Privacy policy – Important information about data protection

Our website integrates the Electronic Timetable service provided by HaCon Ingenieurgesellschaft mbH (Lister Straße 15, 30163 Hannover, Germany; hereinafter referred to as "HaCon").

The above-mentioned company is responsible for processing your data and for ensuring compliance with the applicable data protection legislation.

Processing

When using the Electronic Timetable and route planning functions, usage data and metadata/communication data are processed. In addition, this may include the following data:

• departure and destination locations;
• departure and arrival times;
• travel period;
• means of transport;
• bicycle carriage requirements;
• transfer time preferences.

By integrating this service into our website, usage data, metadata/communication data and the information provided by you are transmitted to HaCon. Any further processing of this data is carried out by HaCon.

Further information about the provider can be found at www.hacon.de.

Legal Basis

The integration of the Electronic Timetable is carried out for the performance of contractual or pre-contractual obligations pursuant to Article 6(1)(b) GDPR.

In addition, the Electronic Timetable is integrated in order to present the transport services offered by all transport operators affiliated with the GVH network on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR.

I. General Information

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft ("ÜSTRA", "we", "us" or "our") maintains publicly accessible profiles on various social media platforms. Visiting these profiles triggers a variety of data processing activities. Below, we provide an overview of how we collect, use and store your personal data when you visit our social media profiles. You are not obliged to provide us with your personal data. However, this may be necessary for certain functionalities available on our social media profiles. If you do not provide your personal data, these functionalities may not be available to you or may only be available to a limited extent.

a)    Name and Contact Details of the Controller and the Data Protection Officer
This Privacy Notice applies to data processing carried out by the following controller:

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Am Hohen Ufer 6
30159 Hannover
Email: info@uestra.de
Telephone: +49 511 1668-0

The Data Protection Officer can be contacted as follows:
ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Data Protection Officer 
Am Hohen Ufer 6
30159 Hannover
Email: datenschutz@uestra.de
Telephone: +49511-16680

aa)     Social Media Channels

When you visit our social media profiles, your personal data is collected, used and stored not only by us, but also by the operators of the respective social media platform. This applies even if you do not have an account with the respective social media platform.

The individual data processing activities and their scope vary depending on the operator of the respective social media channel.

For details of the collection and storage of your personal data, as well as the nature, scope and purpose of its use by the operator of the respective social media channel, please refer to the privacy notice of the relevant operator:

i.    The privacy notice for the social media platform Facebook, operated by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland, can be viewed at: https://www.facebook.com/about/privacy/update;
Further information regarding your rights as a data subject under the GDPR and the joint controller arrangement concluded with Meta can be found at:
de-de.facebook.com/legal/terms/page_controller_addendum.
ii.    The privacy notice for the social media platform Instagram, operated by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland, can be viewed at: privacycenter.instagram.com/policy;
iii.   The privacy notice for the social media platform YouTube, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, can be viewed at:
www.youtube.com/intl/en/howyoutubeworks/privacy/;
iv.    The privacy notice for the social media platform X, provided by X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland, parent company: X Corp., 865 FM 1209, Building 2, Bastrop, TX 78602, USA, can be found at: x.com/en/privacy, (Settings: https://x.com/personalization)
v.  The privacy notice for SoundCloud, provided by SoundCloud Global Limited & Co. KG, Rheinsberger Str. 76/77, 10115 Berlin, can be found at: soundcloud.com/pages/privacy. The privacy notice for Spotify, provided by Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden, SE556703748501, can be found at: www.spotify.com/de/legal/privacy-policy/
vi.  The privacy notice for Apple Podcasts, provided by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Republic of Ireland, can be found at: www.apple.com/de/legal/privacy/de-ww/
vii.    The privacy notice for Google Podcasts, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, can be found at: policies.google.com/privacy

bb)    Social Hub
To manage and process messages received through our social media channels, we use the Social Hub software. Social Hub enables us to process all incoming enquiries through a ticket-based system, allowing us to respond to your enquiry as quickly as possible.

II. Collection of Personal Data and Legal Bases for Processing

a)    Social Media Channels
 

When you visit one of ÜSTRA's social media pages within a social media network, we process your activities and interactions, which may include, for example, sending us a message, creating posts on our social media channel or commenting on posts. We also process data when you share posts with other users or indicate that you like a post.

In addition, we process your profile name and profile picture where these are publicly visible. We operate our social media channels and process the aforementioned data for the purpose of providing you with information about our services and communicating with our followers and other individuals interested in our services.

The legal basis for this processing is our legitimate interest pursuant to Article 6(1)(f) GDPR. Where data is processed in connection with contractual relationships, the legal basis is Article 6(1)(b) GDPR.

In addition, the respective operator of the social media channel or social network provides us with anonymous usage statistics relating to our social media pages (such as follower growth and the use of individual features), based on the activities and interactions of our followers (such as likes, shares and comments). These statistics help us, among other things, to understand the use and reach of our posts. The statistics also assist us in evaluating our content and identifying user preferences, enabling us to tailor our social media pages to the interests of our target audience.

However, we do not have access to the individual user data (such as the age, gender or professional situation of a visitor to a social media page) collected, for example, by Facebook for the purpose of generating these statistics, nor do we have access to other data collected by Facebook (in particular by means of cookies). Consequently, we are unable to view the personal data used to create these usage statistics.

This is the responsibility of the respective operator of the social media channel, which has contractually undertaken towards us to assume primary responsibility under the GDPR for the processing of such data, to fulfil all obligations under the GDPR in relation to such data and to make the essence of these obligations available to data subjects.

Further information regarding the joint controller arrangement concluded with Meta can be found at: de-de.facebook.com/legal/terms/page_controller_addendum.

General information on data processing by Meta can be found here for Facebook:: de-de.facebook.com/privacy/policy/

These processing activities serve our legitimate interest (and your legitimate interest) in improving the user experience when visiting our social media pages and tailoring it to the relevant target audience. The legal basis for this processing is therefore Article 6(1)(f) GDPR.

b)    Social Hub

The legal basis for the processing is Article 6(1)(b) GDPR where your enquiry is processed or answered in connection with a contractual relationship. Where no contractual relationship exists, the legal basis is Article 6(1)(f) GDPR.

The personal data processed by us is retained for a period of 365 days following the last interaction and is then deleted without undue delay, unless statutory provisions require a longer retention period.

We retain your personal data for this period in order to be able to refer back to previous correspondence with you, where necessary. The retention period therefore serves customer relationship purposes by enabling us to provide a timely response to your enquiries.

In relation to the services provided to us by Social Hub, we have entered into a data processing agreement with the provider.

Your personal data is not transferred to any other recipients.

c) YouTube Video Service
We use YouTube on certain pages of our website to integrate and display video content. Youtube is a video-sharing platform provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).
For users in Europe, the service is provided by:
Google LLC, Barrow Street, Dublin 4, Irland

aa)    Processing

When you access a page (or subpage) of our website containing embedded YouTube videos, a connection to the service provider's servers is established when the page is loaded, and the content is displayed via your browser. The server locations also include locations outside the European Union.

Where videos can only be accessed via a separate link, your browser will establish a connection only when that link is activated.

When a video is displayed, usage data and metadata/communication data are processed by the service provider. In this context, information about which of our web pages you have visited is transmitted to the service provider's server. If you have a user account with the service provider and are logged into that account, this information may be associated with your personal user account. The service provider may place a cookie on your device in which certain information required for the display and playback of videos is stored.

We embed YouTube content exclusively in "Enhanced Privacy Mode". This mode is provided by YouTube and ensures that YouTube does not initially store cookies on your device.

bb)    Legal Basis

Processing is carried out on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR in providing a faster, consistent and more attractive presentation of video content, as well as enabling simpler administration and the efficient operation of our online services.

In this regard, we pursue our legitimate interest in providing a faster, consistent and more attractive presentation of content, as well as enabling simpler administration and the efficient operation of our website.

Where a video is displayed only after a separate activation by the user, processing is carried out on the basis of your consent pursuant to Article 6(1)(a) GDPR, which you provided when first visiting this website. You may withdraw your consent at any time without affecting the lawfulness of processing carried out on the basis of your consent before its withdrawal.

We have no control over how Google data processes your data. Further information regarding Google's terms of use and privacy practices can be found at:

marketingplatform.google.com/intl/en_uk/about/analytics/

and

policies.google.com

cc)    Withdrawal of Consent 

You can also prevent YouTube videos from being displayed by visiting the following link:

adssettings.google.de/authenticated (for users with a Google account)

or

g.co/privacytools (for users without a Google account).

III. Data Subject Rights

You have the right:

pursuant to Article 15 GDPR, to obtain access to your personal data processed by us. In particular, you may request information about the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom your personal data has been or will be disclosed, the envisaged retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your personal data where it was not collected by us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the details involved;

pursuant to Article 16 GDPR, to obtain without undue delay the rectification of inaccurate personal data stored by us or the completion of your personal data; 

pursuant to Article 17 GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;

pursuant to Article 18 GDPR, to request restriction of processing of your personal data where you contest the accuracy of the data, the processing is unlawful but you oppose the erasure of the data, we no longer require the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to processing pursuant to Article 21 GDPR;

pursuant to Article 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller;

pursuant to Article 7(3) GDPR, to withdraw your consent at any time. As a result, we will no longer be permitted to continue processing based on that consent in the future; and

pursuant to Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your habitual place of residence, place of work or our registered office.

IV. Right to Object

Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right, pursuant to Article 21 GDPR, to object to the processing of your personal data on grounds relating to your particular situation.

Where the objection relates to processing for direct marketing purposes, you have a general right to object, which we will implement without requiring any specific grounds to be provided.

V. Updates to this Privacy Notice

This Privacy Notice is current as of April 2024.

As a result of the continued development of our website and the services offered through it, or due to changes in legal or regulatory requirements, it may become necessary to amend this Privacy Notice.

The latest version of this Privacy Notice can be accessed and printed at any time here.

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft ("ÜSTRA", "we", "us" or "our") appreciates your interest in our company.

We take the protection of your personal data and its confidential treatment very seriously. Your personal data is processed exclusively in accordance with the applicable data protection laws, in particular the General Data Protection Regulation ("GDPR") and any other applicable legal provisions.

This Privacy Notice provides information about how we process your personal data and informs you of your rights under the GDPR.

You may also inspect this Privacy Notice at our Service Centre, Karmarschstraße 30/32, 30159 Hannover.

1. Name and Contact Details of the Controller and the Data Protection Officer

This Privacy Notice applies to the processing of personal data by:
ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Am Hohen Ufer 6
30159 Hannover
Email: info@uestra.de
Telephone: +49 511-1668-0

The Data Protection Officer can be contacted as follows:
ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Data Protection Officer
Am Hohen Ufer 6
30159 Hannover
Email: datenschutz@uestra.de
Telephone: +49 511-1668-0

2. General Information

As part of the cooperation between the transport operators within the ÜSTRA transport network area, ÜSTRA operates the online shop on the ÜSTRA website and in the ÜSTRA app.

The online shop enables users to purchase ÜSTRA tickets for the ÜSTRA fare zone.

3. Purpose and Legal Basis of Processing

We process data that we receive exclusively within the context of our contractual and business relationship with you.

In particular, we process the following categories of data:

first and last name;
address;
date of birth;
Email address;
first and last name of the passenger, where different to the contracting party;
payment information;
ticket product data;
customer ID;
starting stop location data;
compan name; and
company address.

Your personal data is processed for the purpose of selling tickets to you (Article 6(1)(b) GDPR). Without this data, it is not possible to conclude or perform the contract.

In individual cases, we process your data in order to safeguard our legitimate interests or those of third parties (e.g. public authorities). This applies in particular to the investigation of criminal offences (legal basis: Article 6(1)(f) GDPR in conjunction with Section 24 BDSG) and the exchange of data within our corporate group for administrative purposes (legal basis: Article 6(1)(f) GDPR).

Where you have given your consent to the processing of personal data, such consent constitutes the legal basis for the processing specified therein (Article 6(1)(a) GDPR). You may withdraw your consent at any time. Any withdrawal of consent will apply only with effect for the future.

We also process your data for the purpose of carrying out data analyses relating to demand and/or service planning, and for the further optimisation of transport services within the ÜSTRA transport network. The legal basis for this processing is your consent pursuant to Article 6(1)(a) GDPR.

As part of this processing, your usage data is pseudonymised and used for data analyses relating to demand and/or service planning and the further optimisation of transport services within the ÜSTRA transport network. The objective is to enable us to respond appropriately and in a timely manner to developments in the transport market and, where necessary, adapt our services to the changing needs and interests of passengers.

We also process your data for advertising and marketing purposes. This takes place only on the basis of your express consent pursuant to Article 6(1)(a) GDPR and only to the extent specified in that consent. You may withdraw any consent given to us at any time with effect for the future. The lawfulness of processing carried out prior to the withdrawal of consent shall remain unaffected by such withdrawal.

4. Retention Period and Criteria for Determining the Retention Period

We process your data for the duration of our business relationship with you. Once the business relationship has ended, we delete your data unless statutory retention obligations apply (e.g. under the German Fiscal Code (AO), the German Commercial Code (HGB) or the German Civil Code (BGB)). Such retention periods may be up to ten years and, in the case of enforceable claims, up to thirty years.

Proofs of eligibility (e.g. for a Senior Network Pass or a Student Monthly Pass) are destroyed after verification or returned to you at the Service Centre.

5. Recipients of Data / Disclousure of Data 

Within ÜSTRA, access to your personal data is granted only to authorised persons who require such access in order to fulfil our contractual and legal obligations.

Processors engaged by us, particularly in the areas of IT services, credit checks, payment services, the issuance of digital travel authorisations (mobile tickets), logistics services and printing services, process your data strictly in accordance with our instructions.

In the event of payment defaults, we may also disclose your personal data to debt collection agencies and legal service providers. In doing so, we pursue our legitimate interest in the efficient enforcement of our claims. The legal basis for such disclosure is Article 6(1)(b) and (f) GDPR.

For the administration of tickets, we engage a technical service provider that supplies the systems used to manage our contractual relationships. We have entered into a data processing agreement with this service provider.

For the provision of digital travel authorisations (mobile tickets), we engage technical service providers. We have entered into data processing agreements with these service providers.

The following necessary cookies are used in the online shop:

Cookie Name / Retention Period / Purpose

• ASP.NET_SessionId // Session // Ensures that you remain connected to the same web server throughout your session.
• .ASPXAUTH // Session // Authentication cookie.
• cookieconsent_dismissed // 1 year // Set by the cookie banner to store your cookie preferences.
• LB-Persistence / Session // Ensures that you remain connected to the same web server throughout your session.
• Shop / Session / Used to temporarily store the shopping basket and user login details.

6. Providing Personal Data

ÜSTRA would like to point out that ou are neither legally nor contractually required to provide your personal data. 

Where personal data is required in order to enter into a contract, this will be clearly indicate dduring the ordering process by means of mandatory fields.

In all other cases, you are not required to provide personal data to ÜSTRA. If you choose not to provide such data, there will generally be no adverse consequences for you, except that the service you have requested may not be available or cannot be provided.

7. Data Subject Rights

You have the right:

pursuant to Article 15 GDPR, to obtain access to your personal data processed by us. In particular, you may request information about the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom your personal data has been or will be disclosed, the envisaged retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your personal data where it was not collected by us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the details involved;

pursuant to Article 16 GDPR, to obtain without undue delay the rectification of inaccurate personal data stored by us or the completion of incomplete personal data;

pursuant to Article 17 GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;

pursuant to Article 18 GDPR, to request restriction of processing of your personal data where you contest the accuracy of the data, the processing is unlawful but you oppose the erasure of the data, we no longer require the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to processing pursuant to Article 21 GDPR;

pursuant to Article 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller;

pursuant to Article 7(3) GDPR, to withdraw your consent at any time. As a result, we will no longer be permitted to continue processing based on that consent in the future; and

pursuant to Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your habitual place of residence, place of work or our registered office.

8. Right to Object

Where your personal data is processed on the basis of legitimate interest pursuant to Article 6(1)(f) GDPR, you have the right, pursuant to Article 21 GDPR, to object to the processing of your personal data where there are grounds relating to your particular situation or where the objection is directed against direct marketing activities.

Where personal data is processed for direct marketing purposes, you have the right to object at any time, without having to provide any reasons.

9. Updates to this Privacy Notice

This Privacy Notice is current as of November 2025.
As a result of the continued development of our services or changes in legal or regulatory requirements, it may become necessary to amend this Privacy Notice. The latest version can be accessed and printed at any time online.

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft ("ÜSTRA") appreciates your interest in our company.

We take the protection of your personal data and its confidential treatment very seriously. Your personal data is processed exclusively in accordance with the applicable data protection legislation, in particular the General Data Protection Regulation ("GDPR") and any other applicable legal provisions.

This Privacy Notice provides information about how we process your personal data and informs you of your rights under the GDPR.

This Privacy Notice is also available for viewing at our Service Centre, Karmarschstraße 30/32, 30159 Hannover.

1. Name and Contact Details of the Controller and the Data Protection Officer

This Privac Notice applies to the processing of personal data by:

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Am Hohen Ufer 6
30159 Hannover
Email: info@uestra.de
Telephone: +49 511-16680

The Data Protection Officer can be contacted as follows: 

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Data Protection Officer
Am Hohen Ufer 6
30159 Hannover
Email: datenschutz@uestra.de
Telephone: +49 511-16680

2. General Information

ÜSTRA operates a centralised authentication system (Single Sign-On, or SSO) on behalf of the transport operators within the ÜSTRA transport network.

The use of an Identity Provider (IdP) is required for authentication purposes. The Identity Provider verifies the user's identity and enables secure access to various ÜSTRA services.

3. Purpose and Legal Basis of Processing

We process data obtained through our contractual and business relationships with you.

In order to provide the SSO login, we process the following categories of data:

• first and last name;
• username;
• email address;
• password or other authentication factors;
• address;
• date of birth;
• customer, registration and subscription ID (where applicable)
• telephone number; and
• technical log data (where applicable)

The data is processed for the purpose of carrying out the login and authentication process, managing your user account and providing a consistent, secure and user-friendly authentication method across our digital services.

The SSO login enables users to authenticate themselves for additional ÜSTRA services without having to enter their login credentials separately for each service. Personal data is transferred to the respective services. Following such transfer, the processing of personal data falls within the responsibility of the respective service and is governed by its applicable privacy notice.

Processing is carried out on the basis of Article 6(1)(b) GDPR for the provision and use of the services. For the purpose of carrying out the authentication process, personal data is transferred to the Identity Provider. We have a data processing agreement in place with this service provider.

Deleting your SSO account will result in the loss of access to the connected services and the data stored within those services.

4. Retention Period 

We process your data for the duration of our business relationship with you. Once the business relationship has ended, we delete your data unless statutory retention obligations apply (e.g. under the German Fiscal Code (AO), the German Commercial Code (HGB) or the German Civil Code (BGB)). Such retention periods may be up to ten years and, in the case of enforceable claims, up to thirty years.

5. Recipients of Data / Disclosure of Data

Within ÜSTRA, access to your personal data is granted only to authorised persons who require such access in order to fulfil our contractual and legal obligations.

Where data is disclosed, we do so on the basis of our legitimate interests. The legal basis for such disclosure is Article 6(1)(f) GDPR.

Connected services require this data for the performance of the contract (e.g. the personalisation of travel authorisations). The legal basis for such disclosure is Article 6(1)(b) GDPR.

The following necessary cookies are used within the SSO:

6. Providing Personal Data

ÜSTRA would like to point out that you are not legally or contractually required to provide your personal data.

Where personal data is required in order to enter into a contract, this will be clearly indicated during the ordering process by means of mandatory fields.

In all other cases, you are not required to provide personal data to ÜSTRA. If you choose not to provide such data, there will generally be no adverse consequences for you, except that the service requested by you may not be available or cannot be provided.

7. Data Subject Rights

You have the right: 

pursuant to Article 15 GDPR, to obtain access to your personal data processed by us. In particular, you may request information about the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom your personal data has been or will be disclosed, the envisaged retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your personal data where it was not collected by us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the details involved;

pursuant to Article 16 GDPR, to obtain without undue delay the rectification of inaccurate personal data stored by us or the completion of incomplete personal data;

pursuant to Article 17 GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;

pursuant to Article 18 GDPR, to request restriction of processing of your personal data where you contest the accuracy of the data, the processing is unlawful but you oppose the erasure of the data, we no longer require the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to processing pursuant to Article 21 GDPR;

pursuant to Article 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller;

pursuant to Article 7(3) GDPR, to withdraw your consent at any time. As a result, we will no longer be permitted to continue processing based on that consent in the future; and

pursuant to Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your habitual place of residence, place of work or our registered office.

8. Right to Object 

Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right, pursuant to Article 21 GDPR, to object to the processing of your personal data where there are grounds relating to your particular situation or where the objection relates to direct marketing.

If personal data is processed for direct marketing purposes, you have the right to object at any time without providing any reasons.

9. Update to this Privacy Notice

This Privacy Notice is current as of March 2026.

As a result of the continued development of our services or changes in legal or regulatory requirements, it may become necessary to amend this Privacy Notice.

The latest version can be accessed and printed online at any time.

As online communication continues to play an increasingly important role, ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft ("ÜSTRA") provides Microsoft Teams to facilitate collaboration and communication.

Microsoft Teams is integrated into Microsoft 365, combines a range of functions within a single platform and is a service provided by Microsoft Corporation, whose registered office is located in the United States.

Microsoft Teams provides a chat environment similar to instant messaging services. It also enables multiple users to work simultaneously on files and documents. Use of Microsoft Teams generally requires users to be registered within the same domain and therefore belong to the same organisation. External users may also be invited to participate in Microsoft Teams sessions. Files and documents can also be shared with external users by means of sharing links.

Microsoft Teams offers, in particular, the following features:

• video and telephone conferences for individuals and groups;
• online meetings and training sessions;
• individual and group chats;
• calendar and task management functions;
• meeting notes; and
• file sharing.

The following information explains how personal data is processed when using Microsoft Teams.

Personal data means any information relating to an identified or identifiable individual. This includes, for example, your name or email address.

Personal Data Processed When Using Microsoft Teams

The following categories of personal data may be processed:

a.    Registration

The following personal data is collected during registration:

first and last name;
business email address
 

Registration for the use of Microsoft Teams is carried out by the responsible administrators within the IT department.

b.    Using Microsoft Teams 

When using Microsoft Teams, additional personal data is or may be collected, including:

your profile picture and business telephone number;

your department and name abbreviation;

audio and video data;

content in text form, such as chat messages, shared files and other information stored in your account;

file information (e.g. file name, modification date, document title and author);

the duration of calls (excluding the content of the communication);

call quality data;

diagnostic data (used to improve the security of the software and/or to identify and resolve errors; see section (c)); and

for external users, full name, email address and/or telephone number.

IP Address

Additional personal data or information may be added or amended by you. The provision of such information is voluntary and cannot be required by ÜSTRA.

Examples include:

• profile picture;
• status indicator;
• status messages;
• language settings;
• theme settings; and
• read receipts.

You may also mute your microphone, share your screen, switch off your camera, or share your video feed and background image.

The use of Microsoft Teams for business purposes on your personal device is also voluntary.

c. Diagnostic and Metadata
 

In addition, all user activities are processed, including, for example, the time and date of access, the type of access, details of the data, files or documents accessed, and all activities associated with use of the service. This includes creating, modifying or deleting documents, creating teams and channels in Microsoft Teams, making notes in notebooks, starting chats and responding to chat messages.

We expressly point out that video and telephone conferences conducted via Microsoft Teams are not recorded. The recording function has been disabled by us at system level.

Further information can be found in Microsoft's documentation:

docs.microsoft.com/de-de/microsoftteams/teams-privacy

d.    Cookies

When Microsoft Teams is accessed through a web browser, cookies may also be collected. Microsoft, as the website operator and software provider, is solely responsible for the collection and processing of these cookies.

By using Microsoft Teams, you accept the Microsoft Corporation terms of use and privacy terms. Microsoft's Privacy Statement, together with further information about the collection and use of cookies and the options available to users for managing them, such as enabling and disabling advertising cookies, can be found at:

privacy.microsoft.com/en-gb/privacystatement

Purpose of Processing

Microsoft Teams is primarily used for communication and collaboration. It can also be used to share screen content with other participants.

When an online event is organised through Microsoft Teams, a link to the relevant meeting is generated and shared with internal or external participants. To send the meeting invitation, the participant's email address or username is transmitted to Microsoft Teams.

Invitation emails generated by Microsoft Teams include either a telephone number or a meeting link (including the meeting ID and password), enabling participants to join the meeting.

Your personal data is processed in order to provide you with these communication and collaboration features.

Legal Basis for the Processing of Your Personal Data

a. The legal basis for processing is Article 6(1)(f) GDPR.

ÜSTRA's legitimate interest under Article 6(1)(f) GDPR lies in the use of device-independent Office documents to facilitate effective collaboration within the company and across teams. ÜSTRA also has a legitimate interest in ensuring efficient internal and external communication. In addition, the use of Microsoft Teams supports flexible remote working arrangements by enabling fast, straightforward and digital communication.

b. For external users, the legal basis for processing is consent pursuant to Article 6(1)(a) GDPR. Such consent is deemed to be given when an external user participates in a Microsoft Teams session.

Recipients of the Data 

As the provider of Microsoft Teams, Microsoft will necessarily receive the data referred to above (see Section 2(c)) to the extent required under our data processing agreement with Microsoft.

Your data may also be processed by IT service providers acting on our behalf. We engage external service providers for services such as system maintenance and support, data hosting and helpdesk services. These providers act solely on our instructions and are subject to strict contractual obligations, technical and organisational safeguards, and regular monitoring. They have been carefully selected and are regularly reviewed, particularly with regard to the secure handling and protection of the data entrusted to them. All service providers are required to maintain confidentiality and comply with applicable data protection legislation.

Your data may also be disclosed to other Microsoft Teams users with whom you exchange messages, participate in video or telephone conferences, or share files.

Processing of Data within the European Union

Microsoft Teams is a service provided by Microsoft, a company headquartered in the United States. Personal data is processed on servers located within the European Union and therefore within the scope of the GDPR.

We have entered into a data processing agreement with Microsoft that complies with the requirements of Article 28 GDPR. An adequate level of data protection is ensured through the use of the European Commission's Standard Contractual Clauses.

Storage Location and Retention Period

Your personal data is stored on servers located in German data centres certified by the German Federal Office for Information Security (BSI) in accordance with the C5 Cloud Computing Compliance Criteria Catalogue.

As a general rule, we delete your personal data as soon as it is no longer required for the purposes described above.

Where statutory retention obligations apply, for example under commercial or tax laws, the data will be retained for up to six or ten years, as applicable.

Please note that you and/or an administrator may be able to determine or carry out the deletion of certain data yourself, for example by deleting your profile picture.

Further information is available at:

support.microsoft.com/de-de/office/löschen-eines-teams-c386f91b-f7e6-400b-aac7-8025f74f8b41

If you leave the company, your status will be changed to "inactive". Your data can then be reactivated within 30 days. After that period, your account will be deleted.

Your Data Protection Rights

You have the following rights in relation to your personal data:

pursuant to Article 15 GDPR, the right of access to your personal data;

pursuant to Article 16 GDPR, the right to request the completion of incomplete personal data and the rectification of inaccurate personal data;

pursuant to Article 17 GDPR, the right to request the erasure of your personal data without undue delay, provided that erasure is not precluded by legal requirements;

pursuant to Article 18 GDPR, the right to request restriction of the processing of your personal data;

pursuant to Article 20 GDPR, the right to receive the personal data you have provided to us and to request that such data be transferred to another controller;

pursuant to Article 21 GDPR, the right to object at any time to the further processing of your personal data.

You also have the right to lodge a complaint with the competent data protection supervisory authority if you believe that the processing of your personal data is unlawful.

Profiling

We do not carry out profiling or personalised analyses based on the use of Microsoft Teams.

Information über Ihr Widerspruchsrecht nach Artikel 21 DSGVO

a. Right to Object on Grounds Relating to Your Particular Situation

You have the right to object, at any time, on grounds relating to your particular situation, to the processing of personal data concerning you where such processing is carried out on the basis of Article 6(1)(e) GDPR (processing in the public interest) or Article 6(1)(f) GDPR (processing based on legitimate interests). This right also applies to profiling based on those provisions.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.

b. How to Exercise Your Right to Object

You may exercise your right to object in any form. Please state "Objection" in the subject line and include your name, address and date of birth. Objections should be sent to:

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
External Data Protection Officer
Am Hohen Ufer 6
30159 Hannover

Email: datenschutz@uestra.de
Telephone: +49 511 1668-0

Updates to this Privacy Notice

This Privacy Notice is current as of 18 August 2020.

We reserve the right to amend this Privacy Notice from time to time. Such amendments may be necessary, for example, as a result of technical developments. We therefore recommend that you review this Privacy Notice periodically and refer to the latest version.

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft ("ÜSTRA") is planning the construction of the new Glocksee depot (parallel to Wilhelmshavener Straße).

In this context, ÜSTRA will provide information to neighbouring residents and property owners about the construction project and the opportunities available to participate in the planning process. ÜSTRA wishes to engage in dialogue with those affected by the project.

To facilitate this, information events will be organised. Residents in the immediate vicinity of the project will be informed about the construction project, the information events and the possibility of registering for those events by means of an information leaflet delivered to their address. As the project progresses, further updates on the construction works will also be provided by leaflet distribution.

This Privacy Notice provides an overview of how your personal data is processed and of your rights under data protection legislation, in accordance with Articles 12 to 14 GDPR.

1.    Name and Contact Details of the Controller and the Data Protection Officer

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Am Hohen Ufer 6
30159 Hannover
Email: info@uestra.de
Telephone: +49 511 1668 0

Contact details of the Data Protection Officer:

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
External Data Protection Officer
Am Hohen Ufer 6
30159 Hannover
Email: datenschutz@uestra.de
Telephone: +49 511 1668 0

2.    Data Subject Rights

Where your personal data is processed, you have the right to obtain access to the personal data stored about you (Article 15 GDPR).

If inaccurate personal data relating to you is processed, you have the right to request rectification (Article 16 GDPR).

Where the statutory requirements are met, you may request the erasure of your personal data, the restriction of processing, or object to the processing of your personal data (Articles 17, 18 and 21 GDPR).

You also have the right to lodge a complaint with the State Commissioner for Data Protection of Lower Saxony.

Where you have consented to the processing of your personal data, you may withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal.

If you wish to exercise your right to withdraw consent or your right to object, please contact us by email at NeubauBhfGlocksee@uestra.de or by post at:

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Neubau Bhf. Glocksee
Am Hohen Ufer 6
30159 Hannover

3. Disclosure of Data

We disclose your personal data to third parties (recipients) only where we are permitted to do so under applicable data protection legislation.

Recipients of your personal data may include service providers engaged by us. These service providers act solely on our instructions and are subject to strict contractual obligations, technical and organisational safeguards, and additional monitoring measures to ensure the protection of your personal data.

4. Personal Data 

Personal data means any information relating to an identified or identifiable natural person (the "data subject"). Examples include a person's name, postal address, email address or customer number.

Further information about the specific categories of personal data processed by us can be found in the individual processing activities described below.

I. Information for Property Owners

(1)   Categories of Data Subjects

Owners of residential properties near the Glocksee depot that are not occupied by the owner.

(2)    Categories of Personal Data

Name
Address
Property information
Telephone number (where applicable)
Email address (where applicable)

(3)  Legal Basis for Processing

Processing is based on ÜSTRA's legitimate interests pursuant to Article 6(1)(f) GDPR.

ÜSTRA's legitimate interest lies in informing property owners at an early stage about long-term construction projects and in ensuring that both parties are able to exercise any rights and claims arising in connection with the construction project in accordance with applicable legal requirements.

(4)  Source of the Data

If you are the owner of a property near the Glocksee depot and have received a personalised letter from us, we obtained your contact details from the Surveying and Cadastral Administration of Lower Saxony ("Cadastre Office") and the land parcel and ownership records maintained by that authority.

These records are subject to the principle of public access.

Your data was obtained in accordance with the applicable regulations governing access to cadastral records and upon demonstration of a legitimate interest. That legitimate interest consisted of informing residents and property owners about the construction project at an early stage.

(5)  Retention Period

As a general rule, we delete your personal data as soon as it is no longer required for the purposes described above.

Your data will be used for ongoing communication throughout the construction project, particularly in relation to construction progress and any resulting restrictions. The construction phase is currently planned to run from approximately 2023 until approximately 2028.

In addition, your data may be retained for as long as claims can be asserted against us. Statutory limitation periods may be up to thirty years.

We will also retain your personal data where we are legally required to do so or where it is required for a legitimate purpose, such as the establishment, exercise or defence of legal claims. In such cases, the data will only be processed for that specific purpose.

II. Online Information Events for Property Owners and Residents

Residents and property owners may register for the events voluntarily by email. They will then receive a link together with information about the event and instructions on how to use the relevant software.

The event will not be recorded.

Participation is via a guest link and does not require separate registration. Participants are not required to use their real name or display an image.

(1) Categories of Personal Data

• Email address
• Pseudonym (where applicable)
• Name (where applicable)

(2) Categories of Data Subjects

• Residents near the Glocksee depot
• Owners of properties near the Glocksee depot
• Owners of residential properties near the Glocksee depot that are not occupied by the owner

(3) Legal Basis for Processing

Processing is based on your consent pursuant to Articles 6(1)(a) and 7 GDPR.

Consent is provided either verbally, in writing or in text form.

(4) Retention Period

As a general rule, we delete your personal data as soon as it is no longer required for the purposes described above.

The data collected for the online information event is used solely for that event. Registration takes place by email. The events are scheduled for 23 and 25 March 2021.

Following the events, the data will no longer be required unless further correspondence is received via the functional mailbox.

(5) Requirement to Provide Personal Data

To participate in the online event, you must provide the personal data necessary for participation.

At a minimum, this includes a name or pseudonym and an email address.

Without this information, participation may be restricted or may not be possible.

III. Microsoft 365 Applications

You have been invited to participate in an online information event using Microsoft Teams.

Participation is via a generic guest link and does not require you to create a user account.

When you use Microsoft Teams, Microsoft processes certain personal data relating to you. Further information about Microsoft's data processing practices can be found in the Microsoft Trust Center and Microsoft's Privacy Statement.

ÜSTRA does not process your personal data in connection with your use of Microsoft Teams.

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft ("ÜSTRA", "we", "us" or "our") appreciates your interest in our company.

We take the protection of your personal data and its confidential treatment very seriously. Your personal data is processed exclusively in accordance with applicable data protection legislation, in particular the General Data Protection Regulation ("GDPR") and other applicable legal requirements.

This Privacy Notice explains how we process your personal data and informs you of your rights under the GDPR.

You may also view this Privacy Notice at our Customer Centre, Karmarschstraße 30/32, 30159 Hannover.
 

1. Name and Contact Details of the Controller and the Data Protection Officer

This Privacy Notice applies to the processing of personal data by:
 

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Am Hohen Ufer 6
30159 Hannover
Email: info@uestra.de
Telephone: +49511-16680

The Data Protection Officer can be contacted as follows:
ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Data Protection Officer
Am Hohen Ufer 6
30159 Hannover
Email: datenschutz@uestra.de
Telephone: +49511-16680

2. Purpose and Legal Basis of Processing

We operate video surveillance systems in our buses, trams, stations, stops and premises (publicly accessible areas).

The systems capture images and video footage that may be used to identify individuals. The personal data processed also includes movement and time-related data within vehicles and premises (entry, exit and presence).

Video surveillance is used to prevent, investigate and prosecute vandalism, criminal offences and other disruptive behaviour, to protect the life, health and safety of passengers, to preserve evidence for the establishment, exercise or defence of legal claims, to ensure the security of passengers and employees, and to enforce our property rights.

The legal basis for the video recordings is Section 4(1)(2) and (3), and Section 4(3) of the German Federal Data Protection Act (BDSG), together with Article 6(1)(f) GDPR.

3. Retention Period and Criteria for Determining the Retention Period

Video recordings are overwritten no later than 48 hours after being recorded (after 24 hours in vehicles and after 48 hours in underground stations, stops and other premises).

Recordings will be retained for a longer period only where, and for as long as, this is necessary to investigate a specific incident and/or to preserve evidence for the establishment, exercise or defence of legal claims.

4. Recipients and Categories of Recipients of the Data

Where necessary in connection with a criminal investigation, data may be disclosed to law enforcement authorities (including the police and public prosecutor's office) and to the courts.

Your personal data will not be transferred to any third country.

5. Providing Personal Data 

The video recordings are necessary to achieve the purposes described above.

Without these recordings, we may be unable to provide transport services to you. In certain circumstances, we may also be unable to perform, or may be required to terminate, an existing subscription agreement.

6. Data Subject Rights

You have the right:

pursuant to Article 15 GDPR, to obtain access to your personal data processed by us. In particular, you may request information about the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom your personal data has been or will be disclosed, the envisaged retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your personal data where it was not collected by us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the details involved;

pursuant to Article 16 GDPR, to obtain without undue delay the rectification of inaccurate personal data stored by us or the completion of incomplete personal data;

pursuant to Article 17 GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;

pursuant to Article 18 GDPR, to request restriction of processing of your personal data where you contest the accuracy of the data, the processing is unlawful but you oppose the erasure of the data, we no longer require the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to processing pursuant to Article 21 GDPR;

pursuant to Article 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller;

pursuant to Article 7(3) GDPR, to withdraw your consent at any time. As a result, we will no longer be permitted to continue processing based on that consent in the future; and

pursuant to Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your habitual place of residence, place of work or our registered office.

8. Right to Object

Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right, pursuant to Article 21 GDPR, to object to the processing of your personal data where there are grounds relating to your particular situation or where the objection relates to direct marketing.

Where personal data is processed for direct marketing purposes, you have the right to object at any time without providing any reasons.

9. Updates to this Privacy Notice

This Privacy Notice is current as of April 2024.

As a result of the continued development of our website and the services offered through it, or changes in legal or regulatory requirements, it may become necessary to amend this Privacy Notice.

The latest version of this Privacy Notice can be accessed and printed at any time on this website.
 

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft ("ÜSTRA", "we", "us" or "our") appreciates your interest in our company.

We take the protection of your personal data and its confidential treatment very seriously. Your personal data is processed exclusively in accordance with applicable data protection legislation, in particular the General Data Protection Regulation ("GDPR") and other applicable legal requirements.

This Privacy Notice explains how we process your personal data and informs you of your rights under the GDPR.

You may also view this Privacy Notice at our Customer Service Centre, Karmarschstraße 30/32, 30159 Hannover.
 

1. Name and Contact Details of the Controller and the Data Protection Officer

This Privacy Notice applies to the processing of personal data by: 
ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Am Hohen Ufer 6
30159 Hannover
Email: info@uestra.de
Telephone: +49 511-1668-0

The Data Protection Officer can be contacted as follows:

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Data Protection Officer 
Am Hohen Ufer 6
30159 Hannover
Email: datenschutz@uestra.de
Telephone: +49 511-1668-0

2. General Information

ÜSTRA manages the sale and administration of subscription products on behalf of the transport operators within the ÜSTRA transport network.

ÜSTRA is the contractual partner for customers.

The website uestra.de provides an online portal through which subscriptions can be purchased and managed. Subscriptions may also be ordered using a paper application form.

3. Purpose and Legal Basis of Processing

We process personal data obtained in the course of our contractual and business relationship with you.

In particular, we process the following categories of data:

a { text-decoration: none; color: #464feb; } tr th, tr td { border: 1px solid #e6e6e6; } tr th { background-color: #f5f5f5; }

contract information;

first and last name;

address;

date of birth;

gender;

email address;

email address of the passenger, where different from the subscriber;

contact details of the contracting party;

contact details of the account holder;

payment information;

subscription product data;

company name;

company address;

information required for the administration of contractual relationships (e.g. authorisations); and

information contained in eligibility documents.

Your personal data is processed for the purpose of administering your subscription agreement (Article 6(1)(b) GDPR). Without this data, it is not possible to enter into or perform the contract.

In certain cases, we process your personal data in order to safeguard our legitimate interests or those of third parties (such as public authorities). This applies in particular to the investigation of criminal offences (legal basis: Article 6(1)(f) GDPR in conjunction with Section 24 BDSG) and the exchange of data within our corporate group for administrative purposes (legal basis: Article 6(1)(f) GDPR).

Where you have given your consent to the processing of personal data, such consent constitutes the legal basis for the processing specified therein (Article 6(1)(a) GDPR). You may withdraw your consent at any time. Any withdrawal of consent will apply only with effect for the future.

We also process your data for the purpose of carrying out analyses relating to passenger demand and service planning, as well as the ongoing optimisation of transport services within the ÜSTRA transport network. The legal basis for this processing is your consent pursuant to Article 6(1)(a) GDPR.

For these purposes, your usage data is processed using pseudonyms and used for data analysis relating to passenger demand and service planning, and for the further optimisation of transport services within the ÜSTRA transport network. The aim is to enable us to respond appropriately and in a timely manner to developments in the transport market and, where necessary, adapt our services to the changing needs and expectations of passengers.

We also process your data for advertising and marketing purposes. This takes place only with your express consent pursuant to Article 6(1)(a) GDPR and only to the extent covered by that consent. You may withdraw your consent at any time with effect for the future. Any processing carried out before the withdrawal of consent remains lawful.

4. Retention Period 

We process your personal data for the duration of our business relationship with you. Once that relationship has ended, we delete your personal data unless statutory retention obligations apply (e.g. under the German Fiscal Code (AO), the German Commercial Code (HGB) or the German Civil Code (BGB)). Such retention periods may extend to ten years and, in the case of enforceable claims, up to thirty years.

Proofs of eligibility (e.g. for a Senior Network Pass or a Student Monthly Pass) are disposed of after verification or returned to you at the ÜSTRA Customer Service Centre.

5. Recipients of Data / Disclosure of Data

Access to your personal data within ÜSTRA is limited to employees who require it to perform their contractual or legal duties.

We engage carefully selected service providers to support our IT systems, carry out credit checks, issue mobile tickets and chip cards, and provide logistics and printing services. These service providers process personal data on our behalf and only in accordance with our instructions.

If payments remain outstanding, we may share your personal data with debt collection agencies and legal service providers. This is done to protect our legitimate interest in recovering outstanding amounts owed to us. The legal basis for such processing is Article 6(1)(b) and (f) GDPR.

We use external service providers to support the administration of subscription agreements and the provision of mobile tickets and chip cards. These service providers process personal data on our behalf under data processing agreements.

6. Providing Personal Data

ÜSTRA would like to point out that you are not legally or contractually required to provide your personal data.

Where personal data is required in order to enter into a subscription agreement, this will be clearly indicated during the application process by means of mandatory fields.

In all other cases, you are not required to provide personal data to ÜSTRA. If you choose not to provide such data, there will generally be no adverse consequences for you. However, we may be unable to process your application and, as a result, the subscription agreement may not be concluded.

7. Data Subject Rights

You have the right:

pursuant to Article 15 GDPR, to obtain access to your personal data processed by us. In particular, you may request information about the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom your personal data has been or will be disclosed, the envisaged retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your personal data where it was not collected by us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the details involved;

pursuant to Article 16 GDPR, to obtain without undue delay the rectification of inaccurate personal data stored by us or the completion of incomplete personal data;

pursuant to Article 17 GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;

pursuant to Article 18 GDPR, to request restriction of processing of your personal data where you contest the accuracy of the data, the processing is unlawful but you oppose the erasure of the data, we no longer require the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to processing pursuant to Article 21 GDPR;

pursuant to Article 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller;

pursuant to Article 7(3) GDPR, to withdraw your consent at any time. Any withdrawal of consent will apply only with effect for the future and will not affect the lawfulness of processing carried out before the withdrawal; and

pursuant to Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your habitual place of residence, place of work or our registered office.

8. Right to Object

Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right, pursuant to Article 21 GDPR, to object to the processing of your personal data where there are grounds relating to your particular situation or where the objection relates to direct marketing.

Where personal data is processed for direct marketing purposes, you have the right to object at any time without providing any reasons.

9. Updates to this Privacy Notice

This Privacy Notice is current as of November 2025.

As a result of the continued development of our services or changes in legal or regulatory requirements, it may become necessary to amend this Privacy Notice.

The latest version can be accessed and printed online at any time.

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft ("ÜSTRA", "we", "us" or "our") appreciates your interest in our company.

We take the protection of your personal data and its confidential treatment very seriously. Your personal data is processed exclusively in accordance with applicable data protection legislation, in particular the General Data Protection Regulation ("GDPR") and other applicable legal requirements.

This Privacy Notice explains how we process your personal data and informs you of your rights under the GDPR.

You may also view this Privacy Notice at our Customer Service Centre, Karmarschstraße 30/32, 30159 Hannover.
 

1. Name and Contact Details of the Controller and the Data Protection Officer

This Privacy Notice applies to the processing of personal data by:
ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Am Hohen Ufer 6
30159 Hannover
Email: info@uestra.de
Telephone: +49511-16680

The Data Protection Officer can be contacted as follows:
ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Der Beauftragte für den Datenschutz
Am Hohen Ufer 6
30159 Hannover
Email: datenschutz@uestra.de
Telephone: +49511-16680

2. Purpose and Legal Basis of Processing

The following data is processed in connection with your newsletter subscription:

title;
first name;
last name;
address (for postal delivery, where applicable)
email addres (for email newsletters); and
the type and duration of the subscription.
 

Processing is based on your consent pursuant to Article 6(1)(a) GDPR.

You may withdraw your consent at any time, without providing reasons, by sending an email to: widerruf@gvh.de. 

Upon receipt of your withdrawal request, we will cease processing your personal data unless we are legally required to continue processing certain data.

Statistical analyses are carried out by ÜSTRA only on an anonymised basis. For statistical purposes, we use anonymised tracking in connection with our email newsletters. Recipient interactions, such as opening an email, clicking on text or image links, or downloading images through an email application, are recorded and stored in anonymised form. It is not possible to identify individual users from this data.

If direct marketing activities include a link to our website, additional data relating to your use of the website may be collected through our web analytics services. This data is not combined with data collected for direct marketing purposes. Information about the data collected when you use our website can be found in the corresponding section of our website privacy notice.

3. Retention Period

We will retain the data collected through this processing activity until the purpose for which it was collected has been fulfilled or until you withdraw your consent, unless a longer retention period is required by statutory retention obligations applicable to us.

4. Recipients of Data

Your personal data will not be disclosed to third parties. Nor will it be transferred to any third country.

5. Data Subject Rights

You have the right:

pursuant to Article 15 GDPR, to obtain access to your personal data processed by us. In particular, you may request information about the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom your personal data has been or will be disclosed, the envisaged retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your personal data where it was not collected by us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the details involved;

pursuant to Article 16 GDPR, to obtain without undue delay the rectification of inaccurate personal data stored by us or the completion of incomplete personal data;

pursuant to Article 17 GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;

pursuant to Article 18 GDPR, to request restriction of processing of your personal data where you contest the accuracy of the data, the processing is unlawful but you oppose the erasure of the data, we no longer require the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to processing pursuant to Article 21 GDPR;

pursuant to Article 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller;

pursuant to Article 7(3) GDPR, to withdraw your consent at any time. Any withdrawal of consent will apply only with effect for the future and will not affect the lawfulness of processing carried out prior to the withdrawal; and

pursuant to Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your habitual place of residence, place of work or our registered office.

6. Right to Object

Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right, pursuant to Article 21 GDPR, to object to the processing of your personal data where there are grounds relating to your particular situation or where the objection relates to direct marketing.

Where personal data is processed for direct marketing purposes, you have the right to object at any time without providing any reasons.

7. Updates to this Privacy Notice

This Privacy Notice is current as of April 2024.

As a result of the continued development of our website and the services offered through it, or changes in legal or regulatory requirements, it may become necessary to amend this Privacy Notice.

The latest version of this Privacy Notice can be accessed and printed at any time on this website.

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft ("ÜSTRA") operates the sprinti app. This Privacy Information explains how personal data is processed when you use the sprinti App and the services available through it.

Personal data includes any information relating to an identified or identifiable individual (Article 4(1) of the General Data Protection Regulation ("GDPR")). This includes, for example, personal details such as your first and last name, contact details such as your email address and mobile phone number, and technical information such as your IP address and location data.

Protecting your privacy is of the utmost importance to us. We therefore process personal data in accordance with applicable data protection laws, including the GDPR and the Lower Saxony Data Protection Act.

We also believe it is important that you understand what personal data we collect, how we use it, and for what purposes it is processed.

ÜSTRA is committed to complying with all applicable data protection requirements. Compliance with these requirements is overseen by ÜSTRA's Data Protection Officer.

If you have any questions, suggestions or comments regarding data protection, please contact our Data Protection Officer at datenschutz@uestra.de.

1. Download

You can download the sprinti App from the relevant app store for your device. 

When you download the app, information required for the download process is transmitted to the relevant app store. This includes, in particular, your account details (such as your username and email address), the date and time of the download, and your device identifier.

This data is collected by the operator of the app store as the controller. We process this data only to the extent necessary to enable the download of the sprinti App.

The legal basis for this processing is Article 6(1)(b) GDPR. Processing of this data is necessary to enable you to use the app.

2. Registration and Use of the sprinti App and Related Services

a) Registration

If you wish to use the services available through the sprinti App, you must first register within the app.

You are not legally or contractually required to provide your personal data (Article 13(2)(e) GDPR). However, registration is necessary in order to use the services available through the sprinti App.

During registration, you will be asked to provide the personal data required to create and manage your account. This includes your name, email address and mobile phone number.

To join a passenger group for journeys where no scheduled service is available, you must also provide your age or submit proof of eligibility.

The legal basis for processing the data required for registration is Article 6(1)(b) GDPR, as registration is necessary for the performance of a contract for transport services or to take steps at your request prior to entering into such a contract.

Where you provide information from eligibility documents for the purpose of determining whether you qualify for a passenger group, processing is based on your consent pursuant to Article 6(1)(a) GDPR.

b) Use of the sprinti App

When you use the sprinti App to book journeys and use sprinti services, we process personal data as described below.

When you book services through the sprinti App, we collect the following information:

• IP address;
• device model, manufacturer and version information; and
• information processed or collected as part of the booking process, such as preferences for accessible vehicles, the time of the booking request, pick-up location and time, destination and expected arrival time (including where the booking process is cancelled before completion).

As part of providing the service, we will notify you shortly before pick-up and when the vehicle arrives at the pick-up location by means of a notification displayed in the sprinti App.

The driver of the vehicle assigned to your journey will receive the customer's name and will record when the passenger boards and exits the vehicle.

This processing is based on Article 6(1)(b) GDPR and is necessary for the performance of the transport contract.

If communication issues or connection interruptions occur between the app and the backend system, we will store information relating to the error (such as the request and error details) in your account.

Your device's location is collected only with your consent pursuant to Article 6(1)(a) GDPR in order to provide location-based services.

When you book certain services, we use your location to determine the appropriate pick-up stop and generate a service offer. In these cases, processing is based on Article 6(1)(b) GDPR and is necessary for the performance of the contract.

c) Analysis of Usage Data

We analyse usage data to better understand vehicle utilisation, travel patterns and customer behaviour, and to support market research activities.

The insights gained from these analyses help us measure, develop and improve our services. Where you have given your consent, they may also be used to support the marketing of our services.

The legal basis for the analysis of usage data is Article 6(1)(f) GDPR. We have a legitimate interest in analysing usage data in order to evaluate, develop and improve our services.

Where your data is used for targeted marketing purposes, processing is based on your consent pursuant to Article 6(1)(a) GDPR.

d) Disclosure of Personal Data

(1) Google Maps: The sprinti App uses the Google Maps mapping service via an API. Google Maps is provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

We use Google Maps to provide map-based functionality within the app and to help users locate relevant locations and services. The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest lies in providing user-friendly functionality and an effective presentation of information within the sprinti App.

When you use Google Maps, your device communicates directly with Google. As a result, certain information may be transmitted to and stored by Google on servers located outside the European Union, including in the United States. We have no control over Google's processing of your data.

Further information about how Google processes personal data can be found in Google's Privacy Policy:

policies.google.com/privacy

The Google Maps Terms of Service are available at:

maps.google.com/help/terms_maps/

Additional information about privacy settings and the management of your personal data can be found in Google's Privacy Centre.

(2) We also engage external service providers for IT support, the technical operation and hosting of the app, data storage and customer support (including the handling of customer enquiries).

The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest lies in ensuring the secure and efficient operation of the app and in providing effective customer support.

(3) For marketing purposes, we engage the following service providers:

Meta Platforms, Inc. (Marketing)
1601 Willow Rd.
Menlo Park, CA 94025, USA

LeanPlum, Inc. (Digital Marketing)
1550 Bryant Street, Ste. 525
San Francisco, California 94103, USA

You may decide whether you wish to be contacted for the purpose of receiving tailored marketing communications and helping us improve our services.

Where you have provided your consent, the legal basis for this processing is Article 6(1)(a) GDPR.

3.    No Automated Individual Decision-Making

We do not carry out automated decision-making, including profiling.

4.    Data Subject Rights

Depending on the circumstances of the particular case, you have the following rights in relation to your personal data:

• to obtain information about the personal data we process about you and to request access to that data and/or copies of it. This includes information about the purposes of the processing, the categories of personal data concerned, the recipients and authorised users of the data and, where possible, the envisaged retention period or, if that is not possible, the criteria used to determine that period;
• to request the rectification, erasure or restriction of the processing of your personal data where such processing is not permitted under applicable data protection law, in particular where (i) the data is incomplete or inaccurate, (ii) it is no longer required for the purposes for which it was collected, (iii) the consent on which the processing was based has been withdrawn, or (iv) you have successfully exercised your right to object to the processing. Where your data is processed by third parties, we will communicate your request for rectification, erasure or restriction of processing to those third parties unless this proves impossible or would involve a disproportionate effort;
• to refuse consent or, without affecting the lawfulness of processing carried out prior to its withdrawal, to withdraw your consent to the processing of your personal data at any time;
• to object to the processing of your personal data on grounds relating to your particular situation;
• to obtain information about the scope and intended effects of any automated decision-making carried out by us. You also have the right not to be subject to a decision based solely on automated processing where that decision produces legal effects concerning you or similarly significantly affects you. In such cases, you have the right to express your point of view and to have it taken into account in the decision-making process;
• to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit that data to another controller without hindrance from us. Where technically feasible, you also have the right to request that we transmit the personal data directly to another controller; and
• to lodge a complaint with a competent supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

If you wish to exercise any of your data protection rights, please contact us at:

datenschutz@uestra.de

5.    Retention of Personal Data

Your personal data will be deleted automatically once it is no longer required for the purpose for which it was collected, unless we are required to retain it for a longer period under applicable law.

Any statistical analyses carried out by ÜSTRA are performed only on an anonymised basis.

6.    Updates to this Privacy Information

This Privacy Information is effective as of 1 October 2023.

We reserve the right to amend this Privacy Information in response to technical or legal developments.

EBE is the German abbreviation for Erhöhtes Beförderungsentgelt (Increased Fare Charge).

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft ("ÜSTRA", "we", "us" or "our") appreciates your interest in our company.

We take the protection of your personal data and its confidential treatment very seriously. Your personal data is processed exclusively in accordance with applicable data protection legislation, in particular the General Data Protection Regulation ("GDPR") and other applicable legal requirements.

This Privacy Information explains how we process your personal data and informs you of your rights under the GDPR.

You may also view this Privacy Information at our Customer Service Centre, Karmarschstraße 30/32, 30159 Hannover.
 

1. Name and Contact Details of the Controller and the Data Protection officer

This Privacy Information applies to the processing of personal data by: 
ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Am Hohen Ufer 6
30159 Hannover
Email: info@uestra.de
Telephone: +49511-16680

The Data Protection Officer can be contacted as follows:
ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Data Protection Officer
Am Hohen Ufer 6
30159 Hannover
Email: datenschutz@uestra.de
Telephone: +49511-16680

2. Purpose and Legal Basis of Processing

Under our fare regulations and terms of transport, we are entitled to charge an Increase Fare Charge (EBE) where a passenger travels without a valid ticket. For this purpose, we process personal data including:

first and last name;
address details, (and, in the case of minors, the details of their parent(s) or legal guardian(s));
date and place of birth;
type and number of the identification document presented;
gender;
incident-related information;
boarding stop/station;
route and time of travel; and
reminder and/or payment information.

We process this data to administer and collect the Increased Fare Charge (EBE) and, where necessary, to pursue civil or criminal proceedings.

The legal basis for this processing is Article 6(1)(b), (c) and (f) GDPR.

The legal obligation arises from Section 9 of the German Ordinance on the General Conditions of Carriage for Tram, Bus and Scheduled Motor Vehicle Services.

Our legitimate interest arises from our fare regulations and conditions of carriage, as well as from the investigation and prosecution of offences under Sections 263, 265a and 267 of the German Criminal Code (StGB).

3. Retention Period

The retention period is determined by the requirements of the German Fiscal Code and by statutory retention and documentation obligations under tax and commercial law. Personal data is retained for ten years from the end of the calendar year in which it was collected.

4. Data Recipients 

Where criminal proceedings are initiated, personal data may be disclosed to the police and the public prosecutor's office on the basis of Sections 263, 265a and 267 of the German Criminal Code (StGB), for example where a passenger is repeatedly found travelling without a valid ticket.

Personal data may also be disclosed to the residents' registration authority for the purpose of verifying or obtaining address information.

In addition, personal data may be disclosed to debt collection agencies and legal service providers for the purpose of recovering outstanding amounts owed. This will occur only if the Increased Fare Charge (EBE) is not paid within the applicable payment period.

The legal basis for this processing is Article 6(1)(b) and (f) GDPR.

By disclosing personal data in these circumstances, we pursue our legitimate interest in the efficient recovery and enforcement of outstanding claims.

5. Obligation to Provide Personal Data

You are contractually required to provide this data.

6. Data Subject Rights

You have the right:

pursuant to Article 15 GDPR, to obtain access to your personal data processed by us. In particular, you may request information about the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom your personal data has been or will be disclosed, the envisaged retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your personal data where it was not collected by us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the details involved;

pursuant to Article 16 GDPR, to obtain without undue delay the rectification of inaccurate personal data stored by us or the completion of incomplete personal data;

pursuant to Article 17 GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;

pursuant to Article 18 GDPR, to request restriction of processing of your personal data where you contest the accuracy of the data, the processing is unlawful but you oppose the erasure of the data, we no longer require the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to processing pursuant to Article 21 GDPR;

pursuant to Article 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller;

pursuant to Article 7(3) GDPR, to withdraw your consent at any time. Any withdrawal of consent will apply only with effect for the future and will not affect the lawfulness of processing carried out prior to the withdrawal; and

pursuant to Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your habitual place of residence, place of work or our registered office.

7. Right to Object

Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right, pursuant to Article 21 GDPR, to object to the processing of your personal data where there are grounds relating to your particular situation or where the objection relates to direct marketing.

Where personal data is processed for direct marketing purposes, you have the right to object at any time without providing any reasons.

8. Updates to this Privacy Information

This Privacy Information is current as of April 2024.

As a result of the continued development of our website and the services offered through it, or changes in legal or regulatory requirements, it may become necessary to amend this Privacy Information.

The latest version of this Privacy Information can be accessed and printed at any time on this website.

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft ("ÜSTRA", "we", "us" or "our") appreciates your interest in our company.

We take the protection of your personal data and its confidential treatment very seriously. Your personal data is processed exclusively in accordance with applicable data protection legislation, in particular the General Data Protection Regulation ("GDPR") and other applicable legal requirements.

This Privacy Information explains how we process your personal data and informs you of your rights under the GDPR.

You may also view this Privacy Information at our Customer Centre, Karmarschstraße 30/32, 30159 Hannover.

1. Name and Contact Details of the Controller and the Data Protection Officer

This Privacy Information applies to the processing of personal data by: 
ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Am Hohen Ufer 6
30159 Hannover
Email: info@uestra.de
Telephone: +49511-16680

The Data Protection Officer can be contacted as follows:
ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Data Protection Officer
Am Hohen Ufer 6
30159 Hannover
Email: datenschutz@uestra.de
Telephone: +49511-16680

2. Purpose and Legal Basis of Processing

In connection with claims relating to ticket purchases made at our ticket vending machines, we process personal data including:

• first and last name;
• gender;
• address details;
• telephone number;
• bank account details; and
• information relating to the tickets purchased (including the place of purchase, ticket type and quantity purchased).

We process this data in order to investigate and resolve the claim and to ensure its proper handling.

The legal basis for this processing is Article 6(1)(b) and (f) GDPR.

3. Retention Period

Personal data relating to claims is retained beyond the period required to process the claim in order to prevent misuse. Claim-related data will be deleted only after the expiry of the applicable retention periods under commercial and tax law. These retention periods may be up to ten years.

4. Data Recipients

Your personal data will not be disclosed to third parties. Nor will it be transferred to any third country.

5. Requirement to Provide Personal Data

To enable us to process your claim, you must provide the personal data required for that purpose.

Without this data, we may be unable to process your claim.

6. Data Subject Rights

You have the right:

pursuant to Article 15 GDPR, to obtain access to your personal data processed by us. In particular, you may request information about the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom your personal data has been or will be disclosed, the envisaged retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your personal data where it was not collected by us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the details involved;

pursuant to Article 16 GDPR, to obtain without undue delay the rectification of inaccurate personal data stored by us or the completion of incomplete personal data;

pursuant to Article 17 GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;

pursuant to Article 18 GDPR, to request restriction of processing of your personal data where you contest the accuracy of the data, the processing is unlawful but you oppose the erasure of the data, we no longer require the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to processing pursuant to Article 21 GDPR;

pursuant to Article 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller;

pursuant to Article 7(3) GDPR, to withdraw your consent at any time. Any withdrawal of consent will apply only with effect for the future and will not affect the lawfulness of processing carried out prior to the withdrawal; and

pursuant to Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your habitual place of residence, place of work or our registered office.

7. Right to Object

Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right, pursuant to Article 21 GDPR, to object to the processing of your personal data where there are grounds relating to your particular situation or where the objection relates to direct marketing.

Where personal data is processed for direct marketing purposes, you have the right to object at any time without providing any reasons.

8. Updates to this Privacy Notice

This Privacy Information is current as of April 2024.

As a result of the continued development of our website and the services offered through it, or changes in legal or regulatory requirements, it may become necessary to amend this Privacy Information.

The latest version of this Privacy Information can be accessed and printed at any time on this website.

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft ("ÜSTRA", "we", "us" or "our") appreciates your interest in our company.

We take the protection of your personal data and its confidential treatment very seriously. Your personal data is processed exclusively in accordance with applicable data protection legislation, in particular the General Data Protection Regulation ("GDPR") and other applicable legal requirements.

This Privacy Information explains how we process your personal data and informs you of your rights under the GDPR.

You may also view this Privacy Information at our Customer Centre, Karmarschstraße 30/32, 30159 Hannover.
 

1. Name and Contact Details of the Controller and the Data Protection Officer

This Privacy Information applies to the processing of personal data by: 
ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Am Hohen Ufer 6
30159 Hannover
Email: info@uestra.de
Telephone: +49511-16680

The Data Protection Officer can be contacted as follows:
ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Data Protection Officer
Am Hohen Ufer 6
30159 Hannover
Email: datenschutz@uestra.de
Telephone: +49511-16680

2. Purpose and Legal Basis of Processing

Where breaches of our house rules are identified, we may, in the exercise of our right to control access to our premises, issue a Transit Ban.

For this purpose, we process personal data including:

• title;
• first and last name;
• address;
• date of birth;
• nationality (where applicable);
• date and time of the incident;
• location of the incident; and
• details of the incident.

We process this data in order to issue Transit Bans, to pursue criminal complaints for trespass where a person enters the premises despite a Transit Ban being in place, and to establish, exercise or defend any legal claims, including claims for damages.

The legal basis for this processing is Article 6(1)(f) GDPR.

Our legitimate interest lies in enforcing our house rules and access restrictions, monitoring compliance with Transit Bans, particularly in cases of repeated misconduct, and pursuing infringements of our rights, including, where appropriate, the reporting and prosecution of criminal offences.

3. Retention Period

Your personal data will be deleted once the Transit Ban has been lifted and, in any event, no later than two years thereafter, unless it is required for a legitimate purpose, such as the investigation or prosecution of a criminal offence.

4. Data Recipients

Personal data will be disclosed to third parties (such as the police, courts or public prosecutor's office) only where necessary for the investigation or prosecution of criminal offences.

5. Requirement to Provide Personal Data

You are required to provide the personal data listed above.

6. Data Subject Rights

You have the right:

pursuant to Article 15 GDPR, to obtain access to your personal data processed by us. In particular, you may request information about the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom your personal data has been or will be disclosed, the envisaged retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your personal data where it was not collected by us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the details involved;

pursuant to Article 16 GDPR, to obtain without undue delay the rectification of inaccurate personal data stored by us or the completion of incomplete personal data;

pursuant to Article 17 GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;

pursuant to Article 18 GDPR, to request restriction of processing of your personal data where you contest the accuracy of the data, the processing is unlawful but you oppose the erasure of the data, we no longer require the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to processing pursuant to Article 21 GDPR;

pursuant to Article 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller;

pursuant to Article 7(3) GDPR, to withdraw your consent at any time. Any withdrawal of consent will apply only with effect for the future and will not affect the lawfulness of processing carried out prior to the withdrawal; and

pursuant to Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your habitual place of residence, place of work or our registered office.

7 . Right to Object

Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right, pursuant to Article 21 GDPR, to object to the processing of your personal data where there are grounds relating to your particular situation or where the objection relates to direct marketing.

Where personal data is processed for direct marketing purposes, you have the right to object at any time without providing any reasons.

8. Updates to this Privacy Information

This Privacy Information is current as of April 2024.

As a result of the continued development of our website and the services offered through it, or changes in legal or regulatory requirements, it may become necessary to amend this Privacy Information.

The latest version of this Privacy Information can be accessed and printed at any time on this website.

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft ("ÜSTRA", "we", "us" or "our") appreciates your interest in our company.

We take the protection of your personal data and its confidential treatment very seriously. Your personal data is processed exclusively in accordance with applicable data protection legislation, in particular the General Data Protection Regulation ("GDPR") and other applicable legal requirements.

This Privacy Information explains how we process your personal data and informs you of your rights under the GDPR.

You may also view this Privacy Information at our Customer Service Centre, Karmarschstraße 30/32, 30159 Hannover.

1. Name and Contact Details of the Controller and the Data Protection Officer

This Privacy Information applies to the processing of personal data by:
ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Am Hohen Ufer 6
30159 Hannover
Email: info@uestra.de
Telephone: +49511-16680

The Data Protection Officer can be contacted as follows:
ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Der Beauftragte für den Datenschutz
Am Hohen Ufer 6
30159 Hannover
Email: datenschutz@uestra.de
Telphone: +49511-16680

2. Purpose and Legal Basis of Processing

We welcome your feedback, suggestions, complaints and comments, as they help us improve our services.

To process and respond to your enquiry or complaint, we may process personal data including:

• first and last name;
• address details;
• telephone number; and
• email address.

The legal basis for this processing is Article 6(1)(f) GDPR.

Our legitimate interest lies in handling and responding to customer enquiries and complaints and in continuously improving our services.

3. Retention Period

Your personal data will be deleted unless it is required for the protection of legitimate interests or must be retained in order to comply with statutory retention obligations under commercial or tax law.

Applicable retention periods may be up to ten years.

4. Data Recipients

Your personal data will not be disclosed to third parties.

5. Requirement to Provide Personal Data

In connection with your enquiry or complaint, you must provide the personal data required to process your request.

Without this information, we may be unable to process your enquiry or complaint.

6. Data Subject Rights

You have the right:

• pursuant to Article 15 GDPR, to obtain access to your personal data processed by us. In particular, you may request information about the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom your personal data has been or will be disclosed, the envisaged retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your personal data where it was not collected by us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the details involved;
• pursuant to Article 16 GDPR, to obtain without undue delay the rectification of inaccurate personal data stored by us or the completion of incomplete personal data;
• pursuant to Article 17 GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;
• pursuant to Article 18 GDPR, to request restriction of processing of your personal data where you contest the accuracy of the data, the processing is unlawful but you oppose the erasure of the data, we no longer require the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to processing pursuant to Article 21 GDPR;
• pursuant to Article 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller;
• pursuant to Article 7(3) GDPR, to withdraw your consent at any time. Any withdrawal of consent will apply only with effect for the future and will not affect the lawfulness of processing carried out prior to the withdrawal; and
• pursuant to Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your habitual place of residence, place of work or our registered office.

7. Right to Object

Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right, pursuant to Article 21 GDPR, to object to the processing of your personal data where there are grounds relating to your particular situation or where the objection relates to direct marketing.

Where personal data is processed for direct marketing purposes, you have the right to object at any time without providing any reasons.

8. Updates to this Privacy Information

This Privacy Information is current as of April 2024.

As a result of the continued development of our website and the services offered through it, or changes in legal or regulatory requirements, it may become necessary to amend this Privacy Information.

The latest version of this Privacy Information can be accessed and printed at any time on this website.

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft ("ÜSTRA", "we", "us" or "our") appreciates your interest in joining our company.

We take the protection of your personal data and its confidential treatment very seriously. Your personal data is processed exclusively in accordance with applicable data protection legislation, in particular the General Data Protection Regulation ("GDPR") and other applicable legal requirements.

This Privacy Information explains how we process your personal data and informs you of your rights under the GDPR.

You may also view this Privacy Information at our Customer Service Centre, Karmarschstraße 30/32, 30159 Hannover.

1. Name and Contact Details of the Controller and the Data Protection Officer

This Privacy Information applies to the processing of personal data by:

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Am Hohen Ufer 6
30159 Hannover
Email: info@uestra.de
Telephone: +49 511 1668-0

The Data Protection Officer can be contacted as follows:

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Data Protection Officer
Am Hohen Ufer 6
30159 Hannover
Email: datenschutz@uestra.de
Telephone: +49 511 1668-0

2. Purpose and Legal Basis of Processing

If you apply for a position with us, we will generally collect only the personal data required to process your application. Providing your gender, telephone number, photograph and email address is voluntary.

We process personal data including:

• first and last name;
• address details;
• application documents; and
• information provided in the application form or contact form (such as driving licence information, driving licence categories, information relating to obtaining a driving licence, educational qualifications and language skills).

We may also process the following information where you choose to provide it voluntarily:

• telephone number;
• email address; and
• applicant photograph.

Your personal data is processed for the purpose of assessing your application and selecting suitable candidates.

The legal basis for this processing is Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (pre-contractual measures) and Section 26(1) of the German Federal Data Protection Act (BDSG).

3. Retention Period

If your application is unsuccessful, your personal data will be deleted six months after the recruitment process has been completed.

Your personal data may be retained beyond the end of the recruitment process if you consent to the extended retention of your applicant data.

4. Data Recipients

Your personal data will not be disclosed to third parties.

5. Requirement to Provide Personal Data

Providing your personal data is necessary in order to participate in the recruitment process. Without this data, we will be unable to consider your application.

6. Data Subject Rights

You have the right:

• pursuant to Article 15 GDPR, to obtain access to your personal data processed by us. In particular, you may request information about the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom your personal data has been or will be disclosed, the envisaged retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your personal data where it was not collected by us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the details involved;
• pursuant to Article 16 GDPR, to obtain without undue delay the rectification of inaccurate personal data stored by us or the completion of incomplete personal data;
• pursuant to Article 17 GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;
• pursuant to Article 18 GDPR, to request restriction of processing of your personal data where you contest the accuracy of the data, the processing is unlawful but you oppose the erasure of the data, we no longer require the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to processing pursuant to Article 21 GDPR;
• pursuant to Article 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller;
• pursuant to Article 7(3) GDPR, to withdraw your consent at any time. Any withdrawal of consent will apply only with effect for the future and will not affect the lawfulness of processing carried out prior to the withdrawal; and
• pursuant to Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your habitual place of residence, place of work or our registered office.

7. Right to Object

Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right, pursuant to Article 21 GDPR, to object to the processing of your personal data where there are grounds relating to your particular situation or where the objection relates to direct marketing.

Where personal data is processed for direct marketing purposes, you have the right to object at any time without providing any reasons.

8. Updates to this Privacy Information

This Privacy Information is current as of April 2024.

As a result of the continued development of our website and the services offered through it, or changes in legal or regulatory requirements, it may become necessary to amend this Privacy Information.

The latest version of this Privacy Information can be accessed and printed at any time on this website.

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft ("ÜSTRA", "we", "us" or "our") appreciates your interest in our company.

We take the protection of your personal data and its confidential treatment very seriously. Your personal data is processed exclusively in accordance with applicable data protection legislation, in particular the General Data Protection Regulation ("GDPR") and other applicable legal requirements.

This Privacy Information explains how we process your personal data and informs you of your rights under the GDPR.

You may also view this Privacy Information at our Customer Service Centre, Karmarschstraße 30/32, 30159 Hannover.

1. Name and Contact Details of the Controller and the Data Protection Officer

This Privacy Information applies to the processing of personal data by:

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Am Hohen Ufer 6
30159 Hannover
Email: info@uestra.de
Telephone: +49 511 1668-0

The Data Protection Officer can be contacted as follows:

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Data Protection Officer
Am Hohen Ufer 6
30159 Hannover
Email: datenschutz@uestra.de
Telephone: +49 511 1668-0

2. Purpose and Legal Basis of Processing

In the event of an accident or other claim, we process your personal data in order to assess our liability and determine the amount of any compensation that may be payable.

This may include the following categories of data:

• information contained in your claim notification (e.g. name, address, date of birth, health insurance provider, pension insurance provider and insurance details);
• bank account details;
• witness contact details;
• reference numbers and file numbers issued by public authorities; and
• health data where personal injury is being assessed (e.g. the severity of injuries, the intensity and duration of pain, the duration of incapacity for work, any permanent impairments or disfigurement, and the duration of hospital stays).

The legal basis for processing your personal data for the purpose of handling and settling claims is Article 6(1)(c) GDPR.

Where the handling of a claim requires the processing of special categories of personal data, such as health data, we will obtain your consent in advance in accordance with Article 9(2)(a) in conjunction with Article 7 GDPR.

You may withdraw your consent at any time. Any withdrawal of consent will apply only with effect for the future.

If consent is withdrawn, it may no longer be possible to process and assess your claim.

We also process your personal data (excluding special categories of personal data) where necessary to pursue our legitimate interests or those of third parties. This may be required, in particular, for the establishment, exercise or defence of legal claims, or for the prevention and investigation of criminal offences. The legal basis for this processing is Article 6(1)(f) GDPR.

In addition, we process your personal data to comply with statutory retention obligations under commercial and tax law. The legal basis for this processing is Article 6(1)(c) GDPR.

3. Retention Period

We will delete your personal data as soon as it is no longer required for the purposes described above.

However, your personal data may be retained for as long as claims can be asserted against us. Applicable statutory limitation periods may be up to thirty (30) years.

We will also retain your personal data where we are required to do so by law. Statutory retention obligations arise in particular under the German Commercial Code (HGB) and the German Fiscal Code (AO). Retention periods may be up to ten (10) years.

4. Data Recipients

To fulfil our contractual and legal obligations, we share claim-related data with our reinsurer.

We may also disclose your personal data to other recipients where necessary, including public authorities (such as social security institutions and law enforcement authorities), medical experts, independent experts, residual value assessors and financial institutions.

Your personal data will not be transferred to any third country (i.e. a country outside the European Economic Area (EEA)).

5. Data Subject Rights

You have the right:

pursuant to Article 15 GDPR, to obtain access to your personal data processed by us. In particular, you may request information about the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom your personal data has been or will be disclosed, the envisaged retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your personal data where it was not collected by us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the details involved;

pursuant to Article 16 GDPR, to obtain without undue delay the rectification of inaccurate personal data stored by us or the completion of incomplete personal data;

pursuant to Article 17 GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;

pursuant to Article 18 GDPR, to request restriction of processing of your personal data where you contest the accuracy of the data, the processing is unlawful but you oppose the erasure of the data, we no longer require the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to processing pursuant to Article 21 GDPR;

pursuant to Article 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller;

pursuant to Article 7(3) GDPR, to withdraw your consent at any time. Any withdrawal of consent will apply only with effect for the future and will not affect the lawfulness of processing carried out prior to the withdrawal; and

pursuant to Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your habitual place of residence, place of work or our registered office.

6. Right to Object

Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right, pursuant to Article 21 GDPR, to object to the processing of your personal data where there are grounds relating to your particular situation or where the objection relates to direct marketing.

Where personal data is processed for direct marketing purposes, you have the right to object at any time without providing any reasons.

7. Updates to this Privacy Information

This Privacy Information is current as of April 2024.

As a result of the continued development of our website and the services offered through it, or changes in legal or regulatory requirements, it may become necessary to amend this Privacy Information.

The latest version of this Privacy Information can be accessed and printed at any time on this website.

We offer cashless payments options. To process these payments, we use the services of the following payment service provider:

PAYONE GmbH
Lyoner Straße 9
60528 Frankfurt am Main, Germany
("PAYONE")

For the purposes of the GDPR, PAYONE acts as an independent controller. ÜSTRA has no influence over PAYONE's processing activities. Payment service providers are subject to their own legal and regulatory requirements, including banking and data protection legislation, supervisory requirements, industry standards and contractual obligations towards banks and card issuers.

PAYONE performs two primary functions on behalf of ÜSTRA:

Network Operator
PAYONE provides the technical infrastructure required for the processing of cashless payments. This includes, for example, the secure transmission of payment data between the card terminal and the card issuer.

Acquirer
For credit card payments, PAYONE also acts as the acquiring bank (acquirer). In this role, PAYONE is responsible for the secure processing and settlement of credit card transactions with card schemes such as Visa, Mastercard, American Express, Diners Club, Discover and JCB.

Further information about PAYONE's processing of personal data in connection with card payments can be found at:

www.payone.com/DE-de/dsgvo

As the payment recipient, ÜSTRA is responsible for the operation of the card terminal and its connection to ÜSTRA's internal communications network.

Payment data is transmitted securely from the card terminal to PAYONE via an internet or telephone connection.

Personal data is exchanged between ÜSTRA and PAYONE solely for the purpose of processing payments in connection with the use of the card terminal and, where required by law, for the retention of transaction records.

The legal basis for this processing is Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(c) GDPR (compliance with legal obligations).

1.    Name and Contact Details of the Controllers and Data Protection Officers

For lost property management, the controllers cooperate within the meaning of Article 26 GDPR (Joint Controllers).

As part of this cooperation, it may be necessary for the joint controllers to access your personal data. The joint controllers are therefore jointly responsible for the protection of your personal data.

Joint Controllers

ÜSTRA Controller

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft 
Am Hohen Ufer 6
30159 Hannover
Email: info@uestra.de
Telephone: +49511-16680

The Data Protection Officer can be contacted as follows:
ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Der Beauftragte für den Datenschutz
Am Hohen Ufer 6
30159 Hannover
Email: datenschutz@uestra.de
Telephone:+49511-16680
 

regiobus Controller

regiobus Hannover GmbH
Georgstraße 54
30159 Hannover
Telephone:+49511368880
Email: info@regiobus.de

Data Protection Officer: S-CON GmbH & Co.KG
Email: datenschutzteam019@s-con.de
 

2.    Personal Data 

The subject of data protection is personal data. Personal data means any information relating to an identified or identifiable individual (the "data subject"). Examples of personal data include a person's name, postal address, email address or customer number.

More detailed information about the categories of personal data we process can be found in the individual processing activities described below.

3.   Lost Property

I.    Finder's Data for the Lost Property Report

a.    Purpose and Legal Basis of Processing

If you hand in lost property to us, we process the information you voluntarily provide. This may include:

first and last name;
address details; and
details of the item found, the date it was found and the location where it was found.

Where the finder is a minor, the same information is collected from their parent(s) or legal guardian(s).

The provision of your personal data is necessary in order to notify you when the lost property has been returned to its rightful owner. This enables you to assert any entitlement to a finder's reward.

Under Sections 978 et seq. of the German Civil Code (BGB), a finder may be entitled to a finder's reward. Such entitlement generally requires, among other things, that:

the item has a value of at least EUR 50.00;

the finder is not an employee of ÜSTRA; and

the finder has not waived the finder's reward in advance.

The legal basis for this processing is Article 6(1)(b) and (c) GDPR. The relevant legal obligations arise from Sections 978(2) and 971 BGB.

Where you have consented to the processing of your personal data for the purpose of asserting a finder's reward claim, you may withdraw your consent at any time with effect for the future. To do so, it is sufficient to contact the controller using the contact details provided above.

b.    Retention Period

Personal data is retained:

1. for six months after the lost property has been returned to the rightful owner; or
2. where the item is not collected, for three years after it has been auctioned.

Where the proceeds of the auction remain with the transport operator, any claim for a finder's reward is directed against the transport operator. Such claim expires (rather than becoming time-barred) three years after it arises in accordance with Section 978(3) and Section 195 BGB.

c.    Data Recipients 

To support the administration, organisation, safekeeping and return of lost property in accordance with legal requirements, we engage external service providers that process personal data exclusively within the European Union.

These service providers receive only the personal data required to perform their respective services and process such data solely in accordance with ÜSTRA's instructions. Where required, appropriate data processing agreements are in place.

d.    Requirement to Provide Personal Data

If you wish to assert a claim for a finder's reward against the owner of the item, we require your personal data (including your name and address) in order to notify you when the item has been returned and to provide you with the owner's contact details where necessary.

II.    Data of the Owner/Authorised Collector

a.    Purpose and Legal Basis of Processing

If you collect a lost item from us, we process personal data including:

• first and last name;
• address details;
• information relating to the lost item;
• where applicable, identity card number or driving licence number; and
• bank account details (IBAN) for the transfer of amounts exceeding EUR 20.00 or where the lost property fee is paid using a cashless payment method.

The legal basis for this processing is Article 6(1)(b), (c) and (f) GDPR.

b.    Retention Period

Where your personal data is no longer required for the fulfilment of contractual or legal obligations, it will generally be deleted after six months unless continued retention is necessary to comply with statutory retention obligations under commercial or tax law.

Applicable retention periods may range from six to ten years. During these statutory retention periods, there is no right to erasure.

c.    Data Recipients

We may disclose your personal data to the finder where the finder asserts a claim for a finder's reward.

We also engage external service providers for the administration of lost property. These providers process personal data exclusively within the European Union. They receive only the personal data necessary to perform their services and process such data solely in accordance with ÜSTRA's instructions. Where required, appropriate data processing agreements are in place.

In addition, ÜSTRA forwards personal identification documents submitted as lost property (such as identity cards, passports and residence permits), health insurance cards and credit cards to the issuing authorities or institutions. Student ID cards are returned to the relevant school.

d.    Requirement to Provide Personal Data

Without the information requested above, we will be unable to return the lost property to you.

4.    Data Subject Rights

You have the right:

pursuant to Article 15 GDPR, to obtain access to your personal data processed by us. In particular, you may request information about the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom your personal data has been or will be disclosed, the envisaged retention period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your personal data where it was not collected by us, and the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the details involved;

pursuant to Article 16 GDPR, to obtain without undue delay the rectification of inaccurate personal data stored by us or the completion of incomplete personal data;

pursuant to Article 17 GDPR, to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;

pursuant to Article 18 GDPR, to request restriction of processing of your personal data where you contest the accuracy of the data, the processing is unlawful but you oppose the erasure of the data, we no longer require the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to processing pursuant to Article 21 GDPR;

pursuant to Article 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller;

pursuant to Article 7(3) GDPR, to withdraw your consent at any time. Any withdrawal of consent will apply only with effect for the future and will not affect the lawfulness of processing carried out prior to the withdrawal; and

pursuant to Article 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your habitual place of residence, place of work or our registered office.

5.    Right to Object

Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right, pursuant to Article 21 GDPR, to object to the processing of your personal data where there are grounds relating to your particular situation or where the objection relates to direct marketing.

Where personal data is processed for direct marketing purposes, you have the right to object at any time without providing any reasons.

6.    Updates to this Privacy Information

This Privacy Information is current as of March 2023.

As a result of the continued development of our website and the services offered through it, or changes in legal or regulatory requirements, it may become necessary to amend this Privacy Information.

The latest version of this Privacy Information can be accessed and printed at any time on this website.

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft ("ÜSTRA", "we", "us" or "our") appreciates your interest in our company.

We take the protection of your personal data and its confidential treatment very seriously. Your personal data is processed exclusively in accordance with applicable data protection legislation, in particular the General Data Protection Regulation ("GDPR") and other applicable legal requirements.

This Privacy Information explains how we process your personal data and informs you of your rights under the GDPR.

You may also view this Privacy Information at our Customer Service Centre, Karmarschstraße 30/32, 30159 Hannover.

Name and Contact Details of the Controller and the Data Protection Officer

This Privacy Information applies to the processing of personal data by:

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Am Hohen Ufer 6
30159 Hannover
Email: info@uestra.de
Telephone: +49511-16680

The Data Protection Officer can be contacted as follows:

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Der Beauftragte für den Datenschutz
Am Hohen Ufer 6
30159 Hannover
Email: datenschutz@uestra.de
Telephone: +49511-16680

2. Purpose of Data Collection

The purpose of processing your personal data is to coordinate participation in safety workshops that are organised separately according to the gender of participants.

The legal basis for processing your personal data is your consent pursuant to Article 6(1)(a) GDPR.

For the purpose of organising the safety workshops, we collect the following categories of personal data:

• email address;
• gender; and
• first and last name.

3. Retention Period

The personal data collected for this purpose will be deleted seven days after the end of the event.

4. Data Recipients

The personal data collected in connection with the safety workshops will not be disclosed to third parties.

5. Requirement to Provide Personal Data

You are not legally or contractually required to provide your personal data.

However, without the categories of personal data listed in Section 2, we will be unable to organise and conduct the safety workshops.

regiobus Hannover GmbH
Georgstraße 54
30159 Hannover

If you have any questions or wish to contact our Data Protection Officer, you may do so at:

datenschutz@regiobus.de
or

regiobus Hannover GmbH
Georgstraße 54
30159 Hannover

The personal data you provide will be collected, processed and used for the purpose of handling your complaint pursuant to Article 6(1)(f) GDPR.

Providing your personal data is necessary for the handling of your complaint. Without this information, we will be unable to investigate, process or follow up on your complaint.

Your personal data may be disclosed to the following external recipients where necessary:

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft                                                     
Am Hohen Ufer 6                                               
30159 Hannover

Your information will be forwarded to the responsible employees of regiobus Hannover GmbH for the further handling of your complaint.

The personal data you provide will not be transferred to a third country or an international organisation. No such transfer is planned.

Your personal data will be retained until your enquiry or complaint has been resolved. The data will be deleted or anonymised once it is no longer required for the purpose for which it was collected.

Pursuant to Article 15 GDPR, you have the right to obtain information about the processing of your personal data.

In addition, you may exercise your rights to rectification, erasure or, where erasure is not possible, restriction of processing, as well as your right to data portability in accordance with Articles 16 to 18 and 20 GDPR. If you wish to exercise any of these rights, please contact our Data Protection Officer.

You also have the right to lodge a complaint with the competent supervisory authority at any time. If you believe that your personal data is not being processed in accordance with applicable data protection laws, we kindly ask that you first contact our Data Protection Officer.

Furthermore, you have the right to object at any time to the processing of your personal data.

Controller

The controller responsible for processing your personal data is:

regiobus Hannover GmbH

Georgstraße 54
30159 Hannover
Telephone: +49 511 36888-0 
Managing Directors: Denise Hain, Olof Seidel and Elke Maria van Zadel

If you have any questions or wish to contact our Data Protection Officer, you may do so at:

datenschutz@regiobus.de

or

regiobus Hannover GmbH
Georgstraße 54
30159 Hannover

Purpose and Legal Basis of Processing

The personal data you provide will be collected, processed and used for the purpose of deciding whether to establish an employment relationship with you, pursuant to Article 88(1) GDPR in conjunction with Section 26(1) of the German Federal Data Protection Act (BDSG).

Providing your personal data is necessary for the recruitment process and for making a decision regarding potential employment. If you do not provide the required personal data, we will unfortunately be unable to consider your application for the advertised position.

No automated decision-making takes place.

Your personal data will not be disclosed to external third parties.

The personal data you provide will not be transferred to a third country or an international organisation. No such transfer is planned.

For the purpose of assessing your application, your application documents will be forwarded to the responsible contacts within the relevant department for which the position is being filled.

Retention Period

Your application documents will be retained for the duration of the recruitment process and for a further three months thereafter in order to respond to any follow-up queries.

After this period, the application documents will be deleted. Application documents submitted by post will be securely destroyed after the three-month retention period.

If you are offered and accept employment with us, your application documents will be transferred to your personnel file.

Data Subject Rights

Pursuant to Article 15 GDPR, you have the right to obtain information about the processing of your personal data.

You also have the right to request rectification, erasure or, where erasure is not possible, restriction of processing, as well as the right to data portability in accordance with Articles 16 to 18 and 20 GDPR. If you wish to exercise any of these rights, please contact our Data Protection Officer.

You also have the right to lodge a complaint with the competent supervisory authority at any time. If you believe that your personal data is not being processed in accordance with applicable data protection laws, we kindly ask that you first contact our Data Protection Officer.

Furthermore, pursuant to Article 21 GDPR, you have the right to object at any time to the processing of your personal data.

Controller

The controller responsible for processing your personal data is:

regiobus Hannover GmbH

Georgstraße 54
30159 Hannover
Telephone: +49 511 36888-0 
Managing Directors: Denise Hain, Olof Seidel and Elke Maria van Zadel

If you have any questions or wish to contact our Data Protection Officer, you may do so at:

datenschutz@regiobus.de

or

regiobus Hannover GmbH
Georgstraße 54
30159 Hannover

Purpose and Legal Basis of Processing

The personal data you provide will be collected and processed for the purpose of establishing and entering into a contractual relationship pursuant to Article 6(1)(b) GDPR.

Providing your personal data is necessary for the performance and administration of the contractual relationship. Without this information, we will be unable to contact you in order to discuss and clarify pre-contractual or contractual matters.

No automated decision-making takes place.

Your personal data will not be disclosed to external third parties.

The personal data you provide will not be transferred to a third country or an international organisation. No such transfer is planned.

Retention Period

Your personal data will be retained for the duration of the contractual relationship. Thereafter, we may continue to retain your contact details in connection with the organisation on whose behalf you act in order to address any post-contractual matters.

Where your personal data is no longer required, or where we are informed by the relevant organisation that you are no longer the appropriate contact person, your personal data will be deleted, destroyed or restricted from further processing, as appropriate.

Data Subject Rights

Pursuant to Article 15 GDPR, you have the right to obtain information about the processing of your personal data.

You also have the right to request rectification, erasure or, where erasure is not possible, restriction of processing, as well as the right to data portability in accordance with Articles 16 to 18 and 20 GDPR. If you wish to exercise any of these rights, please contact our Data Protection Officer.

You also have the right to lodge a complaint with the competent supervisory authority at any time. If you believe that your personal data is not being processed in accordance with applicable data protection laws, we kindly ask that you first contact our Data Protection Officer.

Furthermore, pursuant to Article 21 GDPR, you have the right to object at any time to the processing of your personal data.

Controller responsible for the processing of your personal data:

PAYONE GmbH
Lyoner Straße 9
60528 Frankfurt/Main
Germany

Chair of the Supervisory Board: Ottmar Bloching
Managing Directors: Niklaus Santschi, Frank Hartmann, Björn Hoffmeyer, Roland Schaar
Local Court (Amtsgericht) Frankfurt/Main
Commercial Register No. HRB 116860
VAT ID No. DE185996311

We use PAYONE GmbH ("PAYONE") as a service provider for the processing of cashless payments. Below you will find the information required under Article 14 GDPR regarding PAYONE's processing of personal data.

1 Name and Contact Details of the Controller and the Data Protection Officer

PAYONE GmbH
Lyoner Str. 9
60528 Frankfurt/Main
Germany
www.payone.com

Managing Directors: Niklaus Santschi, Frank Hartmann, Björn Hoffmeyer, Roland Schaar
Chair of the Supervisory Board: Ottmar Bloching

PAYONE's Data Protection Officer can be contacted at the above address using the reference "Data Protection Officer" or by email at: privacy@payone.com

PAYONE is authorised and supervised as a payment institution by the German Federal Financial Supervisory Authority (BaFin):

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)
Graurheindorfer Straße 108
53117 Bonn
Germany

2Purposes of Processing by PAYONE

The primary purpose of processing personal data is the handling of cashless payment transactions in both point-of-sale and e-commerce environments.

In addition, personal data may be processed for the following purposes:

Fraud Prevention and Risk Management
This includes various measures to prevent and detect fraud and to reduce payment defaults, such as the rule-based detection and analysis of potential fraud patterns based on specific parameters relating to card usage.

Receivables Management and Debt Collection
This includes the recovery of outstanding debts through appointed debt collection service providers.

Creditworthiness Checks for Dynamic Payment Method Selection
This includes, in particular, the verification and validation of bank account, card and address data, as well as IP addresses, for plausibility and fraud prevention purposes.

Invoicing
Generation and delivery of invoices and credit notes.

Protection of IT Systems and Detection of Cyberattacks
This includes, for example, the temporary storage of IP addresses for the detection, analysis and resolution of technical faults, disruptions and security incidents.

Subscription Management
Processing and administration of recurring payments.

Aggregated Micropayment Management
Aggregation and consolidation of receivables across defined billing periods in order to simplify payment processes and optimise costs.

3 Legal Bases for Processing by PAYONE

The processing of personal data for payment processing purposes is necessary for the performance of the purchase contract or other underlying agreement (such as a service or contract-for-work agreement) between the merchant and the cardholder/user and is therefore based on Article 6(1)(b) GDPR.

In addition, personal data is processed on the basis of the legitimate interests of PAYONE or its contractual partners pursuant to Article 6(1)(f) GDPR.

These legitimate interests include, in particular:
preventing payment defaults and mitigating financial risk;
simplifying payment processes; and
optimising costs for the mutual benefit of both cardholders/users and merchants.

4 Categories of Personal Data Processed by PAYONE

PAYONE stores and processes only the personal data necessary for the provision of the relevant service.

Depending on the payment method used, the following categories of personal data may be processed as part of payment processing:

IBAN;

payment card number;

card verification code (security code); and

transaction data (such as the date and time of the transaction and the transaction amount).

Fraud prevention measures are also based primarily on the processing of transaction data.

For receivables management and debt collection purposes, personal data such as invoice amounts, payment amounts, due dates and recipient details may be processed.

Creditworthiness checks may be carried out using address, bank account and card data, which may be transmitted to credit reference agencies for this purpose.

For invoicing purposes, personal data such as recipient details, bank account information and payment amounts may be processed.

For subscription management, information relating to the recipient, payment amount, contract term and agreed billing cycles may be processed.

Aggregated micropayment management requires the processing of personal data such as billing period information, the number of transactions, recipient details and bank account or card information.

5 Source of the Personal Data Processed by PAYONE

The personal data of cardholders and users is collected by the merchant. Depending on the payment environment, the data is collected either via a point-of-sale (POS) terminal at a physical point of sale or through the merchant's online shop or website.

The merchant then transmits this personal data to PAYONE for the purpose of providing the services described above.

6. Categories of Recipients of Personal Data

To fulfil its contractual and legal obligations, PAYONE may disclose personal data to the following categories of recipients, depending on the services provided:

• banks, card schemes (including Visa and Mastercard) and payment service providers (such as Alipay);
• for online transactions: web crawling service providers, hosting providers, data centre operators and tracking service providers;
• e-commerce service providers (providers of payment solutions for online shops);
• billing service providers and providers of clearing and settlement services;
• other service providers, including credit reference agencies for creditworthiness checks, providers of direct debit and invoice purchase protection services, debt collection service providers and print service providers used for invoicing; and
• public authorities (in particular law enforcement authorities, such as the police and public prosecutor's office) where legally justified information requests are made.

7 Transfers of Personal Data to Third Countries (Outside the EU/EEA)

Some recipients of personal data are located in so-called third countries outside the European Union (EU) or the European Economic Area (EEA), where the level of data protection may be lower than within the EU/EEA.

PAYONE transfers personal data to third countries only where this is necessary for the performance of contractual obligations, for the purposes of legitimate interests, or where required by law.

Depending on the services provided, personal data may be transferred to, among others, the following third countries:

• China and Japan (locations of card schemes and payment service providers); and
• the United States (locations of card schemes, tracking service providers, billing service providers, and providers of clearing and settlement services).

To ensure an adequate level of data protection in third countries, transfers are carried out on the basis of:

• an adequacy decision issued by the European Commission;
• appropriate safeguards, such as the EU Standard Contractual Clauses; or
• a derogation pursuant to Article 49 GDPR, where a transfer is permitted even in the absence of an adequacy decision or appropriate safeguards.

8 Retention Period

PAYONE stores and processes personal data for as long as necessary for the performance of the contract and the fulfilment of its contractual and legal obligations.

Where personal data is no longer required for the fulfilment of contractual or statutory obligations and the purpose of processing has ceased to exist, the data will be deleted unless further processing is required for one of the following purposes:

• compliance with retention obligations under commercial, tax or other applicable laws (for example, the retention of accounting-related records for a period of ten years); or
• the preservation of evidence for the duration of applicable statutory limitation periods.

9 Profiling and Credit Scoring

PAYONE does not itself carry out profiling or credit scoring for the purposes of creditworthiness assessments or payment method selection. Instead, PAYONE uses the following credit reference agencies for these purposes:

• infoscore Consumer Data GmbH, Rheinstraße 99, 76532 Baden-Baden;
• Creditreform Boniversum GmbH, Hellersbergstraße 11, 41460 Neuss; and
• SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden.

In relevant cases, these credit reference agencies provide PAYONE with probability scores and credit scores. Based on this information, PAYONE makes recommendations regarding the payment methods offered.

The information required under Article 14 GDPR regarding the activities of infoscore Consumer Data GmbH is available at:

finance.arvato.com/icdinfoblatt

The information required under Article 14 GDPR regarding Creditreform Boniversum GmbH is available at:

www.boniversum.de

Information regarding the processing activities of SCHUFA Holding AG is available at:

www.schufa.de/de/datenschutz-dsgvo

10 Rights of Data Subjects

Every data subject has the right of access pursuant to Article 15 GDPR, the right to rectification pursuant to Article 16 GDPR, the right to erasure pursuant to Article 17 GDPR, the right to restriction of processing pursuant to Article 18 GDPR, the right to object pursuant to Article 21 GDPR, and the right to data portability pursuant to Article 20 GDPR, in each case subject to the applicable legal requirements.

The restrictions set out in Sections 34 and 35 of the German Federal Data Protection Act (BDSG) also apply to the rights of access and erasure.

In addition, you have the right to lodge a complaint with a competent data protection supervisory authority pursuant to Article 77 GDPR in conjunction with Section 19 BDSG.

For example, complaints may be submitted to the supervisory authority responsible for PAYONE:

The Hessian Commissioner for Data Protection and Freedom of Information
Gustav-Stresemann-Ring 1
65189 Wiesbaden
datenschutz.hessen.de

1. Controller

The controller responsible for the processing of your personal data in connection with the use of our Wi‑Fi hotspots within the meaning of the General Data Protection Regulation ("GDPR") is:

hotsplots GmbH
Rotherstraße 22
10245 Berlin
Telephone: +49 (0)30 2977348-0
Fax: +49 (0)30 2977348-99
Email: datenschutz@hotsplots.de

If you have any questions regarding data protection in connection with our products and services, you may also contact our Data Protection Officer at any time.

The Data Protection Officer can be contacted at the postal address above or by email at datenschutz@hotsplots.de (please state: "For the attention of the HOTSPLOTS Data Protection Officer").

2. Processing of Personal Data When Using HOTSPLOTS Wi-Fi

2.1 Traffic Data

Whenever you use our Wi‑Fi hotspots, we collect traffic data. This includes:

1. hotspot name;
2. timestamps (date and time) of logins, including the type of login;
3. duration of use;
4. volume of data transmitted;
5. session ID, tariff ID and timestamps relating to the latest billing data for a session;
6. the hardware identifier of the device used (MAC address);
7. the hardware identifier of the hotspot router (MAC address);
8. the IP address of the requesting device within the local network (LAN) and the IP address of the hotspot router on the internet;
9. the name of the VPN server and internet IP address, which may be determined using the data referred to above;
10. the username of a registered user or ticket number;
11. timestamps (date and time) of unsuccessful login attempts, including the type of error; and
12. average bandwidth usage over recent minutes (maximum of 10 minutes) and the number of transmitted data packets.

The collection and processing of this traffic data is necessary to establish and maintain telecommunications services and to facilitate billing.

For these purposes, traffic data listed under items 1 to 6 above is also stored internally on a temporary basis (see the section "Retention Period") and analysed for statistical purposes. Where possible, traffic data is additionally pseudonymised using hashing techniques during the retention period as an additional security measure.

We comply with telecommunications secrecy requirements. In particular, we do not analyse the content of communications or their detailed circumstances, nor do we disclose traffic data to third parties.

Statistical analysis of the data is necessary for operational purposes, in particular to identify and resolve technical issues and to detect misuse of the service. The data retained for statistical analysis does not directly identify you.

The legal basis for this processing is Article 6(1)(b) GDPR.

2.2 Registered HOTSPLOTS User

At some of our hotspots, users may log in using self-selected access credentials if they have previously registered with us. Following registration, users can also access a customer account area and top up credit for the use of our hotspots.

Further information on the collection and processing of personal data in connection with registration can be found in the privacy information for our website.

If you use our hotspots as a registered customer, we process billing data and subscriber data in addition to the traffic data described above for billing purposes and fraud prevention. The legal basis for this processing is Article 6(1)(b) GDPR.

Subscriber data includes:

• username and password;
• first and last name;
• address;
• email address;
• bank account details (account holder, IBAN, BIC and bank name);

and, where voluntarily provided:

• company name;
• telephone and fax number;
• website; and

• VAT identification number (VAT ID).

  2.3 Users with Location Tickets

If you use our hotspots with a Location Ticket, we process, in addition to the traffic data described above, information relating to the ticket for billing purposes. This includes the ticket number, password and information regarding the validity of the ticket.

The legal basis for this processing is Article 6(1)(b) GDPR.

2.4 Contacting Us

There are various ways for you to contact us, including by email or by using the contact form on our website.

In this context, we process your personal data solely for the purpose of communicating with you. The legal basis for this processing is Article 6(1)(b) GDPR.

The personal data collected through the contact form will be deleted automatically once your enquiry has been fully processed, unless we are required to retain your enquiry in order to fulfil contractual or legal obligations (see the section "Retention Period").

3. Disclosure of Data

As a general rule, we disclose personal data collected by us only where:

• you have given your express consent pursuant to Article 6(1)(a) GDPR;
• disclosure is necessary pursuant to Article 6(1)(f) GDPR for the establishment, exercise or defence of legal claims and there is no reason to assume that you have an overriding legitimate interest in the non-disclosure of your personal data;
• we are legally required to disclose the data pursuant to Article 6(1)(c) GDPR; or
• disclosure is permitted by law and necessary pursuant to Article 6(1)(b) GDPR for the performance of a contract with you or for taking steps at your request prior to entering into a contract.
• Some processing activities may be carried out by our service providers. These include the operators of the data centres in which our database and web servers are hosted (Interxion Deutschland GmbH and PlusServer GmbH). While these providers do not have access to the servers themselves, they may have physical access to the hardware.
• Our ERP system support provider, Intero Technologies GmbH, may have access to certain subscriber data and accounting information.
• Where we disclose personal data to service providers, they may process such data only for the performance of their assigned services. Service providers are carefully selected and engaged by us, are contractually bound by our instructions, implement appropriate technical and organisational measures to protect the rights of data subjects, and are subject to regular monitoring by us.

4. Retention Period

As a general rule, we retain personal data only for as long as necessary to fulfil the contractual or legal obligations for which it was collected. Once these purposes no longer apply, we will delete the data without undue delay unless it is required for evidential purposes until the expiry of statutory limitation periods or to comply with statutory retention obligations.

• Subscriber data of registered users (see Section 2.2) will be deleted during the fourth year following the end of the most recent contract or, where no contract was concluded, in the year following the deletion of the customer account.
• Subscriber data relating to Location Tickets (see Section 2.3) will be deleted during the fourth year following the last possible date of use of the respective ticket.
• Traffic data relating to successful logins is generally retained for up to seven days. Otherwise, such data is generally deleted once it is more than three days old. Where traffic data is also required for billing purposes, it may be retained for a longer period. Traffic data relevant for billing purposes is deleted on a monthly basis once it is more than three months old.

5. Your Rights

You have the right at any time to request information about the processing of your personal data by us. As part of providing such information, we will explain how your personal data is processed and provide you with an overview of the personal data stored about you.

If any of the personal data we hold about you is inaccurate or no longer up to date, you have the right to request its rectification.

You may also request the erasure of your personal data. Where erasure is exceptionally not possible due to legal requirements, the data will be restricted so that it is available only for the relevant legal purpose.

You may also request the restriction of processing of your personal data, for example if you believe that the data we hold about you is inaccurate.

You also have the right to data portability. This means that, upon request, we will provide you with a digital copy of the personal data you have provided to us.

To exercise any of the rights described above, you may contact us at any time using the contact details provided above. This also applies if you wish to obtain copies of safeguards demonstrating an adequate level of data protection.

You also have the right to lodge a complaint with the competent data protection supervisory authority. You may exercise this right with a supervisory authority in the Member State of your habitual residence, place of work or the place of the alleged infringement.

For hotsplots GmbH, the competent supervisory authority is:

Berlin Commissioner for Data Protection and Freedom of Information
Friedrichstraße 219
10969 Berlin

6. Right to Withdraw Consent and Right to Object

You have the right to withdraw any consent you have given to us at any time. As a result, we will no longer process your personal data on the basis of that consent in the future. The withdrawal of consent does not affect the lawfulness of any processing carried out on the basis of your consent before its withdrawal.

Where we process your personal data on the basis of legitimate interests, you have the right to object to such processing at any time on grounds relating to your particular situation.

If you wish to exercise your right to withdraw consent or your right to object, it is sufficient to send an informal notification using the contact details provided above.

7. Data Security

We maintain up-to-date technical and organisational measures to ensure data security, in particular to protect your personal data against risks associated with data transmission and against unauthorised access by third parties.

These measures are regularly reviewed and updated to reflect the current state of the art.

Our security concept is submitted to the Federal Network Agency (Bundesnetzagentur) on a regular basis and is subject to review by that authority.

8. Changes to this Privacy Information

We may update this Privacy Information from time to time, for example if we modify our website or if changes in legal or regulatory requirements make this necessary.

Controller:

The controller responsible for processing your personal data is:

regiobus Hannover GmbH
Georgstraße 54
30159 Hannover

If you have any questions or wish to contact our Data Protection Officer, you may do so at:

datenschutz@regiobus.deor regiobus Hannover GmbH, Georgstraße 54, 30159 Hannover

Purpose and Legal Basis of Processing

The personal data you provide will be collected, processed and used for the purpose of fulfilling your contractual obligations as a passenger who has been found travelling without a valid ticket, pursuant to Article 6(1)(b) and (c) GDPR.

Providing your personal data is necessary for processing payment of the Increased Fare Charge. If you do not provide the required personal data, it may be necessary to involve the police.

To process the Increased Fare Charge, your information will be forwarded to the responsible employees of regiobus Hannover GmbH.

As part of our cooperation arrangements, your personal data will also be shared with:

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft
Am Hohen Ufer 6
30159 Hannover

for the purpose of fully processing the matter.

If you provide incorrect or incomplete address details and this prevents us from delivering correspondence to you, enquiries may be made to the residents' registration authority in order to determine your current address.

Personal data may also be disclosed, where necessary, to police authorities, public prosecutors, courts or debt collection agencies.

The personal data you provide will not be transferred to a third country or an international organisation. No such transfer is planned.

Retention Period

Your personal data will be retained until the Increased Fare Charge has been paid in full and will thereafter be deleted in accordance with applicable data protection requirements.

Data Subject Rights

Pursuant to Article 15 GDPR, you have the right to obtain information about the processing of your personal data.

You also have the right to request rectification, erasure or, where erasure is not possible, restriction of processing, as well as the right to data portability in accordance with Articles 16 to 18 and 20 GDPR. If you wish to exercise any of these rights, please contact our Data Protection Officer.

You also have the right to lodge a complaint with the competent supervisory authority at any time. If you believe that your personal data is not being processed in accordance with applicable data protection laws, we kindly ask that you first contact our Data Protection Officer.

Right to Object

You also have the right to object at any time to the processing of your personal data.

For the purposes of lost property management, the controllers act as joint controllers within the meaning of Article 26 GDPR.

As part of this cooperation, it may be necessary for the joint controllers to access your personal data. The joint controllers are therefore jointly responsible for the protection of your personal data.

Joint Controllers:

Joint Controller 1

regiobus Hannover GmbH

Georgstraße 54

30159 Hannover

Telephone: +49 511-368880

Email: info@regiobus.de

Data Protection Officer:

Email: datenschutz@regiobus.de or regiobus Hannover GmbH, Georgstraße 54, 30159 Hannover

Joint Controller 2

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft

Am Hohen Ufer 6

30159 Hannover

Email: info@uestra.de

Telephone: +49 511-16680

Data Protection Officer:

ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft

Der Beauftragte für den Datenschutz

Am Hohen Ufer 6

30159 Hannover

Email: datenschutz@uestra.de

Telephone: +49 511-16680

Purpose and Legal Basis of Processing the Finder's Data 

If you hand in a lost item to us, we process the information that you voluntarily provide. This may include:

• first and last name;
• address details; and
• details of the item found, the date it was found and the location where it was found.

Where the finder is a minor, the same information is collected from their parent(s) or legal guardian(s).

The provision of your personal data is necessary to enable us to notify you when the lost item has been returned to its rightful owner and to provide you with the details of the owner/authorised recipient when the item is collected.

This enables you to assert any entitlement to a finder's reward.

The legal basis for this processing is Article 6(1)(b) and (c) GDPR. The relevant legal obligation arises from Sections 978(2) and 971 of the German Civil Code (BGB).

Finder's Reward

Pursuant to Sections 978 et seq. of the German Civil Code (BGB), the finder may be entitled to a finder's reward. Entitlement to a finder's reward generally requires, among other things, that:

• the item has a value of at least EUR 50.00;
• the finder is not an employee of regiobus; and
• the finder has not waived the right to a finder's reward in advance.

The legal basis for this processing is Article 6(1)(b) and (c) GDPR. The relevant legal obligation arises from Sections 978(2) and 971 of the German Civil Code (BGB).

Where you have consented to the processing of your personal data for the purpose of asserting a claim for a finder's reward, you may withdraw your consent at any time with effect for the future and without providing any reasons. To do so, it is sufficient to contact the controller using the contact details provided above.

Die Speicherung personenbezogener Daten erfolgt (i) für die Dauer von 6 Monaten nach Rückgabe der Fundsache an Empfangsberechtigte, (ii) bei Nichtabholung der Fundsache 3 Jahre nach erfolgter Versteigerung. Verbleibt der Versteigerungserlös bei der Verkehrsanstalt, so richtet sich der Anspruch auf Finderlohn gegen diese. Dieser Anspruch erlischt (nicht verjährt) mit dem Ablauf von drei Jahren nach seiner Entstehung, § 978 Abs. 3; § 195 BGB.  Es handelt sich hier um eine Ausschlussfrist.

Zur Fundsachenbearbeitung, Organisation, Sicherstellung von Fundsachen nach gesetzlichen Vorgaben und ggf. Herausgabe an den Verlierer werden externe Dienstleister eingesetzt, die die Daten ausschließlich innerhalb der EU verarbeiten. Die externen Dienstleister erhalten von der regiobus nur solche personenbezogenen Daten, die zur Ausführung des jeweiligen Auftrags erforderlich sind und verarbeiten diese ausschließlich auf Basis der Weisungen der regiobus. Soweit erforderlich werden die Dienstleister durch Auftragsverarbeitungsverträge datenschutzrechtlich verpflichtet.

Sofern Sie einen Anspruch auf Finderlohn erheben, benötigen wir Ihre Angaben (also Name, Adresse), um Ihnen die Herausgabe der Sache an den Empfangsberechtigten anzuzeigen und die Daten des Verlierers übergeben zu können.

Falls Sie einen Fundgegenstand bei uns abholen oder den Verlust einer Sache online melden, verarbeiten wir Ihre Angaben, u.a.

• Vor- und Nachname

• Adressdaten (auch Mailadresse)

• Angaben zum Fundgegenstand

• Ggf. die Personalausweisnummer/Führerscheinnummer

• Kontodaten (IBAN) – bei Ausgabe von Geldbeträgen über 20 € bzw. bei Zahlung der Fundgebühr

Rechtsgrundlage für die vorstehend beschriebene Verarbeitung Ihrer personenbezogenen Daten ist Art. 6 Abs. 1 UAbs.1. lit. b), c) und f) DSGVO.

Werden Ihre Daten für die unmittelbare Erfüllung vertraglicher oder gesetzlicher Pflichten nicht mehr benötigt oder verlief ihre Online-Suche erfolglos, werden diese in der Regel nach 6 Monaten gelöscht, es sei denn, ihre fortgesetzte Speicherung ist zwecks Erfüllung handels- oder steuerrechtlicher Aufbewahrungsfristen erforderlich. Die Aufbewahrungsfrist beträgt 10 Jahre. Innerhalb dieser gesetzlichen Aufbewahrungsfrist besteht kein Löschungsanspruch.

Ihre Daten geben wir an den Finder weiter, sofern dieser einen Anspruch auf Finder- lohn und/oder Ersatz etwaiger Aufwendungen geltend macht. Ferner werden externe Dienstleister zur Fundsachenbearbeitung eingesetzt, die die Daten ausschließlich innerhalb der EU verarbeiten.

Die externen Dienstleister erhalten von der regiobus nur solche personenbezogenen Daten, die zur Ausführung des jeweiligen Auftrags erforderlich sind und verarbeiten diese ausschließlich auf Basis der Weisungen der regiobus. Soweit erforderlich werden die Dienstleister durch Auftragsverarbeitungsverträge datenschutzrechtlich verpflichtet. 

Die regiobus leitet zudem als Fundsachen abgegebene Personaldokumente (Personalausweise, Reisepässe, Aufenthaltstitel etc.), Krankenkassenkarten sowie Kreditkarten an die ausstellenden Behörden und Institution zu. Schülerausweise senden wir an die zuständige Schule.

Ohne Bereitstellung Ihrer Angaben händigen wir die Fundsache nicht aus.

Sie haben das Recht:

• gemäß Art. 15 DSGVO Auskunft über Ihre von uns verarbeiteten personenbezogenen Daten zu verlangen. Insbesondere können Sie Auskunft über die Verarbeitungszwecke, die Kategorie der personenbezogenen Daten, die Kategorien von Empfängern, gegenüber denen Ihre Daten offengelegt wurden oder werden, die geplante Speicherdauer, das Bestehen eines Rechts auf Berichtigung, Löschung, Einschränkung der Verarbeitung oder Widerspruch, das Bestehen eines Beschwerderechts, die Herkunft ihrer Daten, sofern diese nicht bei uns erhoben wurden, sowie über das Bestehen einer automatisierten Entscheidungsfindung einschließlich Profiling und ggf. aussagekräftigen Informationen zu deren Einzelheiten verlangen;

• gemäß Art. 16 DSGVO unverzüglich die Berichtigung unrichtiger oder Vervollständigung Ihrer bei uns gespeicherten personenbezogenen Daten zu verlangen.

• gemäß Art. 17 DSGVO die Löschung Ihrer bei uns gespeicherten personenbezogenen Daten zu verlangen, soweit nicht die Verarbeitung zur Ausübung des Rechts auf freie Meinungsäußerung und Information, zur Erfüllung einer recht- lichen Verpflichtung, aus Gründen des öffentlichen Interesses oder zur Geltendmachung, Ausübung oder Verteidigung von Rechtsansprüchen erforderlich ist;

• gemäß Art. 18 DSGVO die Einschränkung der Verarbeitung Ihrer personenbezogenen Daten zu verlangen, soweit die Richtigkeit der Daten von Ihnen bestritten wird, die Verarbeitung unrechtmäßig ist, Sie aber deren Löschung ablehnen und wir die Daten nicht mehr benötigen, Sie jedoch diese zur Geltendmachung, Ausübung oder Verteidigung von Rechtsansprüchen benötigen oder Sie gemäß Art. 21 DSGVO Widerspruch gegen die Verarbeitung eingelegt haben;

• gemäß Art. 20 DSGVO Ihre personenbezogenen Daten, die Sie uns bereitgestellt haben, in einem strukturierten, gängigen und maschinenlesebaren Format zu erhalten oder die Übermittlung an einen anderen Verantwortlichen zu verlangen;

• gemäß Art. 7 Abs. 3 DSGVO Ihre einmal erteilte Einwilligung jederzeit gegen- über uns zu widerrufen. Dies hat zur Folge, dass wir die Datenverarbeitung, die auf dieser Einwilligung beruhte, für die Zukunft nicht mehr fortführen dürfen; und

• gemäß Art. 77 DSGVO sich bei einer Aufsichtsbehörde zu beschweren. In der Regel können Sie sich hierfür an die Aufsichtsbehörde Ihres üblichen Aufenthaltsortes oder Arbeitsplatzes oder unseres Firmensitzes wenden.

Sofern Ihre personenbezogenen Daten auf Grundlage von berechtigten Interessen gemäß Art. 6 Abs. 1 S. 1 lit. f DSGVO verarbeitet werden, haben Sie das Recht, gemäß Art. 21 DSGVO Widerspruch gegen die Verarbeitung Ihrer personenbezogenen Daten einzulegen, soweit dafür Gründe vorliegen, die sich aus Ihrer besonderen Situation ergeben oder sich der Widerspruch gegen Direktwerbung richtet. Im letzteren Fall haben Sie ein generelles Widerspruchsrecht, das ohne Angabe einer besonderen Situation von uns umgesetzt wird.

Verantwortlicher für die Verarbeitung Ihrer personenbezogenen Daten ist:

regiobus Hannover GmbH
Georgstraße 54
30159 Hannover

Sollten Sie Fragen haben oder eine Kontaktaufnahme zu unserem Datenschutzbeauftragten wünschen, so ist dies unter folgender E-Mail-Adresse möglich: datenschutzteam019@s-con.de oder S-CON GmbH & Co. KG Podbielskistr. 386 30659 Hannover.

Die von Ihnen übermittelten beziehungsweise die uns von Dritten (Versicherungen, Krankenkasse oder Strafverfolgungsbehörden) bereitgestellten personenbezogenen Daten werden zum Zweck der Bearbeitung und Abwicklung des zwischen Ihnen und dem Verantwortlichen entstandenen Schadenfalls sowie zum Zweck der Klärung und Regulierung von etwaigen Schadensersatzansprüchen gegenüber dem Verantwortlichen gemäß Art. 6 Abs. 1 UAbs. 1 lit. c) sowie Art. 6 Abs.1 UAbs.1 lit. f) DSGVO erhoben, verarbeitet und genutzt. Die Bereitstellung Ihrer personenbezogenen Daten ist für die Schadensregulierung erforderlich. Darüber hinaus sind Sie dazu gesetzlich verpflichtet, uns Ihre Daten mitzuteilen.

In dem Fall, dass uns Ihre personenbezogenen Daten durch Dritte auf Grund eines eingetretenen Schadenfalls übermittelt werden, verarbeiten wir folgende Daten zu oben genannten Zwecken: Name, Vorname, Anschrift,Telefonnummer, Aktenzeichen, Versicherungsdaten sowie ggf. KFZ-Kennzeichen und Infromationen zum Schadenfall.

Bei Nichtbereitstellung ist es uns leider nicht möglich, die Ihnen ggf. zustehende Schadensersatzansprüche zu prüfen und unseren gesetzlichen bzw. rechtlichen Verpflichtungen nachzukommen. Eine automatisierte Entscheidungsfindung wird nicht vorgenommen.

Eine Weitergabe Ihrer personenbezogenen Daten erfolgt im Rahmen der Erfüllung unserer Nachweispflichten an die für den vorliegenden Schadenfall zuständigen Versicherungen, Krankenkasse und ggf. Behörde.

Eine Übermittlung an ein Drittland oder eine internationale Organisation der von Ihnen bereitgestellten personenbezogenen Daten findet nicht statt und ist auch nicht in Planung. 

Ihre Daten werden bei uns nach Wegfall des Zwecks (Regulierung des Schadens) gem. § 195 BGB für 3 Jahre gespeichert. Darüber hinaus werden Ihre Daten bis zum Ablauf der gesetzlichen Aufbewahrungsfristen gem. § 257 HGB und §147 AO gespeichert und danach gelöscht.

Gemäß Art. 15 DSGVO steht Ihnen ein Recht auf Auskunft über die Verarbeitung Ihrer personenbezogenen Daten zu.

Darüber hinaus steht es Ihnen frei, Ihre Rechte auf Berichtigung, Löschung oder, sofern das Löschen nicht möglich ist, auf Einschränkung der Verarbeitung und auf Datenübertragbarkeit gemäß der Artikel 16–18, 20 DSGVO geltend zu machen. Sollten Sie dieses Recht in Anspruch nehmen wollen, so wenden Sie sich bitte an unseren Datenschutzbeauftragten.

Weiterhin steht Ihnen das Recht zu, sich jederzeit bei der zuständigen Aufsichtsbehörde zu beschweren. Sollten Sie der Meinung sein, dass die Verarbeitung Ihrer personenbezogenen Daten nicht unter Einhaltung der Datenschutzgesetze erfolgt, würden wir Sie höflich darum bitten, sich mit unserem Datenschutzbeauftragten in Kontakt zu setzen.

Weiterhin haben Sie gemäß DSGVO das Recht, jederzeit der Verarbeitung Ihrer personenbezogenen Daten zu widersprechen.

albus - Datenschutz-Information

Wir freuen uns über Ihr Interesse an der Teilnahme als Mitglied der geschlossenen Nutzergruppe im Rahmen unseres Testbetriebs im Forschungsprojekt „albus - Integration von autonomen Linienbussen in der Region Hannover“. Der Testbetrieb findet im Rahmen einer Erprobungsgenehmigung nach § 16 AFGBV und §1i StVG statt. Die weitere Erprobung von autonomen Bussen im ÖPNV ist nur mithilfe von Testbetrieben möglich, zu denen die Teilnehmer*innen schriftlich ihre freiwillige Bereitschaft erklären. Zum Zwecke der Planung und Durchführung dieser Tests werden erhobene personenbezogene Daten der Teilnehmer (Name, Vorname und Geburtsdatum) mit deren Einwilligung eingeholt, verarbeitet, genutzt und aufbewahrt.

Gemäß Vorgaben des Bundesdatenschutzgesetzes (BDSG) und der europäischen Datenschutz-Verordnung (DSGVO) überwacht der Datenschutzbeauftragte den Umgang mit diesen Daten und stellt die Einhaltung der gesetzlichen Vorgaben sicher.

1. Name und Kontaktdaten der Verantwortlichen

regiobus Hannover GmbH
Georgstr. 54
30159 Hannover

ÜSTRA Hannoversche Verkehrsbetriebe AG
Am Hohen Ufer 6
30159 Hannover

2. Kontaktdaten der Datenschutzbeauftragten

RevCon Audit und Consulting GmbH
Reuterstraße 9
30159 Hannover

3. Verarbeitung der personenbezogenen Daten

a. Personenbezogene Daten die verarbeitet werden:

• Name
• Vorname
• Geburtstag
• E-Mail-Adresse
• IP-Adresse

b. Zwecke der Datenverarbeitung

• Um Ihre Anfrage bzw. Anmeldung als Interessent zu bearbeiten: Um Ihre Anfrage zu bearbeiten benötigen wir Ihre personenbezogenen Angaben (Name, Vorname, Geburtsdatum).
• Um Ihnen einen Fahrtnachweis ausstellen zu können benötigen wir Ihre personenbezogenen Angaben sowie bei einer Online-Buchung Ihre E-Mail-Adresse.
• Um unseren rechtlichen Pflichten nachzukommen.
• Zur Geltendmachung, Ausübung oder Verteidigung von Rechtsansprüchen.

c. Rechtsgrundlage

Wir verarbeiten die uns von Ihnen mitgeteilten personenbezogenen Daten im Rahmen der Zwecke aus 3.b. auf Grundlage von Art. 6 Abs. 1 Abs.1 lit. a DSGVO (Einwilligung). Die Verarbeitung der personenbezogenen Daten erfolgt auf Grundlage der von Ihnen erteilten Einwilligung.

4. Empfänger oder Kategorie von Empfängern der personenbezogenen Daten

Im Rahmen der Durchführung dieses Testbetriebs werden Ihre personenbezogenen Daten in aggregierter und anonymisierter Form verarbeitet. Diese aggregierten Daten werden zu statistischen Zwecken an die zuständigen Behörden weitergegeben, die die Zulassung des Testbetriebs genehmigen. Darüber hinaus können die anonymisierten und aggregierten Daten zu wissenschaftlichen Zwecken an unsere Forschungspartner weitergeleitet werden. Eine Identifizierung einzelner Personen ist hierbei nicht möglich.

Eine Übermittlung an ein Drittland oder eine internationale Organisation der von Ihnen bereitgestellten personenbezogenen Daten findet nicht statt und ist auch nicht in Planung.

5. Dauer der Speicherung der personenbezogenen Daten

Wir speichern Ihre personenbezogenen Daten nicht länger, als es für den Zweck, zu dem sie erfasst wurden, notwendig ist. Das bedeutet, dass Daten in unseren Systemen vernichtet oder gelöscht werden, sobald sie nicht länger benötigt werden. Von uns werden angemessene Maßnahmen ergriffen, um sicherzustellen, dass Ihre personenbezogenen Daten nur unter den folgenden Voraussetzungen verarbeitet werden: Für die Dauer, die die Daten verwendet werden, solange dies für die Projektdurchführung erforderlich oder bis zum Widerruf Ihrer Einwilligung. In jedem Fall erfolgt die Speicherung jedoch nicht länger als zwei Jahre.

6. Betroffenenrechte

Nach der Datenschutz-Grundverordnung stehen Ihnen folgende Rechte zu:

• Werden Ihre personenbezogenen Daten verarbeitet, so haben Sie das Recht Auskunft seitens des Verantwortlichen über die zu Ihrer Person gespeicherten Daten zu erhalten (Art. 15 DSGVO).
• Sollten unrichtige personenbezogene Daten verarbeitet werden, steht Ihnen ein Recht auf Berichtigung zu (Art. 16 DSGVO).
• Liegen die gesetzlichen Voraussetzungen vor, so können Sie die Löschung oder Einschränkung der Verarbeitung verlangen (Art. 17 und 18 DSGVO).
• Wenn Sie in die Datenverarbeitung eingewilligt haben, steht Ihnen gegebenenfalls ein Recht auf Datenübertragbarkeit zu (Art. 20 DSGVO).
• Wenn Sie in die Datenverarbeitung eingewilligt haben, können Sie Ihre Einwilligung jederzeit ohne Angaben von Gründen mit Wirkung für die Zukunft widerrufen. (Art. 7 Abs. 3 S. 1 DSGVO) Durch den Widerruf Ihrer Einwilligung bleibt die bis zu diesem Zeitpunkt bereits erfolgte Datenverarbeitung rechtmäßig.
• Weiterhin steht Ihnen das Recht zu, sich jederzeit bei der zuständigen Aufsichtsbehörde zu beschweren. Sollten Sie der Meinung sein, dass die Verarbeitung Ihrer personenbezogenen Daten nicht unter Einhaltung der Datenschutzgesetze erfolgt, würden wir Sie höflich darum bitten, sich mit unserem Datenschutzbeauftragten in Kontakt zu setzen.

Über verschiedenste Kanäle sind wir mit Ihnen verbunden.

Verarbeitung

Erfolgt die Kontaktaufnahme per Telefon, werden insbesondere Ihre Telefonnummer sowie ggfs. im Rahmen des Gespräches Ihr Name, Ihre Kontaktdaten, der Zeitpunkt des Anrufs, sowie Details zu Ihrem Anliegen verarbeitet.Erfolgt die Kontaktaufnahme per Fax, so werden insbesondere die Faxnummer bzw. die Absenderkennung sowie die sich aus dem Fax ergebenen Daten verarbeitet.

Bei einer Kontaktaufnahme per E-Mail werden insbesondere Ihre E-Mailadresse, Zeitpunkt der E-Mail sowie diejenigen Daten, welche sich aus dem Nachrichtentext (ggf. auch Anhänge) ergeben, verarbeitet. Auf Basis der Daten, die bei Nutzung des Internets, also Websitebesuche und E-Mail-Verkehr, anfallen, werden Daten über jeden Zugriff auf den Server, auf dem sich dieser Dienst befindet, (sogenannte Serverlogfiles) erhoben. Hierzu informiert Sie der Abschnitt Server-Logs / -Protokolle.

Wenn Sie mit uns per Post in Kontakt treten, werden diejenigen Daten, die sich aus Absenderangaben und dem Inhalt der Nachricht (ggf. auch Anlagen) ergeben, verarbeitet.

Bitte beachten Sie, dass der Umfang der erhobenen personenbezogenen Daten im Rahmen der Kontaktaufnahme auch davon abhängt, welche Daten Sie selbst in der Nachricht und durch Anfügen von Dokumenten und Anhängen preisgeben.

Die bei der Kontaktaufnahme von Ihnen gemachten Angaben zur Bearbeitung werden zur Beantwortung der Kontaktanfrage verarbeitet. Ohne Bereitstellung bestimmter Daten können wir Ihre Anfrage nicht oder nur eingeschränkt beantworten. Eine Weitergabe Ihrer im Rahmen der Kontaktaufnahme verarbeiteten Daten erfolgt grundsätzlich nicht. Ausnahme bildet Ihre Einwilligung zur Weitergabe der Daten.

Rechtsgrundlage

Grundlage der Verarbeitung ist insofern die Vertragserfüllung und Bearbeitung vorvertraglicher Anfragen gem. Art. 6 Abs. 1 S. 1 lit. b. DS-GVO sowie auch das berechtigte Interesse an der Bearbeitung Ihrer Nachricht gem. Art. 6 Abs. 1 S. 1 lit. f. DS-GVO.

Es werden personenbezogene Daten der Nutzer erfasst, die mit den Verkehrsunternehmen in Kontakt treten wollen. Der Nutzer ist zu Beginn des Nutzungsvorgangs (vor Absendung des ausgefüllten Kontaktformulars) über Art, Umfang und Zwecke der Erhebung und Verwendung personenbezogener Daten sowie die Verarbeitung seiner Daten zu unterrichten.

Im Rahmen der GVH Garantie können Fahrgäste bei Service-Einschränkungen eine Entschädigung erhalten. Nach den bestehenden Verkehrsverträgen ist jedes Verkehrsunternehmen für die Bearbeitung seiner GVH Pünktlichkeitsgarantiefälle zuständig. Hierfür stellt der GVH eine zentrale Plattform zur Verfügung und wertet nur für statistische Zwecke anonymisiert die Daten aus, um Erkenntnisse zur Qualitätsverbesserung zu gewinnen.

Verarbeitung

Neben den bei der Benutzung unseres Internetauftritts anfallenden Daten (siehe hierzu Abschnitt Website), werden im Rahmen der Inanspruchnahme der GVH Garantie folgende Daten verarbeitet:

• Tarifdaten (Tarif, Fahrkartenart, Fahrkartensorte, Geltungsbereich, Fahrkartennummer, zeitliche Gültigkeit, Datei / Scan zur Fahrkarte),

• Fahrtangaben (u. a. Datum, Uhrzeit, Starthaltestelle, Zielhaltestelle, Auswahl eines Zuges),

• Antragsgrund (u. a. Ausfall, Verspätung, Anschlussverlust, Verschmutzung),

• Stammdaten (u. a. Anrede, Vorname, Name, Straße, Hausnummer, PLZ, Ort),

• Kontaktdaten (E-Mailadresse),

• Kontonummer (IBAN).

Weitergabe

Die Daten werden an das Verkehrsunternehmen weitergeben, das die Inanspruchnahme der Garantie ausgelöst hat.

Rechtsgrundlage

Die Verarbeitung erfolgt zur Prüfung und Bearbeitung Ihres Garantiefalls durch das zuständige Verkehrsunternehmen, auf Basis Ihrer Einwilligung entsprechend Art. 6 Abs. 1 lit. a DS-GVO, § 25 Abs.1 TTDSG.. Sie können die Einwilligung jederzeit widerrufen, ohne dass die Rechtmäßigkeit der aufgrund der Einwilligung bis zum Widerruf erfolgten Verarbeitung berührt wird.

Widerrufsrecht

Sie können Ihre Einwilligung ohne Angabe von Gründen jederzeit mit Wirkung für die Zukunft per E-Mail an: garantie@uestra.de oder per Post an: ÜSTRA Servicecenter, Karmarschstr. 30/32, 30159 Hannover, widerrufen.

Speicherdauer

Die personenbezogenen Daten zu Ihrem Garantiefall werden über die Dauer der eigentlichen Bearbeitung des Garantiefalls hinaus, zum Zwecke der Missbrauchsprävention für 12 Monate beim entsprechenden Verkehrsunternehmen gespeichert. Zweckgebunden, zur Erfüllung handels- oder steuerrechtlicher Aufbewahrungsfristen, werden die Daten für bis zu 10 Jahre vom jeweiligen Verkehrsunternehmen archiviert. Nach Ablauf einer Frist von 12 Monaten, ohne Eingang einer neuen Garantieanfrage, werden die Daten automatisch anonymisiert.

Die ÜSTRA App ist der ideale Begleiter für Ihre Mobilität im Gebiet des Großraum-Verkehr Hannover. Werden bestimmte Services innerhalb der App in Anspruch genommen, kann eine Verarbeitung personenbezogener Daten erforderlich werden. In unserer separaten Datenschutzinformation zur ÜSTRA App informieren wir Sie transparent über die Art, den Umfang und den Zweck der erhobenen und verarbeiteten Daten sowie Ihre Rechte. 

Wir verwenden Ihre unter Ziffer 1 genannten Daten, gemäß Ihrer im Rahmen der Abonnementbestellung für die Monatskarte gegenüber. der ÜSTRA erteilten Einwilligung in den Erhalt von aktuellen Angeboten und Informationen, Eigenwerbung für Produkte und Dienstleistungen sowie für Markt- und Meinungsforschungszwecke des GVH, von regiobus sowie der ÜSTRA.

Soweit in unseren E-Mails mittels externer Links zu Inhalten anderer Anbieter verlinkt wird, ist dies erkennbar. Entweder ist dieser Anbieter explizit gekennzeichnet oder aber mittels eines Hyperlinks kenntlich gemacht. Die Nutzung dieser Angebote unterliegt den Bedingungen der jeweiligen Betreiber.

1. Arten der verarbeiteten Daten

Im Rahmen des Newsletter-Abonnements werden folgende Daten verarbeitet:

• Anrede
• Vorname
• Nachname
• Anschrift (bei Zustellung per Post)
• E-Mail-Adresse (bei E-Mail-Newsletter)
• Art und Dauer des Abonnements

2. Kategorien Betroffener Personen

Direktmarketing Abonnenten

3. Zweck und Rechtsgrundlage

Die Verarbeitung erfolgt auf Basis Ihrer Einwilligung, entsprechend Art. 6 Abs. 1 lit. a DS-GVO. Sie können die Einwilligung jederzeit widerrufen, ohne dass die Rechtmäßigkeit der aufgrund der Einwilligung bis zum Widerruf erfolgten Verarbeitung berührt wird. Nach Eingang Ihres erklärten Widerrufs, werden wir ab diesem Zeitpunkt die Verarbeitung Ihrer personenbezogenen Daten beenden, soweit nicht gesetzliche Erfordernisse bestehen, nach welchen wir dazu verpflichtet sind, einzelne Daten über Sie weiter zu verarbeiten.

Zu statistischen Zwecken setzen wir bei unseren E-Mailings anonymisiertes Tracking ein. Dabei werden Empfängerreaktionen (Öffnung eines Mailings, Klicken auf Text- und Bild-Links, Herunterladen von Bildern mit einem E-Mail-Programm) erfasst und anonymisiert gespeichert. Ein Rückschluss auf einzelne Nutzer ist daraus nicht möglich.

Erfolgt im Rahmen des Direktmarketings eine Weiterleitung auf unsere Internetpräsenz, so können dort im Rahmen unserer Webanalysedienste weitere Daten über die Webseitennutzung gesammelt werden. Diese Daten werden nicht mit den Daten zum Direktmarketing zusammengeführt. Hinsichtlich der bei Benutzung unseres Internetauftritts anfallenden Daten gibt der Abschnitt zur Website entsprechende Auskunft.

4. Widerrufsrecht

Sie können Ihre Einwilligung ohne Angabe von Gründen jederzeit mit Wirkung für die Zukunft per E-Mail an: widerruf@gvh.de widerrufen.

5. Speicherdauer

Die über diese Verarbeitung erhobenen Daten werden so lange durch uns gespeichert bis der Zweck, welchen die Verarbeitung verfolgt, erreicht ist oder aber Sie den Widerruf Ihrer Einwilligung erklärt haben, sofern nicht gesetzliche Aufbewahrungsfristen, denen wir unterliegen, eine längere Speicherdauer vorsehen.