Foreword
We, Flix SE, including our subsidiaries (hereinafter referred to jointly as: “FlixBus”, “we” or “us”) would like to inform you here about data protection at FlixBus.
Data protection regulations for the protection of the person affected by data processing (we refer to you as a data subject hereinafter, as well as “user”, “you” or “data subject”) arise in particular from the EU General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter referred to as “GDPR”). Insofar as we decide on the purposes and means of data processing either alone or jointly with others, this primarily includes the obligation to inform you transparently about the type, scope, purpose, duration and legal basis of the processing (cf. Art. 13 and 14 GDPR).
The purpose of this policy (hereinafter: “privacy policy”) is to inform you about the way in which we process your personal data.
Our privacy policy is modular in structure. It consists of one part containing general information about all processing of personal data and processing situations that come into effect each time our website is accessed (Clause 1 General information) and a special part, the content of which only refers to the processing situation specified therein with the name of the respective offer or product, in particular when you visit our websites, which is described in more detail here (Clause 2 Special information).
You can find further legal information here:
For job applicants:
Data protection information for job applicants
1. General information
1.1 Definition of terms
This privacy policy is based on the following definitions of terms, as outlined in Art. 4 GDPR:
- “Personal data” is all information that relates to an identified or identifiable natural person (“data subject”). A person is identifiable if he/she can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data or by means of information concerning their physical, physiological, genetic, mental, economic, cultural or social identity characteristics (Art. 4(1) GDPR). Identifiability can also be provided by linking such information or other additional knowledge. This does not depend on the occurrence, form or physical embodiment of the information (photos, video or sound recordings may also contain personal data).
- “Processing” is any operation in which personal data is handled, whether or not by automated means (i.e. technology-supported). This includes in particular the collection (i.e. the procurement), the recording, the organization, the structuring, the storage, the adaptation or alteration, the retrieval, the consultation, the use, the disclosure by transmission, the dissemination or otherwise making available, the alignment, the combination, the restriction, the erasure or destruction of personal data, as well as the change of definition of a target or purpose that was originally used as a basis for data processing (Art. 4(2) GDPR).
- “Controller” is the natural or legal person, public authority, agency or other body that decides alone or together with others on the purposes and means of processing personal data (Art. 4(7) GDPR).
- “Processor” is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller, in particular in accordance with its instructions (Art. 4(8) GDPR).
- “Third party” is any natural or legal person, public authority, agency or other body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process the personal data; this also includes other legal entities belonging to the group (Art. 4(10) GDPR).
- “Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her; (Art. 4(11) GDPR).
1.2 Name and address of the controller
The person responsible for the processing of your personal data (Art. 4(7) GDPR) is:
Flix SE
Friedenheimer Brücke 16
80639 Munich
Telephone: +49 (0)30 300 137 300
Email: service@flixbus.de
Further information about our company can be found in the legal notice.
1.3 Contact details of the data protection officer
Our company data protection officer is available to you at any time to answer all your questions and as a contact person on the subject of data protection.
The contact details are:
Flix SE
Friedenheimer Brücke 16
80639 Munich
Email: data.protection@flixbus.com
For general questions about FlixBus, please contact service@flixbus.de.
1.4 Legal basis of data processing
The processing of personal data is permitted if at least one legal basis listed below is complied with:
- Art. 6 para. 1(a) GDPR: the data subject has given his/her consent to the processing of the personal data concerning him/her for one or more specific purposes;
- Art. 6 para. 1(b) GDPR: the processing is necessary for the performance of a contract to which the data subject is a contracting party, or for the implementation of pre-contractual measures which are carried out at the request of the data subject;
- Art. 6 para. 1(c) GDPR: the processing is necessary for compliance with a legal obligation to which the controller is subject (e.g. a statutory retention obligation);
- Art. 6 para. 1(d) GDPR: the processing is necessary to protect the vital interests of the data subject or another natural person;
- Art. 6 para. 1(e) GDPR: the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or
- Art. 6 para. 1(f) GDPR: the processing is necessary to safeguard the legitimate interests pursued by the controller or a third party, unless the opposing interests or rights of the data subject prevail (in particular where the data subject is a child).
For processing carried out by us, we specify the applicable legal basis under Clause 2. Processing can also be based on more than one legal basis.
1.5 Categories of recipients
Under certain conditions, we transmit your personal data to our subsidiary companies, or personal data is transferred to us from our subsidiary companies, when permissible.
As with any major company, we also use external domestic and foreign service providers to handle our business transactions and work with partner companies at home and abroad. These include, for example:
- (IT) service providers
The service providers and partner companies must provide guarantees that suitable technical and organizational measures are implemented by them in such a way that the processing meets legal requirements and the rights of the data subjects are safeguarded.
We transmit personal data to public bodies and institutions (e.g. police, public prosecutor’s office, supervisory authorities) if there is a corresponding obligation/authorization.
For processing carried out by us, we specify the categories of the data recipients under Clause 2.
1.6 Requirements for the transfer of personal data to third countries
As part of our business relationships, your personal data may be shared with or disclosed to third parties who may also be located outside the European Economic Area (EEA), i.e. in third countries.
Insofar as it is necessary, we will inform you in the relevant sections of Clause 2 about the respective details of the transfer to third countries in connection with the processing carried out by us.
The European Commission certifies that some third countries have data protection that is comparable to the EEA standard by means of so-called adequacy decisions (a list of these countries and a copy of the adequacy decisions can be downloaded from: http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.html).
However, in other third countries to which personal data may be transferred, there may not be a consistently high level of data protection by reason of a lack of legal provisions. If this is the case, we ensure that data protection is adequately guaranteed.
This is possible, for example, via binding company regulations (referred to as “binding corporate rules”), standard contractual clauses of the European Commission for the protection of personal data, certificates and recognized codes of conduct.
Insofar as it is necessary for your booking and the associated providing and processing of transport services, the transmission of personal data required for this to third countries is permitted in accordance with Art. 49 para. 1(b) GDPR.
Please contact our data protection officer if you would like more detailed information on this topic.
1.7 Storage duration and data erasure
The storage period of the personal data collected depends on the purpose for which we process the data. The data will be stored for as long as this is necessary to achieve the intended purpose.
In the case of processing carried out by us, we specify in Clause 2 how long the data will be stored by us. If no explicit storage period is specified below, your personal data will be erased or blocked as soon as the purpose or legal basis for the storage no longer applies.
However, storage can take place beyond the specified time in the event of a(n) (imminent) legal dispute with you, or if other legal proceedings are initiated, or if storage is stipulated by statutory provisions to which we as the controller are subject. If the storage period prescribed by statutory provisions expires, the personal data will be blocked or erased unless further storage by us is required and there is a legal basis for this.
1.8 Automated decision making (including profiling)
We do not intend to use any personal data collected from you for any processes involving automated decision-making (including profiling). If we wish to implement these procedures, we will inform you of this separately in accordance with statutory provisions.
1.9 No obligation to provide personal data
We do not fundamentally make the conclusion of contracts with us dependent on you providing us with personal data beforehand. In principle, there is also no statutory or contractual obligation to provide us with your personal data; however, we may only be able to provide certain offers to a limited extent, or not at all, if you do not provide the data required for this.
1.10 Statutory obligation to transmit certain data
Under certain circumstances, we may be subject to a special statutory or legal obligation to provide personal data to third parties, in particular public bodies.
1.11 Data security
We use suitable technical and organizational measures to collect your data, taking into consideration the latest technology, the implementation costs and the nature, the scope, the context and the purpose of the processing, as well as the existing risks of a data breach (including the probability and effect of such an event), in order to protect the data subject against accidental or intentional manipulation, partial or complete loss or destruction, or against unauthorized access by third parties (e.g. we use TSL encryption for our websites). Our security measures are continuously being improved to take into account technological developments.
We will be happy to provide you with further information about this upon request. Please contact our data protection officer or our CISO (chief information security officer) in this regard.
His contact details are:
Flix SE
Friedenheimer Brücke 16
80639 Munich
Email: it-security@flixbus.com
1.12 Your rights
You may assert your rights as a data subject regarding your personal data at any time, in particular by contacting us using the contact details provided in Clause 1.2. Data subjects have the following rights under the GDPR:
Right to information
You can request information in accordance with Art. 15 GDPR about your personal data processed by us. In your request for information, you should clarify your concern to make it easier for us to compile the necessary data. Upon request, we will provide you with a copy of the data that are the subject matter of the processing. Please note that your right to information may be limited under certain circumstances in accordance with statutory provisions.
Right to rectification
If the information relating to you is not (any longer) correct, you may request a correction in accordance with Art. 16 GDPR. If your data is incomplete, you may request completion.
Right to erasure
You may request the erasure of your personal data in accordance with the provisions of Art. 17 GDPR. Your right to erasure depends, among other things, on whether the data relating to you are still required by us to perform our statutory duties.
Right to restriction of processing
In accordance with the provisions of Art. 18 GDPR, you have the right to demand a restriction of the processing of the data relating to you.
Right to data portability
In accordance with the provisions of Art. 20 GDPR, you have the right to receive the data that you have provided to us in a structured, commonly-used and machine-readable format, or to request the transmission to another controller.
Right to object:
In accordance with Art. 21 para. 1 GDPR, you have the right to object to the processing of your data at any time for reasons relating to your particular situation. You can object to receiving advertising at any time with effect for the future, in accordance with Art. 21 para. 2 GDPR (objection to advertising in the case of direct marketing).
Right to appeal
If you are of the opinion that we have not complied with the provisions of data protection regulations when processing your data, you can complain to a data protection supervisory authority about the processing of your personal data, such as to the data protection supervisory authority under whose jurisdiction we fall:
Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach
Right to withdraw consent
You can withdraw your consent to the processing of your data at any time with future effect. This also applies to declarations of consent that were issued before the GDPR came into force, i.e. before 05/25/2018.
2. Special information
2.1 Visiting our websites
Information about FlixBus and the job opportunities we offer can be found in particular at https://flix.careers/, including the associated subpages (hereinafter referred to jointly as “website” or “websites”). When you visit our websites, your personal data is processed.
2.1.1 Provision of websites
When using the websites for information purposes, we collect, store and process the following categories of personal data:
Log data: when you visit our websites, a log data record (referred to as “server log files”) is saved on our web server. This consists of:
- the page from which the page was requested (referred to as referrer URL)
- the name and URL of the requested page
- the date and time of the access request (in the time zone of the server)
- the version of the web browser used
- the IP address of the requesting computer
- the amount of data transferred
- the operating system
- the message whether the call was successful (access status/Http status code)
- GMT time zone difference
We use IT service providers for hosting our websites and for statistical evaluations of the log data.
The processing of the log data serves statistical purposes and improves the quality of our websites, in particular the stability and security of the connection.
The legal basis is Art. 6 para. 1(f) GDPR. Our legitimate interest is to be able to make the websites available to you properly.
2.1.2 Contact forms for applicants
When using contact forms to send applications, the data transmitted in this way are processed (e.g. title, last name and first name, address, phone number, email address, resume, possible start date, expected salary, time of transmission, subject matter of the enquiry).
Contact form data are processed in order to process applications for the purpose of deciding on establishing an employment relationship on the legal basis of Art. 6 para. 1(b), or in other cases on the legal basis of Art. 6 para. 1(f) GDPR; our legitimate interest is to process contact enquiries.
In addition, we store the contact form data as well as the respective IP address in order to comply with our obligations to provide evidence, to ensure compliance with and documentation of legal obligations, in order to be able to clarify any possible misuse of your personal data and to ensure the security of our systems.
The legal basis is Art. 6 para. 1 (c) or (f) GDPR.
2.1.3 Use of cookies, plugins and other services
Cookies
When you visit our website, information is stored in the form of a cookie (small text files) on your device. It saves information about how you use the website (identification ID, visit date, etc.). We use cookies to make it easier for you to use our online services through various service functions (such as the recognition of previous visits) and can thus better adapt our internet offerings to meet your needs.
The legal basis for the use of technically necessary cookies is Art. 6 para. 1(f) GDPR. Our legitimate interest is to make our websites available to you with specific functionalities, to improve them and to ensure the security and integrity of our websites.
You can prevent the storage of cookies and delete existing cookies by choosing the appropriate settings in your browser. The help function of most browsers tells you how to make these settings. However, if you do not accept cookies, the service features of the Internet offer may be impaired. We therefore recommend that you leave the cookie function turned on.
Comprehensive information on how to accomplish this on a variety of browsers can be found on the following websites: youronlinechoices, Network Advertising Initiative and/or Digital Advertising Alliance. You can also find information there about how to delete cookies from your computer as well as general information about cookies. We use different types of cookies:
Transient cookies, which are also referred to as temporary or “session cookies”, are cookies that are deleted after you leave our online service and close the browser. In these cookies, language settings or the content of the order, for example, are stored.
Persistent or permanent cookies remain stored even after the browser is closed. This enables, for example, saving the login status or any search terms that were entered. We use such cookies, among other things, to measure the reach or for marketing purposes. Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. However, you can delete these cookies at any time in the security settings of your browser.
In addition to “first-party cookies”, which we set as controllers for data processing, “third-party cookies” are also used, which are offered by other providers.
As part of consent management (consent banner), we give you the opportunity to decide between the use of cookies and the use of similar technologies. You can find a detailed overview with comprehensive information on the services used and access to your consent settings, including the option of revocation, here.
2.2 Presence on social media channels
We have a presence on social media (currently: Facebook, Instagram, LinkedIn and Twitter). To the extent we have control over the processing of your data, we ensure that the applicable data protection regulations are complied with.
In addition to us, the following are responsible for the company’s presence within the meaning of the GDPR and other data protection regulations:
Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)
Instagram (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)
Twitter (Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland)
LinkedIn (LinkedIn Ireland Unlimited Company, Gardner House Wilton Place, Dublin 2, Ireland)
We would like to point out that your data may be processed outside the European Union.
The legal basis for the processing of your personal data by us is Art. 6 para. 1(f) GDPR. Our legitimate interest is effective information and communication.
Further information about data protection laws in relation to our corporate presence on social media channels can be found here:
Facebook: https://www.facebook.com/notes/flixbus/facebook-fanpage-datenschutzrichtlinie/2107777085936747/
Instagram: https://www.facebook.com/policy.php