Privacy policy

1. General

We are committed to the responsible handling and protection of your personal data. We want you to know which data we collect, when we collect it and how we use it. This Privacy Policy is intended to inform all persons who use our product or services or visit our website about the nature, scope and purpose of the processing of personal data and about your rights in relation to this data processing.

As we continue to develop our website www.klimaticket.at and implement new technologies, changes to this privacy policy may be required. However, we will make sure that the latest version is always made available to you.

2. Data controller within the meaning of the General Data Protection Regulation

The distribution and customer service of KlimaTicket Ö is carried out within the framework of a joint responsibility in accordance with Article 26 GDPR in conjunction with the One Mobility Act, BGBl I No. 75/2021 in its current version. Please note that individual data processing, on the other hand, is the sole responsibility of the Federal Ministry of Innovation, Mobility and Infrastructure under data protection law. See also the explanations under point 5.

The following bodies are joint controllers within the meaning of Article 4 (7) GDPR:

responsible party	address	contact
One Mobility GmbH	Schwindgasse 4/3, 1040 Wien	datenschutz@one-mobility.at
Federal Ministry of Innovation, Mobility and Infrastructure	Radetzkystraße 2, 1030 Wien	datenschutz@bmimi.gv.at
ÖBB-Personenverkehr AG	Am Hauptbahnhof 1, 1100 Wien	datenschutz.personenverkehr@pv.oebb.at
OÖ Verkehrsverbund-Organisations GmbH Nfg. & Co KG	Volksgartenstraße 23, 4020 Linz	datenschutz@ooevg.at

3. Data protection officer in accordance with the General Data Protection Regulation

If you have any questions about data protection or the use of your personal data, please contact the data protection officer of the Federal Ministry of Innovation, Mobility and Infrastructure at datenschutz@bmimi.gv.at.

In addition, the contact options referred to in point 2 are within the framework of joint responsibility.

4. What personal data do we process and for what purpose?

Personal data refers to all the information that relates to a natural person.

The Federal Ministry of Innovation, Mobility and Infrastructure does not process validation data or issued ticketing claims in connection with the KlimaTicket Ö. Any validation shall be carried out by the respective transport company under its own responsibility. This data is not shared with the Federal Ministry of Innovation, Mobility and Infrastructure.

We collect personal data in accordance with Articles 13 and 14 of the GDPR in the following cases and for the following purposes:

4.1. Contact Us

If you contact the KlimaTicket customer service regarding any questions, complaints, suggestions or other comments, or make any other request to the KlimaTicket customer service, we will process your name, contact details (e.g. telephone number or email address) along with the content of your message. This can be done at a service point of all KlimaTicket partners, by telephone, or online via the contact form. This also includes the processing of complaints in the course of payment processing. In this case, data will either be provided by the responsible bank/payment service provider or we will provide feedback to the bank/payment service provider. The processing is necessary so that we can process your inquiry and answer it accordingly and is therefore carried out in order to fulfil our (pre-)contractual obligations toward you (Article 6 Para. 1 lit b GDPR).

4.2. Purchase of the KlimaTicket in the KlimaTicket shop

When you buy a KlimaTicket Ö, the following personal data is processed:

Name
Date of birth
Address
Delivery address, if different from the general address
Billing address, if invoice dispatch is desired
E-mail address, if any
Phone number, if any
Contract information (e.g. product category, validity period, method of payment, request for invoice)
Bank data for SEPA Direct Debit mandate
Photo (except KlimaTicket Ö Special Blind)
Card number
Assignment to a customer account, if any

This data is required to process your order and payment and to provide you with the KlimaTicket. The processing is thus carried out in order to fulfil our (pre-)contractual obligations toward you (Article 6 Para. 1 lit b GDPR).

The participating transport companies also process your data on their own responsibility in order to be able to evaluate whether you are a regular customer. In this case, this information will be sent to the Federal Ministry of Innovation, Mobility and Infrastructure for billing purposes. This processing is carried out on the basis of legal obligations (Article 6 Para. 1 lit c GDPR in conjunction with Article 1 Para. 2 Climate Ticket Act and Enclosure 2 Article 1 point 2 lit a and b of the corresponding regulation) and on the basis of legitimate interests (Article 6 Para. 1 lit f GDPR).

4.3. Customer account

Register in order to use all the functionalities of the sales system and we will create a customer account for you. To create a customer account, we need at least the following information: Email address, password, first and last name and date of birth. When purchasing a ticket at a service desk, a customer profile is automatically created in our system. On request, you can also obtain a customer account at the service desk for the independent management of your customer data and purchases. In this case, after data entry and registration, you will receive an email from us to confirm your email address and activate the customer account. As soon as you confirm the activation link, your customer account is active. If you agree to this process, the existing local data will be transferred to your customer account the next time you log in. The processing of said data is necessary so that we can create your customer account and is therefore carried out in order to fulfil our (pre-)contractual obligations toward you (Article 6 Para. 1 lit b GDPR).

4.4. Administration of the KlimaTicket Ö Armed Forces/Civilian Service

If you are a military/civil or volunteer service provider and you have the KlimaTicket Ö Armed Forces/Civil Service/Voluntary Service, the Federal Ministry of Defence, the Civil Service Agency or the Federal Ministry of Social Affairs will send us the information about a non-commencement or early withdrawal from the military/civil or volunteer service. The processing of this data takes place for the purpose of fulfilling the contract in order to process the termination of your contract with us (Article 6 Para. 1 lit b GDPR). This data will be deleted after the ticket has been returned, the payment of the premium fee in accordance with the General Terms and Conditions for the KlimaTicket Ö Armed Forces/Civil Service/Voluntary Service or after the conclusion of any legal proceedings.

4.5. Administration of the KlimaTicket Ö 18

If you have the KlimaTicket Ö 18, the Federal Ministry of Innovation, Mobility and Infrastructure will conduct random enquiries at the Central Register of Residents. The processing of this data is carried out for the purpose of the legitimate interest of abuse prevention (Article 6 Para. 1 lit f GDPR) in order to check whether a larger number of young adults register a residence in Austria at short notice in order to fulfil the eligibility requirements for the free KlimaTicket Ö 18. This data will be deleted after the check has been completed.

4.6. Visiting the website

When you visit our website www.klimaticket.at , the following data is processed (server logs):

IP address of the terminal
Request details and destination address
Browser and operating system used
Language selection
The date and time of the call
The URL you are calling, including all parameters
The page from which you clicked on the page link, if any
The protocol version used by your browser
The access method used
The name and size of the data you are calling up
Message indicating whether the retrieval was successful

This data is used on the legal basis of Art 6 Para. 1 lit f GDPR in conjunction with Article 165 Para. 3 TKG 2021 to ensure the smooth operation of the website, comfortable use of the website and to check the safety of the website. In any case, the data will not be used to draw conclusions about your person.

4.7. Cookies, web analytics and social media

4.7.1. Use of cookies

Cookies are small text files that are stored on your device in order to be able to recognize it. They do not cause any damage. The information contained in the cookies is used for session control, server load balancing, for analytics purposes and for increasing the security of our applications, as well as for customization and usability. This enables us to provide a high level of user-friendliness of our website.

Our website uses the following categories of cookies:

technically necessary cookies
These cookies are necessary so that you can use our websites with all the functions provided and are used on the basis of our legitimate interests in accordance with Art. 6 Para. 1 lit f GDPR in conjunction with Article 165 Para. 3 TKG 2021. Without these cookies, our services cannot be provided. These cookies do not collect any information about you and do not store any internet sites. These essential cookies can be deactivated at any time via the browser you use. As a result, however, you may no longer be able to use some or all of the services, or you may only be able to use them to a limited extent.
Analytical cookies
These cookies collect information about your usage behaviour on our website. For example, it records which links are clicked. All collected data is stored anonymously together with the information of other visitors. With the help of the data obtained by these cookies, we can create analytical assessments via our website and thereby continuously improve the user experience.
The storage time of cookies depends on whether a cookie is a persistent cookie or a session cookie. Session cookies will only persist on your end device until your browser session is terminated. Persistent cookies remain stored on your end device until the default dwell time of the cookie has expired or it is deleted, even after you have ended a browser session.
Details about cookies can be found in the Terms of Use at https://www.klimaticket.at/de/rechtliches/
nutzungsbedingungen.

4.7.2. Web analytics (Matomo)

Our website www.klimaticket.at uses Matomo, a web analytics service. Matomo uses cookies that allow us to analyse the use of our website. For this purpose, the usage information generated by the cookie (including your truncated IP address) is transmitted to our server and stored for usage analysis purposes, which serves the website optimization on our part. Your IP address will be immediately anonymized during this process, so that you remain anonymous to us.

The information generated by cookies about the use of our website will not be passed on to third parties. You can prevent the use of cookies by setting your browser software accordingly. In this case, however, it may not be possible to make full use of all the functions of our websites. If you do not agree with the storage and evaluation of the data in connection with your visit and the use of our websites, then the storage and use can be objected to at any time (see terms of use for the website www.klimatcket.at). In this case, an opt-out cookie is stored in your browser, which means that Matomo does not collect any session data.

For technical reasons, certain data and information must be collected and stored when visiting our website, e.g. the websites used, the time and duration of the visit as well as data provided by the browser used (e.g. the operating system and the system settings used). We use this data and information anonymously in order to make our offer as user-friendly as possible and to be able to optimize it technically.

4.7.3. Social Media

Verlinkungen
We will redirect you to third-party websites such as Facebook, Instagram or LinkedIn on our website. At the time of linking, we were not aware of any legal violations. If such a violation becomes known, the link will be removed by us immediately.
Competitions on social media
Insofar as personal data is collected from participants in a competition on social media, they will be collected, processed and used exclusively for the purpose of conducting the competition, unless you have expressly given us your consent to the use of your personal data for other purposes or a use of data is required in individual cases for legal or other predominant reasons (such as in the event of a court or other official request or in the event of judicial or official disputes). We will delete or anonymize collected and processed data after expiry of the statutory limitation period (i.e. usually after three years). This also applies to social media messaging history. We cannot assume any responsibility for the accuracy, topicality and completeness of the data provided by you. Therefore, in your own interest, please ensure that the data you provide is accurate, up-to-date and complete.

4.8. Newsletter

You have the opportunity to subscribe to our newsletter. With our personalized newsletter, we will inform you via e-mail about discounts and promotions, invitations to competitions, industry news, information on public transport products, invitations to events, customer surveys and other customer loyalty measures. For this purpose, we process your name and email address, along with your declaration that you agree to receive the newsletter. In order to tailor the newsletter to your interests and needs and to be able to provide you with relevant information and recommendations, we use profiling based on your contract data and information from your purchasing and travel history.

You can unsubscribe from the newsletter at any time, e.g. via newsletterabmeldung@one-mobility.at. Any of your data which was stored in connection with the newsletter dispatch will be deleted immediately. Instead, it will be noted that you no longer wish to receive newsletters.

4.9. Customer satisfaction surveys and market research

In order to further develop our product and to provide you with the best possible service, we process general statistical data on your purchasing behaviour for the purposes of market research. This processing takes place on the basis of our legitimate interests in accordance with Article 6 Para. 1 lit f GDPR.

In addition, you have the opportunity to participate in extensive market research on the basis of voluntary consent. We will provide you with information on this separately at the time of your registration.

4.10. Enforcement of passenger rights
If you assert your statutory rights as a passenger in accordance with EU Regulation No. 1371/2007, the Railway Transport and Passenger Rights Act and the General Terms and Conditions for the purchase of the KlimaTicket Ö, we will forward your contact details and contract data to the relevant transport company with your prior consent. After that, we only keep a record of your declaration of consent in evidence. For more information on how the transport company processes your data, contact the respective transport company.

5. Joint product sales and customer service within the framework of joint responsibility (information in accordance with Article 26 Para. 2 GDPR)

5.1. Background to joint product sales and customer service

The One Mobility Act, BGBl. I No. 75/2021 in its current version provides for uniform and customer-friendly access to public passenger transport products. A cross-company customer account, product portfolio, customer service and payment system is to be made available for the customers of the participating transport companies and transport associations through a shared sales system (ticket shop) and a central payment processing system. In this way, low-threshold access to public transport and the switch to climate-friendly mobility will be promoted, and taxpayers’ money will be used more efficiently through synergy effects.

5.2. Partners within the framework of joint responsibility

The Federal Ministry of Innovation, Mobility and Infrastructure, One Mobility GmbH, ÖBB-Personenverkehr AG and OÖ Verkehrsverbund-Organisations GmbH Nfg. & Co KG jointly define the purposes and means of processing personal data in the shared Ticketshop distribution system and for central payment processing. In this respect, the processing is carried out within the framework of joint responsibility pursuant to Article 26 GDPR and the joint controllers have concluded a special agreement that specifies which partner fulfils which obligation to comply with the provisions of the GDPR.

For this purpose, ÖBB-Personenverkehr AG makes its sales system (ÖBB Ticketshop) available to the other joint controllers. One Mobility GmbH provides a central billing system for the joint controllers.

5.3. Legal basis of joint responsibility

The legal basis for this joint data processing is in particular Article 6 Para. 1 lit e GDPR in conjunction with Article 2 Para. 1 One Mobility Act. It is in the public interest to create a shared distribution system for public transport in order to facilitate access to the public transport network and thus contribute to climate change mitigation and reduce the burden on taxpayers by providing cost benefits.

5.4. Purpose of joint responsibility

The purpose of this joint data processing is to

ensure easy access to public transport in Austria and thus contribute to climate protection;
provide customers with a larger product range in the sales channels of the responsible parties;
provide customers with a cross-company customer service from the responsible parties;
provide customers with central invoicing and payment processing, including dunning;
ensure that customer data is only collected once and data only has to be changed once with effect for all controllers and thus is always up-to-date for all controllers, thereby ensuring that all controllers fulfil their obligation under Article 5 Para 1 lit d GDPR, according to which each controller must take the appropriate measures to ensure that data is correct and up-to-date;
allow customers to log in to the systems of the other controllers using a single set of credentials;
enable a better use of synergies and even more efficient use of tax resources.

5.5. Data subjects of joint data processing

This joint data processing affects all persons who, from the start of the joint responsibility, purchase a product in the sales channels web, app or counter of a joint controller in accordance with point 2, or use a customer service for the modification of customer master data or for a product. The data in accordance with lit. f is shared between the partners from the date of joint responsibility and can be viewed and processed by them for the purpose of cross-company product sales and customer service.

5.6. Data shared between partners

Within the framework of joint responsibility, your customer data will be processed by all controllers within the context of a common customer base. Joint responsibility applies to all processing activities carried out in the context of joint distribution of products, customer services and central payment processing. The subject-matter of joint processing is:

Customer master data (e.g. title, name, date of birth, address, photo, email address, telephone number, customer ID, stored permissions),
Sales data of the products of the joint portfolio of all responsible entities (e.g. tariff product, validity period, purchase date, distribution channel, payment method, discounts),
Billing and payment data (e.g. IBAN, SEPA mandate, invoices, payment method),
Data collected in the context of customer services (e.g. inquiries, complaints),
Health data in the broader sense if voluntarily entered in the customer account (e.g. wheelchair, assistance dog, etc.) to automatically take into account the corresponding reduction/special travel needs for subsequent bookings.

The access rights to your data have been designed in such a way that a right of access is granted only to the extent strictly necessary in each case in order to protect your privacy in the best possible way.

5.7. The essential content of Article 26 of the Agreement

TheFederal Ministry of Innovation, Mobility and Infrastructure, One Mobility GmbH, ÖBB-Personenverkehr AG and OÖ Verkehrsverbund-Organisations GmbH Nfg. & Co KG, as joint controllers for this data processing, have entered into a special agreement that specifies who of them fulfils which obligation under the GDPR. The essence of this agreement is made available here:

Information obligations: All joint controllers comply with the information obligations under Article 12 et seq. GDPR and Article 26 Para. 2 GDPR. The joint controllers have coordinated the data protection information within the framework of this point 5 and make it available to the data subjects in a transparent and easily accessible manner via their respective data protection declarations.
Rights of the data subject: For the assertion of your data subject’s rights pursuant to Articles 15 to 22 GDPR, please use the contact details in point 2 for the respective joint controller.
The processing and response of requests for information (Article 15 GDPR) with regard to data processing under joint responsibility is carried out by One Mobility GmbH with effect for all controllers. Insofar as it concerns the assertion of a data subject’s right for data processing within the respective responsibility of the controller, the responsibility for answering such requests lies with the respective controller. In order to obtain a complete request for information, which concerns both the data processing under joint responsibility and the independent responsibility of the individual data controllers, a request for information must be addressed to One Mobility GmbH for the data processing within the framework of joint responsibility and to the respective partner in accordance with point 2 for data processing under its own responsibility. In any case, a separate response will be provided.
For the assertion of further data subject rights (Article 16 – 22 GDPR), please contact the controller with whom you have a direct contractual relationship (e.g. because you have purchased their product). Notwithstanding this, you may also claim the rights you have in connection with the joint processing of your personal data from all other controllers under point 2. In this case, the responsible party will immediately forward the matter to the party responsible for processing it, if this is a case of joint responsibility.

Notifications to the supervisory authority pursuant to Article 33 GDPR are sent by the controller whose system or organization the data protection incident has occurred in. Notifications to the data subject pursuant to Article 34 GDPR are sent by ONE Mobility GmbH on behalf of and with effect for all responsible parties. The joint controllers have contractually agreed to inform each other immediately if irregularities in data processing activities are detected and to take measures to mitigate possible adverse consequences for data subjects.

6. Differentiation from individual responsibility

In addition to data processing under joint responsibility, data processing continues to be carried out by the Federal Ministry of Innovation, Mobility and Infrastructure under its sole responsibility. This applies in particular to:

Processing of sales and payment data of historical products purchased prior to the introduction of the shared distribution system;
Processing of personal data for advertising purposes and marketing measures (e.g. newsletters) on the basis of prior consent;
Participation in market surveys, including obtaining consent to such;
Consent to the terms and conditions of use and business of each responsible party.

The processing of this data is not subject to the above agreement. The access rights to your data are designed in such a way that they are granted only to the extent strictly necessary in order to protect your privacy in the best possible way.

7. Links to third-party websites (hyperlinks)

Our website may contain links to websites of other providers. We have no control over and assume no responsibility for the contents of these websites and for the extent to which these providers comply with the applicable data protection regulations.

8. storage period

In accordance with the statutory regulations, personal data is generally not stored for longer than is necessary to achieve the purpose of the storage. The actual storage period may result from an applicable law or apply for the duration of your consent. If the purpose for which the personal data was stored is no longer pursued or if a statutory retention period expires, the personal data is routinely blocked or deleted in accordance with legal regulations.

The following application areas should be emphasized regarding the storage period:

Billing-relevant data due to a ticket purchase (e.g. order data including archived data, customer card data and data on the billing layer) as well as the documents referring thereto (e.g. invoices, payment documents, letters concerning the contract renewal) are stored for up to eleven years in accordance with the legal provisions for any evidential obligations, potential retroactive determination of tax liabilities according to Article 209 Para. 5 BAO and in connection with the electronic act (ELAK).
The user data for a customer account will be deleted three years after the last successful login due to inactivity, provided that no active vouchers are linked to the customer account. Otherwise, deletion will take place ten years after the last successful login.
Customer master data will be deleted 6 months after deletion of all sales data, user data and billing data available for these customers. Photos are only retained for as long as they are in use for a product.
Personal data collected by Friendly Captcha to ensure the security and functionality of the website will be deleted within 30 days.
Information to customers according to Article 20 Para. 3 Railway Transport and Passenger Rights Act is kept for a period of 18 months.
If you have subscribed to a newsletter or have submitted a declaration of consent for direct marketing measures, the data will be deleted after you have cancelled your consent to receive the newsletter (blacklist). Otherwise, the data will also be deleted if you are inactive for three years (e.g. no sign-in to the customer account; no purchase of a KlimaTicket, etc.). To ensure that you no longer receive promotional offers, this information cannot be deleted.
If you contact us or participate in a competition or customer survey, we store your data – unless this is done anonymously – for a maximum of three years after the final processing, in particular in connection with complaint management. This data is stored in order to be able to respond to any queries.

In addition, we may also store your personal data beyond the specified time limits, as long as legal claims can be asserted from the relationship between you and us or until the final clarification of a specific incident or legal dispute. This longer retention takes place in order to protect our legitimate interests in the assertion, clarification and defence of legal claims. In connection with the documentation of business cases, legal requirements – e.g. for ELAK – can also provide for a longer storage period.

9. Measures for the protection of personal data

We have taken technical and organizational measures to ensure that the legal provisions on data protection are complied with. Your personal data is stored on secure networks, accessible only to a limited number of people who are committed to maintaining the confidentiality of this data. Despite these measures, however, there is a risk that any personal data made available on the Internet will be intercepted and used by third parties.

10. Data transfers (including data export to third countries)

Data controllers may have personal data processed by processors. Processors are contractual partners who process personal data on behalf of the data controller. The data controllers only use processors for legitimate data processing. The controllers always ensure in advance that the individual contracted processor is suitable for the provision of services, in particular that it offers sufficient guarantee for a lawful and secure handling of data.

The contracted processors selected by the controllers receive personal data only to the absolutely necessary extent and the processing takes place exclusively for the purposes specified by you.

We will transfer your personal data to the following processors within the framework of joint responsibility:

ÖV Ticketshop GmbH for the operation of the ticket shop and error analysis
One Mobility Ticketing GmbH for the implementation of central payment processing
Distributors for the distribution of products in the joint portfolio
Any other IT service providers and providers of data hosting solutions and other providers of tools and solutions (e.g. printers and plastic card manufacturers) who support us in providing you with the products.

Microsoft Cloud Services and other Microsoft products are used to deploy the sales system. The contract processors are ÖV Ticketshop GmbH, Lassallestrasse 5, 1020 Vienna, ÖBB-Business Competence Center GmbH, Lassallestrasse 5, 1020 Vienna, and – for the provision of technical services, among other things – Microsoft Ireland Operations Limited, 70 Sir John Rogersons’s Quay, Dublin 2, Ireland (“Microsoft”). We would like to point out that Microsoft uses sub-contract processors, some of which are based in third countries, to provide its cloud services or to provide Microsoft products. An up-to-date listing of these sub-processors is provided by Microsoft under the following link: https://servicetrust.microsoft.com/DocumentPage/badc200c-02ab-43d9-b092-ed9b93b9b4a8.

To the extent that a transfer of data from Microsoft to Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, takes place in the United States, Microsoft relies on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequacy of the level of protection of personal data under the EU-US Data Privacy Framework. Microsoft Corporation has been certified according to the EU-US Data Privacy Framework.

In addition, Microsoft invokes the standard data protection clauses for the transfer of personal data from processors in the EEA to processors established in third countries that do not guarantee an adequate level of data protection, as described in Article 46 GDPR and approved by the European Commission by Decision 2021/914/EC of 4 June 2021.

To ensure the security and functionality of the distribution system, ÖV Ticketshop GmbH uses Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee, Germany as a sub-processor. For the hosting and delivery of the content, Friendly Captcha uses hosting services of Hetzner Online GmbH (Germany) and SCALEWAY S.A.S. (France).

We also transmit your personal data to the following recipients (responsible parties) to the extent necessary:

ÖBB-Personenverkehr AG for system developments outside the joint responsibility
Railway transport companies for the use of data to process passenger rights on the basis of your consent
Any third parties involved in the provision of services to you for the fulfilment of our contractual obligations (e.g. banks for payment processing, debt collection offices, payment providers, shipping service providers)
External third parties to the extent required on the basis of our legitimate interests (e.g. auditors and tax advisers, insurance providers, legal representatives)
Public authorities and other public bodies to the extent required by law (e.g. financial authorities).

The Federal Ministry of Innovation, Mobility and Infrastructure also transfers your personal data to the following processors within the scope of its own responsibility:

Transport associations and transport companies not participating in joint product sales for the distribution of the KlimaTicket
One Mobility GmbH for the creation of a sales report, the execution of sweepstakes and customer service activities
Partners and agencies to support marketing activities, customer satisfaction surveys and market research
Datenpol GmbH for the use of a tool for sending newsletters

In addition, the Federal Ministry of Innovation, Mobility and Infrastructure transmits your personal data to the extent necessary, within the scope of its own responsibility, to the following recipients (responsible parties):

Participating transport companies for billing purposes
Federal Ministry of Defence, Civil Service Agency and Federal Ministry of Social Affairs exclusively for the KlimaTicket Ö Armed Forces/Civil Service for the purpose of complying with legal regulations regarding the entitlement to travel expenses

11. your rights

In principle, you have the following rights, which you can assert:

Right to information

You have the right to request information about your stored personal data from the data controller at any time.

Right of rectification

You have the right to correct any incorrect data that affects you (e.g. spelling errors).

Right to deletion

You have the right to request the immediate deletion of personal data, provided that it is not necessary for the purposes for which it was collected or otherwise processed and that the deletion does not preclude any legal grounds.

Right to restriction

You have the right to instruct the data controller to restrict the processing of your stored personal data at any time.

Right to data transmission

You have the right to receive the data provided by you in a common and machine-readable format and to transfer the data to another controller.

Right of appeal

You have the right to object to data processing if the data processing is carried out on the basis of a public interest or in the exercise of public authority or on the basis of a legitimate interest. If data processing is carried out in order to conduct direct marketing, you have the right to object to this data processing.

Right to revoke consent

You have the right to revoke your consent to data processing at any time without giving reasons. The further processing of your data becomes inadmissible but the legality of the processing carried out on the basis of your consent until the revocation remains unaffected.

Exercise of affected rights

If you would like to assert affected rights, please contact us. The following contact options are available:

The processing and response of requests for information with regard to data processing under joint responsibility is carried out with effect for all responsible parties by One Mobility GmbH. For the assertion of a request for information (Article 15 GDPR) within the framework of joint responsibility, please use the following contact options:

Email: datenschutz@one-mobility.at
Mail: One Mobility GmbH, Schwindgasse 4/3, 1040 Vienna

The processing and answering of requests for information with regard to data processing is carried out by the Federal Ministry of Innovation, Mobility and Infrastructure itself. In order to obtain a complete request for information, which concerns both the data processing under joint responsibility and the independent responsibility of the Federal Ministry of Innovation, Mobility and Infrastructure, a request for information must therefore be addressed to both One Mobility GmbH for the data processing within the framework of joint responsibility and to the Federal Ministry of Innovation, Mobility and Infrastructure for data processing under its own responsibility. In any case, a separate response will be provided. The contact details of the Federal Ministry of Innovation, Mobility and Infrastructure can be found in point 2.

For the assertion of further data subject rights (Articles 16–22 GDPR), please contact the controller with whom you have a direct contractual relationship (e.g. because you have bought their product). In the case of the KlimaTicket Ö this is the Federal Ministry of Innovation, Mobility and Infrastructure. Use the contact details in point 2.

Notwithstanding this, you may also assert your rights in connection with the joint processing of your personal data with any other responsible party referred to in point 2. In this case, the responsible party will immediately forward the matter to the party responsible for processing it, if this is a case of joint responsibility.

If you have an existing customer account, please also provide us with the registered email address for easier identification and correct assignment.

Once we have received your request and there are no reasonable doubts about your identity, we will respond to your request within one month.

Right to complain

If you believe that the processing of your data violates data protection law or your data protection rights have otherwise been violated in any way, you can contact the email address below or complain to the regulatory authority. In Austria, this is the Datenschutzbehörde (Data protection authority).

Contact details:
Österreichische Datenschutzbehörde
Barichgasse 40–42, 1030 Vienna
Telephone: +43 1 52152-0
Email: dsb@dsb.gv.at
www.dsb.gv.at