Privacy Note

This data privacy statement is valid for the data processing by the following party responsible:

GVH – Großraum-Verkehr Hannover GmbH,
Karmarschstr. 30/32,
e-mail: info@gvh.de, phone: +49 511 5909000.

The corporate data protection officer can be reached as follows:

GVH – Großraumverkehr Hannover GmbH
Data protection officer
Karmarschstr. 30/32
30159 Hanover
phone: +49 511 5909000-0
e-mail: datenschutzbeauftragter@gvh.de

1. Updates and changes to the privacy statement

We ask you to inform yourself regularly about the contents of our data privacy statement. We will adapt the data privacy statement as soon as changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require your cooperation (e.g. consent) or other individual notification.

2. Relevant legal bases

In accordance with Art. 13 GDPR, we will inform you of the legal basis for our data processing. If the legal basis is not mentioned in the data protection declaration, the following applies: The legal basis for obtaining consent is Art. 6 Para. 1 lit. a and Art. 7 GDPR, the legal basis for processing to fulfill our services and carry out contractual measures as well as answering inquiries is Art. 6 Para. 1 lit. b GDPR, the legal basis for processing to fulfill our legal obligations is Art. 6 Para. 1 lit. c GDPR, and the legal basis for processing to safeguard our legitimate interests is Art. 6 Para. 1 lit. f GDPR. In the case, that the vital interests of the data subject or another natural person require the processing of personal data is served by Art. 6 Para. 1 lit. d GDPR as the legal basis.

3. Safety measures

In accordance with Art. 32 GDPR, taking into account the state of the art, implementation costs and the type, scope, circumstances and purposes of processing as well as the different probability of occurrence and severity of the risk for the rights and freedoms of natural persons, we make suitable technical and organisational measures to ensure a level of protection appropriate to the risk; The measures include, in particular, securing the confidentiality, integrity and availability of data by controlling physical access to the data, as well as the access, input, forwarding, ensuring availability and their separation. In addition, we have set up procedures that ensure the exercise of data subject rights, deletion of data and reaction to data threats. Furthermore, we already consider the protection of personal data during the development or selection of hardware, software and procedures, in accordance with the principle of data protection through technology design and data protection-friendly default settings (Art. 25 GDPR).

This site uses SSL or TLS encryption for security reasons and for the protection of the transmission of confidential content, such as the inquiries you send to us as the site operator. You can recognize an encrypted connection in your browser's address line when it changes from "http://" to "https://" and the lock icon is displayed in your browser's address bar. If SSL or TLS encryption is activated, the data you transfer to us cannot be read by third parties.

In spite of all the preventive measures taken by us, security in the context of internet depends on all parts involved (companies, service providers, provider and clients). The data transfer may involve unknown gaps in security. A complete protection of data from being accessed by third parties is especially in case of intent not possible.

4. Cooperation with processors and third parties

If we disclose data to other persons and companies (contract processors or third parties) within the scope of our processing, transmit them to them or otherwise grant them access to the data, this is only done on the basis of legal permission (e.g. if the data is transmitted to third parties, such as to payment service providers, according to Art. 6 Para. 1 lit.b GDPR is required to fulfill the contract), you have consented, a legal obligation provides for this or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).

If we commission third parties to process data on the basis of a so-called "order processing contract", this is done on the basis of Art. 28 GDPR.

5. Transfers to third countries

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this happens in the context of the use of third-party services or disclosure or transmission of data to third parties, this only occurs if it happens to fulfill our (pre) contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or have the data processed in a third country only if the special requirements of Art. 44 ff. GDPR are met. This means that the processing takes place, for example, on the basis of special guarantees, such as the officially recognized determination of a data protection level corresponding to the EU or compliance with officially recognized special contractual obligations (so-called "standard contractual clauses").

6. Storage and deletion of data

Information on storage and deletion of your data can be found in the rights of data subjects and if necessary, in their respective sections of the data privacy statement.

1. Right of access

You can request the confirmation that your data are processed and information about said data as well as further data and copy of data according to Art. 15 GDPR.

2. Right of rectification

According to Art. 16 GDPR you have the right to demand the immediate rectification of your personal data. For incomplete data, similar right applies.

3. Right of erasure

According to Art. 17 GDPR you have the right to demand immediate erasure of your data resp. alternatively according to Art. 18 GDPR to demand the restriction of the data processing.

Unless expressly agreed otherwise in the corresponding sections of the data privacy statement, data stored at us will be deleted as soon as it is no longer required for the purpose of data processing and there is no other legal basis for retention obligation. If the data may not be deleted because it is required for other or lawful purposes, the processing will be restricted. In this case the data are locked and not processed for other purposes. This applies for example for data, that must be stored due to commerce and tax law reasons.

According to legal regulations the preservation period of specific data and documents amounts 6 years according to § 257 Para. 1 German Commercial Code (trading books, inventories, opening balances, financial statements, business letters, accounting vouchers, etc.) or 10 years according to § 147 Para. 1 AO (books, records, status reports, accounting vouchers, commercial and business correspondence, documents relevant for taxation etc.).

4. Right to data portability

You have the right to receive the personal data provided according to Art. 20 GDPR and to demand the transmission to other parties responsible.

5. Right to withdraw the consent

According to Art. 7 Para. 3 GDPR you have the right to withdraw your consent with future effect at any time.

6. Right to object

You can object the future processing of your data in accordance with Art. 21 GDPR at any time.

7. Right to lodge a complaint

In addition, you have the right to complain at a supervisory authority for data protection if you believe that the processing of their personal data is carried out unlawfully. In general, you can contact the supervisory authority in your place of residence or working environment or our registered office.

The address of the supervisory authority responsible for us is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hanover,
phone +49 511-120 4500, fax +49 511-120 45996

If you use this website, various personal data are processed. The following privacy policy statement explains how we collect, store and use the information you provide to us. Here you will find information on the website, the cookies and the used technologies of website design. This also includes the integration of external sources. In the following, we explain the services provided on our website.

Despite all protective measures we would like to point out in advance that the data transmission on the Internet may have security vulnerabilities. It is not possible to protect such data completely against access by third parties.

1. Kinds of data processed

• contact details (e. g. e-mail, telephone numbers).
• usage data (e. g. visited websites, interest in content, referrer).
• meta / communication data (e. g. device information, IP addresses)

2. Special categories of personal data (Art. 9 Para. 1 GDPR)

Basically, no special categories of personal data are processed, unless provided by the user, e. g. when entered in the contact form.

3. Categories of persons concerned by data processing:

• customers/prospects
• suppliers
• visitors and users of the online offering

In the following we name the persons concerned „user“.

4. Processing of usage data, meta/communication data and log files

Based on the data, accruing when using the Internet, we collect data relating to every request made to the server, on which our website is located (so-called server log files). This data includes name of the website accessed, file , date and time of access, data volume transferred, report on successful access, browser type transferred by the browser, version and operating system, the referrer URL (the site visited previously), IP address and the requested provider.

We collect these data to ensure proper operation of the website and for error analysis relevant to the legitimate interests according to Art. 6 Para. 1 lit. f GDPR.

5. Use of cookies

Our website uses so-called cookies.

Cookies don't do any harm to your computer and do not contain computer viruses. Cookies are small text files which are placed by your browser on your computer.

You can configure your browser to inform you about the use of cookies so that you can decide on a case-by-case basis whether to accept or reject a cookie. Alternatively, your browser can be configured to automatically accept cookies under certain conditions or to always reject them, or to automatically delete cookies when closing your browser. Disabling cookies may limit the functionality of this website.

Most of the cookies that are used by us are technically necessary. These serve to run the website optimally. They store e.g. your given consent, are used when sending forms and as well for queries and serve the purpose of making our offer more effective. Legal basis is the previously described legitimate interest within the meaning of Art. 6 Para. 1 lit. f GDPR.

Other cookies are retained and will enable us to recognize your computer upon your next visit and will thus help us to improve our services to you in order to make the services more user-friendly, effective and secure.

When visiting our website for the first time you will be informed on the use of cookies and you will be given the opportunity to accept also analytical cookies.

We use cookies to better understand the use of our website and to embed content. We use a cookie banner to request consent. The data collected in this process is processed anonymously. You can change your settings regarding the use of cookies at any time by clicking on the icon in the lower left corner or by clicking on the link below.

To exercise your right of revocation and to list the cookies used, click here.

This website uses the Open Source software "Matomo" of InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand.

Processing

In order to undertake simple evaluations, cookies are stored in anonymised form. For this purpose, the information generated by the cookie is stored on servers of VisionConnect GmbH in Hostway Deutschland GmbH Am Mittelfelde 29, 30519 Hanover, Germany. You as a user remain anonymous to us. The information generated by the cookie about your use of this website will not be passed on to third parties.

If sub-pages of the website have been called up, meta and communication data are processed. In case of Matomo this includes:

• IP address, shortened by the last two bytes (anonymised)
• called up subpage and time (date/time) of page access
• internet address of the website from which you came to our website (referrer url)
• which browser has been used
• which plugins, which operating system and which resolution is used
• time spent on the site
• ages, accessed from the called-up subpage

Legal basis

We use data collected to analyse the use of our website and to obtain information about the use of different website functions. This allows us to optimise the website and the linked offers. Processing takes place based on your consent, you gave at your first visit on this website, according to Art. 6 Para. 1 lit. a., Art. 7 GDPR. You may withdraw your consent at any time with effect for the future without this affecting the lawfulness of the processing based on consent before its withdrawal.

This website uses „Google Analytics“, a web analysis service of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

This service is used on the following pages:

gratis.gvh.de

namenswettbewerb-eisbär.gvh.de

eisbär.gvh.de

sprinti.gvh.de

Google Analytics is provided by:
Google Ireland Limited („Google“), Gordon House, Barrow Street, Dublin 4, Ireland.

Processing

Google Analytics uses a specific form of cookie, which is stored on your computer and enables an analysis of your use of our website. Google uses this information on our behalf to analyse your use of this website in order to compile reports on website activities and provide additional services related to website and internet use. The IP address transmitted by your browser in the context of Google Analytics is not merged with other Google data.

If subdomains of our website are called up, as indicated above, usage and meta-/ communication data are processed. For Google Analytics this may include the following data:

• IP address (anonymised)
• subpage accessed and time of page view
• click path
• which browser has been used
• device used
• address of the website from which you came to our website (referrer url)
• location data

On the pages on which Google Analytics is integrated, the Google tracking code is supplemented by the function „anonymizeIp“, in order to guarantee an anonymised detection (so-called IP mask method).

Due to the IP anonymisation on this website, your IP address is shortened by Google within the territory of the EU and the Treaty States of the European Economic Area. Only in exceptional cases the full IP address is transmitted to a Google server in the USA and shortened there.

Legal basis

We use personal information collected through our website to analyse the usage of the website and to obtain information on the usage of the website functions. This enables us to optimise the website and the related service offer. Processing of the data takes place based on your consent, provided at your first visit, according to. Art. 6 Para. 1 lit. a., Art. 7 GDPR. You can revoke your consent at any time, without this affecting the lawfulness of the processing based on consent before its withdrawal.

Right of withdrawal

You can prevent the collection of data by Google Analytics by clicking on the following link: https://adssettings.google.de/authenticated or g.co/privacytools. An opt-out cookie will be created which will prevent the future gathering of your data when visiting this website.

You can prevent the storage of cookies by using the corresponding setting on your browser software; however we would point out to you that if you do this, you may not be able to use all functions of this website to their full extent.

Find out more about the terms of use and data protection at https://www.google.com/analytics/terms/de.html resp. at https://www.google.de/intl/de/policies/.

This website uses „Google Ads“, a web analysis service of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

gratis.gvh.de

namenswettbewerb-eisbär.gvh.de

eisbär.gvh.de

sprinti.gvh.de

Google Ads is provided by:
Google Ireland Limited („Google“), Gordon House, Barrow Street, Dublin 4, Ireland.

Processing

Google Analytics uses so-called „cookies". Cookies are small text files that are stored by your browser on your device to save and evaluate certain information. These conversion cookies usually expire after a certain time and are not intended to identify you personally. These cookies enable Google to recognize your Internet browser. If a user visits certain pages of an Adwords customer's website and the cookie stored on their device has not expired, Google and the customer can recognize that the user has clicked on the ad and has been redirected to this page. Information obtained by the conversion cookie are used to compile statistics. We find out the total number of users who have clicked on our ad and have been redirected to certain sites.

The information gathered by the cookie about your usage of the above-mentioned websites are usually transmitted to a Google server in the USA and stored there.

On behalf of the website provider Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage to the website provider. Google will not associate your IP address with any other data held by Google.

Legal basis

We use data collected to analyse the use of our website and to obtain information about the use of different website functions. This allows us to optimise the website and the linked offers. Processing takes place based on your consent, you gave at your first visit on this website, according to Art. 6 Para. 1 lit. a., Art. 7 GDPR. You may withdraw your consent at any time with effect for the future without this affecting the lawfulness of the processing based on consent before its withdrawal.

Right to withdraw the consent

You can prevent the collection of data by Google Analytics as part of Google Ads by clicking on the following link: https://adssettings.google.de/authenticated or g.co/privacytools. An opt-out cookie will be created which will prevent the future gathering of your data when visiting this website.

You can prevent the storage of cookies by using the corresponding setting on your browser software; however we would point out to you that if you do this, you may not be able to use all functions of this website to their full extent.

In addition, you can prevent the processing of the data generated by the cookie (including your IP address) and your use of the website, as well as the processing of this data by Google, by clicking the following link and downloading and installing the following browser plug-in: https://tools.google.com/dlpage/gaoptout?hl=de.

Find out more about the terms of use and data protection at https://www.google.com/analytics/terms/de.html resp. at https://www.google.de/intl/de/policies/.

This website uses the „Remarketing”- or "Similar Audiences"-function, a web analysis service of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

This service is used on the following pages:

gratis.gvh.de

namenswettbewerb-eisbär.gvh.de

eisbär.gvh.de

sprinti.gvh.de

The web analysis is provided by: Google Ireland Limited („Google“), Gordon House, Barrow Street, Dublin 4, Ireland.

The aforementioned company is responsible for the processing of your data and the compliance with applicable data protection laws.

Processing

For remarketing purposes, so-called „cookies" are used. Cookies are small text files that are stored by your browser on your device to analyse the usage of the website and for the possibility to create interest-based ads. These cookies usually expire after a certain time and are not intended to identify you personally. If you visit another website afterwards which as well uses ads provided by Google, almost certainly previously accessed product and information areas will be provided.

The information gathered by the cookie about your usage of the above-mentioned websites are usually transmitted to a Google server in the USA and stored there.

Legal basis

We use data collected to analyse the use of our website and to obtain information about the use of different website functions. This allows us to optimise the website and the linked offers. Processing takes place based on your consent, you gave at your first visit on this website, according to Art. 6 Para. 1 lit. a., Art. 7 GDPR. You may withdraw your consent at any time with effect for the future without this affecting the lawfulness of the processing based on consent before its withdrawal.

Right to withdraw the consent

You can prevent the storage of cookies by using the corresponding setting on your browser software; however we would point out to you that if you do this, you may not be able to use all functions of this website to their full extent.

In addition, you can prevent the processing of the data generated by the cookie (including your IP address) and your use of the website, as well as the processing of this data by Google, by clicking the following link and downloading and installing the following browser plug-in: https://tools.google.com/dlpage/gaoptout?hl=de.

Find out more about the terms of use and data protection at https://www.google.com/analytics/terms/de.html resp. at https://www.google.de/intl/de/policies/.

This website uses „Google Tag Manager“, a web analysis service of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

This service is used on the following pages:

gratis.gvh.de

namenswettbewerb-eisbär.gvh.de

eisbär.gvh.de

sprinti.gvh.de

Google Tag Manager is provided by:
Google Ireland Limited („Google“), Gordon House, Barrow Street, Dublin 4, Ireland.

Processing

Using „Google Tag Manager“, so-called JavaScript tags and HTML tags are managed, which are used for the implementation of tracking and analysis tools. The purpose of the data processing is the tailored design and optimum performance of the above-mentioned websites. Google Tag Manager itself does not save personal data. But it enables triggering further tags, which can collect and process personal data.

Due to Google Tag Manager a connection to Google servers in the USA is established by your browser.

Legal basis

The purpose of data processing is the user-oriented design and the optimization of our website, as described above. Processing takes place based on your consent, given at your first visit on this website, according to Art. 6 Para. 1 lit. a., Art. 7 GDPR. You may withdraw your consent at any time with effect for the future without this affecting the lawfulness of the processing based on consent before its withdrawal.

Right to withdraw the consent

You can prevent the collection of data by Google Analytics as part of Google Tag Manager by clicking on the following link: https://adssettings.google.de/authenticated or g.co/privacytools. An opt-out cookie will be created which will prevent the future gathering of your data when visiting this website.

Find out more about the terms of use and data protection at https://www.google.com/analytics/terms/de.html resp. at https://www.google.de/intl/de/policies/.

We have included "YouTube" in our online services in order to integrate technically correct videos into our website. YouTube is a video service of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

YouTube is provided by:
Google LLC, Barrow Street, Dublin 4, Ireland

Processing

When you display a page that has an embedded video, a connection will be made to the YouTube server and the content will appear on the website via a communication to your browser. The server locations include locations as well outside the EU.

If the videos are accessed only by clicking a separate link, the connection by your browser takes place only when accessing the link.

When displaying a video, user data and meta- / communication data are processed by the service provider. As part of this technical process, YouTube and Google obtain information about which specific subpage of our website you are visiting. When you're logged in, your information will be directly associated with your account. The service provider may place a cookie on your device, that transmits certain stored information on the presentation and representation of videos.

Videos are embedded on our website in "privacy-enhanced mode". It is provided by YouTube and ensures that YouTube does not store details about you in cookies on your device at first.

Legal basis

Processing takes place for the purpose of a quicker, uniform and visually attractive display of video content as well as a simpler administration and efficient operation of our online services based on a justified interest according to Art. 6 Para. 1 lit. f. GDPR.

Provided the video will be displayed only after separate access, this takes place on basis of your consent, you have provided at your first visit of our website according to Art. 6 Para. 1 lit. a., Art. 7 GDPR. You can revoke your consent at any time, without this affecting the lawfulness of the processing based on consent before its withdrawal.

We may not be able to influence the data processing by Google. Find out more about the terms of use and data protection at https://www.google.com/analytics/terms/de.html resp. at https://www.google.de/intl/de/policies/.

Right of withdrawal

You can prevent the consent concerning the display of YouTube videos by clicking the following link: https://adssettings.google.de/authenticated or g.co/privacytools.

On our website we have included the electronic journey planner service provided by HaCon Ingenieurgesellschaft mbH (Lister Straße 15, 30163 Hannover; hereinafter called "HaCon").

The aforementioned company is responsible for the processing of your data and the compliance with applicable data protection laws.

Processing

When using the journey and route planner, user and meta- / communication data are processed. Additionally, this may include the following data:

• place of arrival/departure
• time of arrival/departure
• travel period
• means of transport
• bicycle transport
• duration of connecting time

By the integration of the service on our website, user and meta- / communications data as well as information you submit are transferred to HaCon. Further processing of these data are done by HaCon.

Further information on the provider HaCon can be found here: https://www.hacon.de/en/.

Legal basis

The integration of the journey planner takes place within the scope of (pre)contractual obligations according to Art. 6 Para. 1 lit. b GDPR. Additionally, the integration of the journey planner for the presentation of the transport offer of all GVH transport companies takes place based on a legitimate interest according to Art. 6 Para. 1 lit. f. GDPR.

Based on the data, arising from using the internet (website visits and e-mail communication), data is collected about each access to the server, where this service runs on, (so-called server log files). This is for technical reasons and is used at the same time for administration and error recovery.

Processing

The processed data include the above-mentioned data (section „Website“), defined as usage data, (e.g. visited websites, interest in contents) and meta/communication data (e. g. device information, IP addresses).

Legal basis

Server log files are collected for the purpose of securing the proper operation of the website, the fault analysis and identification of potential abuse or fraud and insofar it is based on legitimate interest according to Art. 6 Para. 1 lit. f GDPR.

Storage duration

Non-anonymous server log files are stored for max. 7 days and anonymous server log files for max. 31 days and will be deleted afterwards unless the data are no longer needed for other legal purposes (e.g. criminal prosecution). After achieving the purpose, the data are deleted immediately.

We are connected with you via various channels.

Processing

If you contact us by telephone, particularly your phone number and, where appropriate, in the course of the conversation your name, your contact details, the time of the call and details of your request are processed.

If you contact us by fax, particularly the fax number resp. the sender identification and the data resulting from the fax itself are processed.

If you contact us by e-mail, particularly your e-mail address, the time of e-mail and the data resulting from the message text (possibly as well appendices) are processed. Based on the data, arising from using the internet (website visits and e-mail communication), data is collected about each access to the server, where this service runs on, (so-called server log files). More information can be found in the section "Server logs".

If you contact us by post, such data is processed arising from the sender details and the message content (possibly as well appendices).

Please note that the extent of collected personal data within the context of contact also depends on the data you reveal in the message or by attaching documents and appendices.

The data transferred in the context of the contact request are processed for the handling of the contact request. Without providing certain data, we cannot answer your request unrestricted. We will generally not pass on your data processed within the context of contact. An exception is your consent to pass on your data.

Legal basis

The basis of the processing is in this respect the contract execution and the handling of pre-contractual requests according to Art. 6 Para. 1 S. 1 lit. b. GDPR as well as the justified interest in processing your message according to Art. 6 Para. 1 S. 1 lit. f. GDPR.

We are connected with you via various channels. You can also get in touch with us by using our contact form.

Processing

If you contact us via the contact form on our website, your name, your e-mail address and details of your request are processed.

Please note that the extent of collected personal data within the context of contact also depends on the data you reveal in the contact form or by attaching documents and appendices.

You can use the contact form by giving only few information. Without providing certain data, we cannot answer your request or only to a limited extent.

Right of withdrawal

You can prevent the consent with immediate effect in the future without stating reasons at: info@gvh.de or by post at: Großraum-Verkehr Hannover GmbH Karmarschstr. 30/32, 30159 Hanover.

Forwarding

If you gave your consent, your request will be forwarded to the transport company which is subject of your enquiry.

Legal basis

The basis of the processing is the consent given in the contact form according to Art. 6 Para. 1 S. 1 lit. a. in compliance with Art. 7 GDPR.

Under the GVH guarantee, passengers can receive compensation in case of service restrictions. According to the current transportation contracts, each transport company is responsible for the handling of its GVH on-time guarantee cases. For this purpose, the GVH provides a central platform and evaluates the data only for statistical purposes and in an anonymised form, in order to obtain findings for the quality improvement.

Processing

In addition to the data occurring when using our website (see section “Website“), following data are processed as part of making a claim under the GVH guarantee:

• tariff data (tariff, type of ticket, kind of ticket, area of application, ticket number, temporal validity, file/scan of ticket),
• journey information (e.g. date, time, starting stop or station, destination, certain trains),
• application reason (e.g. cancellation, delay, missed connection, dirt),
• master data (e. g. address, first name, last name, street, street number, ZIP code and city),
• contact details (email address),
• bank account number (IBAN).

Transfer

Data will be transferred to the transport company that has provided the activation of the guarantee.

Legal basis

The data processing takes place for evaluation and processing of your guarantee claim by the responsible transport company, based on your consent according to Art. 6 Para. 1 lit. a GDPR. You may withdraw your consent at any time with effect for the future without this affecting the lawfulness of the processing based on consent before its withdrawal.

Right of withdrawal

You can prevent the consent with immediate effect in the future without stating reasons at: garantie@gvh.de or by post at: GVH Kundenzentrum, Karmarschstr. 30/32, 30159 Hanover.

Storage duration

The personal data in connection with your guarantee claim will be stored at the corresponding transport company for 12 months after the period actually needed to process your claim for the purpose of preventing fraud. The data will be archived by the corresponding transport company for up to 10 years in order to comply with the retention periods required by commercial and tax law.

The ÜSTRA Hannoversche Verkehrsbetriebe Aktiengesellschaft, Hanover, operates the mobility shop as part of the cooperation between the transport companies running within the GVH area at https://shop.gvh.de/.

Regarding the processing of your personal data when using the mobility shop, please review the separate data privacy statement: https://shop.gvh.de/index.php/cms/privacy_policy/0.

We process personal data for the implementation of competitions, e.g. in order to determine whether you are eligible as well as in order to determine and notify the winner. Without providing the data, participation in the competition or a contact request regarding the winner notification is not possible. Within the scope of the competition we additionally offer you the possibility to stay informed about us, e.g. via newsletter.

Processing

Within the scope of participation in our competitions the following details are processed:

• name (title, first name, family name)
• address (street, street number, ZIP code, city),
• contact details (email address, telephone number),
• if necessary age (date of birth) / majority
• if necessary subscription number

Legal basis

The purpose of the data processing is to run the competition and the proper documentation of the profit allocation. Legal basis is Art. 6 Para. 1 lit. b and lit. c GDPR, because the data processing is required for the fulfilment of the competition contract and the resulting obligation and because of the legal obligations to preserve the data.

As far as consent was requested in the course of competition participation, the legal basis for data processing is Art. 6 Para. 1 lit. a in conjunction with. Art 7 GDPR.

Right to withdraw the consent

You can prevent the consent concerning the competition participation at gvh.de without stating reasons at any time with future effect by email at: presse@gvh.de.

You can prevent the consent concerning the participation in GVH journal competitions and GVH aktuell competitions without stating reasons at any time with future effect by email at: journal@gvh.de.

Storage duration

The processed data of the participants will be deleted after termination or expiration of the competition, at the end of the campaign and after sending the prizes. The data of the winner will be deleted immediately after implementation of the competition resp., in case of raffled tickets, after implementation of the corresponding event as far as no other legal authorisation basis applies for further processing. The general provisions concerning the data retention periods and how they are determined can be found in the corresponding sections at the beginning of our data privacy statement.

You can find the information about the collection and processing of your personal data within the GVH App "My GVH" here.

sprintRAD is the brand name of the nextbike bike sharing in Hanover. The GVH (Transport Association of Greater Hanover) acts as sponsoring partner. Owners of a Monthly pass subscription and students with a valid Semester pass GVH get special conditions when using SprintRAD.

Kinds of data that are processed

• Title
• First name
• Family name
• Address
• E-mail address
• IBAN
• Subscription number / matriculation number
• Entitlement to discounts (Monthly pass subscription, Semester pass, student identity card)

Not required information, such as a photo on student card, can be blackened.

Purpose and legal basis

We use your above-mentioned data, according to your statement of agreement, for the purposes of verifying the entitlement to discounts, fraud prevention and for the communication regarding changes to the range of products as well as for the registration at and in this respect the transmission of your data to nextbike GmbH, Leipzig, as the operator of SprintRAD offers.

The processing is made on the basis of your agreement according to Art. 6 Para. 1 lit. a GDPR.

Right of withdrawal

You have the right to cancel your consent with future effect at any time without providing a reason via e-mail to mobishop@cantamen.de. As a consequence of withdrawal, laying claims to the discounted rates for bike rental is no longer possible.

Recipient

A transmission of your personal data to third parties takes place only, if the passing on is necessary for the following purposes:

• You have expressly given us your consent to do so according to Art.6 Para.1 S.1 lit. a GDPR;
•  The transmission of your personal data according to Art. 6 Para.1 S.1 lit. f GDPR is required for establishment, exercise or defence of legal claims and there is no reason to believe that you have interest worthy of protection not to undertake this transfer of data;
• In case that data transmission according to Art. 6 Para.1 S.1 lit. b GDPR is required for the justification or processing of contracts stipulated with you.

Storage duration

After receipt of your revocation, we will quit the processing of your personal data from that point on, unless there are legal requirements, that bind us to process your data.

Furthermore, we will delete your personal data 9 months after the last update of the entitlement to discounts. We will delete your bank data (IBAN) after successful transmission of your registration to nextbike GmbH.