Privacy policy

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data is all data by which you can be personally identified. For detailed information on the subject of data protection, please refer to our privacy policy set out below this text.

Data collection on our website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. Their contact details can be found in the legal notice of this website.

How do we collect your data?

On the one hand, your data is collected when you provide it to us. This may, for example, be data that you enter in a contact form, in the enquiry form or when registering in the customer portal.

Other data is collected automatically by our IT systems when you visit the website. This is primarily technical data (e.g. internet browser, operating system or time of the page view). This data is collected automatically as soon as you enter our website.

What do we use your data for?

Some of the data is collected to ensure that the website is provided without errors. Your user behaviour is not analysed (no tracking).

What rights do you have regarding your data?

You have the right at any time to obtain, free of charge, information about the origin, recipients and purpose of your stored personal data. You also have the right to request the rectification, restriction of processing or erasure of this data. For this purpose, and for any further questions on the subject of data protection, you can contact us at any time at the address given in the legal notice. You also have the right to lodge a complaint with the competent supervisory authority.

2. General information and mandatory disclosures

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection provisions and this privacy policy.

When you use this website, various personal data is collected. Personal data is data by which you can be personally identified. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

Please note that data transmission over the internet (e.g. when communicating by e-mail) may have security vulnerabilities. Complete protection of data against access by third parties is not possible.

Note on the controller

The controller responsible for data processing on this website is:

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. names, e-mail addresses or the like).

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. An informal notification by e-mail to us is sufficient for this. The lawfulness of the data processing carried out up to the withdrawal remains unaffected by the withdrawal.

Right to lodge a complaint with the competent supervisory authority

In the event of infringements of data protection law, the data subject has the right to lodge a complaint with the competent supervisory authority. The competent supervisory authority for data protection matters is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany (https://www.ldi.nrw.de), because our company is based in North Rhine-Westphalia. A list of all data protection authorities and their contact details can be found at the following link: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent that it is technically feasible.

Further rights of data subjects

Within the scope of the applicable statutory provisions, you have the right at any time to obtain information free of charge (Art. 15 GDPR) and to request the rectification (Art. 16 GDPR), erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR) of your personal data. To do so, please contact us at any time at the address given in the imprint.

Right to object to data processing (Art. 21 GDPR)

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as enquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address bar of the browser changes from “http://” to “https://” and by the lock symbol in your browser bar.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

3. Data collection on our website

Cookies

The websites use so-called cookies in some cases. Cookies do not cause any damage to your computer and do not contain viruses. Cookies are small text files that are stored on your computer and saved by your browser.

We only use cookies that are technically necessary:

• Session cookie (name: PHPSESSID or rail_website): it serves security (protecting forms against misuse), logging in to the customer portal and temporarily storing an enquiry you have not yet sent. It is deleted as soon as you close the browser.
• Language cookie (name: rail_lang): it remembers the language you have chosen (German or English), so that pages without their own language version, such as the customer portal, appear in that language. It is deleted as soon as you close the browser.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when the browser is closed. If cookies are deactivated, the functionality of this website may be limited (e.g. logging in to the customer portal is then not possible).

These cookies are stored on the basis of Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act); the data processed in the process is processed on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free and secure provision of its services. We do not use cookies to analyse your browsing behaviour, to measure reach or for advertising purposes.

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources.

The basis for the data processing is Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and in the security of its website; for this purpose the server log files must be recorded.

Contact form

If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provide there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. The details are delivered to us by e-mail; they are not stored further in the database of the website. We do not pass on this data without your consent.

The processing of the data entered in the contact form therefore takes place exclusively on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time. An informal notification by e-mail to us is sufficient for this. The lawfulness of the data processing operations carried out up to the withdrawal remains unaffected by the withdrawal.

The data you enter in the contact form remains with us until you ask us to erase it, withdraw your consent to its storage, or the purpose for the data storage ceases to apply (e.g. after your enquiry has been fully processed). Mandatory statutory provisions – in particular retention periods – remain unaffected.

Customer portal and enquiry form

If you create a customer account in the customer portal or request an offer via the enquiry form, we process the data you provide: company, name, e-mail address, your password (only as an irreversible hash value), the details of your enquiry (e.g. route, period, train data, remarks) as well as the associated offers and invoices.

The processing takes place to carry out pre-contractual measures and to perform a contract (Art. 6(1)(b) GDPR) and, where required by law, to comply with legal obligations (Art. 6(1)(c) GDPR, e.g. retention obligations under commercial and tax law). In connection with registration, password and enquiry we send you e-mails (e.g. a confirmation link). The data is erased as soon as the purpose ceases to apply and no statutory retention periods stand in the way.

We manage invoices and the associated customer data with the accounting software Lexoffice (Haufe-Lexware GmbH & Co. KG, Freiburg); invoice data is displayed to you in the customer portal.

Protection against misuse

To protect against misuse (e.g. automated login attempts or mass submissions via forms), we count logins, registrations, password resets and form submissions. In doing so, we store only an irreversible hash value of your IP address or e-mail address and the time; the entries are deleted after 24 hours. The legal basis is Art. 6(1)(f) GDPR (security of the website).

Service providers

For the operation of the website and for sending e-mails we use technical service providers (hosting, e-mail delivery) that work on our behalf and in accordance with our instructions.

4. Embedded services and fonts

No third-party services

No analysis, tracking or advertising services are used on this website. No content from third parties (e.g. videos, maps or fonts) is loaded; when you open our pages, your browser does not establish connections to the servers of third parties.

Fonts

The fonts used on this website are delivered from our own server. No connection to Google or other providers is established.