2. Data controller within the meaning of the General Data Protection Regulation
Federal Ministry for Climate Protection, Environment, Energy, Mobility, Innovation and Technology ("BMK", "we", "us")
3. Data protection officer in accordance with the General Data Protection Regulation
If you have any questions about data protection or the use of your personal data, please contact our data protection officer at firstname.lastname@example.org.
4. Which personal data we process and for what purpose
Personal data refers to all the information that relates to a natural person. We collect personal data in accordance with Articles 13 and 14 of the GDPR in the following cases and for the following purposes:
4.1. Contact Us
If you contact our KlimaTicket customer service regarding any questions, complaints, suggestions or other comments, or make any other request to the KlimaTicket customer service, we will process your name, contact details (e.g. telephone number or email address) along with the content of your message to us. This can be done at all service points of KlimaTicket partners, by telephone, or online via the contact form. This also includes the processing of complaints in the course of payment processing. In this case, data will either be provided by the responsible bank/payment service provider or we will provide feedback to the bank/ payment service provider. The processing is necessary so that we can process your inquiry and answer it accordingly and is therefore carried out in order to fulfil our (pre-) contractual obligations toward you (Article 6 Para. 1 lit b GDPR).
4.2. Purchase of the KlimaTicket in the KlimaTicket shop
When you buy a KlimaTicket in the KlimaTicket shop, the following personal data is processed:
- Date of birth
- Delivery address, if different from the general address
- Billing address, if invoice dispatch is desired
- Email address
- Phone number, if any
- Contract information (validity period, method of payment, request for invoice)
- Bank data for SEPA Direct Debit mandate
- Photo (except KlimaTicket Ö Special Blind)
- Card number
- Assignment to a customer account
This data is required to process your order and payment and to provide you with the KlimaTicket. The processing is thus carried out in order to fulfil our (pre-) contractual obligations toward you (Article 6 Para. 1 lit b GDPR).
The participating transport companies also process your data on their own responsibility in order to be able to evaluate whether you are a regular customer. In this case, this information will be sent to us for billing purposes. This processing is carried out on the basis of legal obligations (Article 6 Para. 1 lit c GDPR in conjunction with Article 1 Para. 2 Climate Ticket Act and Enclosure 2 Article 1 point 2 lit a and b of the corresponding regulation) and on the basis of legitimate interests (Article 6 Para. 1 lit f GDPR).
4.3. Customer account
To use all the functionalities of our website, register for a personal KlimaTicket customer account. With it you can use all your stored data regardless of the device and browser and simplify and speed up the ticket purchase. To create a customer account, we need at least the following information about you: Email address, password, title, your first and last name and date of birth. When purchasing a ticket at a service desk, a customer profile is automatically created in our system. On request, you can also obtain a customer account at the service desk for the independent management of your customer data and purchases. In this case, after data entry and registration, you will receive an email from us to confirm your email address and activate the customer account. As soon as you confirm the activation link, your customer account is active. The next time you log in, the existing local data will be transferred to your customer account if you agree to this process. Your customer account enables a pleasant and fast ticket purchase without repeated data entry, for example by storing your address, card and payment details. Of course, you can change the method of payment during the ticket purchase process. The processing of said data is necessary so that we can create your customer account and is therefore carried out in order to fulfil our (pre-) contractual obligations toward you (Article 6 Para. 1 lit b GDPR).
You have the possibility to personalize your account. We show your own person as ICH (ME). You can choose a colour for your profile under ICH (ME). From now on, your customer account will be displayed in the colour you personally selected. The language you choose to display the website content will also be stored in the customer account for future visits. If you no longer want to use your customer account, you have the option of closing the customer account again. Your registration will be cancelled and your access data, email address and password will be deleted. Depending on the intended use, longer (legal) retention periods may exist for up to seven years (see point 7). Your email address or customer number can be used immediately after deletion for creating a new personal customer account. Every new creation is done with general system settings. If you do not use your account for more than one year, we will automatically send you an email reminder to the email address you provided. You will then have two weeks to log in to your account. We can automatically close your account if you do not use this account for an extended period of time, as in this case we assume that you do not want to use it again.
4.4. Visiting the website
When you visit our website www.klimaticket.at , the following data is processed (server logs):
- IP address of the terminal
- Request details and destination address
- Browser and operating system used
- Language selection
- The date and time of the call
- The URL you are calling, including all parameters
- The page from which you clicked on the page link, if any
- The protocol version used by your browser
- The access method used
- The name and size of the data you are calling up
- Message indicating whether the retrieval was successful
This data is used on the legal basis of Art 6 Para. 1 lit f GDPR in conjunction with Article 96 Para. 3 TKG to ensure the smooth operation of the website, comfortable use of the website and to check the safety of the website. In any case, the data will not be used to draw conclusions about your person.
Cookies are small text files that are stored on your device in order to be able to recognize it. They do not cause any damage. The information contained in the cookies is used for session control, server load balancing, for analysis purposes and for increasing the security of our applications, as well as for customization and usability. This enables us to provide a high level of user-friendliness of our website.
You have the opportunity to subscribe to our newsletter. With our personalized newsletter, we will inform you via e-mail about discounts and promotions, invitations to competitions, industry news and information on public transport products. For this purpose, we process your name, title and email address, along with your declaration that you agree to receive the newsletter. In order to tailor the newsletter to your interests and needs and to be able to provide you with relevant information and recommendations, we use profiling based on your contract data and information from your purchasing and travel history.
You can unsubscribe from the newsletter at any time, e.g. via email@example.com. All your personal data which was stored in connection with the newsletter will be deleted immediately and a note made noted that you no longer want to receive newsletters.
4.7. Customer satisfaction surveys and market research
In order to further develop our product and to provide you with the best possible service, we process general statistical data on your purchasing behaviour for the purposes of market research. This processing takes place on the basis of our legitimate interests in accordance with Article 6 Para. 1 lit f GDPR.
In addition, you have the opportunity to participate in extensive market research on a voluntary basis. We will provide you with information on this separately at the time of your registration.
In order to inform you about the possibility of taking part in market research or customer satisfaction surveys, we will send you a postcard with all relevant information by post. For this purpose, we process your name and address on the basis of our legitimate interests in improving our products according to Article 6 Para. 1 lit f GDPR.
4.8. Enforcement of passenger rights
If you assert your statutory rights as a passenger in accordance with EU Regulation No. 1371/2007, the Railway Transport and Passenger Rights Act and the General Terms and Conditions for the purchase of the KlimaTicket Ö, we will forward your contact details and contract data to the relevant transport company with your prior consent. After that, we only keep a record of your declaration of consent in evidence. For more information on how the transport company processes your data, contact the respective transport company.
5. Links to third-party websites (hyperlinks)
Our website may contain links to websites of other providers. We have no control over and assume no responsibility for the contents of these websites and for the extent to which these providers comply with the applicable data protection regulations.
6. Storage period
In accordance with the statutory regulations, personal data is generally not stored for longer than is necessary to achieve the purpose of the storage. The actual storage period may result from an applicable law or apply for the duration of your consent. If the purpose for which the personal data was stored is no longer pursued or if a statutory retention period expires, the personal data is routinely blocked or deleted in accordance with legal regulations.
The following application areas should be emphasized regarding the storage period:
- If you contact us, we will store your data for a maximum of three years after the final processing and answer of your inquiry, in particular in connection with complaint management. This data is stored in order to be able to respond to any queries.
- Invoice-related data due to ticket purchases is stored for ten years in accordance with the legal provisions for any verification obligations, potential retroactive determination of tax debts according to Article 209 Para. 5 BAO in conjunction with the electronic filing system (ELAK).
- If you have subscribed to a newsletter or have submitted a declaration of consent for direct marketing measures, the data will be deleted after you have cancelled your consent to receive the newsletter (blacklist). Otherwise, it will also be deleted if you are inactive for three years (e.g. no sign-in to the customer account; no purchase of a KlimaTicket, etc.). To ensure that you no longer receive promotional offers, this information cannot be deleted.
In addition, we may also store your personal data beyond the specified time limits, as long as legal claims can be asserted from the relationship between you and us or until the final clarification of a specific incident or legal dispute. This longer retention takes place in order to protect our legitimate interests in the assertion, clarification and defence of legal claims. In connection with the documentation of business cases, legal requirements - e.g. for ELAK - can also provide for a longer storage period.
7. Measures for the protection of personal data
We have taken technical and organizational measures to ensure that the legal provisions on data protection are complied with. Your personal data is stored on secure networks, accessible only to a limited number of people who are committed to maintaining the confidentiality of this data. Despite these measures, however, there is a risk that any personal data made available on the Internet will be intercepted and used by third parties.
8. Data transfers
The Federal Ministry for Climate Protection, the Environment, Energy, Mobility, Innovation and Technology can have the personal data processed by contracted processors. By contracted processors we mean our contractual partners, who process personal data on our behalf. We use contracted processors only for data processing that we are lawfully entitled to perform. We always ensure in advance that the individual contracted processor is suitable for the provision of services, in particular that it offers sufficient guarantee for a lawful and secure handling of data.
The contracted processors selected by us receive personal data from us only to the absolutely necessary extent and the processing takes place exclusively for the purposes specified by you. We may transfer your personal data to:
- One Mobility Ticketing GmbH and participating transport associations and transport companies for the management and distribution of the KlimaTicket;
- ÖBB-Personenverkehr AG for the operation of the ticket shop;
- Partners and agencies to support marketing activities, customer satisfaction surveys and market research;
- Any other IT service providers and providers of data hosting solutions and other providers of tools and solutions (e.g. printers and plastic card manufacturers) who support us in providing you with the KlimaTicket.
We also transmit your personal data to the following recipients (responsible persons) to the extent necessary:
- Participating transport companies for billing purposes;
- Any third parties involved in the provision of services to you for the fulfilment of our contractual obligations (e.g. banks for payment processing, debt collection offices, payment providers, shipping service providers);
- External third parties to the extent required on the basis of our legitimate interests (e.g. auditors and tax advisers, insurance providers, legal representatives);
- Public authorities and other public bodies to the extent required by law (e.g. financial authorities).
9. Your rights
In principle, you have the following rights, which you can assert against the Federal Ministry of Climate Protection, Environment, Energy, Mobility, Innovation and Technology:
Right to information
You have the right to request information about your stored personal data from the data controller at any time.
Right of rectification
You have the right to correct any incorrect data that affects you (e.g. spelling errors).
Right to deletion
You have the right to request the immediate deletion of personal data, provided that it is not necessary for the purposes for which it was collected or otherwise processed and that the deletion does not preclude any legal grounds.
Right to restriction
You have the right to instruct the data controller to restrict the processing of your stored personal data at any time.
Right to data transmission
You have the right to receive the data provided by you in a common and machine-readable format and to transfer the data to another controller.
Right of appeal
You have the right to object to data processing if the data processing is carried out on the basis of a public interest or in the exercise of public authority or on the basis of a legitimate interest. If data processing is carried out in order to conduct direct marketing, you have the right to object to this data processing.
Right to revoke consent
You have the right to revoke your consent to data processing at any time without giving reasons. The further processing of your data becomes inadmissible; however, the legality of the processing carried out on the basis of your consent until the revocation remains unaffected.
Exercise of affected rights
If you would like to assert affected rights, please contact us. The following contact options are available:
By post to: Federal Ministry for Climate Protection, Environment, Energy, Mobility, Innovation and Technology, Radetzkystraße 2, 1030 Vienna
If you have an existing customer account, please also provide us with the registered email address for easier identification and correct assignment.
Once we have received your request and there are no reasonable doubts about your identity, we will respond to your request within four weeks.
Right to complain
If you believe that the processing of your data violates data protection law or your data protection rights have otherwise been violated in any way, you can contact the e-mail address below or complain to the regulatory authority. In Austria, this is the Datenschutzbehörde (Data protection authority).
Austrian Data Protection Authority
Barichgasse 40-12, 1030 Vienna
Phone: +43 (0)1 52152-0