1.) Information in accordance with Article 13 GDPR
We know that the careful handling of your personal data is very important to you and appreciate your confidence that VVT will handle this data conscientiously.
2.) Data controller in accordance with Article 24 GDPR
Verkehrsverbund Tirol GesmbH
Sterzinger Strasse 3
+43 512 56 16 16
3.) Data protection officer in accordance with Article 37 ff GDPR
VVT is 100% owned by the state of Tyrol. For this reason VVT has appointed the following data protection officer to protect your data:
- Which information we collect and for what reason;
- How we use this information;
- Your rights as a data subject;
We have tried to make the presentation as simple as possible.
5.) Legal basis for processing
VVT processes personal data exclusively on one of the following legal bases:
- Your consent
- On a contractual basis
- Legitimate interests
If you also transfer the personal data of fellow passengers to VVT as part of buying the ticket, you declare in a legally binding manner that you have been authorised to do so by the data owners in advance. The legal basis for processing the personal data of fellow passengers is point (a) and (b) of Article 6(1) GDPR.
6.) Processing personal data in special categories in accordance with Article 9 GDPR
If you transfer information to VVT relating to your physical or mental health in connection with purchasing a ticket, you grant VVT express permission for the further use for the purpose of passenger transport in accordance with Section 3 of the VVT Terms and Conditions in accordance with point (a) of Article 9(2) and point (b) of Article. 6(1) GDPR.
7.) How do we protect your personal data?
We have introduced a number of technical and organisational measures in accordance with Article 32 GDPR in order to guarantee the protection of your personal data. Your personal information is stored on secure networks that can only be accessed by a limited number of people who have special access rights and are committed to respecting and maintaining the confidentiality of that information.
Despite these measures, each time you provide personal information on the Internet, there is a risk that it may be intercepted and used by third parties outside our control. Although we do everything in our power to protect your personal information and privacy, we cannot guarantee the security of the information you provide over the Internet.
VVT shall take the following data security measures:
- Encryption of some services using SSL;
- User authentication controls;
- Secure network infrastructures;
- Restriction of access to personal data;
- Network monitoring solutions;
- Compliance Policy;
- Raising staff awareness as part of training;
- Cyclical penetration testing of the network infrastructure by a certified company.
8.) Who has access to your personal data and how far does this access extend?
VVT may have the personal data processed by contract processors. Personal data is processed exclusively on our instructions and for the previously defined purposes.
9.) Personal data is processed exclusively for the purposes specified by you.
You are entitled to the following rights as a data subject in terms of the GDPR, which we wish to inform you of here.
a) RIGHT TO INFORMATION (Article 15 GDPR)
You have the right to be provided with information by the data controller about the personal data retained about your identity and with a copy of such information free of charge at any time. If the right to information is unduly exercised by the data subject by sending excessive requests for information to the data controller, VVT may charge a local fee for the administrative costs of providing the data subject with information.
b) RIGHT TO CORRECTION (ARTICLE 16 GDPR)
You have the right to request that the data controller immediately corrects incorrect personal data concerning you.
c) RIGHT TO ERASURE (RIGHT TO BE FORGOTTEN) (Article 17 GDPR)
You have the right to request from the data controller that the personal data concerning you be deleted immediately, insofar as they are not necessary for the purposes for which they were collected or otherwise processed and the deletion does not conflict with any legal grounds. If the deletion is requested by the person concerned, VVT checks the aforementioned legal requirements and informs you accordingly.
d)RIGHT TO RESTRICTION OF PROCESSING (Article 18 GDPR):
You have the right to request that the data controller restrict the processing of your personal data.
e) RIGHT TO DATA PORTABILITY (Article 20 GDPR)
You have the right to receive any personal data related to you which you have provided the data controller with in a structured, commonly used and machine-readable format. You also have the right to transfer this data to another data controller without hindrance from the data controller who has been provided with the personal data.
f) RIGHT TO OBJECT (Article 21 GDPR)
If VVT processes personal data that are based on a public interest or carried out in the exercising of official authority or are required due to a legitimate interest, you have the right to object to this processing of your data at any time on grounds relating to your particular situation. If VVT processes personal data in order to carry out direct marketing, you have the right to object to this processing of your data at any time. This shall also apply to profiling in so far as it is linked to such direct marketing.
g) RIGHT TO WITHDRAWAL OF CONSENT (Article 7(3) GDPR)
You have the right to withdraw your previously given consent to any processing of personal data at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
h) RIGHT TO LODGE A COMPLAINT (Article 77 GDPR)
If you are of the opinion that the processing of your data infringes applicable data protection legislation, or that your legal claim to data protection may be violated in some way, you can complain to the relevant supervisory authority. In Austria, this is the Austrian Data Protection Authority, Wickenburggasse 8, 1080 Vienna.
i) COMPLIANCE WITH DATA SUBJECT RIGHTS
If you have any questions regarding data protection or exercising the above rights, please contact us using the following contact details:
- By email to: datenschutz@VVT.at*
- By post to: Verkehrsverbund Tirol GesmbH, Sterzinger Strasse 3, 6020 Innsbruck *
*Please attach an official copy of your ID documents.
We will not be able to process the data subject’s request without successfully verifying the identity beforehand. For this reason, we ask you to support the identity verification process accordingly.
10.) Storage of personal data
In accordance with applicable law, we are obligated to delete your data if the purpose no longer exists and there is no legal basis for data storage in accordance with point (e) of Article 5(1) GDPR.
Personal data will be saved and stored in any case until the termination of the business relationship or until the expiry of statutory retention periods, in addition until the termination of any legal disputes in which the data is required as evidence, at most until the expiry of seven calendar years after the last contact.
11.) Data transfer to third parties
Your personal data are not disclosed to third parties for any purposes other than the purposes listed below.
VVT may pass on your personal data to suppliers who provide services on our behalf in accordance with our instructions.
VVT may also pass on your personal data to our affiliated companies and partners.
12.) Collection and storage of personal data; type, purpose and use
When accessing this website, information used by the browser on your device is automatically sent to the server hosting our website. This information is stored temporarily in a so-called log file. The following information is collected in this process without any manual input from you and will be stored until automatic erasure:
- IP address of the accessing computer,
- Date and time of access,
- Name and URL of the file accessed,
- Website, the access request originates from (referrer URL),
- The browser used and, as the case may be, the operating system of your computer and the name of your access provider.
We currently make use of the option to use this data on the legal basis of point (f) of Article 6(1) GDPR for purposes such as
- Guaranteeing smooth establishment of connection to the website,
- Guaranteeing convenient use of our website,
- Evaluating the system security and stability, as well as
- other administrative purposes.
13.) Online contact form
You can use a contact form to send enquiries, suggestions and requests to VVT.
You will need to provide the following information to contact us:
Furthermore you have to write a text in the corresponding field.
You acknowledge that the aforementioned data will be processed by VVT for the purpose of processing or responding to your request.
Your data is processed on the basis of your consent in accordance with point (e) of Article (6)(1) GDPR.
You can give your consent to being sent various newsletters.
When registering in the ticket shop you can consent to our service for offers and news.
Furthermore, you will receive coordinated information and recommendations (based on your previous purchase and travel behaviour or other personal preferences) by email, telephone, SMS or other VVT channels (e.g. VVT account).
The content of the offers, information and recommendations specifically includes the latest offers, products, travel, services, competitions, vouchers, campaigns, customer surveys and other customer loyalty programmes.
Your data that are used for this purpose by Verkehrsverbund Tirol GesmbH are:
- First name / Surname
- Date of birth
- Address and contact details
- Personal details saved for booking, customer and season ticket, discount, travel and voucher data
- My preferences and customer loyalty programmes
- Device and browser information including my assignable user behaviour
- Data on possible mobility preferences or restrictions
You agree that the aforementioned personal data may be processed by VVT for the purpose of sending you information about offers, product innovations, competitions in accordance with points (a), (b) and (f) of Article 6(1) GDPR.
VVT may arrange for your personal data to be disclosed to contract processors. Your personal data will be processed by the processor exclusively on our instructions and for the defined purpose.
The consent given by you can be withdrawn at any time in accordance with point (c) of Article 6(2) GDPR without affecting the lawfulness of processing based on consent before its withdrawal. You can also cancel your newsletter subscription from any newsletter or mailing at any time by clicking on Unsubscribe.
If you withdraw your consent in accordance with point (c) of Article 6(1) and (2) GDPR, your personal data will be routinely blocked or deleted in accordance with the statutory provisions, unless a legal provision provides otherwise.
15.) Use of CleverReach
The newsletters is sent using “CleverReach”, a newsletter platform provided by CleverReach GmbH & Co. KG – www.cleverreach.com Data is processed on the basis on your consent in accordance with point (a) of Article 6(1) GDPR or our legitimate interests in accordance with point (f) of Article 6(1) GDPR.
Our newsletter recipients’ email addresses, as well as their other data described in the context of this policy, are stored on the CleverReach servers in Germany. CleverReach uses this information to send and evaluate the newsletter on our behalf. In addition, CleverReach may use this data to optimise or improve their own services, e. g. for the technical optimisation of the way the newsletters are sent and displayed or for statistical purposes to determine which countries the recipients come from. CleverReach, however, does not use the newsletter recipients’ data to contact them and does not disclose them to third parties.
We trust in CleverReach’s reliability and IT and data security (https://www.cleverreach.com/de/datenschutz).
16.) Product preference surveys, product feedback, general opinion surveys
We collect opinions, moods, wishes and interest for the purpose of quality assurance and product orientation as part of online campaigns. You can participate in such campaigns. You are also addressed by display advertising on social media channels. In the case of voluntary participation, we collect the following information:
While using the tool, different data is collected by the tool manufacturer:
- Usage data (e.g. time filling in the form)
- Device data (IP address, browser type, operating system, possibly location data - if these can be derived from the IP address)
- Source data (from which page you were linked to the form)
- Tracking data (anonymised and aggregated of usage and user statistics)
- Email address (the use of this email address can be revoked at Typeform at any time at https://www.typeform.com)
Personal data will be stored for 6 months and then destroyed in accordance with data protection regulations.
By participating, you acknowledge that the aforementioned data will be processed by VVT and comm ag for the purpose of processing or evaluation.
Your data is processed on the basis of your consent in accordance with point (e) of Article (6)(1) GDPR.
We basically collect information when you visit our websites. This information is referred to as a "cookie". Together with the information you have provided us with, we can tailor your visits to our website even better to your needs.
"Cookies" are small files that allow VVT to store information specific to you, the user, on your PC or digital device while you visit the websites. The website uses or sets cookies in accordance with the legal situation under EU law and Austrian law (Article 5(3) E-Privacy Directive and Article 96(3) TKG 2003). Cookies help determine the Internet pages’ frequency of use and the number of users, as well as making the sites as comfortable and efficient as possible for you. The content of the cookies used is usually limited to an identification number and usage data that does not allow any personal reference to the user.
The use of our offers is also possible without cookies but may be restricted.
When using or setting cookies that contain personal data or affect privacy, VVT obtains your consent in advance and in fact through your active behaviour by navigating you through and via our cookie banner on our website after receiving information about the purposes of the cookies used and thus giving your consent to the setting of cookies.
Data protection is an essential contribution to customer satisfaction for us. You can therefore deactivate the storage of cookies in your browser, restrict it to certain websites or set your browser to notify you when a cookie is sent. You can also delete cookies from your PC's hard drive at any time. Please note, however, that in this case you must expect a restricted display of the page and limited user guidance.
18.) Use of Google Analytics
This website uses Google Analytics, a web analysis service provided by Google Inc. (hereinafter: Google). Google Analytics uses so-called “cookies”, text files stored on your computer allowing them to analyse how you use our website. The information generated by the cookie about your use of this Web page is usually transmitted to a Google server in the USA and stored there. As a result of activating IP anonymisation on these websites, however, your IP address is first abbreviated by Google within European Union member states or other states which are part of the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and abbreviated there. On behalf of the provider of this website, Google uses this information to analyse your use of the website, to compile reports about the website activity and to provide further services which are connected to the use of this website and the Internet for its operator. IP addresses which Google Analytics transmits from your browser will not be combined with other data from Google.
By changing your browser settings accordingly, you may prevent cookies from being stored; however, we point out that you may not have full access to all the functions of this website if this is the case. In addition, you may prevent any data created by the cookie and relating to website usage on your part (including your IP address) from being transmitted to and being processed by Google by downloading and installing the browser plug-in available at the link below: Browser add-on to disable Google Analytics.
19.) Use of script libraries (Google Webfonts)
To be able to correctly display our content on an attractive graphical basis in a variety of web browsers, on this website we use script libraries and font libraries such as Google Webfonts (https://www.google.com/webfonts/). Google Webfonts will be transferred to your browser's cache in order to avoid repeated loading. If your browser does not support Google Webfonts or does not allow access, the content will be displayed in a standard font.
Accessing script libraries or font libraries automatically establishes a connection with the operator of the respective library. In such cases, it is theoretically possible that the operators of such libraries could collect data – although it is currently unclear as to whether this will take place and for what purpose.
20.) Use of Google Search
21.) Use of Google Maps
Further information on the management of your own data in connection with Google products can be found here.
VVT also uses services from ISSUU (Issuu, Inc., 131 Lytton Ave, Palo Alto, CA 94301, USA). ISSUU does not store any information about users of the VVT website unless the user reads the content provided by ISSUU. By actively clicking on the content integrated by ISSUU, data is also transferred to ISSUU. Please note that we, the website provider, do not have access to the content of the data transferred or its use by ISSUU.
23.) Embedded YouTube videos
We embed YouTube videos on our website. The operator of the corresponding plug-ins is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA.
If you visit a page that features a YouTube plug-in, a connection is established with the YouTube servers. YouTube will be informed which pages you visit. If you are logged into your YouTube account, YouTube can personally assign your surfing behaviour to you. You can prevent this by logging out of your YouTube account beforehand.
Anyone who has disabled the saving of cookies for the Google Ad program will not have to reckon with such cookies when watching YouTube videos. However, YouTube also stores non-personal usage information in other cookies. If you wish to prevent this, you must block the storage of cookies in the browser.
24.) Use of Google AdWords Conversion Tracking
VVT uses the online advertising program "Google AdWords" and conversion tracking as part of Google AdWords. Google Conversion Tracking is an analysis service provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”). When you click on an advertisement placed by Google, a cookie is stored on your computer for the conversion tracking. These cookies will become invalid after 30 days, do not contain any personal data and therefore are not used for the personal identification of users.
If you visit certain Internet pages on our website and the cookie has not expired yet, Google and we are able to see that the user clicked on the advertisement and was referred to this site. Every Google AdWords customer gets a different cookie. As a result, there is no possibility that cookies cannot be tracked via the AdWords customers’ websites.
The information which was obtained with the help of the conversion cookie is used to create conversion statistics for AdWords customers who have opted for conversion tracking. The customers receive information on the total number of users who clicked on their advert and were referred to a page with a conversion tracking tag. They do, however, not receive any information which can be used to identify the user personally.
25.) Use of social plug-ins
VVT uses social plug-ins (“plug-ins”) provided by the social network Facebook, which is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, United States (“Facebook”). You will find an overview of the Facebook plug-ins and their appearance here: https://developers.facebook.com/docs/plugins
The plug-ins are integrated into the page using a so-called "2-click" or "Shariff" solution to increase the protection of your data when you visit our website. This integration ensures that when a page on our website containing such plug-ins is accessed, no connection is established with the Facebook servers. Only when you activate the plug-ins and give your consent to the data transfer does your browser establish a direct connection with the Facebook servers. The plug-in contents are transferred directly to you browser, which then includes them on the website. The plug-in then transmits data (including your IP address) to Facebook. We do not have any influence on the amount of data that Facebook collects using this plug-in. To the best of our knowledge, Facebook receives information about which of our websites you have currently and previously visited. By integrating the plug-ins, Facebook also receives the information that your browser has visited our website’s corresponding page if you do not have a profile on Facebook or are not currently logged in. This information (including your IP address) is transmitted directly from your browser to a Facebook server in the USA and stored there. If you interact with these plug-ins, such as by clicking the “Like” button, your browser transfers this information directly to Facebook where this information is stored. The information is also published on Facebook and displayed to your contacts.
If you are a member of Facebook's social network and wish to limit the collection of information about our websites and the merging of your user information with information about you stored on Facebook's social network, you should log out of Facebook before visiting our website. You can also completely prevent the loading of Facebook plug-ins with add-ons for your browser in the future, e.g. using the script blocker "NoScript” (http://noscript.net/).
26.) SSL encryption
To protect the security of your data when it is transferred, we use state-of-the-art encryption methods (such as SSL) via HTTPS. You can recognise an encrypted connection by the character string "https://" and the lock symbol in your browser line