The

Deutsche Bahn AG

Potsdamer Platz 2
10785 Berlin
Germany

collects and processes your data as the responsible body.

The appointed privacy officer is Dr. Marein Müller.

E-mail: konzerndatenschutz@deutschebahn.com

Purposes for which personal data is processed at the Investor Relations Microsite

We collect and process your data only for specific purposes, which can be due to technical reasons, contractual requirements or explicit user requests.

1. Visiting our website

When you visit www.deutschebahn.com, certain data must be collected and saved for technical reasons (the date and the duration of your visit, the web pages used, identification data of the browser and operating system type used and the website from which you visit us).

2. Contracts

For contractual reasons, we require personal information from you (such as contact data) in order to perform our services and fulfill the contractual relationships that we have agreed with you. This data is needed for any postal deliveries to the specified address, and to process any cancellations and refunds. If you provide us with data as part of a contract, we use your data without your separate consent only to fulfill the contract that we have concluded with you. If the contract has been fully fulfilled, your data is blocked and then deleted once the mandatory retention periods stipulated by tax and commercial law have expired, unless you have explicitly consented to further use of your data.

3. Newsletter data / order form

If you subscribe to a newsletter/ reports we offered on our website, we will use the registration data you provided only to send you the newsletter / reports unless you approve a more extensive use.

You can unsubscribe from the newsletter at any time by using the form on the order page.

4. Contact form

If you send us a request using the contact form, the data you enter on the request form, including the contact data, is saved and processed only in order to handle the request and answer any follow-up questions. Your data is then blocked, and once the mandatory retention periods stipulated by tax and commercial law have expired, your data is deleted if you have not explicitly consented to further use of your data.

Legal basis for data processing

If we ask for and receive your consent to perform processing operations on your personal data, your consent is considered, in accordance with point (a) of Article 6(1) of the General Data Protection Regulation (GDPR), as the legal basis to perform such processing operations.

When personal data is processed that is required to fulfill a contract agreed with you, the legal basis, in accordance with point (b) of Article 6 (1) of the GDPR, is the contract. Point (b) of Article 6 (1) of the GDPR also applies to processing operations that are required to carry out precontractual measures, for example, in the case inquiries about our products or services.

If our company must process personal data to comply with legal obligations, for example, to fulfill tax obligations, the data is processed on the basis of point (c) of Article 6 (1) of the GDPR.

Cookies are small text files in which personal data can be saved. When a page is accessed, cookies can be sent to this page to enable the user to be identified. Cookies make it easier for users to use web pages. 

We distinguish between cookies that are strictly required and cookies that are not necessarily required for the website to function from a technical perspective.

We want to give you the option of making an informed decision to accept or refuse the use of cookies that are not necessarily required for the website's technical functions. Please note that the advertising you receive will be less tailored to your interests if you refuse cookies that are used for advertising purposes. However, use of the website is still possible to the full extent.

We would like to inform you here about how and to what extent which cookies are used on our web pages:

The use of www.deutschebahn.com is generally possible without cookies that do not serve a technical purpose. This means that you can configure your browser to prevent traceability via cookies, that is, refuse the saving of third-party cookies.

We also recommend that you regularly check which cookies are stored, provided that you have not expressly requested these.

Important note: If all cookies are deleted, any opt-out cookies set are also deleted, which means any objections declared need to be exercised again.

Matomo (formerly Piwik)

We use the Matomo analytics platform (formerly Piwik) on our website in order to analyze the use of our website and regularly improve it. We can apply the statistics obtained to improve our products and design them to be more interesting to you, as a user. By means of small text files (cookies), information about how you use our website is saved, including your IP address. This data is anonymized and saved on our servers.

The legal basis for the use of Matamo is point (f) of Article 6 (1) of the GDPR.

Your deactivation options: If you oppose to the analysis of your user behavior, you can configure your browser at any time to refuse the setting of analysis cookies. You can also decide here whether your browser is allowed to store a unique web analysis cookie to enable the website operator to record and analyze various statistical data. If you want to oppose, click the following link to store the Piwik deactivation cookie in your browser.

Please note: If you delete all of your cookies, the deactivation cookie is also deleted. This means that you would have to refuse analysis of your user behavior again.

We use the following cookies:

• Typo3 session cookies -> session ID storage
• Cookie hint cookie -> stores whether the cookie hint was agreed to
• PHP session cookie -> session ID storage
• In addition, we use a notice tool to store notices in your browser.

We also recommend that you regularly monitor the cookies saved on your system and delete any you do not expressly want.

Please note: If you delete all cookies, you will also delete any opt-out cookies, which means that you will have to exercise your opt-out options again.

We save your data only for as long as it is required for fulfilling the purpose for which it was collected (for example, within a contractual relationship) or as required by law. As part of a contractual relationship, we save your data at least until the contract has been fully fulfilled. The data is then stored for the duration of legal retention periods.

• You can demand information regarding which data relating to you is stored.
• You can demand that your personal data be corrected, deleted and blocked, as long as this is permitted by law and within the framework of an existing contractual relationship.
• You have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for Deutsche Bahn AG is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany; e-mail: mailbox@datenschutz-berlin.de
• You have the right to transferability of the data that you have provided to us by consent or on the basis of a contract (right to data portability).
• If you have given us your consent for data processing, you can withdraw this consent at any time in the same way as you gave it. Any processing of your personal data that took place from the time at which you granted your consent to the time at which you withdrew it will still be considered to have been lawful.
• You have the right to object, on grounds relating to your particular situation, to the processing of personal data if the data is processed based on our legitimate interest or is necessary for the performance of a task carried out in the public interest.
• Sie können der werblichen Ansprache jederzeit mit Wirkung für die Zukunft widersprechen (Werbewiderspruch).
• If we process your data for the purpose of direct advertising, you may object to this promotional approach at any time with future effect.

To exercise your rights, send a letter by post to

Deutsche Bahn AG
Potsdamer Platz 2
10785 Berlin

Alternatively, you can send an e-mail to konzerndatenschutz@deutschebahn.com.

Implementation of a contract normally requires the involvement of instruction-dependent data processors such as data center operators, printing or shipping service providers or other parties involved in fulfilling the contract.

External service providers that process data on our behalf are carefully selected by us and strictly bound by contract. The service providers work as instructed by us, which is ensured through strict contractual provisions, technical and organizational measures and additional checks.

Your data is otherwise transmitted only if you have given us your explicit consent or if this is required by law.

The data is not transferred to third-party states outside the EU/EEA or to an international organization unless adequate guarantees are in place. These include standard contractual clauses of the EU as well as adequacy decisions of the European Commission.

If functionalities or legal situations change, we shall adjust the data protection notice. For this reason, we recommend that you read the data protection notice at regular intervals. If your consent is required or if parts of the data protection notice contain provisions of the contractual relationship with you, these changes shall be made only with your approval.