Privacy Policy

Data protection principles

We are pleased about your visit to our website and would like to explain to you transparently whether and when your personal data is collected and processed.
The following data protection information gives you an overview of the collection and processing of your data on this site.

Who is responsible for data processing?

Deutsche Bahn
Potsdamer Platz 2
10785 Berlin
collects and processes your data as the data controller.

The appointed data protection officer is Ms Chris Newiger.

What data do we collect and how and why do we process data?

We collect and process your data exclusively for specific purposes. These may result from technical necessities, contractual requirements or express user requests. 
Purposes for which personal data are processed on

1. visit the website

For technical reasons, certain data must be collected and stored when you visit in order to be able to display the page to you (the date and duration of the visit, the web pages used, the recognition data of the browser and operating system type used and the website from which you are visiting us).

2. analysis of the website data

If you have given us your consent to analyse your data, we process and analyse your data in order to continuously improve our digital products (websites and apps). It is important to us to correct any deficiencies in digital products at an early stage and to take the knowledge gained from this into account in the further development and new development of digital products. We also want to continuously improve the user experience for you and provide content that is suitable for you. For this purpose, data processing in the form of analysis and evaluation can be helpful, on the basis of which we learn more about the general usage behaviour and needs of our customers. This data processing only takes place if you have given us your consent to do so.
In order to carry out this analysis and evaluation, the following personal data are usually processed, depending on whether you use a website or app: An identifier of a device and a session (specific period of product use on a specific device), an identifier assigned to you by us, pseudonymised/abbreviated IP address (which also allows an inference to a geo-location), the information that the analysis has been consented to, scrolling behaviour, Clicks on specific content/links and pages/content previously viewed (this may also include third party pages/content you viewed before using our digital product), information related to pages you use that are the subject of one of our campaigns, length of time spent on pages or app screens, and date and time of the visit. App screens and the date and time of use. In addition, technical information is processed for analysis. These are loading times, browser, browser version, browser setting (language), mobile phone model, operating system/operating system version as well as the mode of connection to the internet/mobile phone and mobile network operator.
This usage data is permanently stored only in an aggregated form that does not allow any personal reference. 
Please note that not all of the data mentioned here is processed when using every digital product. If possible, data will only be collected in anonymised form. In addition, personal data is converted into a pseudonymised form at the earliest possible stage, which only allows us and no third parties to relate to a person. Your personal or personally identifiable data will not be passed on to third parties outside the Group.
The legal basis for this data processing is Art. 6 para. 1 p. 1 lit. a) DSGVO (data processing based on consent). The analysis will only take place after you have voluntarily given your consent. You are not obliged to give your consent in this regard and you can also make use of the product without agreeing to the analysis. 
You can revoke your consent at any time and without giving reasons. Please note that the revocation does not affect the lawfulness of the data processing until the time of revocation. 
To withdraw your consent, you can change your settings regarding the analysis of the data at any time by clicking on "Manage analysis" (bottom right in the footer). 
We store your settings for analysis for 30 days and ask for these settings again at the end of this period. 
In addition, data processing takes place temporarily in order to ensure the functionality of the consent layer (field through which you can give your consent) from a technical point of view and to remedy possible technical malfunctions with certain types of devices. The legal basis for this data processing is Art. 6 para. 1 lit. f) DSGVO (data processing based on legitimate interests). Our legitimate interest is to offer a flawlessly functioning Consent Layer in the product.

3. contact by e-mail

If you send us enquiries by e-mail, the information you provide in the e-mail, including the contact details you enter there, will only be stored and processed by us for the purpose of processing the enquiry and in the event of follow-up questions. Afterwards, your data will be deleted.

4. contact via contact form

If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provide there (first name, surname, email address and company, if applicable), will only be stored and processed by us for the purpose of processing the enquiry and in the event of follow-up questions. Afterwards, your data will be deleted or blocked and deleted after expiry of the retention periods under tax and commercial law, unless you have expressly consented to the further use of your data.

5 Newsletter

If you register for our e-mail newsletter, we will regularly send you information about our offers. The only information required from you for sending the newsletter is your e-mail address.
We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you an e-mail newsletter if you have expressly confirmed that you consent to receiving the newsletter. For this purpose, we will send you a confirmation e-mail asking you to confirm that you wish to receive our newsletter in the future by clicking on a corresponding link.
The legal basis for the data processing carried out by us for this purpose is Art. 6 para. 1 lit. a) DSGVO. When you register for the newsletter, we store your IP address entered by your internet service provider (ISP) as well as the date and time of registration in order to be able to trace any possible misuse of your email address at a later date. The data collected by us when you register for the newsletter is used exclusively for the purpose of addressing you in an advertising manner by way of the newsletter. You can unsubscribe from the newsletter at any time by clicking on the link provided in the newsletter or by sending us a message to this effect ( After unsubscribing, your email address will be deleted from our newsletter distribution list immediately.

Technically, the dispatch of our e-mail newsletter is carried out via the service provider
CleverReach GmbH & Co KG ("CleverReach")
Mühlenstr. 43
26180 Rastede

to whom we pass on the data you provided when registering for the newsletter for the purpose of sending it.
We have an order processing contract with CleverReach. All external service providers who process data on our behalf are carefully selected by us and strictly bound by contract. CleverReach only works according to instructions, which is ensured by strict contractual regulations, by technical and organisational measures and by supplementary controls.
The data transmitted by you for the purpose of receiving the newsletter is stored on CleverReach's servers in Germany or Ireland.
CleverReach uses this information to send and statistically evaluate the newsletters on our behalf. For the evaluation, the emails sent contain so-called web beacons or tracking pixels, which are single-pixel image files that are stored on our website. This makes it possible to determine whether a newsletter message has been opened and which links, if any, have been clicked on. With the help of so-called conversion tracking, it can also be analysed whether a predefined action has taken place after clicking on the link in the newsletter. In addition, technical information is recorded (e.g. time of retrieval, IP address, browser type and operating system). The data is collected exclusively in pseudonymised form and is not linked to your other personal data; direct personal reference is excluded. This data is used exclusively for the statistical analysis of newsletter campaigns. The results of these analyses can be used to better adapt future newsletters to the interests of the recipients.
If you wish to object to data analysis for statistical evaluation purposes, you must unsubscribe from the newsletter.

You can read more about CleverReach's data analysis here:
You can view CleverReach's privacy policy here:

When are cookies used?

Cookies are small text files in which personal data can be stored in the browser of your end device. The cookies can be transmitted to a page when it is called up and thus enable the user to be identified. Cookies help to simplify the use of Internet pages for users.
We distinguish between cookies that are absolutely necessary for the functions of the website and those cookies that are not absolutely necessary for the functions of the website. 
We want to give you the opportunity to make an informed decision for or against the use of cookies, which are not absolutely necessary for the technical functions of the website.
We therefore inform you here about the type and scope of the use of cookies on our pages:
The use of is generally possible without cookies that do not serve technical purposes. 
If you have consented to the use of your data for analysis purposes, we process personal data to the extent and for the purposes described in the section "Analysis of website data" above and use cookies for this purpose. On the one hand, this is a cookie with which we ensure the technical functionality of the Consent Layer itself. In addition, we set so-called "session cookies" if consent has been given for the analysis. These are used to recognise related interactions during a visit to, to bundle these interactions during use and to accurately record user figures. In addition, we use "analysis cookies" during visits to the website to the extent described under "Analysis of website data" and for the purposes named there, in order to recognise the same users when they visit the website and to better understand user behaviour.

When will your data be deleted?

We only store your data for as long as it is required to fulfil the purpose for which it was collected (e.g. within the framework of a contractual relationship) or if this is provided for by law. For example, in the context of a contractual relationship, we store your data at least until the complete termination of the contract. Afterwards, the data is stored for the duration of the legal retention periods.

Will data be passed on?

The provision of the website usually requires the involvement of instruction-dependent processors, for example for the provision of a technical infrastructure.
External service providers who process data on our behalf are carefully selected by us and strictly bound by contract. These processors only receive your personal data insofar as this is necessary for the fulfilment of their respective tasks in connection with the service we have commissioned. The service providers work according to our instructions, which is ensured by strict contractual regulations, by technical and organisational measures and by supplementary controls.
A transfer to third countries outside the EU/EEA or to an international organisation does not take place unless there are adequate guarantees. 
We also do not transmit any personal data to social networks. The grey icons of various social networks on the website are merely links. Clicking on the image opens the page of the respective social network in a new window. We do not transmit any data to the social networks. As the provider of, we have no knowledge of the content of the data processed by the social network and the processing procedure and are not responsible for their content.

Is the provision of personal data necessary?

The provision of personal data is neither contractually required nor legally prescribed. You will not suffer any disadvantage if you do not provide data.

Do automated decision-making processes take place?

No automated decision-making, including profiling, that has legal effect on you or otherwise significantly affects you takes place on the basis of your personal data.

What rights do you have as a user of

Right to information:
Under the conditions of Art. 15 DSGVO, you can request information about your personal data processed by us. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of complaint, the origin of your data if it has not been collected by us, as well as the existence of automated decision-making, including profiling, and, if applicable, meaningful information about its details;

Right of rectification:
Under the conditions of Art. 16 DSGVO, you can request the immediate correction of incorrect or completion of your personal data stored by us;

Right to erasure:
Under the conditions of Art. 17 DSGVO, you may request the deletion of your personal data stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the assertion, exercise or defence of legal claims;

Right to restriction of processing:
Under the conditions of Art. 18 DSGVO, you may request the restriction of the processing of your personal data if either the accuracy of the data is disputed by you or the processing is unlawful, but you object to its erasure and instead request that we cease using the personal data or we no longer need the data, but you need it to assert, exercise or defend legal claims or you have objected to the processing in accordance with Art. 21 (1) DSGVO;

Right to data portability:
Under the conditions of Art. 20 DSGVO, you have the right to receive your personal data that you have provided to us in a structured, common and machine-readable format or to request that it be transferred to another controller;

Right to object:
You also have the right to object to data processing at any time under the conditions of Art. 21 (1) DSGVO and Art. 21 (2) DSGVO.

Right to withdraw consent:
If you have given us consent, you have the right to revoke your consent at any time with effect for the future - in full or in part; the lawfulness of the processing of your personal data carried out on the basis of the consent up to the revocation remains unaffected by this.
To exercise your rights, simply send a letter by post to
Deutsche Bahn
Potsdamer Platz 2
10785 Berlin
or by e-mail to:

You also have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for Deutsche Bahn AG is: 
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219
10969 Berlin

What happens with links to external pages? 

When you click on a link to an external site or on the social network icons displayed (WhatsApp, LinkedIn, Twitter), you are moving outside our site. We are therefore not responsible for the content, services or products offered on the linked website, nor for the data protection and technical security on the linked website. 

Updating this privacy notice

We adapt the data protection notice to changed functionalities or changed legal situations. We therefore recommend that you read the data protection notice at regular intervals.

Status: January 2021