Data Privacy | hvv switch | hvv switch

Privacy Policy for the hvv switch app

A. Responsible body and data protection officer

B. Use of the hvv switch app

B.1 Informational use

B.2 hvv information

B.2.1 Querying connections

B.2.2 Push notifications about disruptions on selected lines (or sections thereof)

B.3 Location data and location tracking

B.4 Registration for hvv switch

B.5 hvv ticket purchase

B.5.1 Purchase of hvv tickets before departure

B.5.2 Booking and use of hvv Any

B.5.3 Optimization of transport services in the hvv

B.5.4 Self-promotion for the hvv switch app and other transport services in the hvv

B.6 Mobility services

B.6.1 Activation for mobility services

B.6.2 Validation of driver's license

B.6.3 Booking and use of mobility services

B.7 Payment and billing for mobility services

B.8 Tracking and consent management solutions

B.9 Optimization of the hvv switch app

B.9.1 Google Analytics for Firebase and Firebase Crashlytics

B.9.2 Optimization of Mapbox and OpenStreetMap map services

B.10 Optimization of marketing activities for the hvv switch app

B.10.1 Adjust and Outbrain

B.10.2 CleverTap

B.11 Customer service inquiries

B.12 Use of vouchers

B.13 System security, prevention of criminal offenses

B.14 Hosting and messaging service providers

C. Disclosure of personal data

C.1 Mobility service providers

C.2 Payment service providers

C.2.1 LOGPAY

C.2.2 PayPal

C.2.3 Mobility budget hvv-m DB Bonvoyo

C.3 Form for reporting illegal parking, littering, and damage at hvv switch points

D. EU-U.S. Data Privacy Framework

E. Storage period

F. Data protection rights

F.1 Information, deletion, and correction

F.2 Withdrawal of consent

F.3 Right to object

F.4 Right to object to processing

F.5 Right to data portability

F.6 Right to lodge a complaint with a supervisory authority

We, Hamburger Hochbahn AG (HOCHBAHN for short), appreciate your interest in hvv switch. With the hvv switch app, hvv switch offers you the opportunity to purchase hvv tickets and use various mobility services in Hamburg with just one app and without having to register separately with the individual mobility providers. The long-term goal of hvv switch is to create a simple and reliable alternative to private car use with the hvv switch app and the integrated mobility services. 

This privacy policy informs you about what data is processed for what purposes when you use the hvv switch app. You will also receive information about how long the data is stored, how it is passed on to third parties, and your rights. Your personal data includes all information that can be attributed to you as a person. This includes, among other things, your name, email address, mobile phone number, location, and payment data.

A. Responsible body and data protection officer

Responsible body

The responsible body is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g., names, email addresses, etc.).

The responsible body for the hvv switch app in terms of data protection law is: 

Hamburger Hochbahn AG 
Sales and Transport Management 
Steinstraße 20 
20095 Hamburg 

Phone: +49 40 3288-6363 
Email: info@hvv-switch.de

When processing a mobility service booked by you via the hvv switch app, the respective mobility provider is also responsible for processing your personal data. You can find more details on this under C. Disclosure of personal data.

Data protection officer

We have appointed a data protection officer; you can contact them as follows:

Hamburger Hochbahn AG
Data Protection Department
Steinstraße 20
20095 Hamburg

Email: datenschutzbeauftragter@hochbahn.de

B. Use of the hvv switch app

B.1 Informational use

If you use the hvv switch app for informational purposes, i.e., you have not registered, we only process personal data that is necessary for us to enable you to use the hvv switch app. This includes, for example, the device ID (DeviceID for Android, IDFA for iOS), language and version of the app, operating system, and date and time of the request. We process this automatically collected personal data in order to ensure that the hvv switch app is functional and stable, to enable optimization of the hvv switch app (e.g., by making appropriate adjustments to the app for your mobile device), and also to ensure the security of our information technology systems.

Data processing for informational purposes is carried out on the basis of Art. 6 (1) lit. f of Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR).

B.2 hvv information

B.2.1 Querying connections

As part of the hvv information service, we collect stop locations, dates, desired departure and arrival times, query times, and device types (e.g., iPhone or Android).

To make it easier for you to enter starting points or destinations, you can save favorites in the hvv switch app. In this case, the data is stored exclusively locally in the app. No further processing takes place. You can also allow the hvv switch app to access your current location in order to determine, for example, a nearby stop and the best route to it, or the best route from the stop to your desired destination.

We process this data in order to be able to show you transport connections based on your search parameters and to tailor the information displayed in the hvv switch app to your needs. The legal basis for the processing of this data is Art. 6 (1) lit. b GDPR (performance of a contract) and Art. 6 (1) lit. f GDPR (overriding legitimate interest). We base our legitimate interest on the goal of providing our passengers with information as quickly and efficiently as possible. The provision of such information also serves to guide passengers more effectively.

B.2.2 Push notifications about disruptions on selected lines (or sections of lines)

Push notifications are messages that appear on your smartphone without you having to open the hvv switch app. You can save hvv lines or sections of lines for which we will send you messages to your home screen or notification bar at travel times defined by you. The hvv switch app does not need to be open for this. An internet connection is required so that the hvv switch app can receive new data. For this purpose, we need to store a pseudonymized device ID with your desired lines or sections on our server so that messages can be sent to your device in a targeted manner. We process your data in accordance with Art. 6 (1) (b) GDPR. The legal basis for data processing is a free contract between you and HOCHBAHN, which you enter into when you request push notifications. In addition, we have an overriding legitimate interest in providing our passengers with targeted information for the purpose of effective passenger guidance (Art. 6 (1) (f) GDPR).

B.3 Location data and location tracking

When you request a mobility service via the hvv switch app, e.g., select an hvv ticket, a MOIA ride, a car-sharing offer, or an e-scooter, we use the location data contained in the request (e.g., your current location, starting stop, starting point, and destination). This enables us to issue you with a valid hvv ticket, show you booking options for MOIA or available car-sharing vehicles or e-scooters in your area, and show you the way to the respective vehicles. We also offer you the option of finding out the live location of moving vehicles that you wish to use, depending on your location.

We also use this information to better tailor our offers in the hvv switch app to demand. This is done without establishing any personal reference. We do not use the location data to create a movement profile of you.

In order to provide you with the easiest possible user experience with the hvv switch app, we recommend that you activate location tracking for the hvv switch app. To do this, you must allow the hvv switch app to access location services via the operating system of the mobile device you are using and its authorization system. In this context, we only record the location determined by your device when the hvv switch app is open. If location tracking is active, this is usually indicated by a corresponding function on your mobile device. You can enable or disable location tracking at any time in the settings of your mobile device's operating system. When you launch the hvv switch app for the first time, we will ask you once whether you want to enable automatic location tracking. 

Data processing for location tracking is based on Art. 6 (1) lit. f GDPR. If consent has been requested, processing is carried out exclusively on the basis of Art. 6 (1) lit. a GDPR and § 25(1) of the Telecommunications Digital Services Data Protection Act (TDDDG), insofar as the consent includes the storage of cookies or access to information on the user's end device (e.g., for device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time. 

B.4 Registration for hvv switch

When you register for the hvv switch app, you specify your login details (email address and password). We process this personal data as part of setting up your user account. Your user account is a prerequisite for you to be able to use mobility services in the hvv switch app (via corresponding activations).

Data processing for registration is based on Art. 6 (1) (b) GDPR (performance of a contract).

If you use the hvv switch identification function to access additional offers in the hvv, such as hvv Plus, the Hamburger Verkehrsverbund GmbH loyalty program, our data processing also includes what is necessary to enable these functions. This means that in such a case, we will pass on your data from your hvv switch account to Hamburger Verkehrsverbund GmbH or the transport company in the hvv that offers the service you require as the competent body responsible for data protection. Conversely, we receive data from this body to the extent necessary to enable you to access the service you require. You can find out which company this is in the separate data protection information for the individual offers. If an application that requests a login or registration uses tracking tools, we may set corresponding parameters. The operator of the requesting instance is responsible for the use of these tools.

It is important to note that although you have full access to the data generated by using the additional offers of transport companies with your hvv switch login, we as HOCHBAHN do not. If you decide to use a service that requires an hvv switch account, only the corresponding authorization or an ID that allows you to “transfer” to the connected system is stored in our database. HOCHBAHN has no access to the connected system and does not obtain any knowledge of the data processed there.

As part of providing the identification function, we also collect certain usage parameters, such as a history of logins. This enables us to assist users who are experiencing problems with their customer accounts in resolving the issue.

B.5 hvv ticket purchase

The processing of data in connection with the purchase of hvv tickets is carried out by HOCHBAHN and Hamburger Verkehrsverbund GmbH, Brooktorkai 18, 20457 Hamburg (hereinafter referred to as “hvv GmbH”), in deviation from point A. Responsible body and data protection officer.

The controllers listed in accordance with data protection law come into contact with your personal data to varying degrees. This results from the distribution of roles and tasks within the hvv:

As your contractual partner in connection with the use of the hvv switch app and the ticket purchase function, HOCHBAHN is responsible for administration, processing, and support (customer contractual partner). This also includes the implementation of information and advertising measures.
As the managing organization for local public transport in the hvv, hvv GmbH is responsible, among other things, for network-wide product marketing and the associated data processing.
With this in mind, the following processing may occur when purchasing hvv tickets:

B.5.1 Purchase of hvv tickets before departure

With an existing hvv switch user account, you can use the hvv switch app to purchase certain hvv tickets directly in the hvv switch app at the hvv community fare and download them for use. For this purpose, HOCHBAHN processes the following data:

Type of ticket,
Starting stop (if required by the fare),
Fare information,
First and last name of the main user of the hvv ticket,
Email address (corresponds to username),
Address (if required), Date of birth or age (if required),
Details of the selected payment method, and
Device information (including operating software, version, and build).
The above data is required to process the hvv ticket purchase. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract). We also process your personal data if and to the extent necessary to fulfill legal obligations (e.g., tax retention obligations) (Art. 6(1)(c) GDPR).

In addition, we transfer personal data to our payment service provider for the payment process (see B.7 Payment and billing for mobility services).

The hvv ticket is displayed and stored within the hvv switch app on the start screen and under “Trips.” Once it has expired, it automatically disappears from the start screen. If you use a device with the iOS (Apple) or Android (Google) operating system, you can also save the hvv ticket in the Apple or Google Wallet on your device. The following data is transferred to Apple or Google Wallet with the hvv ticket:

First and last name,
Starting stop (if necessary for the fare),
Start and end date and time of the ticket,
Fare product,
Product class (standard/reduced fare),
Fare zone,
Ticket ID,
Price,
Fare level
If you want to save the hvv ticket in Apple Wallet, you must manually move the hvv ticket from the hvv switch app to Wallet. This transfer of the hvv ticket to Apple Wallet takes place locally on your device, as do any necessary updates. hvv tickets saved in Apple Wallet must be deleted manually by you; the hvv switch app has no access to them.

If you want the hvv ticket to be displayed on additional iOS devices in your Apple Wallet, the ticket data will be sent to your device (e.g., Apple Watch) via iCloud. This function must be activated on your device beforehand.

When ticket data is stored in iCloud, encrypted data is transmitted to participating subcontractors in third countries, among others. However, according to the information provided by Apple for iCloud, the subcontractors used do not receive the key. For more information about Apple Wallet, visit https://support.apple.com/de-de/HT204003.

If you want to store your hvv ticket in Google Wallet, the necessary data will be transferred to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, once you confirm the storage. We also notify Google of any necessary updates (e.g., in the event of cancellation) so that the hvv ticket is displayed correctly or removed from Google Wallet.

In this case, Google acts as an independent responsible body for the storage and display of the hvv ticket in Google Wallet with regard to the data transferred to it. For more information about data processing by Google, please visit https://policies.google.com/privacy?hl=de. We have no influence on data processing by Google. Further information about Google Wallet can be found at https://wallet.google/intl/de_de/.

The legal basis for data processing is Art. 6 (1) (b) GDPR (performance of a contract). This data is required to create and deliver a valid hvv ticket.

B.5.2 Booking and using hvv Any

With our hvv Any service, we offer you the opportunity to use hvv transport without having to worry about selecting a suitable hvv ticket in advance. You check in to the hvv switch app before starting your journey and hvv Any automatically recognizes the route you have traveled. From the moment you use hvv Any, i.e., when you check in, we use your location data (e.g., your current location, starting stop, starting point, and destination) until you check out to record your use of hvv transport services. To do this, we need access to the following system services on your smartphone for the purpose stated below:

Location services (GPS)
Location services (GPS) are important for determining your locations (e.g., your current location, starting stop, starting point, and destination).

Internet connection
An internet connection is required to ensure smooth communication with our background system. This is where the trips are created and the prices are determined.

Bluetooth and Wi-Fi
Bluetooth and Wi-Fi on your smartphone also help to verify the trip results, especially when traveling through tunnels. To record your trips correctly, we send Bluetooth signals using our transmitters (known as beacons) in vehicles and at stops.

Motion sensors
Your smartphone's motion sensors help to distinguish between walking and cycling and the use of our transport services.

It is therefore necessary that you also activate and keep these services active throughout the entire period of use of hvv Any.

We use the aforementioned information collected as part of hvv Any to record your use of hvv transportation. This happens regardless of whether the hvv switch app is open – but only after you have checked in. If the required system services are active, this is usually indicated by corresponding symbols or functions on your mobile device. You can activate or deactivate these system services at any time via the settings in the operating system of your mobile device. Before using our hvv Any service, i.e., before each check-in, we will inform you that the listed system services and location tracking must be activated. By using hvv Any, you agree that the aforementioned systems may be used and that access to your personal data and movement data is permitted for the purpose of maintaining system operation and clarifying your customer request.

We use this data from you to correctly record your journeys with hvv transport services. We do not collect this data to create a movement profile.

The following data is processed during use:

  • Name
  • Address
  • Email
  • Birthday
  • Location data of the mobile device during active use of hvv Any (period between check-in and check-out)
  • Device information (including operating software, version, and build).
  • Data processing for location tracking and the use of the aforementioned system service data is based on Art. 6 (1) lit. b GDPR. If consent has been requested, processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Consent can be revoked at any time. 

If you use our hvv Any service via the hvv switch app, we assign the associated usage and purchase data to your user account. In this context, we also process your name and necessary location data, for example. We display the hvv Any services you have used (active and completed) in your user account.

The distance traveled is determined and the fare to be paid is then calculated with the help of the order processor Scheidt & Bachmann GmbH, Breite Straße 132, 41238 Mönchengladbach. For this purpose, we have integrated an SDK (Software Developer Kit) from the provider into the hvv switch app.

If disruptions or similar occur in connection with the use of our hvv Any service, we will use your contact details to inform you, e.g., via email, SMS, in-app or push message.

B.5.3 Optimisation of transport services in the hvv

Pseudonymised data is used and evaluated for the purpose of demand and/or supply analysis and the further optimisation of transport services in the hvv. Such evaluations can be carried out by hvv GmbH and HOCHBAHN individually or jointly. This processing is based on Art. 6(1)(f) GDPR (overriding legitimate interest). Without this data and its analysis, we cannot respond appropriately and quickly enough to developments in the transport market and adapt to changes in the interests of passengers. As the data is processed in pseudonymized form, there is no apparent overriding legitimate interest to the contrary.

B.5.4 Self-promotion for the hvv switch app and other transport services in the hvv

We base the use of your personal data for the purpose of exclusive self-promotion relating to the hvv switch app and other transport services in the hvv on Art. 6 (1) lit. f GDPR (overriding legitimate interest). In our view, such advertising information and customer service meet reasonable and customary expectations regarding the handling of customer data and customer service during an ongoing contractual relationship. Since we ask for your consent to process this data for this purpose, we do not see any overriding conflicting interests. If consent has been given, processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR. Consent can be revoked at any time. Advertising campaigns for the sole purpose of self-promotion can be carried out individually or jointly by hvv GmbH and HOCHBAHN.

B.6 Mobility services

To book and use mobility services, you enter into a separate contractual relationship with the respective mobility provider with our participation. We transmit the data required for the respective contract to the corresponding mobility provider, who processes it on their own responsibility for the purpose of executing the contract. If a driver's license validation is required, we engage our validation service provider.

B.6.1 Activation for mobility services

With the hvv switch app, we offer you the opportunity to use mobility services from various mobility providers. Depending on the respective mobility service, additional personal data and validation of your personal data may be required for this use.

For example, this may include the provision and validation of

  • your first and last name,
  • your date of birth,
  • your place of birth,
  • your mobile phone number,
  • your address,
  • your driver's license details, and
  • your payment details.

Without the relevant information and validations, it is not possible to use the corresponding mobility service.

For certain mobility services, it is also necessary to create a personal PIN. This PIN is then requested again for additional identification of the user before the start of each rental. This is the case, for example, when renting a car-sharing vehicle from SIXTshare.

When activating the respective mobility service, only the personal data required for the use of the respective mobility service is requested, validated if necessary, and stored in your user account. Any additional information in your user account is optional.

Once you have successfully activated a selected mobility service, certain personal data in your user account can no longer be deleted by you, as it is essential for the use of the selected mobility service. You can make changes to your personal data, subject to revalidation. If you wish to delete certain personal data that is essential for the use of a mobility service, you can do so via our customer service. It will then no longer be possible to use the corresponding mobility service.

Data processing for the activation of mobility services is carried out on the basis of Art. 6 (1) lit. b GDPR (contract processing) and Art. 6 (1) lit. c GDPR (legal obligation).

B.6.2 Validation of driver's license

To use a car sharing service, you must have a valid driver's license that allows you to drive a car. When you activate a car sharing service, we therefore offer you the option of having your identity and driver's license verified via the hvv switch app using an online procedure.

In the event that identification and verification are required as part of the driver's license validation process, we will transfer personal data to our service provider IDnow GmbH, Auenstraße 100, 80469 Munich, Germany, which completes the identification and verification process for us and acts as our processor.

IDnow uses automated methods for document verification (AutoIdent) as part of the process. These include basic checks such as document recognition and classification, extraction of the machine-readable zone (MRZ), age verification, and validity and consistency checks. In addition, advanced security checks are performed, e.g., to detect dynamic security features (such as holograms or optically variable ink) and country-specific data field checks.

Biometric procedures are also used to increase security and prevent fraud. The image of the user taken during the selfie process is automatically compared with the photo on the ID document. In addition, a so-called liveness check is performed, which uses biometric analysis to ensure that the person is actually present and alive.

The biometric data is processed exclusively for the purpose of identity verification. For quality assurance purposes, each identification process is finally checked by qualified IDnow personnel. All personal data is deleted 60 days after completion of processing and provision to us in our service provider's production system.

As part of the online validation process in the hvv switch app, photographs of ID documents and driver's licenses are taken. We store the photographs of your driver's license for the duration of the business relationship between you and us as proof of the driver's license check. However, this is not done as part of an active customer profile. Instead, the relevant data is excluded from ongoing use and blocked via a strict authorization concept.

Data processing for the purpose of validating the driver's license is carried out on the basis of Art. 6 (1) lit. b and c GDPR (contract processing and legal obligation).

B.6.3 Booking and use of mobility services

When you reserve or book a mobility service via the hvv switch app, we assign the associated reservation/booking data to your user account. In this context, we also process, for example, your name and the location data you provided in your request for a mobility service. We display the mobility services you have used (active and completed) in your user account.

Furthermore, we transmit the reservation/booking data required for the respective mobility service to the corresponding mobility provider, who processes this data on their own responsibility for the purpose of processing the mobility service. For certain bookings, we ask whether you use a wheelchair. If you answer yes, this information will be transmitted to the mobility service provider when you request the respective trip. We use this information so that we can provide you with a wheelchair-accessible vehicle and inform the driving personnel accordingly. In addition, in this case, it is not possible to use autonomous vehicles; your trip will be carried out with a vehicle manned by driving personnel. The processing of this information serves to fulfill the contract in accordance with Art. 6 (1) (b) (contract fulfillment) in conjunction with your consent within the meaning of Art. 9 (2) (a) GDPR. You can find out more about how we share data under C.1 Mobility service providers.

We also process personal data for the purpose of handling further claims (e.g., handling damages incurred) resulting from a booking and/or use. 

If disruptions or similar occur in connection with the provision of mobility services, we will use your contact details to inform you, e.g., by email, SMS, in-app or push message.

Data processing for the booking and use of mobility services is based on Art. 6 (1) (b) and (c) GDPR (contract processing and legal obligation).

B.7 Payment and billing for mobility services

In order to carry out the payment process and for the purpose of selling and assigning our claims against you, we transfer personal data to our payment service provider LOGPAY Financial Services GmbH (“LOGPAY”). Additional information can be found under C.2 Payment service providers.

In order to use a mobility service via the hvv switch app, you must register a valid payment method in your user account.

If you select credit card or SEPA direct debit as your payment method, the necessary payment information (e.g., credit card provider, holder, number, expiration date, and verification number or account holder and IBAN, as well as BIC, if applicable) will be stored by LOGPAY. LOGPAY processes the personal data as its own responsible body.

If you would like to use PayPal as your payment method, you must first link your PayPal account to your hvv switch user account. When linking your accounts, you have the option of transferring personal data already stored in your PayPal account (e.g., name and billing address) to your hvv switch user account and saving it there.

Your data is transferred to PayPal on the basis of Art. 6 (1) (a) GDPR and Art. 6 (1) (b) GDPR. Additional information can be found under C.2 Payment service providers.

You also have the option of paying for the mobility services in the hvv switch app using a mobility budget provided by your employer. For this purpose, we have integrated hvv-m DB Bonvoyo as a possible payment method. Additional information can be found under C.2 Payment service providers.

For each mobility service you use via the hvv switch app, we create an invoice and process your personal data in this context (e.g., your name, date, and location of use of the respective service). We send our own invoices and invoices issued on behalf of individual mobility providers exclusively by email.

B.8 Tracking and consent management solution

We use Google Tag Manager and Google Consent Mode. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that allows us to integrate tracking or statistics tools and other technologies into our app. Google Tag Manager itself does not create user profiles or perform any independent analyses. It is used solely for the management and display of the tools integrated via it. However, Google Tag Manager records your IP address, which may also be transferred to Google's parent company in the USA.

Google Consent Mode allows us to customize the behavior of Google tags and scripts based on your consent status. Tags are loaded into the app before the consent dialog appears, so that tag behavior is dynamically adjusted depending on the privacy settings you have selected. Analysis tools are only used for specifically defined purposes if you have given your consent. The user's consent status is transmitted by Google Consent Mode to Google for further processing. No personal data is sent to Google, only information about the consent decisions of individual users, e.g., permission to use certain marketing tools.

You actively decide whether you want to allow the use of Google Tag Manager, Google Consent Mode, and integrated tools. We ask for your consent once when you first start the hvv switch app. In addition, you have the option to adjust your consent in the privacy settings of the hvv switch app at any time. If consent has been requested, processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. You can adjust your consent in the privacy settings of the hvv switch app at any time (revocation of consent). Google is certified under the EU-U.S. Data Privacy Framework. For more information, see D. EU-U.S. Data Privacy Framework.

B.9 Optimization of the hvv switch app

B.9.1 Google Analytics for Firebase and Firebase Crashlytics

We have integrated an SDK (Software Developer Kit) from Google Firebase into the hvv switch app in order to better understand the use of our app and improve our offering. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Firebase provides various products, of which we use Analytics for Firebase and Crashlytics. The pseudonymized information about the use of our app collected via Google Firebase provides us with information about, for example, the number of app openings in a given period, app crashes, particularly popular features, the number of in-app purchases, and the total number of users in a given period. For more information about data processing by Google Firebase, please visit https://www.firebase.com/terms/privacy-policy.html.

Crashlytics processes data relating to the operation of the app, including the type of operating system used, information about malfunctions (type, time, and duration of the malfunction, and use of the app at the time of the malfunction), and device information. This data enables us to obtain an overview of various malfunctions when disruptions or problems occur in the operation of the hvv switch app and to weight them according to their relevance for use in order to ensure efficient troubleshooting and the stability of the app.

You actively decide whether you want to allow the use of Analytics for Firebase or Crashlytics to optimize our offering. We ask for your consent once when you first start the hvv switch app. If consent has been requested, processing will be carried out exclusively on the basis of Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's end device (e.g. device fingerprinting) within the meaning of the TDDDG. You can adjust your consent in the privacy settings of the hvv switch app at any time (revocation of consent). Google is certified under the EU-U.S. Data Privacy Framework. For more information, see D. EU-U.S. Data Privacy Framework.

B.9.2 Optimization of Mapbox and OpenStreetMap map services

We have integrated an SDK (Software Developer Kit) from the Mapbox map service into the hvv switch app to enable you to use the hvv switch app easily and reliably. The provider is Mapbox Inc., based at 740, 15th Street NW, Washington DC, 20005, USA. To use the Mapbox functions, it is necessary to store your IP address. In addition, device information and location data are also collected and temporarily stored. This information is usually transferred to a Mapbox server in the USA, where it may be processed. For more information about data processing by Mapbox, please visit https://www.mapbox.com/privacy/.

You actively decide whether you want to help improve OpenStreetMap and Mapbox maps by collecting anonymized usage data. Mapbox uses location data from all integrations to improve its maps, directions, and travel times and to provide aggregated insights. We ask for your consent once when you first start the hvv switch app. If consent has been requested, processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. You can adjust your consent at any time in the privacy settings of the hvv switch app. The company Mapbox is certified under the EU-U.S. Data Privacy Framework. Additional information can be found under D. EU-U.S. Data Privacy Framework.

B.10 Optimisation of marketing activities for the hvv switch app

B.10.1 Adjust and Outbrain

In order to optimise our marketing activities, we use the service provider Adjust (Adjust GmbH, Saarbrücker Straße 37A, 10405 Berlin) and have integrated its SDK (Software Developer Kit) into the hvv switch app. The purpose of data processing with Adjust is to analyze user behavior and the path by which the user arrived at the hvv switch app. The usage analyses are evaluated and used to optimize user communication. Data is collected during the measurement and processed in pseudonymized form. The data is determined by Adjust using various methods. These include the use of advertising IDs, device IDs, Adjust Reftags, and the so-called “hashed fingerprint” (use of publicly available device statistics). The data collected via Adjust provides information, for example, about the download of the hvv switch app, the online advertising channel through which the download was generated, and the time at which the hvv switch app was opened.

The analysis by Adjust helps us to continuously improve our communication and tailor it to your needs. For more information about data processing by Adjust, please see Adjust's Privacy Statement & Policy | Adjust.

We have integrated Outbrain (Outbrain Inc., 111 West 19th Street, New York, NY 10011, USA) via Adjust so that information on usage behavior is passed on to this online-based marketing platform. This enables us to provide useful and interesting content to our users who are interested in hvv switch products, while at the same time running marketing campaigns more efficiently.

For more information on data processing by Outbrain, please visit https://www.outbrain.com/privacy/

Outbrain is certified under the EU-U.S. Data Privacy Framework. For more information, please see D. EU-U.S. Data Privacy Framework.

You actively decide whether you want to allow the use of Adjust and Outbrain to optimize our marketing activities. To do this, we ask for your consent once when you first start the hvv switch app. If consent has been requested, processing will be carried out exclusively on the basis of Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. You can adjust your consent at any time in the privacy settings of the hvv switch app (revocation of consent).

B.10.2 CleverTap

In order to optimize our marketing activities with regard to communication with you, we use the service provider Wizrocket Inc. (607 W Dana St. Suite A Mountain View, CA 94041, USA) and have integrated its SDK (Software Developer Kit) CleverTap into the hvv switch app. The purpose of data processing with CleverTap is to analyze your behavior in the hvv switch app in order to optimize our communication with you and to provide you with information about our products and services tailored to your needs. In addition to your personal data (device ID, first name, last name, date of birth, email address, and place of residence), your behavior in the hvv switch app is also recorded in CleverTap (e.g., which products you inquire about and which services you book). For more information about data processing by CleverTap, please visit https://clevertap.com/privacy-policy.

You actively decide whether you want to allow the CleverTap application to optimize our marketing activities. We ask for your consent once when you first start the hvv switch app. If consent has been requested, processing will be carried out exclusively on the basis of Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. You can adjust your consent at any time in the privacy settings of the hvv switch app (revocation of consent). The company CleverTap is certified under the EU-U.S. Data Privacy Framework. Additional information can be found under D. EU-U.S. Data Privacy Framework.

B.11 Customer service inquiries

When you contact us, your inquiry or feedback, including all resulting personal data (name, inquiry/feedback), will be stored and processed by us for the purpose of handling your request. We will not pass on this data without your consent, unless it concerns matters relating to the contractual processing of the mobility service providers mentioned under C.1 or the payment service providers mentioned under C.2.  

In the event of service issues and for the purpose of error analysis, you have the option of providing us with additional information from your mobile device. A function linked in the version display of the hvv switch app can be used for this purpose. Our customer service will usually ask you to click on this link. When you click on the link, an event log file is generated that is specific to the day and limited to the period of use of the hvv switch app. This file will be forwarded to us after your confirmation. No direct personal reference can be made on the basis of the information available in the file.

This data is processed on the basis of Art. 6 (1) (b) GDPR, provided that your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective processing of requests addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR), if this has been requested; consent can be revoked at any time. 

The data you send us via contact request will remain with us until you request us to delete it, revoke your consent to its storage, or the purpose for data storage no longer applies (e.g., after your request has been processed). Mandatory legal provisions – in particular statutory retention periods – remain unaffected.

B.12 Use of vouchers

If you participate in an hvv switch voucher campaign, we will process your personal data to the extent necessary to send you the corresponding vouchers and to confirm your participation in the campaign. The use of vouchers is voluntary. The terms and conditions of the respective hvv switch voucher campaign will be made available to you during participation.

We use our service provider Voucherify PSA, Porcelanowa 23/A4, 40-246 Katowice, Poland (“Voucherify”) to provide this service. For the purpose of providing the vouchers, we process the following data:

Technical information required to redeem a voucher (such as redemption ID and status, hvv switch customer number, Voucherify-specific ID, date and time of entering the voucher code in the hvv switch app) 

Journey-related information required for redeeming a voucher (such as journey-specific or provider-specific ID) 

This data is processed on the basis of Art. 6 (1) (b) GDPR, as it is related to the performance of a contract or is necessary for the implementation of pre-contractual measures.

Further information on data processing by Voucherify can be found at https://www.voucherify.io/legal/

B.13 System security, prevention of criminal offenses

We process your personal data to ensure the security of our systems and to prevent and detect fraud and other criminal offenses. The legal basis for data processing is the protection of legitimate interests by HOCHBAHN, in particular the interest in preventing fraudulent activities (Art. 6 (1) (f) GDPR).

B.14 Hosting and messaging service providers

We use various service providers who process your personal data on our behalf. These have been carefully selected by us and process personal data exclusively in accordance with our instructions and under our control. In particular, these are the following service providers:

Hosting and operation:

Claranet GmbH, Hanauer Landstraße 196, 60314 Frankfurt am Main

Bechtle GmbH, Bernhard-Nocht-Straße 113, 20359 Hamburg

Sending emails and text messages:

Twilio Ireland Limited, 25-28 North Wall Quay, Dublin 1, Ireland

rapidmail GmbH, Wentzingerstraße 21, 79106 Freiburg im Breisgau  

The processing of personal data by our aforementioned service providers is based on our overriding legitimate interest in accordance with Art. 6 (1) lit. f GDPR. This lies in the secure, efficient, and economical provision of our services and communication with users. Processing is necessary to achieve these purposes and is carried out in strict compliance with data protection regulations.

C. Disclosure of personal data

C.1 Mobility providers

For the booking and use of mobility services, with the exception of hvv tickets, you enter into a separate contractual relationship with the respective mobility provider with our participation. You decide which mobility services you want to use and which contract you want to enter into in connection with this. We then transfer the data required for the respective contract exclusively to the corresponding mobility provider, who processes it for the purpose of executing the contract. You explicitly agree to the transfer of the necessary data during the process.

We currently work with the following mobility service providers:

Bike+Ride in Schleswig-Holstein, c/o Kienzler Stadtmobiliar GmbH, Vorlandstr. 5, 77756 Hausach

No personal data is passed on during the booking process. In the event of customer inquiries regarding contract processing, we pass on the validated email address for further clarification.

https://nahsh.bike-and-park.de/meta/datenschutzerklaerung

cambio Hamburg CarSharing GmbH, Humboldtstr. 131-137, 28203 Bremen

Data for activation or as a result of changes you have made, e.g., validated first and last name, validated date of birth, validated email address, validated mobile phone number, validated address, validated driver's license data; data on booking requests, e.g., location data; upon request, proof of driver's license check

https://www.cambio-carsharing.de/datenschutz/nutzer

Free2move Deutschland GmbH (SHARE NOW), c/o WeWork, Warschauer Platz 11-13, 10245 Berlin

Data for activation or as a result of changes made by you, e.g., validated first and last name, validated date of birth, validated email address, validated mobile phone number, validated address, validated driver's license data; data relating to booking requests, e.g., location data; upon request, proof of driver's license check

https://www.share-now.com/de/de/legal/#privacy-app

MILES Mobility GmbH, Leipnizstraße 49, 10629 Berlin

Data for activation or as a result of changes made by you, e.g., validated first and last name, validated date of birth, validated email address, validated mobile phone number, validated address, validated driver's license data; data on booking requests, e.g., location data; upon request, proof of driver's license check

https://miles-mobility.com/datenschutz

MOIA GmbH, Alexanderufer 5, 10117 Berlin and MOIA Operations Germany GmbH, Podbielskistraße 306, 30655 Hannover

Data for activation or as a result of changes made by you, e.g., first and last name, validated email address, validated mobile phone number; Data relating to booking requests, e.g., start and destination locations, data on mobility restrictions if applicable

https://www.moia.io/de-DE/datenschutz

Sixt GmbH & Co. Autovermietung KG, Zugspitzstraße 1, 82049 Pullach

Data relating to activation or changes made by you, e.g., validated first and last name, validated date of birth, validated email address, validated mobile phone number, validated address, validated driver's license data; Data relating to booking requests, e.g., location data; upon request, proof of driver's license check

https://www.sixt.de/shared/data-protection/DSGVO_DE_de.pdf

Voi Technology Germany GmbH, Oskar-Messter-Str. 15, 85737 Ismaning

Data for activation in the form of your hvv switch customer number; data relating to booking requests, e.g., location data; on request, first and last name, address, validated email address

https://www.voi.com/de/rechtliche-hinweise/datenschutzerklaerung/deutschland

C.2. Payment service providers

C.2.1 LOGPAY

In order to carry out the payment process and for the purpose of selling and assigning our claims against you, we transfer personal data to our payment service provider LOGPAY Financial Services GmbH, Schwalbacher Straße 72, 65760 Eschborn (“LOGPAY”). In addition, we also pass on personal data for the settlement of further claims (e.g., settlement of damages incurred) arising from the booking/use. Our payment service provider processes and stores your personal data for the purpose of processing payments, assessing the admissibility of payment methods, and avoiding payment defaults, as well as for receivables management.

Further information about data processing by LOGPAY can be found at https://www.logpay.de/DE/datenschutzinformationen/.

Please note that these notices also indicate that LOGPAY will transfer your data to credit agencies (such as SCHUFA) to verify your details and creditworthiness in order to avoid payment defaults if you are not yet known to LOGPAY. Furthermore, in order to protect you and your bank details, LOGPAY uses a bank identification procedure from the service provider Verimi GmbH to verify your IBAN. All you need is access to your online banking. 

C.2.2 PayPal

We have integrated a PayPal SDK (Software Developer Kit) into the hvv switch app to offer you a simple payment method with PayPal. The provider is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, Luxembourg. PayPal uses this SDK for risk management purposes to protect its services and customers from fraud and abuse. Using the SDK, PayPal collects and processes your IP address, device information, technical usage data, and location data. This occurs when you select PayPal as your payment method. We have no influence on further data transmission and processing. For more information about data processing by PayPal, please visit https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE.

C.2.3 Mobility budget hvv-m DB Bonvoyo

To give you the option of paying for mobility services in the hvv switch app using a mobility budget provided by your employer, we have integrated hvv-m DB Bonvoyo as a possible payment method. The provider of hvv-m DB Bonvoyo is Deutsche Bahn Connect GmbH (“DB Connect”), Mainzer Landstraße 169, 60327 Frankfurt am Main. If you use this function, the data required for its use will be transferred between DB Connect and us. We have no influence whatsoever on data processing within DB Connect.

Invoices and receipts for services used that can be billed via DB Bonvoyo can be submitted using the receipt scanner in the hvv switch app. To do this, take a photo of the receipt using your smartphone. All relevant information is automatically recognized and extracted. The information obtained, consisting of the travel date, the means of transport, and the cost amount, is displayed directly in the hvv switch app. Before submitting, you must confirm the information or, in the case of incorrect or incomplete information, correct it to confirm the proper use of the mobility budget. You also have the option of giving your trip a title for later reference. The budget granted by your employer will then be charged with the price of the trip.

In order to send your receipts to your employer via the hvv switch app to DB Bonvoyo, you may need to take a photo of a receipt. The hvv switch app will ask you for permission to use the camera as soon as you want to photograph a receipt.

You can find more information about data processing in the context of the mobility budget at https://www.bonvoyo.de/benefit/Datenschutzhinweise-Bonvoyo-App-13448270#.

C.3 Form for reporting illegal parking, littering, and damage at hvv switch points

If you use the reporting form to send us information about illegal parking at hvv switch points, your details, including your first and last name and your email address, will be recorded for the purpose of reporting and processing the illegal parking. Your personal data will not be stored by HOCHBAHN, but will be forwarded to our parking space monitoring service provider (PRS Parkraum Service GmbH, Kirchplatz 7, 58739 Wickede (Ruhr); hereinafter referred to as PRS) when you submit the form and will be processed there. Only the photo of the illegally parked vehicle will be stored by HOCHBAHN for a period of three months for the purpose of preserving evidence and will then be deleted (statute of limitations according to § 26 (3) of the Road Traffic Act (StVG)). Information on data protection and the handling of your personal data at PRS can be found in their privacy policy.

If you send us information about dirt or damage at hvv switch points, you have the option of providing your name and email address. This information is voluntary. This data is processed by HOCHBAHN. The data you provide will be used exclusively for the purpose of processing your report. If you have provided your name and email address, this information will be deleted immediately after the necessary measures to remove the dirt or repair the damage have been completed. If you decide to report anonymously, no personal data will be stored.

In principle, reports via the forms and the provision of your personal data are voluntary. We base the processing on Art. 6 (1) lit. f GDPR (overriding legitimate interest). We have a legitimate interest in eliminating breaches of contract (illegal parking) as well as pollution and damage at hvv switch points and in making the available car-sharing parking spaces available to our hvv switch customers in the best possible condition. Due to the voluntary nature of your report, we do not see any legitimate interest on your part that conflicts with or outweighs our legitimate interest.

We use ProcessWire, a content management system (CMS), to display the forms described here. By using ProcessWire, we process certain personal data in order to provide you with a user-friendly and personalized online experience. The personal data processed by ProcessWire is used for the purpose of providing and maintaining our website. This includes displaying content and improving website functionality. ProcessWire enables us to process data such as IP addresses, browser information, and, if provided, personal data such as your name and email address, which you have provided to us, for example, via the contact form provided. The processing of your data by ProcessWire is based on our legitimate interest in the efficient provision and maintenance of the functions of our website (Art. 6 (1) (f) GDPR) and, where applicable, on the basis of your consent, which you have given us, for example, for the use of cookies (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG).

D. EU-U.S. Data Privacy Framework

We also use service providers that are certified under the EU-U.S. Data Privacy Framework (EU-U.S. DPF). The EU-U.S. DPF is an agreement between the European Union and the United States that aims to ensure compliance with European data protection standards when data is processed in the United States. Every company certified under the EU-U.S. DPF undertakes to comply with these data protection standards. Further information on this can be found at the following link: https://www.dataprivacyframework.gov/. If a company is certified under the EU-U.S. DPF, data is transferred to the United States on the basis of an adequacy decision by the European Commission pursuant to Art. 45 GDPR dated July 10, 2023. Such an adequacy decision makes it possible to transfer personal data from the EU to the third country in question without the need for further transfer instruments or additional measures.

 E. Storage period

As your contractual partner, HOCHBAHN processes and stores your personal data only for as long as is necessary to fulfill its contractual and legal obligations. We distinguish between different categories of data. As a rule, we only store data from registered customers. This is done only at your request so that you do not have to re-enter your personal data when you use our services again. When you purchase subscription products (e.g., Deutschlandticket), a continuing obligation arises with regard to your business relationship with us, which means that we also need to permanently store and process certain basic data such as your name, address, and stored payment method (master data).

If data is no longer required for the immediate fulfillment of contractual or legal obligations, for example because it relates to transactions that have already been settled, it is deleted on a regular basis. This does not apply to data whose (temporary) continued storage is necessary for the following purposes:

Compliance with commercial or tax law retention periods: Examples include the German Commercial Code and the German Fiscal Code. The retention and documentation periods specified therein are up to 10 years.

Preservation of evidence within the framework of the statute of limitations: According to §§ 195 ff. of the German Civil Code (BGB), these limitation periods are generally 3 years, but can also be up to 30 years in individual cases.

Movement data for trip determination in connection with the use of hvv Any is stored for a maximum of four months from the time the movement data was determined. Data on trips and trip chains from the use of hvv Any is stored for a maximum of seven months from the time the trip was determined. The data is stored for the purpose of clarifying and tracing possible complaints.

 F. Data protection rights

The GDPR grants certain rights to data subjects whose personal data is processed by us, which we would like to explain to you here. If you have any questions about this or other aspects of data protection at hvv switch, please feel free to contact us as the controller or our data protection officer. You will find the contact details in section A.

F.1 Information, deletion, and correction

You have the right to request information about your personal data stored by us at any time and free of charge. This includes information about the purpose of the processing, the category of data used, its recipients, and the planned duration of data storage or, if this is not possible, the criteria for determining this duration. You also have the right to have the data deleted and/or corrected, in particular if the data is incomplete or incorrect, is no longer necessary for the purpose for which it was collected, or you have revoked your consent to its processing.

F.2 Revocation of consent

If data processing is carried out with your consent, you can revoke this consent at any time. An informal email notification is sufficient for this purpose. You can revoke your consent to the analysis of your usage behavior in the privacy settings under Settings in the hvv switch app. The legality of the data processing operations carried out until revocation remains unaffected by the revocation.

F.3 Right to object

If data processing is carried out on the basis of a legitimate interest on our part, you have the right to object to the data processing. This requires reasons arising from your particular situation (Art. 21 (1) GDPR).

F.4 Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. The right to restriction of processing applies in the following cases:

If you dispute the accuracy of your personal data stored by us, we usually need time to verify this.

For the duration of the verification, you have the right to request the restriction of the processing of your personal data.

If the processing of your personal data was or is unlawful, you can request the restriction of data processing instead of erasure.

If we no longer need your personal data, but you need it to exercise, defend, or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure.

If you have lodged an objection pursuant to Art. 21(1) GDPR, a balance must be struck between your interests and ours. As long as it is not yet clear whose interests prevail, you have the right to request the restriction of the processing of your personal data.

F.5 Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a structured, commonly used, and machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent that it is technically feasible.

F.6 Right to lodge a complaint with a supervisory authority

If you believe that we are in breach of data protection law, you have the right to lodge a complaint with a supervisory authority. The right to lodge a complaint exists without prejudice to other administrative or judicial remedies. In Hamburg, you can contact the competent supervisory authority at: The Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Straße 22, 20459 Hamburg, email: mailbox@datenschutz.hamburg.de.

Version: July 2025