Privacy Policy
1. General Information
We are pleased that you are visiting our app and are interested in the Kelheim District Transport Association. We know that the careful handling of your personal information is important to you. Naturally, we comply with the statutory data protection regulations, in particular the General Data Protection Regulation (GDPR), the Bavarian Data Protection Act (BayDSG) and the Telecommunications-Digital Services Data Protection Act (TDDDG).
Below we would like to inform you about the processing of your personal data when using our app and ticket shop, as well as about your rights.
2. Personal Data
Personal data means any information relating to an identified or identifiable natural person; a natural person is considered identifiable if they can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more specific characteristics that express the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
3. Controller Responsible for Data Processing
The controller responsible for processing your personal data is:
Landkreis Kelheim – VLK Verkejrsverbund Landkreis Kelheim
Donaupark 12
93309 Kelheim
Phone: 09441 / 2073525
E-Mail: ticketshop@meinvlk.de
The controller responsible for processing personal data is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.
4. Data Collected by the VLK App
With the VLK app you can access timetable and fare information. No registration is required for this.
When retrieving timetable and fare information, the following permissions are required:
(1) Full Internet access
Internet access is required so that the app can establish a connection to the servers of the information system.
(2) Read contact data
You have the option in the settings to allow the VLK app access to your contacts in order to easily use stored addresses as a start or destination. When selecting a contact, only the selected address is transmitted to the VLK app information system. Our timetable information system cannot distinguish whether the address comes from contacts or was entered manually.
Access to contacts is disabled by default when installing the app. Regardless of whether you activate access to your contacts, your consent to this permission may still be required prior to installation of the app.
(3) Calendar
Calendar permission is required so that you can save a connection in your calendar.
(4) Location data
If desired, the VLK app also shows you the stops nearest to your location. You can also specify your current location as the starting point of a connection. For this purpose, the app requires access to the location function.
(5) Storage
The Android and iOS apps include their own map. To conserve your data volume and speed up map display, downloaded map tiles are stored on your smartphone. You can delete these map tiles at any time via the app. Therefore, permission for read and write access to local storage is required.
Unfortunately, some platforms combine different accesses into one permission, meaning that in some cases more rights must be requested than are actually required. On Android, for example, access to photos, media and files is combined into one permission.
(6) Sharing function
Calculated journeys can be saved in the calendar via the app or sent to third parties, for example by e-mail or WhatsApp. The available functions depend on the services installed on the smartphone and are subject to their data protection policies. Access to configured calendars is write-only; existing entries are not read. Contact data is used solely for the purpose of message transmission; no application-side or server-side further processing or storage of the data takes place.
5. Purposes and Legal Bases for Processing Personal Data(1) What types of personal data are processed?
For what purposes and on what legal basis is processing carried out?
We process the following categories of personal data:
• Personal data (e.g. gender, date of birth)
• Contact data (e.g. name, address, e-mail address, telephone number)
• Data relating to your ticket purchases.
The personal data concerning you are processed for the following purposes on the following legal bases:
• Implementation of pre-contractual measures at your request and fulfillment (including billing) of the contractual relationship on the basis of Art. 6 (1) lit. b GDPR.
• Fulfillment of legal obligations (e.g. due to commercial or tax law requirements) on the basis of Art. 6 (1) lit. c GDPR.
• Implementation of measures to improve and develop services and products in order to provide you with customer-specific communication with tailored offers and products, on the basis of Art. 6 (1) lit. a GDPR with your consent.
• Direct marketing and market research on the basis of Art. 6 (1) lit. a GDPR. Processing based on Art. 6 (1) lit. a GDPR with your consent.
(2) Will my personal data be disclosed to other recipients?
Your personal data will only be disclosed or transmitted within the scope of the above-mentioned purposes to the following recipients or categories of recipients:
Processors & IT service providers:
MENTZ GmbH, Grillparzerstraße 18, D-81675 Munich,
E-Mail: info@mentz.net, Phone: +49 (0)89 / 418680
Payment service provider:
Logpay Financial Services GmbH, Schwalbacher Str. 72, D-65760 Eschborn,
E-Mail: info@logpay.de, Phone: +49 (0)6196 / 8012702
(3) Registration
If you would like to purchase tickets via the VLK ticket shop integrated into the VLK app, a two-step registration process is required. In the first step, a customer account is created in the VLK ticket shop. This account will only be activated once successful registration with the payment service provider has taken place. If you do not wish to register, our other sales channels are available to you. An overview of all purchase options can be found at www.meinvlk.de.
The data provided during registration can be viewed by the user at any time in their personal account and can be changed there or by request via our customer service (E-Mail: ticketshop@meinvlk.de).
(4) Payment processing
We transfer your personal data (first and last name, date of birth, address, e-mail address, if applicable mobile phone number as well as data relating to your respective ticket purchases) and any changes to LogPay Financial Services GmbH for the purpose of selling and assigning our claims against you arising in connection with your ticket purchase. This is done on the basis of Art. 6 (1) sentence 1 lit. b GDPR with your consent for outsourcing payment processing and receivables management. LogPay Financial Services GmbH will use the data for the purpose of payment processing, receivables management, assessing the admissibility of payment methods and preventing payment defaults.
You may object to the transfer of this data to LogPay Financial Services GmbH at any time; however, ordering via the electronic sales channel will then no longer be possible.
You can access the data protection information of LogPay Financial Services GmbH at https://www.logpay.de/datenschutz.html.
(5) Location
When purchasing a ticket, you may optionally determine the starting stop based on your current location.
6. Transfer of Personal Data to Third CountriesYour personal data will not be transferred to third countries or to international organizations.
7. Rights of the Data SubjectWith regard to your personal data, you have the following rights vis-à-vis us:
• Right of access to your stored personal data (Art. 15 GDPR),
• Right to rectification if the data stored concerning you is incorrect, outdated or otherwise inaccurate (Art. 16 GDPR),
• Right to erasure if storage is unlawful, the purpose of processing has been fulfilled and storage is therefore no longer necessary or if you have withdrawn your consent to the processing of certain personal data (Art. 17 GDPR),
• Right to restriction of processing if one of the conditions set out in Art. 18 (1) lit. a to d GDPR is met (Art. 18 GDPR),
• Right to data portability of the personal data concerning you that you have provided (Art. 20 GDPR),
• Right to withdraw consent at any time, whereby the withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal (Art. 7 (3) lit. c GDPR) and
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).
The duration of storage of personal data is determined by the respective statutory retention period (e.g. commercial and tax retention periods). After expiry of the period, the corresponding data will be routinely deleted, provided that they are no longer required for the fulfillment or initiation of the contract and you have not consented to storage.
9. Provision of Personal DataWithin the scope of our business relationship, you must provide those personal data (see categories of personal data) that are necessary for the establishment and performance of the business relationship and the fulfillment of the associated contractual obligations or that we are legally obliged to collect. Without this data, we cannot conclude the contract.
10. Automated Decision-MakingNo automated decision-making, including profiling, takes place for the establishment and performance of this contract.
11. Contact Data Protection OfficerOur Data Protection Officer is available to answer any questions regarding the processing of your personal data:
Landkreis Kelheim
Donaupark 12
93309 Kelheim
E-Mail: datenschutz@landkreis-kelheim.de
We reserve the right to amend our privacy policy if this becomes necessary due to new technologies. Please ensure that you have the most current version. If fundamental changes are made to this privacy policy, we will announce them via our app.
13. Right to ObjectYou may object at any time to the processing of your personal data for purposes of direct marketing and/or market research without giving reasons. After receipt of your objection, we will no longer process the personal data for purposes of direct marketing and/or market research and will delete the data unless processing is required for other purposes (for example, to fulfill the contractual relationship).
In the event of a justified objection, we will generally no longer process the personal data for the respective purposes and will delete the data, unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
The objection must be addressed to Landkreis Kelheim [VLK Verkehrsverbund Landkreis Kelheim], Donaupark 12, 93309 Kelheim, E-Mail: datenschutz@landkreis-kelheim.de.