Privacy Policy

The protection of information relating to you (so-called "personal data") is an important concern for us. We are therefore operating the eTariff pilot project in strict compliance with the relevant data protection requirements, in particular the EU General Data Protection Regulation ("GDPR") and the German Federal Data Protection Act ("BDSG"). Part of this are information obligations, which we fulfil by means of this documentation. "We" in the above sense are Hallesche Verkehrs-AG as well as FAIRTIQ AG ("FAIRTIQ") as participants in processing operations within the scope of or in connection with the eTariff pilot project, graduated according to sole or joint responsibility under data protection law.

The eTariff pilot project (hereinafter referred to as "eTariff Pilot") is an attempt not to divide tickets and their prices into fixed fare zones, but to adjust the prices individually and dynamically to the passenger and the distance actually travelled.

Two project partners are collaborating on this: HAVAG and FAIRTIQ (hereinafter called the "project partners"). The main common goals of the pilot project with its product development character are above all the testing of a technology for the recording of travel data as a mandatory basis for downstream pricing after the journey (technical component), the development of an electronic fare for ex-post fare calculation (tariff component) as well as market research and data analysis that accompanies the project to record the levels of customer acceptance and improved comprehensibility of the results of the pilot project.

The pilot project will only run for a limited period of time.

The prerequisite for participation in the pilot project is registration on the registration page, accessible at www.havag.com/fairtiq-luftlinie, downloading and installing the FTQ Lab App and registering in it. In addition, within the framework of the pilot project, an evaluation and analysis of customer transportation is performed for the purposes of dynamic pricing, pilot customer contact, the improvement of service offerings and the implementation of control processes (hereinafter called the "implementation of the pilot project"), each of which requires the processing of your personal data as described in detail below.

Below you will find an explanation of how the respective data controller(s) will handle your personal data in connection with the implementation of the pilot project.

In the pilot project and the services provided under it, personal data are processed partly under the sole responsibility (operation of the website https://www.havag.com by HAVAG, operation of the FTQ Lab-App by FAIRTIQ), and partly under the joint responsibility of HAVAG and FAIRTIQ (core aspects of the pilot project), see below (in the case of sole responsibility see the privacy policy at www.havag.com or privacy policy for FTQ Lab-App), the relevant service components of this privacy policies are highlighted in bold.

1. Who is responsible for the implementation of the pilot project? Who is the respective Data Protection Officer?

Two companies are responsible for implementing the essential components of the pilot project described above:

Hallesche Verkehrs-AG (HAVAG), 
Datenschutz, 
Freiimfelder Strasse 74, 
06112 Halle (Saale),
Email: datenschutz@swh.de

FAIRTIQ AG,
Datenschutz,
Aarbergergasse 29,
3011 Bern (Schweiz),
Email: dataprotection@fairtiq.com
FAIRTIQ's data protection representative in the EU in accordance with Article 27 paragraph 1 of the German GDPR is FAIRTIQ Austria GmbH, Straubingerstrasse 12, 5020 Salzburg, Austria.

Information on joint responsibility in accordance with Article 26 paragraph 2 sentence 2 of the General Data Protection Regulation (GDPR)

What is the reason for the joint responsibility?

Hallesche Verkehrs-AG (HAVAG) and FAIRTIQ AG (FAIRTIQ) are working closely together on the ticketing app "FTQ Lab" as part of the pilot project "Luftlinientarif” (Shortest-distance fare). This also applies to the processing of your personal data. The parties have jointly determined the order in which these data are processed in the individual process stages. They are therefore jointly responsible for the protection of your personal data within the process stages described below (Article 26 GDPR).

For which process stages are the parties jointly responsible?

The parties are of the opinion that they are jointly responsible

• in the areas of market research
• and in terms of the marketing strategy pursued

What have the parties agreed?

As part of their joint responsibility under data protection law, HAVAG and FAIRTIQ have agreed which of them fulfils which obligations under the GDPR. This applies in particular to the exercising of the rights of the data subjects and the fulfilment of the information obligations in accordance with Articles 13 and 14 of the GDPR.

This agreement is necessary because the mobile public transport IT distribution system FTQ Lab processes personal data in different process sections and systems for which either HAVAG or FAIRTIQ is responsible.

What does this mean for the data subjects?

Even if there is joint responsibility, the parties shall fulfil the obligations under data protection law in accordance with their respective responsibilities for the individual process stages as follows:

• On the basis of the joint responsibility,
  • FAIRTIQ is responsible for the processing of the personal data in Chapter 1 and
  • HAVAG is responsible for the processing of the personal data in Chapter 2.

• The parties shall make the information required under Articles 13 and 14 of the GDPR available to data subjects free of charge in a precise, transparent, comprehensible and easily accessible form in plain and simple language. Here, each party shall provide the other party with all necessary information from its sphere of influence.
• The parties shall inform each other without delay of legal positions asserted by affected parties. They shall provide each other with all information necessary to respond to requests for information.
• Data protection rights can be asserted both at FAIRTIQ and at HAVAG.

As at: August 2022

2. Specific processing activities in the context of the implementation of the pilot project (subject service components)

2.1  Registration and Use of the FTQ Lab-App

In order to use the FTQ Lab app in the course of the pilot project, you need to download the app after registering as a pilot customer at (www.havag.com/fairtiq-luftlinie) and register there. As part of the registration process, the following data will be processed from you:

As part of the registration process, the following data will be processed from you:

• First name and surname
• Date of birth
• Mobile telephone number
• Email Address
• Consent to the General Terms and Conditions and Privacy Policy
• technical meta information

The following data is also processed when using the FTQ Lab app (travel data):

• Location data and activity data (based on motion sensors, if activated) as well as the registered electronic tickets
• Payment data (means of payment and amounts charged)

The collection of travel data starts with the opening of the FTQ Lab app and ends after the check-out process is completed. The completion of the check-out process is signalled in the FTQ Lab app. In order for the next public stop to be recorded before the check-in, the location data is recorded when the FTQ Lab app is activated in the foreground. This data is stored in temporary log files. Furthermore, the following data is stored:

• Smartphone: Brand and model
• Operating system
• Wifi signals
• Battery level 

The data will also be used to process your enquiries to the customer service department. In addition, the data is also used for customer communication, for example by sending you (warning) notices or onboarding messages. 

2.1.1 Legal basis

The legal basis for the processing is the fulfilment of the pilot customer contract (or Article 6 paragraph 1 p. 1 lit. b) GDPR) and our overriding legitimate interest (Article 6 paragraph 1 p. 1 lit. f) GDPR). The processing serves the following purposes: In order to provide the applications for electronic tickets, in particular the sale and processing of electronic tickets, the determination and payment of the relevant journeys, including the consideration of vouchers or similar bonuses. Furthermore, the data is also processed to combat abuse (identification of unlawfully obtained journeys).

 2.1.2 Weighing up of interests

Within the framework of the necessary balancing of interests (see above under legal basis Article 6 paragraph 1 p. 1 lit. f) GDPR), we have weighed up your interest in confidentiality and our interest in providing and implementing the pilot project. Your interest in confidentiality is assigned a lower priority. We require the processing in order to provide the services as a whole, to ensure the collection of fares owed and to be able to provide accurate billing and accounting.

2.1.3 Recipients of personal data

FAIRTIQ shall provide HAVAG with the aforementioned personal data collected in the course of the registration (email and mobile phone number only) as well as the aforementioned personal data collected in the course of using the FTQ Lab app (the location data exclusively in visual form and not as raw data).

In addition, payment data is passed on to payment service providers used for this purpose.

2.1.4 Transmission of data to the United States

In the course of the registration process, customer service and customer communication, we use service providers who may process your personal data in the USA. These are specifically the following:

All data transfers to the USA are secured by the current standard contractual clauses of the EU Commission with further appropriate guarantees to maintain an equivalent level of data protection.

2.2  Evaluation of transport of customers and dynamic pricing

If you participate in the pilot project, we will evaluate the transport of customers and dynamic pricing pseudonymously. We collect personal data required for this, such as travel data. The evaluation is necessary to control the pilot project as a whole and in particular to evaluate the route information for the purpose of calculating prices and for the pricing model.

2.2.1 Legal basis

The legal basis for the processing of personal data is the fulfilment of the pilot customer contract (or Article 6 paragraph 1 p. 1 lit. b) GDPR).

2.2.2 Recipients of personal data

Personal data is processed in a mutual exchange between the project partners FAIRTIQ and HAVAG.

2.2.3 Transmission of data to the United States

In the course of the evaluation of the transportation of customers and the dynamic pricing (calculation of the journey) we make use of service providers who may transmit your personal data in the USA. There are the following:

All data transfers to the USA are secured by the current standard contractual clauses of the EU Commission with further appropriate guarantees to maintain an equivalent level of data protection.

2.3  Pilot customer contact

The overall aim of this pilot project is to test whether modern, digital and user-friendly fare collection in public transport is possible.

Technology for the recording of travel data as a mandatory basis for downstream pricing after the journey (technical component), the development of an electronic fare for ex-post fare calculation (tariff component) as well as market analysis that accompanies the project to record the levels of customer acceptance and the improved comprehensibility of the results of the pilot project. In addition, accompanying customer monitoring, data management (data analysis and statistics) and the guarantee of data protection, among other things, are important components that must be examined more closely in the pilot project with regard to future electronic travel authorisation offers.

Due to the fact the pilot project is explicitly designed as a product development project (learning project), the use to analyse the collected personal data from surveys and polls forms an indispensable part of the pilot project in order to be able to achieve the common goals mentioned above. Only data that is necessary for the processing of the contract will be collated. Personal travel data from the FTQ Lab app is stored separately from the analysis data so that it can be evaluated separately for the aforementioned purposes. As part of the evaluation of the analysis data, personal data is aggregated and pseudonymised using a hash function before it is subsequently anonymised (with a time delay of 1 year after the respective date of origin, at the latest at the end of the pilot project). Retrospective personalisation of the data is then no longer possible. The data is kept in separate databases.

2.3.1 Legal basis

The legal basis for the processing of personal data is the performance of the Pilot Customer Contract (or Article 6 paragraph 1 p. 1 lit. b) GDPR).

2.3.2 Recipients of the personal data

For the purpose of contacting to obtain experiences with the pilot project, o.phone GmbH receives the contact data of the pilot customer. O.phone GmbH sends emails to the pilot customers within the framework of the respective cycle. Survey links are also sent out in the process. The surveys are conducted exclusively online.

Personal data is only stored as part of the market research if the pilot customer participates in the survey. These are specifically the following:

• Access data to the survey page (IP address of the requesting computer; date and time of access; name and URL of the file accessed; website from which it is accessed; browser used and, if applicable, operating system of your computer),
  
• Survey data (answers given by the participant of the market analysis in the context of the online surveys on usage behaviour, handling in the FTQ Lab app, etc.).

We will aggregate or anonymise all personal data within the scope of the market analysis after termination, but at the latest at the end of the pilot project. The pilot customer survey can be conducted in several individual surveys or in multi-stage surveys spread over the entire pilot project period in order to be able to record the changes over time or the changes due to tariff changes during the pilot project. Automated decision-making including profiling in accordance with Article 22 paragraph 1 and 4 of the GDPR is not performed.

2.4 Improvement of the service offer

We process your personal data in order to improve our service offer within the framework of the pilot project. Insofar as the processing of personal data is not necessary because the (global) evaluation of the pilot project is not personal, personal data will be anonymised at the earliest possible stage.

2.4.1 Legal basis

We process your personal data on the basis of the pilot customer contract (or Article 6 paragraph 1 p. 1 lit. b) GDPR) and on the basis of our overriding legitimate interest. Otherwise, it would not be possible to fulfil the pilot customer contract and achieve the purpose of the pilot project as a whole.

2.4.2 Weighing up of interests

In the context of the necessary balancing of interests, we have weighed up your interest in confidentiality against our interest in improving the pilot project and optimising offers beyond that. Your interest in confidentiality is assigned a lower priority. Without this data processing, it would not be possible for us to provide new and digital services such as the pilot project in a functional way and to work on improving them for the general public.

2.5 Control processes

Certain control processes are required to guarantee our service offer under the pilot project. These include a process for increased fares, fare follow-up charges or the provision of information as part of a process for handling an increased fare. This requires the processing of your personal data, such as your customer master data and travel data.

2.5.1 Legal basis

We process your personal data to carry out of the pilot customer contract or Article 6 paragraph 1 p. 1 lit. b) GDPR.

2.6 (Direct) Advertising

The customer will be contacted by HAVAG and FAIRTIQ by email and in the FAIRTIQ app in order to create personal offers, for advertising purposes, to maintain the customer relationship and to participate in competitions or prize draws. The advertising exclusively comprises information regarding the services and goods of HAVAG and FAIRTIQ.

2.6.1 Legal basis

The legal basis for the processing of personal data is your consent that you have provided while registering on www.havag.com/fairtiq-luftlinie or Article 6 paragraph 1 sentence 1 lit. a) GDPR.

Under certain circumstances, you may also be contacted by email by way of existing customer advertising without your consent in accordance with Section 7 paragraph 3 of the German Unfair Competition Act (UWG).

2.6.2 Recipients of the personal data

In the context of an advertising campaign, your personal data provided during registration will be used by HAVAG and FAIRTIQ and their subcontracted processors.

2.6.3 Transmission of data to the United States

In the course of the advertising campaigns we make use of service providers who may transmit your personal data to the USA.

All data transfers to the USA are secured by the current standard contractual clauses of the EU Commission with further appropriate guarantees to maintain an equivalent level of data protection.

3. How long do we store your personal data?

We delete your personal data when the purpose for which it was stored no longer applies (journeys have been provided and billed, any claims have been excluded or are time-barred) and no statutory provision requires storage (e.g. Section 147 of the German Fiscal Code, Section 257 of the German Commercial Code, storage periods of 6, 7 or 10 years depending on whether personal data can be assigned to these provisions). Travel data, such as location and activity data, are anonymised within twelve months.

4. What are your data subject rights?

Please contact us using the contact details above to exercise your rights and withdraw your consent.

• You have the right to request information about all personal data we process about you at any time.
• If your personal data is incorrect or incomplete, you have the right to have it corrected and completed.
• You can request the deletion of your personal data at any time, unless we are legally obliged or entitled to continue processing your data.
• If the legal requirements are met, you may request restriction of the processing of your personal data.
• You have the right to object to the processing insofar as the data processing is performed for the purpose of direct marketing or profiling. If the processing is performed on the basis of a balancing of interests, you can object to the processing by stating the reasons that arise from your particular situation.
• If the data processing is performed on the basis of your consent or within the framework of a contract, you have a right to the transfer of the data you have issued us with, provided that this does not affect the rights and freedoms of other persons.
• If we process your data on the basis of a declaration of consent, you have the right to revoke this consent at any time with effect for the future. The processing performed before a revocation remains unaffected by the revocation.
• You also have the right to lodge a complaint with a data protection supervisory authority at any time if you believe that data processing has been performed in breach of applicable law.
• The competent supervisory authority within the framework of the pilot project is the Saxony-Anhalt State Commissioner for Data Protection; P.O. Box 1947, 39009 Magdeburg (email: poststelle@lfd.sachsen-anhalt.de).

5. Data Security

HAVAG and FAIRTIQ take appropriate technical and organisational security measures to protect the personal data we process against accidental or intentional manipulation, loss, destruction or against unauthorised access.

As at: 24 August 2022

Back to Mainpage FAIRTIQ LUFTLINIE / FTQ LAB