home en Shopping Cart

No products in shopping cart

  • €0.00 Total amount incl. VAT

Proceed to checkout

 

Privacy Policy

Table of contents

1. General

1.1 Grundsätze

At VAG Verkehrs-Aktiengesellschaft, Südliche Fürther Str. 5 90429 Nuremberg, Germany, we are committed to protecting and respecting your privacy. In the sections below, we would like to briefly explain how we protect your data and what it means for you when you make use of our online services.

The protection of your privacy is of the greatest importance to us. In accordance with applicable regulations on the protection of personal data, any personal data generated will only be collected, processed and used for the purpose of fulfilling the contract and pursuing our legitimate business interests by advising and supporting our customers and tailoring our products to their needs. Therefore, it goes without saying that we comply with applicable legislation such as the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the Bavarian Data Protection Act (BayDSG).</>

It is also important that you are aware at all times of the data which we store and of the way in which we use it. If you have any questions, suggestions or comments relating to data protection, please do not hesitate to contact us by sending an email to verkauf@vag.de.

1.2 Role of the Verkehrsverbund Großraum Nürnberg GmbH ("VGN")

Verkehrsverbund Großraum Nürnberg GmbH is neither the operator of the ticket shop in the app nor the seller of the tickets. Tickets are sold by the VAG public transport company. Customers enter into contracts with VAG.

1.3 Terms and definitions in this document

Personal data

Personal data means any information relating to an identified or identifiable natural person. This includes information such as name, email address, IP address, postal address or telephone number. This does not apply to information that cannot be directly or indirectly linked to your person, such as the number of people using a website (Article 4 No. 1 GDPR).

Processing

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Article 4 No. 2 GDPR).

1.4 Controller

Responsible body (Article 4 No. 7 GDPR):

VAG Verkehrs-Aktiengesellschaft Nürnberg
Südliche Fürther Str. 5 90429 Nürnberg

Telefon:          0911 283-4646
Telefax:          0911 283-4800
E-Mail:           service@vag.de

1.5 Data protection officer

All interested parties and visitors to our website can contact us about privacy matters at:

VAG Verkehrs-Aktiengesellschaft Nürnberg
Data Protection Officer
Südliche Fürther Str. 5 90429 Nürnberg

Telefon:          0911 283-4646
Telefax:          0911 283-4800
E-Mail:           datenschutz@vag.de

1.6 Your rights

You have the following rights as a data subject:

1.6.1 Right of access in accordance with Article 15 GDPR

You have the right to access the personal information we hold about you. This information includes whether or not we hold personal data concerning you, the nature of that personal data and the purposes for which it is processed. Upon request, we will provide you with a copy of the personal data undergoing processing.

1.6.2 Right to rectification of inaccurate personal data in accordance with Article 16 GDPR

You have the right to obtain from VAG the rectification of inaccurate or incomplete personal data.

1.6.3 Right to erasure in accordance with Article 17 GDPR

You have the right, under certain circumstances, to obtain the erasure of your personal data.

We have the obligation to erase your personal data if they are no longer necessary in relation to the purposes for which they were collected or otherwise processed, if you withdraw your consent or if your personal data has been unlawfully processed.

1.6.4 Right to restriction of processing in accordance with Article 18 GDPR

You have the right, under certain circumstances, to have the processing of your personal data restricted. This is particularly the case if you contest the accuracy of your personal data and we need to verify the accuracy of your data. In this case, we may store your personal data but not to process it until we have verified its accuracy.

1.6.5 Right to data portability in accordance with Article 20 GDPR

If you wish to move to another service provider, you have the right to receive the personal data that you have provided to us on the basis of your consent or of an existing contractual relationship with you in a commonly used and machine-readable format or, alternatively, you have the right to transmit those data to another controller.

1.6.6 Right to object in accordance with Article 21 No. 1 GDPR

You have the right to object, on grounds arising from your particular situation, to the processing of personal data where we are processing your data on the basis of our legitimate interests in accordance with Article 6 No. 1(f) GDPR. In such a case, we will review your objection and will no longer process your data until we have completed our review. Where they exist we will demonstrate compelling legitimate grounds for the processing which override your interests or demonstrate that processing is necessary for the establishment, exercise or defence of legal claims.

1.6.7 Right to object to direct marketing pursuant to Article 21 No. 2 GDPR

You have the right to object to future direct marketing (opt-out).

All you need to do is send us a short message using the contact details provided.

1.6.8 Right to withdraw your consent pursuant to Article 7 No. 3 GDPR

You have the right to withdraw your consent to data processing at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

All you need to do is send us a short message using the contact details provided.

1.6.9 Right to lodge a complaint with a supervisory authority according to Article 77 No. 1 GDPR

You have the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your place of residence or workplace or the supervisory authority responsible for VAG.

The Bavarian State Office for Data Protection Supervision (Promenade 18, 91522 Ansbach, phone: +49 (0)981 1800930, email: poststelle@lda.bayern.de) is responsible for VAG.

1.7 Data security

In accordance with Article 32 GDPR, we have implemented technical and organisational measures to protect your personal data from loss, destruction, manipulation and unauthorised disclosure. All our employees and all service providers who work for us have committed to adhere to the current data protection laws.

Whenever we collect and process personal data, this data is encrypted before it is transferred. This means that your data cannot be misused by third parties. Our security precautions are subject to a continuous improvement process and our data protection declarations are continuously being revised.

2. Disclosure of personal data

Some of your personal data will be shared with service providers who act on our behalf. We have entered into data processing agreements with each of our service providers in accordance with Article 28 GDPR. The service providers process your personal data in accordance with the legal framework referenced in these agreements. These service providers are used by us (the processing service provider is noted in the following at the appropriate place):

  • eos.uptrade GmbH, Schanzenstraße 70, 20357 Hamburg, Germany („eos“)
  • etracker GmbH, Erste Brunnenstraße 1, 20459 Hamburg, Germany („etracker“)
  • LOGPAY Financial Services GmbH, Schwalbacher Straße 72, 65760 Eschborn, Germany (“LOGPAY”)
  • Apple Inc., 1 Infinite Loop, Cupertino, CA 95014, USA (“Apple”)
  • Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA(„Google“)

3. Data collected by the VGN Fahrplan & Tickets app

You can use the VGN Fahrplan & Tickets app to retrieve Fahrplan information and to buy tickets.

3.1 Downloading the app

When the app is downloaded, the necessary information is transmitted to the respective app store (Apple AppStore or Google Play Store), including your user name, email address and customer number of your account, time of download, payment information and unique device identification number. We have no control over, and are not responsible for, the collection of data by the app stores. Further information can be found in the privacy policies of the app store operators:

3.2 Data collected and purpose of processing

The VGN Fahrplan & Tickets app collects and processes data for ticket purchases (see section 6.) When you use the app, the following additional data is collected and processed.

3.2.1 Firebase tracking service (sending personal data to Google)

For our VGN Fahrplan & Tickets app, we use Google's "Firebase" tracking service. Firebase uses tracking technologies that enable an analysis of your use of our app, e.g. for performance monitoring, for error logs and to analyse user behaviour, e.g. which screens are viewed and which features are used and how often. The purpose of using Firebase in our app is to analyse crashes (crashlytics) in order to regularly improve the app. The legal basis for this data processing is Article 6 No. 1 sentence 1 (f) GDPR, as we have a legitimate interest in the analysis, optimisation and economic operation of our app and the data processing is necessary to safeguard this interest.

Firebase collects information about the use of our app and sends it to Google in Ireland or the USA where it is stored. The data is only collected and transmitted to Firebase in an anonymous form. This data is not combined with any other user data.

Google uses this information for the purpose of evaluating your use of the app and providing us with other services relating to app activity.

Google is certified under the EU-US Privacy Framework: https://www.dataprivacyframework.gov/s/

You can find more information about Google Firebase and data protection at www.google.com/policies/privacy/ sowie firebase.google.com

3.3 Permissions

In order for the VGN Fahrplan & Tickets app to function, certain access permissions are technically necessary; other access permissions are optional.

The data for which you have given permission will only be used within the mobile device for the purposes described or, unless otherwise stated, will be passed on anonymously (e.g. journey information and departure monitor). Requests for permission may be designated differently depending on the device and operating system version. We have no control over the designation of permissions in the app store.

3.3.1 Technically necessary permissions

Internet data

For the application to send and receive data, Internet data must be available outside of a WLAN area. This data is required to purchase tickets. Purchased tickets can still be displayed even without internet data.

The legal basis for processing is Article 6 No. 1(b) GDPR (necessary for the performance of the contract). The data will only be used to the extent necessary to provide the features described above.

3.3.2 Optional permissions

Location

If you wish, you can have the nearest stop preset in the app. You can also enter your current location as the starting point of a journey or use it as the starting stop when buying a ticket.

Your current location needs to be transmitted for this purpose. On Android and iOS, you will be prompted for permission the first time you use any of the above features.

Camera

Optionally, access to the camera can be activated when redeeming a voucher. The QR code scanning function can then be used.

Access to the camera must be granted for this to work. On Android and iOS, you will be prompted for permission the first time you use any of the above features. You can also do this in the device settings.

Read contacts

You can choose to use the addresses saved for a contact as the start or destination. When a contact is selected only the selected address is sent to the VGN information system. Our timetable information cannot tell whether the address has been taken from your contacts or has been entered manually.

This requires that access is granted to your contacts. On Android and iOS, you will be prompted for permission the first time you use any of the above features.

Calendar

Permission for the calendar is needed before you can store a journey in the calendar.

Access must be granted to the calendar for this purpose. On Android and iOS, you will be prompted for permission the first time you use any of the above features.

Send notifications (sending personal data to Google or Apple)

You can subscribe to push notifications for routes, connections, journeys and stops to get the latest information on delays, timetable changes and cancellations. If there are messages that match your settings, we will send the selected notifications to your mobile device without you having to open the VGN Fahrplan & Tickets app. The Google Cloud Messaging (Android) and Apple Push Notifications (iOS) services we use generate a fictitious "push ID" from the app identifier and your device identifier. This identifier is stored on our push platform with selected settings and used to deliver the notification to the correct device. Google and Apple only act as intermediaries and cannot draw any conclusions about you.

This requires that access to the notifications is granted. On Android and iOS, you are prompted to give your permission in a dialogue box.

The permission given in this way constitutes legal consent for processing in accordance with Article 6 No. 1(a) GDPR. Data are only used to the extent necessary to provide the feature. You can disable access to the notifications in the device settings to revoke your consent at any time.

3.3.3 Other features without explicit permissions

Memory

Apps for Android and iOS have their own map. Map tiles are downloaded and stored on your smart phone once to cut down on data volumes and to speed up the display of maps. You can have these map tiles deleted from the app at any time. Permission for read and write access to local storage is therefore required.

Unfortunately some platforms group app permissions into groups of related permissions so that, in some cases, the app has to request more rights than it actually needs. Android, for example, groups access to photos/media/files under a single permission.

Sharing feature

The app can be used to store planned routes and times in a calendar or send them to third parties via email or WhatsApp, for example. The features that are available depend on the services installed in the smartphone and are subject to applicable privacy policies. Access to calendars is write only and existing entries are therefore not read out. Contact data is only used to send messages; data is not processed further by applications or servers, nor is data stored.

3.4 Personal data storage period

For ticket purchases, the storage period specified in section 5.8 applies. The VGN Fahrplan & Tickets app does not store any additional personal data.

4. Data collected by the VGN Onlineshop

4.1 Web analysis and tracking (sending personal data to etracker)

The VAG website shop.vgn.de uses services provided by etracker GmbH, Hamburg, Germany, to analyse usage data. By default, we do not use cookies for web analytics by default. We will obtain your explicit consent separately in advance if we use analysis and optimisation cookies. If this is the case and you have consented, cookies will be used to enable statistical analysis of the reach of this website, to measure the success of our online marketing activities and to test procedures, e.g. to test and optimise different versions of our online offering or its components. Cookies are small text files which are stored on the user's terminal device by the Internet browser. There is no information in etracker cookies that could be used to identify a user.

Data generated with etracker are processed and stored by etracker on behalf of the provider. This is undertaken exclusively in Germany and is thus subject to the strict German and European data protection legislation and standards. etracker has been independently tested, certified and awarded the ePrivacyseal for data protection [https://www.eprivacy.eu/kunden/vergebene-siegel/firma/etracker-gmbh/] ausgezeichnet.

Data are processed in accordance with the legal provisions of Article 6 No. 1(f) (legitimate interest) of the General Data Protection Regulation (GDPR). Our interest under the GDPR (legitimate interest) is to optimise our online service and website. Because we care about the privacy of our visitors, any data that could be linked to an individual, such as IP address, login or device identifier, are anonymised or pseudonymised as soon as possible. The data will not be used in any other way, combined with other data or passed on to third parties.

4.2 Cookies

When you visit our website, we only store technically necessary information on your computer in the form of cookies. Cookies are small files transferred by an internet server to your browser and then stored on your computer’s hard disk. Only the Internet Protocol address is stored: no personal data is stored for this. The information stored in the cookies ensures that, when you next visit our website, you will automatically be recognised, which will make it easier for you to use our site.

4.3 Personal data storage period

For ticket purchases, the storage period specified in section 5.8 applies. The VGN Onlineshop does not store any additional personal data.

5. Use of the VGN Onlineshop and the VGN Fahrplan & Tickets app

The following privacy policy and our terms and conditions apply when you register or make a guest purchase.

5.1 Registration (sending personal data to eos)

You can register to buy tickets via the VGN Onlineshop or the VGN Fahrplan & Tickets app.

When you register you will be asked to provide your last name, first name, your date of birth, your email address and your postal address (or alternatively a delivery address). You can change the information in your personal account that you provided when you registered at any time in the future.

Personal data you provide when you register will only be collected, processed and used in accordance with Art. 6 No. 1(b) GDPR for the purpose of performing the contract. Information is only passed on to third parties if this is necessary for the purpose of performing the contract, settling accounts or if you have given your permission in advance.

5.2 Purchase with registration (sending personal data to eos)

In addition to the customer data already stored, the following data is stored when you buy a ticket:

  • Means of payment
  • IP address
  • User agent including version (VGN Fahrplan & Tickets app or VGN Onlineshop)
  • Operating system and version of the device

We receive the following information from the device:

  • User agent including version
  • Departure point and possibly final stop

Our system also stores the date and time of the purchase.

5.3 Purchase without registration (sending personal data to eos)

You can use the VGN app and the online shop even if you haven't registered. If you haven't registered, you can still use the VGN app to make a guest purchase using Apple Pay or Google Pay and PayPal payment methods. You can make a guest purchase with PayPal in the VGN Onlineshop.

We receive the following data from the payment method providers for guest purchases:

  • Means of payment
  • IP address
  • First name
  • Last name
  • Email address

We receive the following information from the device:

  • User agent including version
  • Departure point and possibly final stop

Our system also stores the date and time of the purchase.

5.4 Email promotional information on similar products to existing customers

VAG may send you emails with promotional information on products in the VGN ticket range that are similar to those you have purchased in the past from the VGN Onlineshop or the VGN Fahrplan & Tickets app, even without your express consent. This may also include emails with customer satisfaction and ticket purchase surveys.

The processing of the data for the above purpose is based on Article 6 No. 1(f) of the GDPR together with Section 7 No. 3 of the Act Against Unfair Competition (UWG).

Notice of your right to object at any time is also provided at the bottom of each survey email. If you opt out, we will no longer send you emails with promotional content (e.g. ticket offers, ticket experience surveys) that are similar to the products you have previously purchased. Please send your objection by e-mail to service@vag.de.

5.5 Journey information & departures information services

If you use the journey planner in the VGN Onlineshop or the VGN Fahrplan & Tickets app, you can call up information on journeys by entering the place you are leaving from and the address or stop you are travelling to. The information you enter here is only sent to the server to determine possible journeys and is not stored permanently. Data is not linked to any individual during transmission. You can use your current location to find out from which stop you can start a journey. To find and view departures from the stop you have entered, use "Departures". Optionally, your current location can be used to find the closest stop to where you want to go.

5.6 Payment processing

5.6.1 Payment service provider (sending personal data to LOGPAY)

We pass on your personal data (first name, last name, date of birth, address, email address, account details, credit card data, mobile phone data, if applicable, and data on your ticket purchases) and all other changes to LogPay Financial Services GmbH for the purpose of selling and assigning our claims against you that have arisen in connection with your ticket purchase. This process is covered by Article 6 No. 1 sentence 1 (f) GDPR. Our legitimate interest relates to the outsourcing of payment processing and the management of receivables. The legitimate interest of LogPay Financial Services GmbH involves the collection of data for the purpose of processing payments, managing receivables, assessing the permissibility of types of payment and avoiding payment risks.

You can withdraw your consent to LogPay Financial Services GmbH transferring this data at any time, but you will then no longer be able to place orders via the electronic sales channel. You can access the data protection information of LogPay Financial Services GmbH at LogPay LogPay Financial Services GmbH / EN / Datenschutzinformation The legal basis for the transmission of data relating to receivables is Article 6 No. 1(f) GDPR. Here the "justified interest of a third party" exists, as has been ruled in the high court (FCJ, NJW 2011, 2204, 2206), that an information service and "the provision of information on creditworthiness is of considerable importance for the economy to function".

When we use your personal data, we take reasonable account of your legitimate needs.

5.6.2 Online payment services

We also accept payment methods from the following service providers:

  • PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A. 22-24 Boulevard Royal, L-2449 Luxembourg
  • Apple Pay, Apple Inc., 1 Infinite Loop, Cupertino, CA 95014, USA
  • Google Pay, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

The current privacy policy of the relevant service provider will apply.

5.6.4 Vouchers (sending personal data to eos)

We also store the following data when you redeem a voucher:

  • Voucher code used
  • Assigned marketing campaign
  • Voucher type
  • Voucher value
  • The date and time of redemption
  • Status of the voucher (code issued, code redeemed)

The legal basis for processing is Article 6 No. 1(b) GDPR (necessary for the performance of the contract). The data is only used to determine the requested information.

5.7 Subscription products

When you buy or order a subscription product, the app offers to jump to the ordering portal at meinabo.vag.de. The privacy policy of this portal applies.

5.8 Storage period

We will only retain your personal information for as long as is necessary to fulfil the purpose for which it was collected (e.g. as part of a contractual relationship) or as required by law. If we have a contractual relationship with you, we will keep your data for at least the duration of the contract. The data is then stored for the duration of the statutory retention periods.

The order data collected by the transport company or service provider is anonymised in the system 36 months after the transaction has been completed, after which time it is no longer possible to assign the data to an identified person. Personal data is stored in accordance with the statutory retention periods.

One year's billing data (personal data used to create the purchase receipt and to invoice the journey) is stored for 36 months, after which it is deleted and transferred to the financial data archive and blocked for tax audit purposes in accordance with the legal retention periods of the tax authorities.

Last updated: February 2024