Data Privacy Statement on VVS Websites and VVS app

Verkehrs- und Tarifverbund Stuttgart GmbH
Rotebühlstr. 121
70178 Stuttgart

Email: kontakt@vvs.de
Telephone: 0711 6606-0

Should you have any suggestions or queries regarding data protection, please contact our Data Protection Officer.

By post
Verkehrs- und Tarifverbund Stuttgart GmbH
Datenschutzbeauftragter
Rotebühlstr. 121
70178 Stuttgart

or by email
datenschutz@vvs.de

On our websites and on the VVS app we offer you a variety of information and services. For this we process your data only when this is sanctioned by an appropriate statutory provision. We rely for the processing of your data on the following legal bases:

• Consent (Art. 6 par. 1 sentence 1 a), Art. 7 GDPR: We will process certain data only on the basis of your prior, explicit and voluntary consent. You have the right to withdraw your consent at any time, with future effect.
• Performance of a contract / precontractual measures (Art. 6 par. 1 sentence 1 b) GDPR): For the initiation or performance of your contract (e.g. booking a ticket) we need access to certain data.
• Fulfilment of a legal obligation (Art. 6 par. 1 sentence 1 c) GDPR).
• Protection of legitimate interests (Art. 6 par. 1 sentence 1 f) GDPR): VVS will process certain data for the protection of its interests or the interests of third parties. This applies only in individual cases where your interests do not prevail.

b) Data privacy friendly incorporation of the ‘Like’ button from Facebook into the website

For the protection of your data on the VVS websites, the ‘Like’ button from Facebook is incorporated using a two-stage solution: By clicking first on the ‘Share on Facebook?’ button, this button is activated and a connection is thereby established to the Facebook servers. Next, by means of a second click on the ‘Like’ button you can recommend the website to your friends.
With this two-stage solution, data exchange with the Facebook operators occurs only with your active consent, which is triggered by your first click on the button. In this way we are able to guarantee enhanced protection of your data.

a) Data processing in the app

In addition to our online offering we provide you with the VVS app as a mobile application which you can download onto your mobile terminal.
When downloading the app the relevant information will be transferred to the App Store, in particular the user name, email address and customer number of your account, the time of download, payment information and the individual device code. However, we have no influence on the collection of such data nor are we responsible therefor.
We process the data thus provided insofar as this is necessary for downloading the app onto your smartphone. They will not be further stored beyond this.
When you use the app, and thus not when you are logging onto the website, registering or otherwise transferring information to us, we collect the following further personal data to enable you to use the functions of the app:

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status/HTTP status code
• Data volume transmitted at any time
• Website sending the request
• Browser – operating system and interface
• Language and version of the browser software
• Your device code
• Unique number of the terminal (IMEI = International Mobile Equipment Identity)
• Name of your smart phone

Our offering comprises so-called location-based services, which help us to bring you special offers that are tailored to your location at any time. In order to allow us to offer these functions of the app, we collect your location data by means of GPS and your IP address in anonymised form, when you consent to this via the settings on your mobile terminal.
You may at any time allow or cancel this function in the settings of the app or of your operating system. Your location will only be transferred to us if, when using the app, you avail yourself of functions which we can only offer you if we know your location.

b) Web analysis in the app 

Data for marketing and optimisation purposes are collected on the app and stored with Google Analytics for Firebase, a web analysis service of Google Inc. (‘Google’). 

Google uses cookies. The information generated by the cookies about use of the app by the user is generally transmitted to and stored on a Google server in the USA. However, Google is certified under the Privacy Shield Agreement and by virtue hereof guarantees its compliance with European data protection law.

Google will use this information on our behalf, in order to evaluate the use of our app by the users, to compile reports on activities occurring within the app and to provide us with further services connected with the use of this app and with internet use in general. 

We use Google Analytics for Firebase, but only with activated IP anonymisation. This means that the IP address of the user is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area (EEA). Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there.

The IP address transmitted from the user’s device is not merged with other Google data. Users are able to deactivate Google Analytics for Firebase in VVS Mobil without the functionality of VVS Mobil being thereby restricted. For this you must click on the linked field ‘Authorisations’ in this Data Privacy Statement or on the field ‘Authorisations’ in the app settings and deactivate the corresponding field there in each case.

Further information on the use of data by Google for advertising purposes, on setting options and on the right to object can be found on the Google websites: www.google.com/intl/... (‘Data use by Google when you use our partners’ websites or apps’), www.google.com/policies/... (‘Data use for advertising purposes’), www.google.com/settings/ads (‘Managing information which Google uses to show you advertising’) and www.google.com/ads/... (‘Decide which advertising Google shows you’).

Data stored by us are deleted as soon as any consent is withdrawn, or when the data are no longer required for their intended purpose and no legitimate interests or statutory obligations to store them prevent their deletion.
If the data are not deleted because they are required for other, lawfully permitted purposes, their processing is restricted. This means that the data are blocked and will not be processed for other purposes. This applies, for example, to users’ data which must be stored for commercial or fiscal reasons.
According to current statutory requirements, storage occurs for 6 years according to § 257 par. 1 HGB (German Commercial Code) (e.g. commercial letters, accounting vouchers etc.) and for 10 years according to § 147 par. 1 AO  (German Revenue Code) (e.g. commercial and business letters, tax-related documents).

We offer specific functions both on the websites and on our app. If you use the Ticketshop of Stuttgarter Straßenbahnen AG (SSB) Schockenriedstraße 50, 70565 Stuttgart, which is accessible via the websites or the app, or book a ticket there, the corresponding Data Privacy Notices of the SSB also apply.

You have the following data subject rights:

a) Right to access

You have the right to request from us confirmation as to whether your personal data are being processed.

b) Right to rectification/erasure/restriction of processing

You also have the right to request from us that

• incorrect personal data concerning you are rectified without delay (Right to rectification);
• personal data concerning you are erased without delay (Right to erasure) and
• processing is restricted (Right to restriction of processing).

c) Right to data portability
You have the right to receive, in a structured, commonly used and machine-readable format, your personal data which you have provided to us, and to transmit such data to another responsible party.

d) Right to withdraw consent
You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the legitimacy of processing which has by virtue of your consent already occurred, up to the time of withdrawal thereof.

e) Right to object to processing
If the processing of your personal data is necessary for the performance of a task which is in the public interest (Art. 6 par. 1 e) GDPR) or for the protection of our legitimate interests (Art. 6 par. 1 f) GDPR), you have a right to object thereto.

f) Right to appeal
If you are of the opinion that the processing of personal data concerning you contravenes the GDPR, you have the right, without prejudice to any other legal remedies, to appeal to a regulatory authority.