Table of contents

A. Data controller and data protection officer    3

A.1 Data controller    3

A.2 Data Protection Officer     3

B. Use of the hvv switch app       3

B.1 Informational use      3

B.2 hvv Information      4

B.3 Location data and location tracking      5

B.4 Registration for hvv switch       5

B.5 Purchasing hvv tickets     6

B.6 Mobility services     10

B.7 Payment and billing for mobility services     13

B.8 Tracking and consent management solutions    13

B.9 Optimisation of the hvv switch app       14

B.10 Optimisation of marketing activities for the hvv switch app      15

B.11 Enquiries to customer service      19

B.12 Use of vouchers     19

B.13 System security, prevention of criminal offences     20

B.14 Service providers for hosting and messaging     20

C. Disclosure of personal data      20

C.1 Mobility providers     20

C.2 Payment service providers     23

C.3 Form for reporting illegal parking, littering and damage at hvv switch points    24

D. EU-US Data Privacy Framework      25

E. Retention period      25

F. Data protection rights     26

F.1 Access, erasure and rectification      26

F.2 Withdrawal of consent    26

F.3 Right to object    26

F.4 Right to restriction of processing     26

F.5 Right to data portability     27

F.6 Right to lodge a complaint with a supervisory authority     27

We, Hamburger Hochbahn AG (or “HOCHBAHN” for short), are delighted that you are interested in hvv switch. With the hvv switch app, hvv switch offers you the opportunity to buy hvv tickets and use various transport services in Hamburg via a single app, without having to register separately with individual transport providers. The long-term aim of hvv switch is to create a simple and reliable alternative to private car use through the hvv switch app and its integrated transport services.

This privacy policy informs you about which data is processed and for what purposes when you use the hvv switch app. You will also find information on how long data is stored, on sharing data with third parties, and on your rights. Your personal data includes all information that can be linked to you as an individual. This includes, amongst other things, your name, email address, mobile phone number, location data and payment details.

A. Data controller and data protection officer

A.1 Data controller

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. names, email addresses, etc.).

The data controller for the hvv switch app is:

Hamburger Hochbahn AG
Sales and Transport Management Division
Steinstraße 20
20095 Hamburg
Germany

Telephone: +49 40 3288-6363
Email: info@hvv-switch.de

In connection with the processing of a mobility service booked by you via the hvv switch app, the respective mobility provider is also responsible for the processing of your personal data. You can find further details on this under C. Disclosure of personal data

A.2 Data Protection Officer

We have appointed a Data Protection Officer; you can contact them as follows:

Hamburger Hochbahn AG
Data Protection Unit
Steinstraße 20
20095 Hamburg
Germany

Email: datenschutzbeauftragter@hochbahn.de

B. Use of the hvv switch app

B.1 Informational use

If you use the hvv switch app for information purposes only, i.e. you have not registered, we only process personal data that is necessary for us to enable you to use the hvv switch app. This includes, for example, the device identifier (DeviceID for Android, IDFA for iOS), language and version of the app, operating system, and the date and time of the request. We process this automatically collected personal data to ensure that the hvv switch app functions properly and remains stable, to enable the optimisation of the hvv switch app (e.g. by adapting the app to your mobile device) and also to ensure the security of our IT systems.

Data processing for informational purposes is carried out on the basis of Article 6(1)(f) of Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR).

B.2 hvv Enquiries

B.2.1 Querying connections

As part of the hvv Information service, we collect stop details, date, desired departure and arrival times, time of enquiry and device type (e.g. iPhone or Android).

To make it easier for you to enter starting points or destinations, you can save favourites in the hvv switch app. In this case, the data is stored exclusively locally within the app. No further processing takes place. You can also allow the hvv switch app to access your current location, for example to find a nearby stop and the best route to it, or the best route from the stop to your desired destination.

We process this data to be able to display travel connections based on your search parameters and to tailor the information displayed in the hvv switch app to your needs. The legal basis for the processing of this data is Article 6(1)(b) of the GDPR (performance of a contract) and Article 6(1)(f) of the GDPR (legitimate interest).
Our legitimate interest is based on the aim of providing our passengers with information as promptly and efficiently as possible. The provision of such information also serves to manage passenger flows more effectively.

B.2.2 Push notifications regarding disruptions on selected routes (or sections thereof)

Push notifications are messages that appear on your smartphone without you having to open the hvv switch app. You can save hvv routes or route sections for which we will send you notifications to your home screen or notification bar at times you have specified. The hvv switch app does not need to be open for this to work. An internet connection is required so that the hvv switch app can receive new data. To do this, we need to store a pseudonymised device identifier along with your chosen routes or route sections on our server, so that notifications can be sent directly to your device.

We process your data in accordance with Article 6(1)(b) of the GDPR. The legal basis for data processing is a contract concluded free of charge between you and HOCHBAHN, which you enter into when you request push notifications. Furthermore, we have an overriding legitimate interest in providing targeted information to our passengers for the purpose of effective passenger management (Article 6(1)(f) of the GDPR).

B.3 Location data and location tracking

When you request a mobility service via the hvv switch app – for example, by selecting an hvv ticket, a MOIA journey, a car-sharing offer or an e-scooter – we use the location data contained in the request (e.g. your current location, starting stop, starting point and destination). This enables us to issue you with a valid hvv ticket, display booking options for MOIA or available car-sharing vehicles or e-scooters in your vicinity, and show you the route to the respective vehicles. We also offer you the option of receiving information, based on your location, about the live location of moving vehicles that you wish to use.

Furthermore, we use this information to better tailor our services in the hvv switch app to demand. This is done without establishing any personal reference. We do not use the location data to create a movement profile of you.

To ensure we can offer you the simplest possible user experience with the hvv switch app, we recommend that you enable location tracking for the hvv switch app. To do this, you must allow the hvv switch app to access location services via the operating system of the mobile device you are using and its permissions system. In this context, we will only collect the location determined by your device whilst the hvv switch app is open. If location tracking is active, this is usually indicated by a corresponding feature on your mobile device. You can enable or disable location tracking at any time via the settings in your mobile device’s operating system. We will ask you once, when you first launch the hvv switch app, whether you wish to enable automatic location tracking.

Data processing for location tracking is carried out on the basis of Article 6(1)(f) of the GDPR. Where consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25( 1 of the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (Telecommunications and Digital Services Data Protection Act, TDDDG)), insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. for device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

B.4 Registration for hvv switch

When you register for the hvv switch app, you set your login details (email address and password). We process this personal data as part of setting up your user account. Your user account is a prerequisite for you to be able to use mobility services in the hvv switch app (subject to the relevant authorisations).

Data processing for registration is carried out on the basis of Article 6(1)(b) of the GDPR (performance of a contract).

B.5 hvv Ticket Purchase

The processing of data in connection with the purchase of hvv tickets is carried out, in deviation from Section A. Controller and Data Protection Officer, by HOCHBAHN and Hamburger Verkehrsverbund GmbH, Brooktorkai 18, 20457 Hamburg (hereinafter “hvv GmbH”).

The controllers listed here, within the meaning of data protection law, handle your personal data to varying degrees. This stems from the distribution of roles and responsibilities within hvv:

• As your contractual partner in relation to the use of the hvv switch app and the ticket purchase function, HOCHBAHN is responsible for administration, processing and customer support (customer contractual partner). This also includes the implementation of information and advertising measures.

• hvv GmbH, as the managing organisation for local public transport within the hvv network, is responsible, among other things, for network-wide product marketing and the associated data processing.

That said, the following processing operations may occur when purchasing hvv tickets:

B.5.1 Purchase of hvv tickets before departure

With an existing hvv switch user account, you can use the hvv switch app to purchase certain hvv tickets directly within the app at the hvv joint fare rate and download them for later use. To this end, HOCHBAHN processes the following data:

• Type of hvv ticket,

• Starting stop (if required by the fare),

• Fare information,

• First name and surname of the main user of the hvv ticket,

• Email address (corresponds to username),

• Address (if required), Date of birth or age (if required),

• Details of the chosen payment method, and

• device information (including operating system, version and build).

The above data is required to process the purchase of the hvv ticket. The legal basis is Article 6(1)(b) of the GDPR (performance of a contract). We also process your personal data where and to the extent that this is necessary to comply with legal obligations (e.g. tax retention obligations) (Article 6(1)(c) of the GDPR).

Tickets can also be purchased without registering, using the third-party payment method PayPal. In this case, your first name, surname and email address are requested for the ticket purchase and stored in our customer service system, along with the payment method, device type and information regarding your acceptance of the Terms and Conditions. During the purchase process, the user is redirected to the payment service provider LOGPAY to confirm the PayPal payment method (see C.2 Payment Service Providers). The user is then redirected to PayPal to complete the purchase. No registration with an hvv switch customer account takes place during this process. Nor is the data combined with data from any other purchase process.

In addition, we transmit personal data to our payment service provider for the payment process (see B.7 Payment and billing of mobility services).

The hvv ticket is displayed and saved within the hvv switch app on the home screen and under ‘Journeys’. Once it has expired, it automatically disappears from the home screen. If you use a device running the iOS (Apple) or Android (Google) operating system , you can also save the hvv ticket in your device’s Apple or Google Wallet. The following data is transmitted to Apple or Google Wallet along with the hvv ticket:

• First name and surname,

• Starting stop (where required by the fare structure),

• Start and end date and time of the ticket,

• Fare product,

• Product class (standard/concessionary fare),

• Fare zone,

• Ticket ID,

• Price,

• Fare tier

If you wish to save the hvv ticket in Apple Wallet, you must manually move the hvv ticket from the hvv switch app to Wallet. This transfer of
hvv ticket to Apple Wallet takes place locally on your device, as do any necessary updates. hvv tickets stored in Apple Wallet must be deleted manually by you; the hvv switch app has no access to them.

If you wish to view the hvv ticket in your Apple Wallet on additional iOS devices, the ticket data is sent to your device (e.g. Apple Watch) via iCloud. This feature must first be enabled on your device.

When ticket data is stored in iCloud, encrypted data is transmitted to, amongst others, participating sub-service providers in third countries. However, according to the information provided by Apple regarding iCloud, the sub-service providers used do not receive the encryption key. Further information on Apple Wallet can be found athttps://support.apple.com/en-gb/111112.

If you wish to store the hvv ticket in Google Wallet, the data required for this will be passed on to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, upon your confirmation of storage. We also notify Google of any necessary updates (e.g. in the event of cancellation) so that the hvv ticket is displayed or removed correctly in Google Wallet.

In this case, Google acts as a separate data controller with regard to the data transferred to it for the storage and display of the hvv ticket in
Google Wallet as an independent data controller with regard to the data transferred to it. Further information on data processing by Google is available athttps://policies.google.com/privacy?hl=en. We have
. Further information on Google Wallet can be found athttps://wallet.google/intl/de_en/.

The legal basis for data processing is Article 6(1)(b) of the GDPR (performance of a contract). This data is required to create and deliver a valid hvv ticket.

B.5.2 Switching from the hvv chip card to the hvv switch app

Anyone who currently has their hvv Deutschlandticket on the hvv chip card can transfer their subscription from the chip card to the hvv switch app without cancelling it in the meantime. A personal switch code is generated for this purpose. For customer verification, we require certain personal data or details regarding the subscription, which are requested via a form at hvv.de (mandatory fields to be completed). We process this data on the basis of Article 6(1)(b) of the GDPR (performance of a contract).

B.5.3 Optimisation of transport services within the hvv

Pseudonymised data is used and analysed for the purpose of demand and/or supply analysis, as well as the further optimisation of transport services within the hvv. Such analyses may be carried out by either hvv GmbH or HOCHBAHN, either individually or jointly. This processing is based on Article 6(1)(f) of the GDPR (overriding legitimate interest). Without this data or its analysis, we cannot respond appropriately and with the necessary speed to developments in the transport market and adapt to changes in the interests of passengers. As the data is processed in pseudonymised form, no overriding legitimate interest to the contrary is apparent.

B.5.4 Promotional material for the hvv switch app and other transport services within the hvv

We base the use of your personal data for the sole purpose of self-promotion relating to the hvv switch app and other transport services within the hvv network on Article 6(1)(f) of the GDPR (overriding legitimate interest). In our view, such promotional information and customer support meet reasonable and customary expectations regarding the handling of customer data and customer support during an ongoing contractual relationship. As we seek your consent regarding the processing of this data for this purpose, we do not consider there to be any overriding conflicting interest. Where such consent has been given, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR. Consent may be withdrawn at any time. Promotional campaigns for the sole purpose of self-promotion may be carried out by both hvv GmbH and HOCHBAHN, either individually or jointly.

B.6 Mobility services

When booking and using mobility services, you enter into a separate contractual relationship with the relevant mobility provider with our involvement. We transfer the data required for the respective contract to the relevant mobility provider, who processes this data under their own responsibility for the purpose of fulfilling the contract. This also includes the processing of personal data in connection with the exercise of statutory rights of withdrawal, in particular the receipt, documentation and processing of notices of withdrawal, as well as the necessary communication in this regard (e.g. acknowledgements of receipt and confirmation messages by email). Should a driving licence validation be required, we will engage our validation service provider.

B.6.1 Activation for mobility services

With the hvv switch app, we offer you the opportunity to use mobility services from various mobility providers. Depending on the specific mobility service, this requires the provision of additional personal data as well as the validation of your personal data.

For example, this may include the provision and validation

• your first name and surname,

• your date of birth,

• your place of birth

• your mobile phone number,

• your address,

• your driving licence details, and

• your payment details

. Without the relevant details and validations, it is not possible to use the relevant mobility service.

For certain mobility services, it is also necessary to create a personal PIN. This PIN is then requested again for additional user identification before the start of each hire. This is the case, for example, when hiring a car-sharing vehicle from SIXTshare.

When activating the relevant mobility service, only the personal data required for the use of that service is requested, validated where necessary, and stored in your user account. Any additional information in your user account is optional.

Once you have successfully activated a selected mobility service, certain personal data in your user account can no longer be deleted by you, as it is essential for using the selected mobility service. You can make changes to your personal data, subject to revalidation. If you wish to delete certain personal data that is essential for using a mobility service, you can request this via our customer service. It will then no longer be possible to use the relevant mobility service.

Data processing for the activation of mobility services is carried out on the basis of Article 6(1)(b) of the GDPR (performance of a contract) and Article 6(1)(c) of the GDPR (legal obligation).

B.6.2 Validation of driving licence

To use a car-sharing service, you must hold a valid driving licence authorising you to drive a car. We therefore offer you the option, as part of the activation process for a car-sharing service, to have your identity and driving licence verified via the hvv switch app using an online procedure.

Where identification and verification are required as part of the driving licence validation process, we transfer personal data to our service provider IDnow GmbH, Auenstraße 100, 80469 Munich, Germany, which completes the identification and verification process on our behalf and acts as our data processor.

As part of the process, IDnow uses automated methods for document verification (AutoIdent). These include basic checks such as document recognition and classification, extraction of the machine-readable zone (MRZ), age verification, and validity and consistency checks. In addition, advanced security checks are carried out, e.g. to detect dynamic security features (such as holograms or optically variable ink) as well as country-specific data field checks.

Biometric procedures are also used to enhance security and prevent fraud. The image of the user captured during the selfie process is automatically compared with the photograph on the identity document. In addition, a so-called liveness check is carried out, in which biometric analysis ensures that the person is actually present and alive.

The biometric data is processed exclusively for the purpose of identity verification. For quality assurance purposes, each identification process is finally reviewed by qualified specialists from IDnow. All personal data is deleted 60 days after completion of processing and provision to us in our service provider’s production system.

As part of the online validation process in the hvv switch app, images of identity documents and driving licences are captured. We store the images of your driving licence for the duration of the business relationship between you and us as proof of the driving licence check. However, this is not done as part of an active customer profile. Instead, the relevant data is excluded from ongoing use and blocked via a strict authorisation scheme.

Data processing for the validation of the driving licence is carried out on the basis of Article 6(1)(b) and (c) of the GDPR (contract performance and legal obligation).

B.6.3 Booking and use of mobility services

When you reserve a mobility service via the hvv switch app or book one at  , we assign the associated reservation/booking data to your user account. In this context, we also process, for example, your name and the location data you provided in your enquiry regarding a mobility service. We display the mobility services you have used (active and completed) in your user account.

We also pass on the reservation/booking details required for the relevant mobility service to the relevant mobility provider, who processes this information on their own responsibility for the purpose of providing the mobility service. For certain bookings, we ask whether you use a wheelchair. If you answer in the affirmative, this information is passed on to the mobility provider when the request for the relevant journey is made. We use this information so that we can provide you with a wheelchair-accessible vehicle and ensure that the driver is informed accordingly. Furthermore, in this case, it is not possible to use autonomous vehicles from the mobility provider MOIA; your journey will be carried out in a vehicle with a driver. The processing of this information serves the purpose of performing the contract in accordance with Article 6(1)(b) (performance of a contract) in conjunction with your consent within the meaning of Article 9(2)(a) of the GDPR. You can find out more about the disclosure of data by us under C.1 Mobility Service Providers.

We also process personal data for the settlement of further claims (e.g. settlement of damages incurred) arising from a booking and/or use.

If disruptions or similar issues arise in connection with the provision of mobility services, we will use your contact details to inform you, for example, by email, SMS, in-app or push notification.

Data processing for the booking and use of mobility services is carried out on the basis of Article 6(1)(b) and (c) of the GDPR (contract performance and legal obligation).

HOCHBAHN’s autonomous mobility services
HOCHBAHN offers its own autonomous mobility services as part of pilot and regular operations. For the technical operation of the autonomous vehicles, HOCHBAHN uses vehicles provided by HOLON GmbH, Elsener Straße 95, 33102 Paderborn, Germany. HOLON GmbH acts as a data processor in accordance with Article 28 of the GDPR. As part of this data processing, HOLON GmbH processes only the data necessary for the execution of the autonomous journey, in accordance with HOCHBAHN’s instructions. Information on data protection when using HOLON GmbH’s autonomous vehicles can be found at:https://www.driveholon.com/en/live/. For autonomous journeys, only the data technically necessary to carry out the journey safely is processed ( ). Beyond this, no independent processing takes place by HOLON GmbH.

B.7 Payment and billing for mobility services

To carry out the payment process and for the purpose of selling and assigning our claims against you, we transfer personal data to our payment service provider LOGPAY Financial Services GmbH (“LOGPAY”). You can find further information on this under C.2 Payment Service Provider.

In order for you to use a mobility service via the hvv switch app, you must store a valid payment method in your user account.

If you select credit card or SEPA direct debit as your payment method, the necessary payment details (e.g. credit card provider, cardholder, card number, expiry date and
security code or account holder and IBAN, as well as BIC where applicable) will be stored with LOGPAY. The processing of personal data is carried out by LOGPAY as the data controller.

If you wish to use PayPal as your payment method, the first step is to link your PayPal account to your hvv switch user account. As part of this account linking process, you have the option to transfer personal data already stored in your PayPal account (e.g. name and billing address) to your hvv switch user account and save it there.

The transfer of your data to PayPal is based on Article 6(1)(a) GDPR and Article 6(1)(b) GDPR. You can find further information on this under
C.2 Payment Service Providers.

You also have the option to settle the mobility services in the hvv switch app using a mobility budget provided by your employer. For this purpose, we have integrated hvv-m DB Bonvoyo as a possible payment method. Further information on this can be found under C.2 Payment service providers.

For every mobility service you use via the hvv switch app, we issue an invoice and process your personal data in this context (e.g. your name, date and location of use of the respective service). We send our own invoices, as well as invoices issued on behalf of individual mobility providers, exclusively by email.

B.8 Tracking and consent management solutions

We use Google Tag Manager and Google Consent Mode. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that enables us to integrate tracking or analytics tools and other technologies into our app. Google Tag Manager itself does not create user profiles or carry out any independent analysis. It is used solely to manage and deploy the tools integrated via it. However, Google Tag Manager does collect your IP address, which may also be transferred to Google’s parent company in the USA.

Google Consent Mode allows us to adjust the behaviour of Google tags and scripts based on your consent status. Tags are loaded into the app before the consent dialogue appears, so that tag behaviour is dynamically adjusted depending on the privacy settings you have selected. Analytics tools are only used for specifically defined purposes if you have given your consent for this. The user’s consent status is transmitted by Google Consent Mode to Google for further processing. No personal data is sent to Google; only information regarding individual users’ consent decisions, such as permission to use certain marketing tools.

You actively decide whether you wish to allow the use of Google Tag Manager, Google Consent Mode and integrated tools. To this end, we request your consent once when you first launch the hvv switch app. Furthermore, you have the option to adjust your consent at any time in the privacy settings of the hvv switch app. Provided that the relevant consent has been requested, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. You have the option to adjust your consent at any time in the privacy settings of the hvv switch app (withdrawal of consent). Google is certified under the “EU-U.S. Data Privacy Framework”. You can find further information on this under D. EU-U.S. Data Privacy Framework.

B.9 Optimisation of the hvv switch app

B.9.1 Google Analytics for Firebase and Firebase Crashlytics

We have integrated a Google Firebase SDK (Software Development Kit) into the hvv switch app to better understand how our app is used and to improve the service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Firebase provides various products, of which we use Analytics for Firebase and Crashlytics. The pseudonymised information collected via Google Firebase regarding the use of our app provides us, for example, with insights into the number of times the app is opened over a period, app crashes, particularly popular features, as well as the number of in-app purchases and the total number of users over a specific period. Further information on data processing by Google Firebase can be found at https://www.firebase.com/terms/privacy-policy.html.

Crashlytics processes data relating to the operation of the app, including the type of operating system used, information on operational disruptions (type, time and duration of the disruption, and app usage at the time of the disruption), and device information. Using this data, when faults or issues occur during the operation of the hvv switch app, we can gain an overview of various faults and prioritise them based on their relevance to usage, in order to ensure efficient troubleshooting and the stability of the app.

You actively decide in each case whether you wish to allow the use of Analytics for Firebase or Crashlytics to optimise our service. To this end, we request your consent once when you first launch the hvv switch app. Provided that such consent has been requested, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. You have the option to adjust your consent at any time in the privacy settings of the hvv switch app (withdrawal of consent). Google is certified under the “EU-U.S. Data Privacy Framework”. You can find further information on this under D. EU-U.S. Data Privacy Framework.

B.9.2 Optimisation of Mapbox and OpenStreetMap map services

We have integrated an SDK (Software Development Kit) from the Mapbox map service into the hvv switch app to enable you to use the hvv switch app easily and reliably. The provider is Mapbox Inc., based at 740, 15th Street NW, Washington DC, 20005, USA. To use Mapbox’s features, it is necessary to store your IP address. In addition, device information and location data are also collected and temporarily stored. This information is usually transferred to a Mapbox server in the USA and may be processed there. You can find more information about data processing by Mapbox at https://www.mapbox.com/privacy/.

You actively decide whether you wish to help improve OpenStreetMap and Mapbox maps by providing anonymised usage data. Mapbox uses location data from all integrations to improve its maps, directions and journey times, and to provide aggregated insights. To this end, we request your consent once when you first launch the hvv switch app. Provided that such consent has been requested, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. You can adjust your consent at any time in the privacy settings of the hvv switch app. Mapbox is certified under the “EU-U.S. Data Privacy Framework”. You can find further information on this under D. EU-U.S. Data Privacy Framework.

B.10 Optimisation of marketing activities for the hvv switch app

B.10.1 Adjust

To optimise our marketing activities, we use the service provider Adjust (Adjust GmbH, Saarbrücker Straße 37A, 10405 Berlin, Germany) and have integrated its SDK (Software Development Kit) into the hvv switch app. The purpose of data processing with Adjust is to analyse usage behaviour and the path by which the user arrived at the hvv switch app. The usage analyses are evaluated and used to optimise user communication. In doing so, data is collected during measurement and processed in a pseudonymised form. Adjust determines the data using various methods. These include the use of advertising IDs, device IDs, Adjust Reftags and the so-called ‘hashed fingerprint’ (use of publicly available device statistics). The data collected via Adjust provides information, for example, on the download of the hvv switch app, the online advertising channel through which the download was generated, and the time the hvv switch app was opened.

The analysis carried out by Adjust helps us to continuously improve our communication and tailor it specifically to your needs. Further information on data processing by Adjust can be found in Adjust’s Privacy Statement & Policy | Adjust.

Adjust may be connected to external advertising and marketing platforms for the purpose of analysing and optimising our marketing activities. In doing so, pseudonymised attribution and event data is transmitted to participating partners to the extent necessary for measuring the success and optimising our campaigns. It is not possible to identify individual users . We have integrated the following online marketing platforms via Adjust, so that information regarding usage behaviour is passed on to them.

Apple Search Ads

As an advertiser, we use the “Apple Ads” (Apple Search Ads) advertising platform provided by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, to efficiently deliver our marketing activities within the Apple ecosystem and to measure their reach and impact. Apple Ads enables us to display our advertising content to users who are actively searching for relevant offers in the App Store, thereby increasing the relevance of our app campaigns. Apple processes data for advertising purposes on its own responsibility and without tracking users across different services. To select adverts, Apple uses contextual information such as search queries, device type, OS version and App Store interactions, with personalised adverts only being displayed for sufficiently large segments (at least 5,000 people).

Google Ads

We use Google Ads. Google Ads is an online advertising programme provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to display advertisements in the Google search engine or on third-party websites when the user enters specific search terms into Google (keyword targeting). Furthermore, targeted advertisements can be displayed based on user data held by Google (e.g. location data and interests) (audience targeting). As website operators, we can evaluate this data quantitatively, for example by analysing which search terms led to our adverts being displayed and how many adverts resulted in corresponding clicks.

Data transfers to the USA are based on the EU Commission’s Standard Contractual Clauses. You can find details here:
https://policies.google.com/privacy/frameworks and here:
https://privacy.google.com/businesses/controllerterms/mccs/.

The company is certified under the “EU-U.S. Data Privacy Framework” (EU-U.S. DPF). Further information on this can be found under section D. EU-U.S. Data Privacy Framework.

Meta

We use advertising services provided by Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, D04 X2K5, Ireland) for the targeted delivery and reach measurement of our marketing communications. The use of Meta’s advertising platforms enables us to promote our offerings in line with demand, efficiently target audiences on social media platforms such as Facebook and Instagram, and evaluate the performance of our campaigns using aggregated performance metrics.

Further information on data processing by Meta can be found at:
https://www.facebook.com/privacy/policy.

Microsoft Ads

As an advertiser, we use the “Microsoft Ads” advertising platform provided by Microsoft Ireland Operations Limited (70 Sir John Rogerson’s Quay, Dublin 2, Ireland) to deliver our online marketing campaigns in a targeted manner, measure their reach and effectiveness, and reach relevant user groups via the Microsoft advertising network. Microsoft Ads enables us to display adverts within the search networks of Bing, Yahoo and DuckDuckGo, as well as on other Microsoft services such as MSN, Outlook and Microsoft 365, in order to reach users in various usage scenarios.

Further information on data processing by Microsoft Ads can be found at:
https://www.microsoft.com/en-gb/privacy/privacystatement.

Outbrain

We have integrated Outbrain (Outbrain Inc., 111 West 19th Street, New York, NY 10011, USA) via Adjust. This enables us to provide useful and interesting content to our users who are interested in hvv switch products, whilst also running marketing campaigns more efficiently.

Further information on data processing by Outbrain can be found at https://www.outbrain.com/privacy/

Outbrain is certified under the “EU-U.S. Data Privacy Framework”. Further information on this can be found under D. EU-U.S. Data Privacy Framework.

Taboola

As an advertiser, we use the “Taboola” advertising platform provided by Taboola Inc. (Taboola Europe Ltd., Aldgate House, 33 Aldgate High Street, 2nd Floor, London EC3N 1DL, United Kingdom) to run our marketing campaigns more efficiently and optimise them for specific target groups. Taboola enables us to target advertising campaigns based on anonymised or pseudonymised usage data in such a way that our adverts reach the most relevant user groups. To this end, Taboola uses cookies and similar technologies to collect and analyse information on the effectiveness of our campaigns, their reach and user interactions.

Further information on data processing by Taboola can be found at:
https://policies.taboola.com/advertiser-privacy-terms/.

You actively decide whether you wish to allow the use of Adjust and the integration of the aforementioned partner platforms to optimise our marketing activities. To this end, we will ask for your consent once when you first launch the hvv switch app. Provided that the relevant consent has been requested, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. You can adjust your consent at any time in the privacy settings of the hvv switch app (withdrawal of consent).

B.10.2 CleverTap

To optimise our marketing activities regarding communication with you, we use the service provider CleverTap, c/o WeWork 535 Mission St., Unit 1624, San Francisco, CA 94105, USA and have integrated its SDK (Software Development Kit) CleverTap into the hvv switch app. The purpose of data processing with CleverTap is to analyse your behaviour within the hvv switch app in order to optimise our communication with you and to provide you with information about our products and services tailored to your needs. In addition to your personal data (device ID, first name, surname, date of birth, email address and place of residence), your behaviour within the hvv switch app is also recorded in CleverTap (e.g. which products you view and which services you book). Further information on data processing by CleverTap can be found at https://clevertap.com/privacy-policy.

You actively decide whether you wish to allow the use of CleverTap to optimise our marketing activities. To this end, we will ask for your consent once when you first launch the hvv switch app. Provided that such consent has been requested, processing takes place exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g. device fingerprinting) within the meaning of the TDDDG. You have the option to adjust your consent at any time in the privacy settings of the hvv switch app (withdrawal of consent). The company CleverTap is certified under the “EU-U.S. Data Privacy Framework”. You can find further information on this under D. EU-U.S. Data Privacy Framework.

B.10.3 Google Looker Studio

We use Google Looker Studio – software provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Google Looker Studio is used to manage and visualise data from the aforementioned analytics tools. We can only analyse data in Google Looker Studio if you have consented to the use of the relevant tool.

We use Google Looker Studio for marketing and optimisation purposes, in particular to analyse  the use of our app and to continuously improve individual functions and offers as well as the user experience. By statistically analysing usage behaviour, we can improve our offering and make it more interesting for you as a user.  

The use of this service is based on your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. You may withdraw your consent at any time.

Data transfers to the USA are based on the EU Commission’s Standard Contractual Clauses. You can find details here:
https://privacy.google.com/businesses/gdprcontrollerterms/ and here:
https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

For more information on how Google Looker Studio processes your data, please visit
https://cloud.google.com/looker/privacy-policy/

The company is certified under the EU-U.S. Data Privacy Framework (EU-U.S. DPF). Further information on this can be found under Section D. EU-U.S. Data Privacy Framework.

B.11 Enquiries to Customer Service

When you contact us, your enquiry or feedback, including all resulting personal data (name, enquiry/feedback), will be stored and processed by us for the purpose of handling your request. We will not pass on this data without your consent, unless it relates to matters concerning the fulfilment of contracts with the mobility service providers mentioned under C.1 or the payment service providers mentioned under C.2.

In the event of a service issue and for the purpose of fault analysis, you have the option to provide us with additional information from your mobile device. A function linked in the version display of the hvv switch app can be used for this purpose. Our customer service team will usually ask you to click this link. When you click the link, an event log file is generated that is specific to the day and limited to the period of use of the hvv switch app. This file is forwarded to us following your confirmation. No direct personal reference can be established on the basis of the information available in the file.

The processing of this data is based on Article 6(1)(b) of the GDPR, provided that your enquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Article 6(1)(f) of the GDPR) or on your consent (Article 6(1)(a) of the GDPR), provided that this has been requested; consent may be withdrawn at any time.

The data you send to us via a contact enquiry will remain with us until you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. once your enquiry has been fully processed). Mandatory legal provisions – in particular statutory retention periods – remain unaffected.

B.12 Use of vouchers

If you take part in an hvv switch voucher campaign, we will process your personal data to the extent necessary to send you the relevant vouchers and to confirm your participation in the campaign. The use of vouchers is voluntary. The terms and conditions of the respective hvv switch voucher campaign will be made available to you upon participation.

To provide the service, we use our service provider Voucherify PSA, Porcelanowa 23/A4, 40-246 Katowice, Poland (“Voucherify”). For the purpose of providing the vouchers, we process the following data:

• Technical information required to redeem a voucher (such as redemption ID and status, hvv switch customer number and Voucherify-specific ID, date and time the voucher code was entered in the hvv switch app)

• Journey-related information required to redeem a voucher (such as journey-specific or provider-specific ID)

This data is processed on the basis of Article 6(1)(b) of the GDPR, as it is related to the performance of a contract or is necessary for the implementation of pre-contractual measures.

Further information on data processing by Voucherify can be found at https://www.voucherify.io/legal/

B.13 System security, prevention of criminal offences

We process your personal data to ensure the security of our systems and to prevent and detect fraud and other criminal offences. The legal basis for data processing is the protection of legitimate interests by
HOCHBAHN, in particular the interest in preventing fraudulent activities (Art. 6(1)(f) GDPR).

B.14 Hosting and messaging service providers

We use various service providers who process your personal data on our behalf. These have been carefully selected by us and process personal data exclusively in accordance with our instructions and under our control. In particular, these are the following service providers:

Hosting and operation:
Public Cloud Group GmbH, Blumenstraße 33/1, 71106 Magstadt, Germany
Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, D02 R296, Ireland
Bechtle GmbH, Bernhard-Nocht-Straße 113, 20359 Hamburg, Germany
Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland

Sending of emails and SMS messages:
Twilio Ireland Limited, 25-28 North Wall Quay, Dublin 1, Ireland
rapidmail GmbH, Wentzingerstraße 21, 79106 Freiburg im Breisgau, Germany
CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany

The processing of personal data by our aforementioned service providers is carried out on the basis of our overriding legitimate interest pursuant to Article 6(1)(f) of the GDPR. This interest lies in the secure, efficient and cost-effective provision of our services and in communication with users. The processing is necessary to achieve these purposes and is carried out in strict compliance with data protection regulations.

C. Disclosure of personal data

C.1 Mobility providers

When booking and using mobility services, with the exception of hvv tickets, you enter into a separate contractual relationship with the relevant mobility provider, with our involvement. You decide which mobility services you wish to use and which contract you wish to enter into in connection with them. We then transfer the data required for the respective contract exclusively to the relevant mobility provider, who processes it for the purpose of fulfilling the contract. You explicitly consent to the transfer of the required data during the process.

We currently work with the following mobility service providers:

C.2 Payment service provider

C.2.1 LOGPAY

In order to process the payment transaction and for the purposes of selling and assigning our claims against you, we transfer personal data to our payment service provider LOGPAY Financial Services GmbH, Schwalbacher Straße 72, 65760 Eschborn, Germany (“LOGPAY”). In addition, we also pass on personal data for the settlement of further claims (e.g. settlement of damages incurred) arising from the booking/use. Our payment service provider processes and stores your personal data for the purposes of processing payments, assessing the validity of payment methods, preventing payment defaults and managing claims.

Further information on data processing by LOGPAY is available at https://docs.logpay.de/_docs/uk/data_protection.pdf.

Please note that these terms also mean that LOGPAY will pass on your data to credit reference agencies (such as SCHUFA) to verify your details and creditworthiness in order to prevent payment defaults, if you are not yet known to LOGPAY. Furthermore, to protect you and your bank details, LOGPAY uses a bank identification procedure provided by the service provider Verimi GmbH to verify your IBAN. All you need for this is access to your online banking.

C.2.2 PayPal

We have integrated a PayPal SDK (Software Development Kit) into the hvv switch app to offer you a simple payment method via PayPal. The provider is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, Luxembourg. PayPal uses this SDK for risk management purposes to protect its services and its customers from fraud and misuse. Using the SDK, PayPal collects and processes not only your IP address but also device information, technical usage data and location data. This occurs when you have selected PayPal as your payment method. We have no influence over the subsequent data transfer and processing. You can find more information about data processing by PayPal athttps://www.paypal.com/de/legalhub/paypal/privacy-full?locale.x=en.

C.2.3 Mobility budget hvv-m DB Bonvoyo

To give you the option of settling the mobility services in the hvv switch app using
a mobility budget provided by your employer, we have integrated hvv-m DB Bonvoyo as a payment option. The provider of hvv-m DB Bonvoyo is Deutsche Bahn Connect GmbH (“DB Connect”), Mainzer Landstraße 169, 60327 Frankfurt am Main. Should you use this feature, the data required for its use will be transferred between DB Connect and us. We have no influence whatsoever on data processing within DB Connect.

Invoices and receipts for services used that can be settled via DB Bonvoyo can be submitted via the receipt scanner in the hvv switch app. To do this, simply take a photo of the receipt using your smartphone. All relevant information is automatically recognised and extracted. The information obtained, consisting of the travel date, the mode of transport and the cost, is displayed directly in the hvv switch app. Before submitting, you must confirm the information or, in the event of incorrect or incomplete information, correct it to confirm the proper use of the mobility budget. You also have the option to give your journey a title for future reference. The budget provided by your employer will then be debited with the cost of the journey.

To be able to send your receipts to your employer via the hvv switch app to DB Bonvoyo, you may need to take a photo of a receipt. The hvv switch app will ask for permission to use the camera as soon as you wish to photograph a receipt.

You can find more information about data processing in connection with the mobility budget at https://www.bonvoyo.de/benefit/Datenschutzhinweise-Bonvoyo-App-13448270#.

C.3 Form for reporting illegal parking, littering and damage at hvv switch points

If you send us information about illegal parking at hvv switch points via the reporting form, your details, including your first and last names and your email address, will be recorded for the purpose of reporting and dealing with the illegal parking. Your personal data will not be stored by HOCHBAHN, but will be forwarded to our parking enforcement service provider (PRS Parkraum Service GmbH, Kirchplatz 7, 58739 Wickede (Ruhr), Germany; hereinafter referred to as PRS) upon submission of the form and processed there. Only the photograph of the illegally parked vehicle will be stored by HOCHBAHN for a period of three months for the purpose of preserving evidence and will subsequently be deleted (limitation period in accordance with Section 26(3) of the Straßenverkehrsgesetz (Road Traffic Act ). Information on data protection and the handling of your personal data by PRS can be found at
https://parkraumservice.de/datenschutz.

If you send us information regarding litter or damage at hvv switch points, you have the option to provide your name and email address. Providing this information is voluntary. This data is processed by HOCHBAHN. The data you provide will be used exclusively to process your report. If you have provided your name and email address, this information will be deleted immediately once the necessary measures to remove the litter or repair the damage have been completed. If you choose to report anonymously, no personal data will be stored.

In principle, reports submitted via the forms and the provision of your personal data are voluntary. We base the processing on Article 6(1)(f) of the GDPR (overriding legitimate interest). We have a legitimate interest in resolving contractual breaches (illegal parking) as well as cleaning up and repairing damage at hvv switch points, and in making the available car-sharing parking spaces available to our hvv switch customers in the best possible condition. As your submission is voluntary, we do not consider that you have a legitimate interest that conflicts with or outweighs our legitimate interest.

We use ProcessWire, a content management system (CMS), to display the forms described here. By using ProcessWire, we process certain personal data in order to provide you with a user-friendly and personalised online experience. The personal data processed by ProcessWire serves the purpose of providing and maintaining our website. This includes displaying content and improving website functionality. ProcessWire enables us to process data such as IP addresses, browser information and – where provided – personal data such as your name and email address, which you have provided to us, for example, via the contact form. The processing of your data by ProcessWire is based on our legitimate interest in the efficient provision and maintenance of our website’s functions (Art. 6(1)(f) GDPR) and, where applicable, on the basis of your consent, which you have given us, for example, for the use of cookies (Art. 6(1)(a) GDPR and Section 25( 1 TDDDG).

D. EU-US Data Privacy Framework

We also use service providers that are certified under the “EU-U.S. Data Privacy Framework” (EU-U.S. DPF). The EU-U.S. DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards when data is processed in the United States. Every company certified under the EU-U.S. DPF undertakes to comply with these data protection standards. Further information on this is available at the following link: https://www.dataprivacyframework.gov/. If a company is certified under the EU-U.S. DPF, data transfers to the USA are carried out on the basis of an adequacy decision by the European Commission pursuant to Article 45 of the GDPR dated 10 July 2023. Such an adequacy decision allows personal data to be transferred from the EU to the relevant third country without the need for further transfer mechanisms or additional measures.

E. Retention period

As your contractual partner, HOCHBAHN processes and stores your personal data only for as long as is necessary to fulfil contractual and legal obligations. In doing so, we distinguish between different categories of data. In principle, we retain data only from registered customers. This is done solely at your request, so that you do not have to re-enter personal data when using our services again. When purchasing subscription products (e.g. Deutschlandticket), a continuing contractual relationship arises with regard to your business relationship with us, meaning that we also need and must process certain basic data such as name, address and stored payment method (master data) on a permanent basis.

If data is no longer required for the immediate fulfilment of contractual or legal obligations – for example, because it relates to transactions that have already been settled – it is regularly deleted. This does not apply to data whose (temporary) continued storage is necessary for the following purposes:

• Compliance with retention periods under commercial or tax law: Examples include
the Handelsgesetzbuch (German Commercial Code) and the Abgabenordnung (German Fiscal Code). The retention and documentation periods stipulated therein are up to 10 years.

• Preservation of evidence within the framework of the statute of limitations: According to Sections 195 et seq. of the Bürgerliches Gesetzbuch (German Civil Code), these limitation periods are generally 3 years, but may in individual cases extend up to 30 years.

F. Data protection rights

The GDPR grants data subjects whose personal data is processed by us
, certain rights, which we would like to explain to you here. For this
and regarding any further questions about data protection at hvv switch, please feel free to contact us as the data controller or our Data Protection Officer. You can find the contact details in Section A.

F.1 Access, erasure and rectification

You have the right at any time to request, free of charge, information about your personal data stored by us. This includes information on the purpose of the processing, the category of data used, the recipients of the data and the planned duration of data storage or, if this is not possible, the criteria for determining this duration. Furthermore, you have the right to have the data erased and/or rectified, in particular if the data is incomplete or inaccurate, is no longer necessary for the purpose for which it was collected, or if you have withdrawn your consent to its processing.

F.2 Withdrawal of consent

Where data processing is carried out with your consent, you may withdraw this consent at any time. An informal notification by email is sufficient for this purpose. You can withdraw any consent given for the analysis of your usage behaviour in the privacy settings under ‘Settings’ in the hvv switch app. The lawfulness of data processing operations carried out prior to withdrawal remains unaffected by the withdrawal.

F.3 Right to object

Where data processing is carried out on the basis of a legitimate interest on our part,
you have the right to object to the data processing. This requires grounds arising from your particular situation (Art. 21(1) GDPR).

F.4 Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. The right to restriction of processing applies in the following cases:

• If you dispute the accuracy of your personal data stored by us, we usually need time to verify this.

• For the duration of the verification, you have the right to request the restriction of the processing of your personal data.

• If the processing of your personal data has been or is being carried out unlawfully, you may request the restriction of data processing instead of erasure.

• If we no longer require your personal data, but require it to exercise, defend or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure.

• If you have lodged an objection under Article 21(1) of the GDPR, a balancing of interests between yours and ours must be carried out. Until it is determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

F.5 Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract provided to you or to a third party in a structured, commonly used and machine-readable format. If you request the direct transfer of the data to another controller, this will only take place insofar as it is technically feasible.

F.6 Right to lodge a complaint with a supervisory authority

If you believe that we are in breach of data protection law, you have the right to lodge a complaint with a supervisory authority. This right to lodge a complaint is without prejudice to any other administrative or judicial remedies. In Hamburg, you can contact the competent supervisory authority at: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (The Hamburg Commissioner for Data Protection and Freedom of Information), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany,
email: mailbox@datenschutz.hamburg.de.

As of: May 2026