Privacy statement

DB InfraGO AG, Adam-Riese-Straße 11-13, 60327 Frankfurt am Main collects and processes your data as the data controller.

The appointed data protection officer is Dr Marein Müller.

If you have any questions or suggestions in relation to data protection, please contact:Datenschutz.DBInfraGO@deutschebahn.com

Should you have any questions, suggestions or criticism regarding our web pages, please contact:

DB InfraGO AG
Sales and Communication 
Adam-Riese-Strasse 11-13
60327 Frankfurt am Main, Germany

E-mail:  redaktion.dbinfrago@deutschebahn.com

or for the DB InfraGO AG Stations business unit:

DB InfraGO AG
Mobility Sales
Europaplatz 1
10557 Berlin Germany

E-mail:  redaktion.dbinfrago@deutschebahn.com

We collect and process your data only for specific purposes. These purposes may relate to technical requirements, contractual obligations or specific user requests.

For technical reasons, certain data must be collected and stored when you visit the DB InfraGO web pages (e. g. date and duration of your visit; pages visited; identification data of your browser and operating system; and the web page you were on before navigating here).

This applies in the following cases:

   a. Login form for the German legal duty to take reasonable measures to protect against self-created or self-controlled dangers on railway tracks:

If you use the form to contact a regional office, the following mandatory data will be collected:

• E-mail address
• First name
• Last name
• Street
• House number
• Postcode
• Town/city
• Route
• District
• Parcel

When the contact form is sent, the data is transmitted to the relevant region of DB Fahrwegdienste GmbH. The transmitted data is also stored in an internal database.

    b. Newsletter and customer magazine (StationsAnzeiger):

If you subscribe to one of our newsletters, the following mandatory information is required:

• E-mail address

The provision of further data is voluntary.

When you register for a newsletter, we store the IP address of the computer system you were using at the time of registration. This is provided by the internet service provider (ISP). We also store the date and time at which you registered. The collection of this data is mandatory to detect (potential) misuse of the e-mail address of a data subject at a later point in time and therefore provides us with a legal safeguard.

We will only process the data for the purpose of sending the newsletter.

You can unsubscribe from the newsletter at any time using the form on the respective order page or via the corresponding link in the e-mail you receive or at the bottom of your newsletter.

If you object to the use of your data for advertising purposes, your data will be anonymised and used in statistical evaluations only.

    c. Contacting us

When you send an e-mail to redaktion.dbinfrago@deutschebahn.com, we process the data you provide only for the purpose of handling your enquiry.

If you contact us via other channels, such as those communicated within the scope of special campaigns or programmes for customers at selected stations, we will use the information you provide us with (e. g. e-mail or phone number) only for measures required within the context of the relevant campaign or programme.

Article 6(1)(a) of the General Data Protection Regulation (GDPR) serves our company as the legal basis for processing operations for which we obtain your consent for a specific processing purpose.

Processing is based on Article 6(1)(b) GDPR if we are required to process personal data in order to meet the terms of a contract with you. This is the case when delivering goods, providing any other service or in the event of a reciprocal service. The same applies to such processing operations that are necessary to implement pre-contractual measures, as is the case with enquiries about our products or services.

If our company is subject to a legal obligation which requires the processing of personal data, for example fulfilment of tax requirements, this is considered processing in accordance with Article 6(1)(c) GDPR.

Processing operations that are not covered by any of the legal bases stated above, will be based on Article 6(1)(f) GDPR if it is necessary to protect a legitimate interest of our company or of a third party, provided that the interests and fundamental rights and freedoms of the data subject are not overriding.

We are permitted to carry out such processing operations in particular because they have been specifically mentioned by the European legislature. In this respect, the legislature took the view that a legitimate interest could be assumed if the data subject is a customer of the controller (recital 47 sentence 2 GDPR).

Processing contracts generally requires the involvement of processors acting on our instructions, e. g. computer centre operators, printing service providers, delivery service providers or other parties involved in contract performance.

The external service providers that we hire to process data are carefully selected and subject to strict contractual obligations. The service providers follow our instructions, and this is guaranteed by strict contractual regulations, technical and organisational measures, and supplementary checks and controls.

Furthermore, transfer of your data only takes place if you have given your express consent or on the basis of a statutory requirement.

Transfer to third countries

Data is not transferred to third countries outside the European Union (EU)/European Economic Area (EEA) or to an international organisation unless appropriate guarantees have been provided. These include EU standard contractual clauses or an adequacy decision by the European Commission.

You can find further information on data processing in the DB Group here: www.deutschebahn.com/de/konzern/konzernprofil/datenschutz.

We store your data only for as long as is necessary to fulfil the purpose for which the data was collected (as part of a contractual relationship, for example) or to comply with legal requirements. For example, if you submit an enquiry, we store your data for at least the period of time necessary for processing your questions or enquiries in a satisfactory manner. Your data is then deleted.

In the context of a contractual relationship, we will store your data at least until full and final completion of the contract.

In the event of statutory data retention periods (e. g. as per Germany's tax code or commercial code), the data is retained for the duration of such a period. Using suitable identification details, it is stored in a manner which prevents it being accessed, and it is deleted when the retention period expires.

• You may request information about the data that has been stored about you.
• You can request the correction, deletion or restriction of processing of your personal data, provided this is legally admissible and possible under an existing contract.
• If you believe that the processing of your personal data violates data privacy law, you have the right to lodge a complaint with the competent data protection supervisory authority in accordance with Article 77(1) GDPR.
  The supervisory authority responsible for DB InfraGO AG is:
  Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden
• You have the right to the portability of data that you have made available to us on the basis of consent or a contract (data portability).
• If you have given us consent to process your data, you can revoke this consent at any time, using the same method you used to give your consent. If you revoke your consent, any processing of your personal data which took place from the time you granted your consent to the time you revoked it will still be considered lawful.
• You have the right to opt out, on grounds relating to your particular situation, of the processing of personal data concerning you which is based on our legitimate interest or is necessary for the performance of a task carried out in the public interest.
• You can opt out of targeted advertising at any time. This takes effect for the future (advertising opt-out).

To exercise this right, simply send a letter to the controller (see section “Who is responsible for collecting and processing data”) or an e-mail to: Datenschutz.DBInfraGO@deutschebahn.com.

The contact addresses for exercising your rights in connection with use of the ElBa app or for recording test data for the development of automated driving functions can be found under No. 10 and No. 11 of this privacy statement.

Cookies are small text files used to store personal data. Cookies can be sent to a web page when a user visits it, allowing that user to be identified. Cookies help make web pages easier for users to navigate.

We differentiate between cookies which are necessary for a web page's technical functionality and those which are not necessary for this purpose.

We want to enable you to make an informed decision for or against using cookies which are not necessary for the web page's technical functionality. Please note that by rejecting any cookies used for promotional purposes, any advertising you receive will not be tailored as carefully to your interests as it would be otherwise. It will not however affect your ability to make full use of the web page.

Generally speaking, you can use the DB InfraGO AG web page without cookies that are not used for technical purposes. This means that you can prevent the tracking via cookies on your browser (do-not-track, tracking protection list, etc.) or block the storage of third-party cookies.

We also recommend that you regularly check which cookies are stored on your system unless you have explicitly requested they be saved.

Please note: if you delete all cookies, your deactivation cookie will also be deleted, meaning you will have to opt out of user behaviour analysis again.

Analysis of the data by Deutsche Bahn AG

For more information on data processing and analysis by Deutsche Bahn AG and your options in relation to this, please go to "Manage consent"/"Analyse verwalten".

If you click on a link to an external site, you will leave the DB InfraGO AG web page. This means that DB InfraGO AG is not responsible for the content, services or products offered on the linked web page, nor is it responsible for data protection or technical security on the linked web page.

DB InfraGO AG reserves the right to change or adapt this privacy statement to the extent required by ongoing technical developments in the field of IT and the internet or by a change in the legal situation. We therefore recommend that you review our privacy statement at regular intervals. If your consent is required or parts of the privacy statement are contained within rules of a contractual relationship, changes will be made only with your consent.​​​​​

    a. Who collects and processes my personal data?

DB InfraGO AG, Adam-Riese-Straße 11-13, 60327 Frankfurt am Main collects and processes your data as the data controller.

The address or e-mail address given under No. 1 of this privacy statement is also available to you if you have any questions or suggestions regarding data protection relating to DB InfraGO AG’s ElBa mobile app.

    b. What data do we collect, and why and how do we process it?

For technical reasons, certain data must be collected and stored when you use the ElBa mobile app (e. g. date and duration of the visit; pages visited; identification data of your browser and operating system; and the web page you were on before navigating here).

When processing personal data, lookouts and safety supervisors are recorded in a database together with their qualifications. This is the basis for issuing electronic access credentials in the form of a QR code. 

To fulfil a contract, we require you to provide us with personal data, which will also be stored in the QR code. 

• Login name 
• First name 
• Last name 
• Date of birth 
• Address details (business) 
• Contact details (business) 
• Data on qualifications 
• Role 
• Assignment details 
• ID card number 
• Photo 
• Suitability data

Registering with the ElBa mobile app

To create a customer account on the ElBa mobile app, the following mandatory information is collected. It is not possible to create a personal account without this information.

• First and last name
• E-mail address

We store your login data in your user account.

    c. Legal basis for data processing (lawful processing pursuant to Article 6 GDPR):

The ElBa mobile app cannot function correctly without saving and transferring data. It therefore requires permission to alter or delete memory content and to access internet data. The legal basis for this processing is provided by Article 6(1)(c) GDPR and Article 6(1)(f) GDPR. You will find more detailed information on this legal basis under No. 2 of this privacy statement.

Lookouts and safety supervisors are deployed as a safety measure when work is carried in the track area of DB InfraGO AG. The aim of deploying these specialists is to safeguard the people working on building sites, other third parties and, among other things, train traffic. To ensure adequate protection, lookouts and safety supervisors must be suitably qualified, and their qualification verified by valid credentials cards. For this reason, we process the following personal data for the electronic credentials card as proof of identification, billing, qualification and suitability:

• Login name 
• First name 
• Last name 
• Date of birth 
• Address details (business) 
• Contact details (business) 
• Data on qualifications 
• Role 
• Assignment details 
• ID card number 
• Photo 
• Suitability data 

    d. How long do we store your data? 

Your data will be stored for as long as your user account is active. The data will then be stored for the mandatory retention period. 

For dispatching purposes, the check-in/check-out data in the database is used for random checks of billing or on an ad hoc basis (e. g. EBA, public prosecutor's office). It is stored in the system for 10 years for such purposes and then deleted.

   e. What are the rights of users of the ElBa mobile app? 

Your rights as a user of the ElBa mobile app correspond to those in Section 6.

To exercise your rights, simply write to us at the following address: 

DB InfraGO AG 
Sales and Communication
Adam-Riese-Strasse 11-13 
60327 Frankfurt am Main, Germany 

or send an e-mail to FBf-ElBa@deutschebahn.com.

As part of the development of automated driving functions, the industry is working on automated obstacle detection and environment perception as a driver assistance system for train systems. For the development and validation of these systems, it is necessary to record test data using, for example, sensors such as video cameras at the front of the train (camera view in the direction of travel). This may involve personal data of people in the vicinity of the train. The evaluation of the data focuses in particular on the number and positions of people and objects detected in the track environment. These test runs take place with different vehicles on different routes, including Berlin and Hamburg, for example. Identifying potential data subjects is not part of the project and is neither practised nor tested.

Figure 1: Symbolic arrangement of the camera sensors on the test vehicle

Any processing of personal data, in particular video images of data subjects recorded during test runs, is always carried out in accordance with the applicable data privacy laws and in consultation with the data protection officers responsible.

    a. Who collects and processes my personal data?

DB InfraGO AG, Adam-Riese-Straße 11-13, 60327 Frankfurt am Main collects and processes your data as the data controller.

If you have any questions or comments regarding data protection in the stated project, please use the following details to contact us:

DB InfraGO AG
Digitalisation of rail system/development of fully automated operation
Stresemannstr. 123 
10963 Berlin, Germany

E-mail: Videoaufzeichnung_DBB@deutschebahn.com

    b. What data do we collect, and why and how do we process it?  

During time-limited test runs, video data is recorded by cameras on test vehicles. The viewing angles of the cameras are aligned in the direction of travel. As a result, personal data of people on the track could be recorded. The recorded data is stored and used to develop and validate environment perception and automation functions. Identifying potential data subjects is not part of the project.

    c. Legal basis for data processing (lawful processing pursuant to Article 6 GDPR):

The legal basis for this processing is provided by Article 6(1)(f) GDPR. You will find more detailed information on this legal basis under No. 2 of this privacy statement.

    d. Do we share data with third parties?

When executing a project, it is typically necessary to involve a processor who acts on our instructions, for example, annotation or other development service providers or other parties involved in contract fulfilment. 

The external partners that we hire to process data are carefully selected and subject to strict contractual obligations. 

Transfer to third countries

Data is not transferred to third countries outside the European Union (EU)/European Economic Area (EEA) or to an international organisation unless appropriate guarantees have been provided. These include EU standard contractual clauses or an adequacy decision by the European Commission.

    e. How long do we store your data?

We store data only while this is necessary to fulfil the aim for which it was collected (e. g. as part of a development project), or if such storage is mandated by law. We store data required for development at least until the development project has been completed. The data will then be stored for the mandatory retention period.

    f. What rights do data subjects of test data recordings have? 

Your rights as a data subject of test data recording correspond to those in Section 6.

To exercise your rights in connection with the recording of test data, simply send a letter to

DB InfraGO AG 
Digitalisation of rail system/development of fully automated operation
Stresemannstr. 123 
10963 Berlin, Germany 

Alternatively, you can send an e-mail to Videoaufzeichnung_DBB@deutschebahn.com.