Data privacy notice

The use of our web pages without providing personal data is possible as a general rule. However, if you wish to use specific services from our company via our website, or if you book a journey via our website, it may be necessary to process personal data. If processing personal data is required and there is no legal basis for such processing (for example, carrying out a contractual agreement), we must ask for your consent.

In this notice, we inform you about what data we collect on you, how we use it and how you can opt out to having your data used.

Who is responsible for collecting and processing my data?

Deutsche Bahn AG, Potsdamer Platz 2, 10785 Berlin collects and processes your data in its capacity as a data controller.

The appointed data privacy officer is Ms Chris Newiger. If you have any questions or suggestions regarding data protection on smartcity.db.de, please contact us:

Deutsche Bahn AG, Washingtonplatz 2, 10557 Berlin, Germany E-mail: konzerndatenschutz@deutschebahn.com

What data do we collect and how and why do we process your data?

We collect and process your data exclusively for specific purposes. These may be matters related to technical necessity, contractual obligations or requests on the part of users.

When you visit this website, certain device-specific data is collected and processed automatically. This refers to what are known as server log files that are typically created when you visit a website.

As a rule, the following data is transmitted to us via these files:

  • IP address
  • Date and time of your request
  • Time zone difference to Greenwich Mean Time (GMT)
  • Content of your request
  • Access status/HTTP status code
  • Data quantity transmitted
  • Website (from which the request came)
  • Browser
  • Operating system and its interface
  • Language and version of browser software

It is not technically possible to use of website if this data is not processed. The legal basis is point (f) of Article 6(1) of the GDPR.

If you contact us, we will process the personal data you have provided in the course of our correspondence with you. The legal basis is point (f) of Article 6(1) of the GDPR.

Do you share my data with other parties?

For contract processing, it is typically necessary to involve instruction-based data processing companies, for example data centre operators, print or dispatch service providers or other parties involved in contract fulfilment.

The external service providers that we hire to process data are carefully selected and subject to strict contractual obligations. The service providers work in accordance with the instructions we provide and this is verified by technical and organisational actions and supplementary checks.

Furthermore, transmission of your data only takes place where you have given your express consent or on the basis of a statutory requirement.

Transmission to third countries outside the EU/EEA or to an international organisation will not take place unless appropriate guarantees have been provided. These include the EU standard contractual clauses and an adequacy decision from the EU Commission.

How long do you store my data?

We store your data only for as long as is necessary to fulfil the purpose for which the data was to collected (for example, in the context of a contractual relationship), or to comply with statutory requirements. In a contractual relationship, for example, we save your data at least until full and final completion of the contract. Thereafter, the data will be stored for the statutory storage period.

What rights do users of smartcity.db.de have?

  • You can request information about what data relating to you is stored.
  • You can request the correction, deletion and blocking of your personal data as long as this is permitted by law and possible within the scope of an existing contractual relationship.
  • You have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for Deutsche Bahn AG is Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstrasse 219, 10969 Berlin, Germany; e-mail: mailbox@datenschutz-berlin.de.
  • You have the right to portability of the data which you have provided to us based on a declaration of consent or a contract (data portability).
  • If you grant us consent to use your data, you can withdraw it at any time using the same method you used to grant it. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, simply send a letter by post to Deutsche Bahn AG, Washingtonplatz 2, 10557 Berlin, Germany, or by e-mail to smartcity@deutschebahn.com.

Update to the data privacy notice

We adjust the data privacy notice to reflect changes to functionalities or changes to the legal situation. We therefore recommend that you review the data privacy notice at regular intervals. If your consent is required or parts of the data privacy notice are contained within rules of the contractual relationship, changes will be made only with your consent.

Last modified September 2018

When are cookies used?

Cookies are small text files used to store personal data. Cookies can be sent to a website when it is called up, allowing the user to be identified. Cookies help users to use internet sites more easily.

We differentiate between cookies that are mandatory for the technical functions of the website and those that are not mandatory for the technical functions of the website.

We want to give you the option of making an informed decision for or against using cookies that are not essential for the technical functions of the website. Please note that rejecting cookies designed for advertising purposes means that any advertising you receive will not be as closely tailored to your interests as would otherwise be the case. The use of this website in its entirety will not be affected by this.

This is a notification of how and in what manner cookies are used on our sites:

It is generally possible to use smartcity.db.de without cookies that are not for technical purposes. This means that you can prevent browser tracking by cookies (do-not-track, tracking protection list) or block storage of third-party cookies. In addition, we recommend checking the saved cookies regularly if they are not expressly desired.

Please note that when you delete all cookies, you are also deleting any opt-out cookies, meaning that you must opt out again.

Cookies that are mandatory for using the site are session cookies in particular. These allow the website to be displayed and are valid until the end of your browser session.

Cookies that are not mandatory for the use of the site include:

Use of DB WAS (Matomo and formerly Piwik)

We use the analysis service DB WAS (Matomo and formerly Piwik) on our website to analyse and regularly improve the use of our website. The statistics we gain from this allow us to improve our services and make them more interesting for you as the user. With the help of small text files (cookies), we collect data on how you use our website, which includes your IP address. This data is anonymised and stored on our servers.

The legal basis for the use of DB WAS is Art. 6 (1) Sentence 1 (f) of the GDPR.