1. General
1.1 ÖBB-Technische Services-GmbH, Am Hauptbahnhof 2, 1100 Vienna, company register no. (FN) 249665f, ("ÖBB-TS" or “We”/“Us”/“Our”) deems the protection of your personal data and the processing of this data in accordance with data protection rules to be important. In this Privacy Policy, we explain how we, as data controllers, collect, share and use personal information about you, and how you can exercise your rights.
1.2 If you have questions regarding the use of your personal data by Us, please contact us via our data protection officer at: datenschutz.ts@oebb.at or by post to “ÖBB-Technische Services-GmbH, The Management, Attn. Data Protection Officer, Am Hauptbahnhof 2, 1100 Vienna”.
2. Types of personal data and processing purposes
2.1 Types of personal data and processing purposes
| Types of personal data | Purpose of collection |
|---|---|
| “Contact information” such as salutation, title, name, address, telephone number, email address, position, associated company/authority, department |
|
| “Customer data” which you disclose to us (e.g. as a railway undertaking) or which we need for the provision and billing of our services, such as salutation, title, name, address, telephone number, email address, company affiliation of the contact person at the customer, customer number, order and usage data, customer’s payment information |
|
| “Supplier data”, which you disclose to us as a contracting party in the course of the procurement process and contract execution, such as salutation, title, name, address, telephone number, email address, company affiliation of the contact person at the supplier, supplier’s payment information |
|
2.1.1 If we ask you to provide personal data other than those given above, we will provide you with these and the corresponding purposes at the time of collection.
2.2 Data we collect automatically, cookies and similar technologies
2.2.1 For information on personal data that we collect automatically when you visit our website, where applicable, as well as cookies and similar technologies, please see the Terms of Use for our website.
2.2.2 The systems provided by ÖBB-TS for their customers and business partners keep system and application logs to the usual extent for the sole purpose of error analysis. This includes the IP address and, depending on the operating system used, if applicable, the user’s browser. The legal basis for the processing of this data is ÖBB-TS’ legitimate interest in ensuring network and data security and the functioning of the systems, which is not overridden by your data protection interests or fundamental rights and freedoms (Art 6 (1) (f) GDPR),
2.3 Data we receive from external sources
2.3.1 We may occasionally receive personal information about you from external sources (such as public records, company or land register data, published information on the websites of your company or organisation, or any request/complaint submitted by ÖBB TS, to another company of the ÖBB Group and forwarded to ÖBB-TS for processing). In doing so, we verify that these third parties either have your consent or are otherwise legally authorised or forced to disclose your personal information.
2.3.2 The types of information that we collect from third parties include personal information that appears in public books or your contact information from other publicly available sources, such as corporate websites. We use the information we receive from these third parties for the following purposes:
- To maintain and improve the accuracy of the records we keep about you
- In order to contact you in your professional capacity or, for example, as a neighbour in the vicinity of a construction project and to inform you about important railway projects that may affect you and, if necessary, to involve you in the project management
- To process a request/complaint concerning Us.
3. Recipient of the data
3.1 We may transfer your personal information to the following categories of recipients:
3.1.1 To our group companies, processors and partners who provide data processing services to us or who otherwise process personal information for the purposes described in this Privacy Policy or who will be notified when we collect your personal information. A list of the most important Group companies of the ÖBB Group can be found in the section ÖBB Group/Organization.
- Our central processor for information technology services (e.g. operation of IT systems, technical maintenance and fault clearance) is ÖBB-Business Competence Center GmbH, Erdberger Lände 40-48, 1030 Vienna, company register no. (FN) 248730 f, a company of the ÖBB Group.
- Our processor for the administration and utilisation of certain real estate of ÖBB-TS is ÖBB-Immobilienmanagement GmbH, Nordbahnstraße 50, 1020 Vienna, company register no. (FN) 249152a, a company of the ÖBB Group. According to Art. 24 of the Federal Act on the Restructuring of the Legal Status of the Austrian Federal Railways (Bundesbahngesetz), ÖBB-Immobilienmanagement GmbH is in particular responsible for the administration and utilisation of certain properties of ÖBB-TS. ÖBB-Immobilienmanagement GmbH collects and processes the “customer data in the real estate sector” listed in item 2.1 on behalf of ÖBB-TS for this purpose.
3.1.2 To a competent enforcement authority, regulatory agency or governmental body, court or other third party where disclosure is necessary (i) under applicable laws or regulations, (ii) to exercise, protect or defend our legal rights; or (iii) to protect your important interests or the important interests of another person.
3.1.3 To any potential buyer (and its agents and advisers) in connection with a proposed purchase, merger or acquisition of our company (or any part thereof), if we notify the buyer that it may only use your personal information for the purposes specified in this Privacy Policy.
3.1.4 If you are involved in one of our railway projects in your professional capacity, and if applicable, to other project partners, if this is necessary for project execution.
3.1.5 To any other person, if you agree to the disclosure.
4. Legal basis for the processing of personal data
4.1 The legal basis for the collection and processing of personal data depends on the specific context in which we collect it.
4.2 As a rule, we will only process your personal data if we have your consent to do so (Art. 6 (1) (a) of the EU’s General Data Protection Regulation, “GDPR”), if we need your personal data in order to fulfil a contract with you (Art. 6 (1) (b) GDPR), or if we have a legitimate interest in processing that is not invalidated by your privacy interests or fundamental rights and freedoms (Art. 6 (1) (f) GDPR). Such legitimate interests of ÖBB-TS include, for example, timely, complete and consistent responses to inquiries or complaints, informing neighbours, authorities and business partners about important rail projects concerning these persons, and efficient project implementation involving all project partners. In some cases, the processing of your personal data may be required to fulfil a legal obligation that applies to us (Art. 6 (1) (c) GDPR), such as statutory retention requirements, or to protect your vital interests or the vital interests of another person (Art. 6 (1) (d) GDPR). Concerning the subject of video surveillance, see point 5 for details.
4.3 If we process your personal data for other legitimate interests (or those of a third party) not mentioned above, we will inform you of these legitimate interests at the relevant time.
5. Video surveillance
5.1 Some of the publicly accessible areas within the ÖBB-TS operating areas are monitored by video camera. Video surveillance serves to ensure the safe operation of the railway as well as the protection of persons and property, in particular the containment of damage to property of ÖBB-TS and thus the fulfilment of our legal obligations and our legitimate interest. These measures include the operation of stationary video cameras. Unless the recorded image data are needed for use as evidence, these image data will be deleted automatically after 72 hours.
5.2 In some of the administrative and office buildings of ÖBB-TS, access points to the building (in particular entrances and exits and garage entrances) and to some of the floors are used for the purpose and in the legitimate interest of access control, theft prevention, protection of trade and business secrets, and are therefore monitored by video to protect legitimate interests.
5.3 Each of the monitored areas is clearly marked.
6. Data retention
6.1 We retain your personal data for as long as is necessary to fulfil the purpose or if contractual or legal obligations or legitimate interests exist (e.g. to provide a service requested by you, to fulfil statutory retention obligations or to assert legal claims).
6.2 As soon as no legitimate purposes exist for the further storage of the personal data, these will be either erased or rendered anonymous. If this is not possible (e.g. because your personal information has been stored in backup archives), we will securely store your personal information and will not make it accessible for any further processing until deletion is possible.
7. Rights of data subjects
7.1 In accordance with legal provisions, you have the right to obtain information about your data, to rectification, to deletion, to limitation of processing or objection to the processing, to data portability and to complain to a supervisory authority. The data protection authority responsible for ÖBB-TS is the Austrian Data Protection Authority.
7.2 If we process your personal data on the basis of your consent, you can revoke your consent at any time. The revocation of your consent does not affect the lawfulness of the processing before your revocation.
7.3 If personal data are processed for direct marketing purposes, the processing of which is not based on your consent, you have the right to object at any time to the processing of your personal data for the purpose of such advertising.
7.4 To exercise these rights, please write to us at datenschutz.ts@oebb.at or by post to ÖBB-Technische Service-GmbH, management, e.g. Attn. Data Protection Officer, Am Hauptbahnhof 2, 1100 Vienna. We will check your request and reply accordingly.
7.5 You can also unsubscribe from any marketing communications that we may send you. In order to unsubscribe from other forms of marketing communication (such as by post or telephone), please send a letter in this regard to datenschutz.ts@oebb.at or by post to “ÖBB-Technische Services-GmbH, The Management, Attn. Data Protection Officer, Am Hauptbahnhof 2, 1100 Vienna”.
8. Updates to this Privacy Policy
8.1 We may update this Privacy Policy from time to time in light of any legal, technical or business developments. When we update our Privacy Policy, we will take all reasonable steps to notify you based on the importance of the changes made. We will seek your consent for any material change in the Privacy Policy we make, if and to the extent required by applicable privacy laws. The date of the “last update” can be found at the beginning of this Privacy Policy.