1.1 Controller and data protection officer
Who is responsible for data collection and processing?
Usedomer Bäderbahn GmbH collects and processes your data as the controller. Should you have any questions or comments related to www.ubb-online.com, please contact:
Usedomer Bäderbahn GmbH
Am Bahnhof 1
The appointed data protection officer is Mr Fred Burchardt. Should you have any questions or comments regarding data protection on our website www.ubb-online.com, please contact:
Am Bahnhof 1,
1.2 Nature, scope, purpose and legal basis of data processing
What data do we collect, how and why do we process your data?
When visiting this website, certain device-related data is automatically collected and processed. This concerns the typical server log files involved when visiting a website.
As a rule, the following data is sent to us:
- IP address
• Date and time of your request
• Time zone difference compared to Greenwich Mean Time (GMT)
• Content of your request
• Access status/HTTP status code
- Data volume transmitted
• Website (from which the request originates)
• Operating system and its interface
• Language and version of the browser software
It is not technically possible to use this website without the processing of this data. The legal basis for processing is provided by Art. 6 (1) f GDPR.
If you contact us, we shall process the personal data you send to us in order to process the correspondence. The legal basis for processing is provided by Art. 6 (1) f GDPR.
When processing personal data required for the fulfilment of a contract with you, the legal basis is the contract according to Art. 6 (1) b GDPR. Art. 6 (1) b GDPR also applies to processing required for the performance of precontractual measures, such as in cases of requests about our products or services or for applications.
In detail, this concerns the following:
Travel bookings for the long-distance bus, day trips, multiple-day trips, charter trips and class trips, catalogue orders, prize draws, customer tickets, customer surveys, voucher orders, souvenirs and insurance
In the event that our company is subject to a legal obligation that necessitates the processing of personal data, such as to fulfil tax obligations, this processing shall be based on Art. 6 (1) c GDPR.
Purchase of tickets at machines or in the travel centre
In order to enable the purchase of tickets at machines or in the travel centre using a credit or debit card, we require your payment data such as account or credit card data, as well as contact and identification data to process the payment. The check digit is requested for every payment transaction in order to authorise the credit card payment. This number is not stored.
As a rule, other personal data is not required. Only employees identify themselves when purchasing a ticket at machines using their internal personnel number.
In order to process payments in connection with ticket or BahnCard bookings, payment data such as account or credit card data, as well as contact and identification data are collected. The check digit is requested for every payment transaction in order to authorise the credit card payment. This number is not stored.
Online or mobile ticket bookings
In order to verify online tickets and mobile tickets on the train, contact and identification data are collected during booking. During ticket inspection on the train, the information found on the ticket are displayed on the ticket inspection device (mobile terminal).
Contact and identification data (such as date of birth) are collected when purchasing a BahnCard.
Recovery of the ticket price
In the event of the recovery of ticket prices, we shall collect your name, your address and your date of birth for the purpose of processing the ticket price recovery in accordance with the respective carriage agreement. Further information is available here. The legal basis for this processing is Art. 6 (1) b GDPR.
Exercising passenger rights
If you assert passenger rights against us, we shall collect the data regarding the journey, possibly including your name and your address, for our internal accounting. In the event that you request a transfer, we shall collect your bank account information for the purpose of executing the payment to your account. The legal basis for this processing is Art. 6 (1) b GDPR.
Participation in prize draws
In connection with prize draws, data is collected for the purpose of their processing. The details in this regard – including which data is collected for which purpose – can be found on the page of the respective prize draw. The legal basis for this processing is Art. 6 (1) f GDPR.
1.3 Customer account
If you register for a customer account, the following mandatory information is collected:
– First name and surname
– Street and house number
– Post code and city
– Telephone number
– Email address
No personal account can be created without providing this data. All further disclosures are voluntary. Insofar as we obtain your consent for the processing of personal data, the legal basis is Art. 6 (1) a GDPR. By registering on our website, the IP address of the data subject assigned by the Internet service provider (ISP) as well as the date and time of registration are stored. This data is stored because the misuse of our services can only be prevented in this way.
Moreover, we store your booking data, your registration data and – if you subscribe to a newsletter as a registered customer – the data disclosed in this connection regarding your areas of interest in your customer account and we use this data for internal analysis and market research purposes in addition to the processing of the contractual relationship with you. We intend to use the insights obtained to constantly improve our offering. Furthermore, we would like to ideally adjust our offering to your preferences and needs. The pseudonymous storage and analysis of usage data from the online area also serves this objective. No connection is established with your personal data in this context. You may object to this pseudonymous use of data at any time. Please send your objection to email@example.com. You can also delete your customer account at any time.
If you subscribe to a newsletter of ours, the following mandatory data is collected:
– Email address
In this case, we may use your email address for promotional purposes.
When subscribing to a newsletter, we store the IP address assigned by the Internet service provider (ISP) for your computer system used at the time of subscription as well as the date and time of the subscription. The collection of this data is required in order to trace the (potential) misuse of the email address of a data subject at a later time and is therefore for our legal protection.
You can unsubscribe to the newsletter at any time via firstname.lastname@example.org or by clicking on the link to unsubscribe in your newsletter.
Insofar as you object to the promotional use of your data, your data will only be used in anonymised form for statistical analysis purposes.
1.5 Legal basis of data processing
The legal basis of data processing: in the event that our company is subject to a legal obligation that necessitates the processing of personal data, such as to fulfil tax obligations, this processing shall be based on Art. 6 (1) c GDPR.
In the event that vital interests of the data subject or another natural personal render the processing of personal data necessary, Art. 6 (1) d GDPR provides the legal basis. All further legal bases are named with the explanation of the processing purposes.
1.6 Data provision / data recipients and transmission to third countries
Is data shared?
In order to process the contract, it is typically necessary to involve order processors bound by instruction – such as data centre operators, printing or dispatch service providers or others involved in contractual fulfilment.
We carefully select external service providers that process data on behalf of us and commit these service providers to strict confidentiality obligations. The service providers work according to our instructions, which is ensured by strict contractual provisions, technical and organisational measures as well as supplementary controls. The involvement of service providers is necessary in connection with the administration and maintenance of IT systems, for example.
Your data shall only otherwise be transmitted if you have provided your express consent to such transmission or on the basis of a statutory regulation.
No data is transmitted to third countries outside the EU/EEA or to an international organisation, unless suitable guarantees are provided. These include the EU standard contract clauses as well as the adequacy ruling by the EU Commission.
The provision of data may be required in the following instances for the purpose of contractual processing when booking on www.ubb-online.com:
– Travel insurance of our partner Europäische Reiseversicherung AG
– Package travel services by our travel operator partners
– Credit checks
Insofar as you assert your passenger rights, these shall be processed at the centre for passenger rights www.fahrgastrechte.info.
When booking a BahnCard on bahn.de, you enter into a contract with DB Fernverkehr AG. For this purpose, we transmit the data disclosed to this company. More information in this regard can be found in the corresponding terms of business. We merely process the payment to this end and store the data provided for this purpose.
We generally engage our hotline in the travel centres for telephone customer support.
In the event of payment irregularities / payment default, receivables data may be forwarded to a debt collection company.
When using the contact forms on ubb.com for customer communication with UBB, the data entered is sent for customer communication.
1.7 Duration of storage / data erasure
We only store your data for as long as the data is required in order to fulfil the purpose for which it was collected (such as in connection with a contractual relationship) or this is statutorily prescribed. We therefore store your data in connection with a contractual relationship at least until the complete end of the contract. The data is then stored for the duration of the statutory retention periods.
1.8 Rights of data subjects
You can request information about which data of yours is stored.
You may request the rectification, erasure and restriction of processing (blocking) of your personal data, provided this is legally permissible and possible in connection with an existing contractual relationship.
You have the right to lodge a complaint with the supervisory authority. The supervisory authority responsible for UBB is: the State Commissioner for Data Protection and Information Freedom in Mecklenburg-Western Pomerania, Werderstr. 74a, 19055 Schwerin, email: email@example.com, website: www.datenschutz-mv.de. You have the right to the portability of the data you have provided us on the basis of consent or a contract (data portability).
If you have given us consent to data processing, you can revoke this consent at any time through the same channel you used to issue the consent. By revoking the consent, the lawfulness of the processing carried out on the basis of the consent until revocation is not affected.
You can object to data processing due to reasons relating to your special situation if data processing occurs based on our legitimate interests or is required for the performance of a public task.
You may object to promotional contact at any time with effect for the future (objection to advertising).
In order to exercise your rights, a letter sent by post to Usedomer Bäderbahn, Am Bahnbof 1, 17424 Heringsdorf or by email to firstname.lastname@example.org is sufficient.
1.9 Data collection
We have received your travel data from our partner agencies. You can obtain specific information about this at any time from UBB via email@example.com or at your travel agency.
We distinguish between cookies that are absolutely required for the technical functions of the website and cookies that are not absolutely required for the technical functions of the website.
The use of www.ubb-online.com is generally possible without cookies that do not serve technical purposes. You may therefore prevent traceability through cookies in your browser (do not track, tracking protection list) or disable the saving of third-party cookies. Moreover, we recommend that you regularly check the cookies saved if they are not expressly desired.
Please note: when deleting all cookies, any opt-out cookies will also be deleted, meaning you will need to exercise new objections.
1.11 Use of Google Analytics
This website uses the service “Google Analytics” offered by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA, 94043, USA) in order to analyse website use by users. The legal basis for this processing is Art. 6 (1) f GDPR.
The services uses “cookies” – or text files saved on your end device. The information collected by the cookies is generally sent to a Google server in the USA, where it is then stored. IP anonymisation is performed on this website. The IP address of users is shortened within the member states of the EU and the European Economic Area. This shortening removes the personal reference of your IP address. As part of the agreement on data processing which the website operators have concluded with Google Inc., Google Inc. uses the collected information to analyse website use and website activity as well as render other services related to Internet use.
You have the option to prevent the storage of cookies on your device by changing your browser settings accordingly. If your browser does not accept any cookies, it is not possible to guarantee that you will be able to use all functions of this website without limitations. Furthermore, you can use a browser plug-in to prevent the information collected by cookies (including your IP address) from being sent to Google Inc. and being used by Google Inc. This plug-in can be found via the following link: https://tools.google.com/dlpage/gaoptout?hl=de
Here you can find further information on how Google Inc. uses data: https://support.google.com/analytics/answer/6004245?hl=de
1.12 What happens with links to external websites?
If you click on a link to an external website, you will leave the website of www.ubb-online.com. Usedomer Bäderbahn GmbH is therefore not responsible for the content, services or products offered on the linked website and is also not responsible for data protection and technical security on the linked website.
As of May 2018