we need these data for.

    Details of the responsible entity (data controller)
    With the help of the service provider ONSEI, Hamburger Hochbahn AG is developing HVV Skill, and collects and processes your data as data controller.  The appointed Data Protection Officer is Ingomar Spieß. If you have any questions, suggestions or criticisms in connection with data protection with HVV Skill on Amazon Alexa, please contact:

    Hamburger Hochbahn AG
    Steinstraße 20
    20095 Hamburg
    E-Mail (new window)

    When does HVV Skill collect and process personal data?
    We are pleased that you are using HVV Skill from Hamburger Hochbahn AG and would like to explain to you clearly and transparently whether and when your personal data are collected and processed. We observe the principle of data minimisation.

    Data are stored exclusively under a pseudonym. The basis for storage is your pseudonymised Amazon User ID.
    All data collection and data processing operations are done with the purpose of improving the performance of Skill. Improvements may be made for technical reasons, due to contractual requirements or where explicitly desired by the user. Data on user behaviour such as enquiries, frequency of use, error messages as well as voice output are collected and evaluated.

    N.B.: In the function “My standard start point”, the address is only used by Alexa with a declaration of consent from the client. This is required the first time you use Skill and is then stored in the Alexa App. Addresses are not stored, but are retrieved from the client’s Amazon Alexa account for each new enquiry.

    The address is used, e.g. when the client asks: “Alexa, what is the quickest way to get to Hauptbahnhof?” This means that the client does not need to give his start point.  

    When are data deleted?
    The data stored will be deleted by the service provider ONSEI GmbH after 30 days (date and period of use, enquiries to HVV Skill, error messages).

    The client is given a unique ID at every login. This cannot be assigned later to his utilisation data (pseudonymisation). After every deactivation of Skill the reference to the utilisation data (the unique ID) is deleted, so that no client-specific tracking takes place.  
     
    Are your data passed on?
    We do not pass on your data to third parties unless it is necessary to comply with the requirements of a commercial relationship. If we employ the services of a subcontractor or agent in order to carry out the contracts we have concluded with you, we have to pass on your data. These business partners are bound by the terms of their contract with us to process your data exclusively to fulfil the task we delegate to them. When data are passed on, this is only in pseudonymised form, e.g. exclusively using the unique ID (see above).

    Legal basis for data processing
    To the extent that we obtain your consent for operations involving processing your personal data, this forms the legal basis according to Art. 6 Par 1 (a) GDPR for such processing.
    When personal data are processed in order to fulfil the contract with you, the legal basis is Art. 6 Par 1 (b) (Contract Processing) GDPR. Art. 6 Par 1 (b) (Contract Processing) also applies to the processing necessary for carrying out pre-contractual measures, such as enquiries about our products or services.
    In cases where our company is subject to a legal obligation which requires the processing of personal data, e.g. to comply with our tax obligations, such processing is based on Art. 6 Par 1 (c) GDPR (Compliance with a legal obligation).

    What rights do users of HVV Alexa Skill have?
    You have the right to be informed what data on you are stored.

    You can require your personal data to be rectified, deleted or processing of them to be restricted (blocking) to the extent that this is legally permissible and possible under the terms of an existing contract.  

    You have the right to lodge a complaint with a supervisory authority. The competent supervisory authority is:

    The Hamburg Representative for Data Protection and Freedom of Information 

    Prof. Dr. Johannes Caspar
    
Kurt-Schumacher-Allee 4

    20097 Hamburg
Tel.: 040 / 428 54 - 4040
    
Fax: 040 / 428 54 - 4000
    
E-Mail (new window)

    You have the right to portability of the data you have provided to us on the basis of your consent or under your contract with us (Data portability).

    If you have given us your consent to processing of your data, you can revoke your consent any time you wish using the same means of communication with which you gave it.  The lawfulness of processing your data prior to the time you revoked your consent is not affected by this.

    You can object to the processing of your data for reasons relating to your particular situation if such processing is carried out by us on the basis of our legitimate interests.  
    You can object to being sent advertising offers at any time with future effect (Objection to data being used for advertising).

    If you wish to exercise your rights, just write to us by post to
    Hamburger Hochbahn AG
    Steinstraße 20
    20095 Hamburg
    or by e-mail    

    How up-to-date is the information in this privacy notice?
    We adapt our privacy notice to changes in the functionalities available in HVV Skill on Amazon Alexa. We recommend reading it at regular intervals.  

    Current status as per: May 2018

  • Your rights as a user

Certain of your rights as a user and/or as a data subject are valid in every case. These rights always apply, irrespective of which of the service options mentioned above you use. For this reason we have summarized these rights for you here centrally.

In compliance with the legal requirements which apply, every responsible entity (data controller) in the HVV will be happy to inform you on request whether and, if so, which personal data concerning you are stored by them (Right to be Informed/Right of Access). In addition to this you can notify them of incorrect data to have it corrected (Right to Rectification) or have data whose storage is inadmissible or no longer needed deleted (Right to Erasure). In addition, under certain circumstances you are entitled to require that the processing of your personal data be restricted (Right to Restriction of Processing) as well as to object to the processing of your data if and when such processing takes place on the legal basis of Overriding Legitimate Interest (Article 6 Par 1 (f) GDPR), or for the performance of a task carried out in the public interest (Article 6 Par 1 (e) GDPR) or to revoke your Consent (Article 6 Par 1 (a) GDPR) (Right to Object). In particular, you can object at any time to your personal data being used for advertising purposes or for market research or opinion polling (Right to Object to Data being used for Advertising). You can further require in principle that personal data applying to you are made available to you in a structured, conventional and machine-readable format in order to be able to transmit them to another data controller (Right of Data Portability).

The rights described above are guaranteed to you under Articles 15 – 21 of the EU Regulation 2016/679 (GDPR), but are only presented here in very abridged form for reasons of space.
If you have questions regarding the exact scope of the rights described and how to exercise them, you can get in touch with the Data Protection Officer given below and/or the Hamburg Representative for Data Protection and Freedom of Information.

  • Your right of appeal

As a data subject you have the right, without prejudice to any other administrative or judicial legal remedy, to lodge a complaint with the competent supervisory authority if you are of the opinion that the processing of the personal data concerning you infringes the EU Regulation 2016/679 (GDPR) or, pending this coming into force as of 25.05.2018, the German Data Protection Law (BDSG).

The competent authority for data processing in the HVV is:
The Hamburg Representative for Data Protection and Freedom of Information
Prof. Dr. Johannes Caspar
Kurt-Schumacher-Allee 4
20097 Hamburg
Tel.: 040 / 428 54 - 4040
Fax: 040 / 428 54 - 4000
E-Mail (new window)

  • Contact data for the company Data Protection Officer

If you have questions concerning the processing of your personal data and/or how to exercise your rights as a user (data subject), you can get in touch directly with the responsible company Data Protection Officer.

Please only use the following contact data for questions and enquiries dealing with the subject of data protection:

Kai H. Terschüren
Data Protection Officer of HVV GmbH
Steindamm  94
20099 Hamburg
Telephone: 040/32 57 75-0
E-Mail
In all other cases, please use the general contact form.

The fact that only the details of the appointed company Data Protection Officer of Hamburger Verkehrsverbund GmbH are given here should not be construed as signifying that the entity represented by this Data Protection Officer is solely responsible for data protection. Designating only this particular named Data Protection Officer is done purely to facilitate communication in order to make it easier for you to exercise your rights. It has no effect for the duties and responsibilities of the individual responsible entities (data controllers) - see above - arising out of the type and scope of the actual data processing.