Privacy policy

1. General

We are committed to the responsible handling and protection of your personal data. We want you to know which data we collect, when we collect it and how we use it. This Privacy Policy is intended to inform all persons who use our product or services or visit our website about the nature, scope and purpose of the processing of personal data and about your rights in relation to this data processing. 

As we continue to develop our website www.klimaticket.at and implement new technologies, changes to this privacy policy may be required. However, we will make sure that the latest version is always made available to you.

2. Data controller within the meaning of the General Data Protection Regulation

Federal Minister for Climate Protection, Environment, Energy, Mobility, Innovation and Technology ("BMK", "we", "us")

Radetzkystraße 2
1030 Vienna
E-mail: servicebuero@bmk.gv.at
www.bmk.gv.at

3. Data protection officer in accordance with the General Data Protection Regulation

If you have any questions about data protection or the use of your personal data, please contact our data protection officer at datenschutz@bmk.gv.at. 

4. Which personal data we process and for what purpose

Personal data refers to all the information that relates to a natural person. We collect personal data in accordance with Articles 13 and 14 of the GDPR in the following cases and for the following purposes:

4.1. Contact Us

If you contact our KlimaTicket customer service regarding any questions, complaints, suggestions or other comments, or make any other request to the KlimaTicket customer service, we will process your name, contact details (e.g. telephone number or email address) along with the content of your message to us. This can be done at all service points of KlimaTicket partners, by telephone, or online via the contact form. This also includes the processing of complaints in the course of payment processing. In this case, data will either be provided by the responsible bank/ payment service provider or we will provide feedback to the bank/ payment service provider. The processing is necessary so that we can process your inquiry and answer it accordingly and is therefore carried out in order to fulfil our (pre-) contractual obligations toward you (Article 6 Para. 1 lit b GDPR).

4.2. Purchase of the KlimaTicket in the KlimaTicket shop 

When you buy a KlimaTicket Ö in the KlimaTicket shop, the following personal data is processed:

  • Name
  • Date of birth
  • Address
  • Delivery address, if different from the general address
  • Billing address, if invoice dispatch is desired
  • Photo
  • Email address
  • Phone number, if any
  • Contract information (validity period, method of payment, request for invoice)
  • Bank data for SEPA Direct Debit mandate
  • Photo (except KlimaTicket Ö Special Blind)
  • Card number
  • Assignment to a customer account

This data is required to process your order and payment and to provide you with the KlimaTicket. The processing is thus carried out in order to fulfil our (pre-) contractual obligations toward you (Article 6 Para. 1 lit b GDPR).

The participating transport companies also process your data on their own responsibility in order to be able to evaluate whether you are a regular customer. In this case, this information will be sent to us for billing purposes. This processing is carried out on the basis of legal obligations (Article 6 Para. 1 lit c GDPR in conjunction with Article 1 Para. 2 Climate Ticket Act and Enclosure 2 Article 1 point 2 lit a and b of the corresponding regulation) and on the basis of legitimate interests (Article 6 Para. 1 lit f GDPR).

4.3. Customer account

To use all the functionalities of our website, register for a personal KlimaTicket customer account. With it you can use all your stored data regardless of the device and browser and simplify and speed up the ticket purchase. To create a customer account, we need at least the following information about you: Email address, password, title, your first and last name and date of birth. When purchasing a ticket at a service desk, a customer profile is automatically created in our system. On request, you can also obtain a customer account at the service desk for the independent management of your customer data and purchases. In this case, after data entry and registration, you will receive an email from us to confirm your email address and activate the customer account. As soon as you confirm the activation link, your customer account is active. The next time you log in, the existing local data will be transferred to your customer account if you agree to this process. Your customer account enables a pleasant and fast ticket purchase without repeated data entry, for example by storing your address, card and payment details. Of course, you can change the method of payment during the ticket purchase process. The processing of said data is necessary so that we can create your customer account and is therefore carried out in order to fulfil our (pre-) contractual obligations toward you (Article 6 Para. 1 lit b GDPR).

You have the possibility to personalize your account. We show your own person as ICH (ME). You can choose a colour for your profile under ICH (ME). From now on, your customer account will be displayed in the colour you personally selected. The language you choose to display the website content will also be stored in the customer account for future visits. If you no longer want to use your customer account, you have the option of closing the customer account again. Your registration will be cancelled and your access data, email address and password will be deleted. Depending on the intended use, longer (legal) retention periods may exist for up to seven years (see point 7). Your email address or customer number can be used immediately after deletion for creating a new personal customer account. Every new creation is done with general system settings. If you do not use your account for more than one year, we will automatically send you an email reminder to the email address you provided. You will then have two weeks to log in to your account. We can automatically close your account if you do not use this account for an extended period of time, as in this case we assume that you do not want to use it again.

4.4. Shared responsibility

The person responsible for the KlimaTicket Ö within the meaning of Article 4 (7) GDPR is the Federal Minister for Climate Action, Environment, Energy, Mobility, Innovation and Technology (BMK).

As far as it concerns the customer account of the KlimaTicket shop and ÖBB-Personenverkehr AG, the special feature is that customers have the option of registering in the ticket shop of ÖBB-Personenverkehr AG with the access data of the customer account of the KlimaTicket shop. The data processing is carried out within the framework of joint responsibility within the meaning of Article 26 GDPR. Responsible within the meaning of Article 4 (7) GDPR:

a) The Federal Minister for Climate Action, Environment, Energy, Mobility, Innovation and Technology for data processing in connection with the KlimaTicket Ö,
b) ÖBB-Personenverkehr AG for data processing and the distribution of ÖBB products and 
c) One Mobility GmbH for the provision of non-discriminatory access to the common distribution system within the meaning of § 2 of the One Mobility Act.

A limited number of your customer data is therefore processed within the framework of a common customer base in accordance with the One Mobility Act, BGBl. I No. 75/2021 in the current valid version, under joint responsibility between the Federal Ministry for Climate Action, Environment, Energy, Mobility, Innovation and Technology, One Mobility GmbH and ÖBB-Personenverkehr AG. Specific master date subject of joint processing consists of:

  • Salutation
  • Name
  • Date of birth
  • Address
  • Photo
  • Contact details
  • Banking details
  • Card details KlimaTicket Ö

The purpose of this joint data processing is that

1. The customer master data is only recorded once in the common sales system and
2. Data need to be changed only once with effect for all those responsible

Master data is therefore always up-to-date for all those responsible. On the one hand, this makes use of possible synergies and improves the use of the sales system for both customers and those responsible. On the other hand, this also ensures that all data controllers fulfil their obligation under Article 5(1)(d) of the GDPR, according to which each data controller must take appropriate measures to ensure that data are correct and up-to-date.

The legal basis for this joint data processing is Article 6 Para. 1 lit e GDPR in conjunction with Article 2 Para. 1 One Mobility Act. In the public interest, the task is to create a common distribution system for public passenger transport in order to facilitate access to the public transport network and thus contribute to climate protection. All persons who purchase a KlimaTicket Ö or a product of ÖBB-Personenverkehr AG (VorteilsCard, Upgrade, Reservation, etc.) are affected by this joint data processing.

For this reason, the Federal Minister for Climate Action, Environment, Energy, Mobility, Innovation and Technology, One Mobility GmbH and ÖBB-Personenverkehr AG, as joint controllers for this data processing, have concluded a special agreement that specifies who of them fulfils which obligation in accordance with the GDPR.

You can exercise your rights as a data subject in accordance with Articles 15 to 22 GDPR with all three entities, preferably you should contact the responsible person with whom you are in a contractual relationship. The processing is carried out with effect for all those responsible by the Ministry of Climate Action and ÖBB-Personenverkehr AG. 

The ÖBB-Personenverkehr AG will make notifications to the supervisory authority or to those affected pursuant to Articles 33 and 34 GDPR with effect for all three responsible persons.

Contact details for enforcing a request for information:

Federal Ministry for Climate Action, Environment, Energy, Mobility, Innovation and Technology 
1030 Vienna
datenschutz@bmk.gv.at

ÖBB-Personenverkehr AG
Am Hauptbahnhof 2, 1100 Vienna
datenschutz.personenverkehr@pv.oebb.at

One Mobility GmbH
Schwindgasse 4/3, 1040 Vienna
office@one-mobility.at

4.5. Administration of the KlimaTicket Ö Armed Forces/Civilian Service

If you are a military or civilian service member and hold the KlimaTicket Ö Armes Forces/Civilian Service, the Federal Ministry of Defence or the Civilian Service Agency will inform us of your non-enlistment or premature withdrawal from military or civilian service. This data is processed for the purpose of fulfilling the contract in order to handle the termination of your contract with us (Art 6 para 1 lit b DSGVO). This data is deleted after the ticket has been returned, the payment of the surcharge in accordance with the General Terms and Conditions for the KlimaTicket Ö Bundesheer/Zivildienst or after the conclusion of any legal proceedings.

4.6. Visiting the website

When you visit our website www.klimaticket.at , the following data is processed (server logs):

  • IP address of the terminal
  • Request details and destination address
  • Browser and operating system used
  • Language selection
  • The date and time of the call
  • The URL you are calling, including all parameters
  • The page from which you clicked on the page link, if any
  • The protocol version used by your browser
  • The access method used
  • The name and size of the data you are calling up
  • Message indicating whether the retrieval was successful

This data is used on the legal basis of Art 6 Para. 1 lit f GDPR in conjunction with Article 165 Para. 3 TKG 2021 to ensure the smooth operation of the website, comfortable use of the website and to check the safety of the website. In any case, the data will not be used to draw conclusions about your person. 

4.7. Cookies

Cookies are small text files that are stored on your device in order to be able to recognize it. They do not cause any damage. The information contained in the cookies is used for session control, server load balancing, for analysis purposes and for increasing the security of our applications, as well as for customization and usability. This enables us to provide a high level of user-friendliness of our website. 

This website uses only technically necessary cookies on the basis of our legitimate interests according to Article 6 Para 1 lit f GDPR in conjunction with Article 165 Para. 3 TKG 2021. These cookies are necessary to enable you to use our websites with all the functions provided by us. Without these cookies, our services cannot be provided. These cookies do not collect any information about you and do not store any internet sites. These essential cookies can be deactivated at any time via the browser you use. As a result, you may no longer be able to use some or all of the services, or you may only be able to use them to a limited extent. Details about cookies can be found in the Terms of Use.

4.8. Newsletter

You have the opportunity to subscribe to our newsletter. With our personalized newsletter, we will inform you via email about discounts and promotions, invitations to competitions, industry news, information on public transport products, invitations to events, customer surveys and other customer loyalty measures. For this purpose, we process your name, title and email address, along with your declaration that you agree to receive the newsletter. In order to tailor the newsletter to your interests and needs and to be able to provide you with relevant information and recommendations, we use profiling based on your contract data and information from your purchasing and travel history.

You can unsubscribe from the newsletter at any time, e.g. via newsletterabmeldung@one-mobility.at. All your personal data which was stored in connection with the newsletter will be deleted immediately and a note made noted that you no longer want to receive newsletters.

4.9. Customer satisfaction surveys and market research

In order to further develop our product and to provide you with the best possible service, we process general statistical data on your purchasing behaviour for the purposes of market research. This processing takes place on the basis of our legitimate interests in accordance with Article 6 Para. 1 lit f GDPR.

In addition, you have the opportunity to participate in extensive market research on a voluntary basis. We will provide you with information on this separately at the time of your registration.
In order to inform you about the possibility of taking part in market research or customer satisfaction surveys, we will send you a all relevant information by post. For this purpose, we process your name and address on the basis of our legitimate interests in improving our products according to Article 6 Para. 1 lit f GDPR.

4.10. Enforcement of passenger rights

If you assert your statutory rights as a passenger in accordance with EU Regulation No. 1371/2007, the Railway Transport and Passenger Rights Act and the General Terms and Conditions for the purchase of the KlimaTicket Ö, we will forward your contact details and contract data to the relevant transport company with your prior consent. After that, we only keep a record of your declaration of consent in evidence. For more information on how the transport company processes your data, contact the respective transport company. 

5. Links to third-party websites (hyperlinks)

Our website may contain links to websites of other providers. We have no control over and assume no responsibility for the contents of these websites and for the extent to which these providers comply with the applicable data protection regulations.

6. Storage period

In accordance with the statutory regulations, personal data is generally not stored for longer than is necessary to achieve the purpose of the storage. The actual storage period may result from an applicable law or apply for the duration of your consent. If the purpose for which the personal data was stored is no longer pursued or if a statutory retention period expires, the personal data is routinely blocked or deleted in accordance with legal regulations.

The following application areas should be emphasized regarding the storage period:

  • If you contact us, we will store your data for a maximum of three years after the final processing and answer of your inquiry, in particular in connection with complaint management. This data is stored in order to be able to respond to any queries.
  • Invoice-related data due to ticket purchases is stored for ten years in accordance with the legal provisions for any verification obligations, potential retroactive determination of tax debts according to Article 209 Para. 5 BAO in conjunction with the electronic filing system (ELAK).
  • If you have subscribed to a newsletter or have submitted a declaration of consent for direct marketing measures, the data will be deleted after you have cancelled your consent to receive the newsletter (blacklist). Otherwise, it will also be deleted if you are inactive for three years (e.g. no sign-in to the customer account; no purchase of a KlimaTicket, etc.). To ensure that you no longer receive promotional offers, this information cannot be deleted.

In addition, we may also store your personal data beyond the specified time limits, as long as legal claims can be asserted from the relationship between you and us or until the final clarification of a specific incident or legal dispute. This longer retention takes place in order to protect our legitimate interests in the assertion, clarification and defence of legal claims. In connection with the documentation of business cases, legal requirements - e.g. for ELAK - can also provide for a longer storage period.

7. Measures for the protection of personal data

We have taken technical and organizational measures to ensure that the legal provisions on data protection are complied with. Your personal data is stored on secure networks, accessible only to a limited number of people who are committed to maintaining the confidentiality of this data. Despite these measures, however, there is a risk that any personal data made available on the Internet will be intercepted and used by third parties. 

8. Data transfers

The Federal Minister for Climate Protection, the Environment, Energy, Mobility, Innovation and Technology can have the personal data processed by contracted processors. By contracted processors we mean our contractual partners, who process personal data on our behalf. We use contracted processors only for data processing that we are lawfully entitled to perform. We always ensure in advance that the individual contracted processor is suitable for the provision of services, in particular that it offers sufficient guarantee for a lawful and secure handling of data.
The contracted processors selected by us receive personal data from us only to the absolutely necessary extent and the processing takes place exclusively for the purposes specified by you. We may transfer your personal data to:

  • One Mobility Ticketing GmbH, One Mobility GmbH and participating transport associations and transport companies for the management and distribution of the KlimaTicket;
  • ÖBB-Personenverkehr AG for the operation of the ticket shop;
  • Partners and agencies to support marketing activities, customer satisfaction surveys and market research;
  • Any other IT service providers and providers of data hosting solutions and other providers of tools and solutions (e.g. printers and plastic card manufacturers) who support us in providing you with the KlimaTicket.

We also transmit your personal data to the following recipients (responsible persons) to the extent necessary:

  • Participating transport companies for billing purposes;
  • Any third parties involved in the provision of services to you for the fulfilment of our contractual obligations (e.g. banks for payment processing, debt collection offices, payment providers, shipping service providers);
  • External third parties to the extent required on the basis of our legitimate interests (e.g. auditors and tax advisers, insurance providers, legal representatives);
  • Federal Minister of Defence and Civilian Service Agency exclusively for the KlimaTicket Ö Bundesheer/Zivildienst for the purposes of compliance with statutory provisions concerning entitlement to reimbursement of travel costs
  • Public authorities and other public bodies to the extent required by law (e.g. financial authorities).

9. Your rights

In principle, you have the following rights, which you can assert against the Federal Minister of Climate Protection, Environment, Energy, Mobility, Innovation and Technology:

Right to information
You have the right to request information about your stored personal data from the data controller at any time. 

Right of rectification
You have the right to correct any incorrect data that affects you (e.g. spelling errors).

Right to deletion
You have the right to request the immediate deletion of personal data, provided that it is not necessary for the purposes for which it was collected or otherwise processed and that the deletion does not preclude any legal grounds. 

Right to restriction
You have the right to instruct the data controller to restrict the processing of your stored personal data at any time.

Right to data transmission
You have the right to receive the data provided by you in a common and machine-readable format and to transfer the data to another controller.

Right of appeal 
You have the right to object to data processing if the data processing is carried out on the basis of a public interest or in the exercise of public authority or on the basis of a legitimate interest. If data processing is carried out in order to conduct direct marketing, you have the right to object to this data processing. 

Right to revoke consent
You have the right to revoke your consent to data processing at any time without giving reasons. The further processing of your data becomes inadmissible; however, the legality of the processing carried out on the basis of your consent until the revocation remains unaffected.

Exercise of affected rights
If you would like to assert affected rights, please contact us. The following contact options are available:
Email: datenschutz@bmk.gv.at
By post to: Federal Ministry for Climate Protection, Environment, Energy, Mobility, Innovation and Technology, Radetzkystraße 2, 1030 Vienna

If you have an existing customer account, please also provide us with the registered email address and your card number for easier identification and correct assignment.
Once we have received your request and there are no reasonable doubts about your identity, we will respond to your request within four weeks.

Right to complain
If you believe that the processing of your data violates data protection law or your data protection rights have otherwise been violated in any way, you can contact the e-mail address below or complain to the regulatory authority. In Austria, this is the Datenschutzbehörde (Data protection authority). 

Contact details:
Austrian Data Protection Authority
Barichgasse 40-12, 1030 Vienna
Phone: +43 (0)1 52152-0
E-mail: dsb@dsb.gv.at
www.dsb.gv.at