PRIVACY POLICY
PRIVACY POLICY OF RAILPOOL GMBH
Data protection information according to Art. 13, 14 GDPR
As the operator of these pages, we take the protection of your personal data very seriously. We therefore treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
Should offers from other providers be accessible from our website, our data protection information does not apply to them.
With the following data protection information, we would like to inform you about how we handle your personal data in detail. For reasons of better readability, the language form of the generic masculine is used. Please note that the exclusive use of the masculine form should be understood to be gender-independent.
General information
1. name and contact details of the person responsible
The controller within the meaning of data protection laws, in particular the EU General Data Protection Regulation (GDPR), is the:
RAILPOOL GmbH
Seidlstrasse 23
80335 Munich
Phone +49 89 510 85 77 – 120
Fax +49 89 510 85 77 – 220
E-mail: sales@railpool.eu
Internet: www.railpool.eu
2. contact details of the data protection officer
You can reach our data protection officer by email at datenschutz@dataguard.de
Currently appointed as data protection officer for the client:
DataCo GmbH
Nymphenburger Str. 86,
80636 Munich
+49 (0) 89 7400 45840
datenschutz@dataguard.de
Rights of data subjects
1. right to information
If your personal data is processed, you have the right to obtain information from the controller about the personal data stored about you (Art. 15 GDPR)
2. right to rectification
You have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning you and the right to have incomplete personal data completed (Art. 16 GDPR)
3. right to cancellation
If the legal requirements are met, you can request the immediate erasure of your personal data or restriction of processing (Art. 17 and 18 GDPR).
4. right to information
If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right to be informed about these recipients by the controller (right to information, Art. 19 GDPR).
5. right to data portability
If you have consented to the data processing or a contract for data processing exists and the data processing is carried out using automated procedures, you may have a right to data portability (Art. 20 GDPR). In exercising this right, you also have the right to obtain that the personal data concerning you be transferred directly from one controller to another controller, insofar as this is technically feasible. The freedoms and rights of other persons must not be affected by this.
6. right to object to the processing
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions. The controller will no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims (Art. 21 (1) GDPR).
7. right to object to direct marketing
Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing (Art. 21 (2) GDPR). If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.
8. right to withdraw consent
You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal (Art. 7 (3) GDPR).
9. automated decisions in individual cases including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. In this case, if the legal requirements are met, you have the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision (Art. 22 GDPR).
10. right to lodge a complaint
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR). The supervisory authority with which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
Provision of the website
1. Hosting
The website is hosted on servers of a service provider commissioned by us.
Our service provider is:
Host Europe GmbH
c/o WeWork Wallarkaden
Pilgrimstraße 6
50674 Köln
The servers automatically collect and store information in so-called server log files, which your browser automatically transmits when you visit the website. The information stored is
- IP address of the requesting computer
- Date and time of access
- Name and URL of the retrieved file
- Website from which the access is made (referrer URL)
- the browser used and, if applicable, the operating system of your computer, as well as the name of your access provider
This data is not merged with other data sources. This data is collected on the basis of Art. 6 para. 1 lit. f GDPR. The processing of the aforementioned data is necessary for the provision of a website and thus serves to safeguard a legitimate interest of the web operator.
The server of the website is geographically located in Strasbourg (France). Your data is transferred to servers in France.
2. Description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.
The following data is collected:
- Information about the browser type and version used
- The user’s operating system
- The user’s internet service provider
- The IP address of the user
- Date and time of access
- Websites from which the user’s system reaches our website
- Websites that are accessed by the user’s system via our website
This data is stored in the log files of our system. This data is not stored together with other personal data of the user.
3. Purpose of data processing
Temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session.
Data is stored in log files to ensure the functionality of the website. We also use the data to optimise the website and to ensure the security of our information technology systems. The data is not analysed for marketing purposes in this context.
4. Legal basis for data processing
The legal basis for the temporary storage of log files is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in the purposes of data processing mentioned under 2.
5. Duration of storage
The data is deleted as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.
Use of cookies
1. Description and scope of data processing
Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user’s computer system. When a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again.
We use cookies to make our website more user-friendly. Some elements of our website require that the accessing browser can be identified even after a page change. The following data is stored and transmitted in the cookies:
- Language settings
- Log-in information
- Your cookie settings (consent/refusal)
- Search terms
- Other information necessary for the provision of the website
The user data collected in this way is pseudonymised using technical precautions. The data is not stored together with other personal user data.
Other information used for marketing purposes
You can find more information on our use of cookies in our privacy policy under the section « Plugins and tools used ».
2. Legal basis for data processing
The legal basis for the processing of personal data using technically unnecessary cookies is § 25 para. 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR. Art. 6 para. 1 lit. a GDPR.
The legal basis for the processing of personal data using technically necessary cookies is § 25 para. 2 TDDDG in conjunction with Art. 6 para. 1 lit. f GDPR. Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the purposes of data processing mentioned under 2.
3. Duration of storage, objection and removal options
Cookies are stored on the user’s computer and transmitted by it to our website. As a user, you therefore have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all the functions of the website to their full extent.
Plugins and tools used
When using some plug-in service providers, personal data may be transferred to servers in third countries outside the EU, such as the USA.
The following service providers marked with an * have joined the Trans-Atlantic Data Privacy Framework (TDPF; data protection agreement between the EU and the USA), so that an appropriate level of data protection is guaranteed for data processing.
Borlabs
We use the Borlabs Cookie provided cookie hint plugin for WordPress.
Borlabs GmbH
Hamburger Str. 11, 22083 Hamburg, Germany
When you visit our online presence, you as a user are asked for your individual consent to the use of cookies.
Information on processing can be found here Data protection (borlabs.io)
We use several plugins provided by Google.
Google Ireland Limited,
Gordon House, Barrow Street, Dublin 4, Ireland
- YouTube
We use the YouTube plugin to embed videos from YouTube on our online presence.
We use the Friendly Captcha plugin to protect our online services from spam and misuse.
Friendly Captcha GmbH
Am Anger 3-5, 82237 Woerthsee, Germany
When you visit our online presence, your browser establishes a connection with the plugin servers. This allows personal data to be stored and analysed, in particular the user’s activity (in particular which pages have been visited and which elements have been clicked on) as well as device and browser information (in particular the IP address and operating system). We have no influence on the content of the plug-in. If you are logged into your personal account during your visit, your online presence visit can be assigned to this account. By interacting with this plug-in, this corresponding information is transmitted directly to the plug-in owner and stored there.
Information on the processing of data by Google can be found here: https://policies.google.com/privacy?gl=EN&hl=en
Information on the processing of data by Friendly Captcha can be found here:
https://friendlycaptcha.com/en/legal/
Purpose of the processing
The use of plug-ins serves to improve user-friendliness and an appealing presentation of our online presence. As well as the protection and technical functionality of the online presence
Legal basis for the processing of personal data
The legal basis for the processing of users’ personal data is generally the consent of the user in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.
Duration of storage
Your personal information will be stored for as long as necessary to fulfil the purposes described in this Privacy Policy or as required by law, e.g. for tax and accounting purposes.
Right of cancellation and removal
You have the right to revoke your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. You can prevent the collection and processing of your personal data by Google by preventing the storage of third-party cookies on your computer
for applicants
1. processing of your personal data
RAILPOOL GmbH collects the following personal data from you as part of the application process:
- First name and surname
- E-mail address
- Telephone / mobile phone number
- Availability
- Salary expectations
- All personal data contained in the application (CV, cover letter, references, etc.)
RAILPOOL collects personal data from applicants as follows:
- Direct application via the Railpool career pages
- Application by e-mail addressed directly to a Railpool employee
- Postal application
- Immediate applications made via application platforms
- Recruitment agency
- Candidates who are contacted by Railpool via social media platforms (e.g. Xing, LinkedIn)
2. purposes of the processing and its legal basis
Your personal data will be processed for the following purposes:
- Implementation of the application procedure and decision on the establishment of the employment relationship
- Communication (telephone, e-mail, video telephony)
- Implementation of pre-contractual measures (initiation of the employment relationship)
- Inclusion of applicant data in an applicant pool
- Assertion, exercise or defence of legal claims arising from the application process
Processing of special categories of personal data that have been made public
Insofar as special categories of personal data are processed that you have obviously made public, your data will be processed in accordance with Art. 9 para. 2 lit e GDPR.
Processing for the establishment, exercise or defence of legal claims or in the event of legal proceedings
If necessary, your data will be processed for the purpose of asserting, exercising or defending legal claims or in the case of actions by the courts pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, Art. 9 para. 1 lit. f GDPR.
Processing on the basis of consent
If you have given your consent to data processing, your data will be processed in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with Art. 7 GDPR, Art. 88 para. 1 GDPR (in conjunction with Art. 26 para. 2 BDSG, applies in Germany). Art. 7 GDPR, Art. 88 para. 1 GDPR (in conjunction with Art. 26 para. 2 BDSG, only applies to Germany).
Processing for the purpose of performing the contract with you
Insofar as we process your personal data for the purpose of contract fulfilment, Art. 6 para. 1 sentence 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre- and post-contractual measures.
Processing for the fulfilment of a legal obligation
Insofar as the processing of your personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 para. 1 sentence 1 lit. c GDPR serves as the legal basis. Our legal obligation to process data arises, for example, from retention obligations under tax and/or commercial law.
Decision on the establishment of the employment relationship
We process your data in order to make a decision on the establishment of the employment relationship. If you are hired by our company, your data will be processed for the purpose of implementing and terminating the employment relationship. Separate information about the processing of your personal data will be provided for this purpose.
Processing on the basis of legitimate interest
Insofar as the processing is carried out to safeguard a legitimate interest of us or a third party and your interests or fundamental rights and freedoms do not outweigh the first-mentioned interest, Art. 6 para. 1 sentence 1 lit. f GDPR serves as the legal basis for data processing. Our legitimate interest arises in particular for the following reasons
The proper implementation and optimisation of the application process
Assertion, exercise or defence of legal claims
Processing of special categories of personal data
If you have given your consent to the processing of special categories of personal data, such as health data, religious affiliation or nationality, your data will be processed in accordance with Art. 9 para. 2 lit. a GDPR.
3. recipients or categories of recipients of the personal data and third country transfers
As part of the processing of your personal data, we may pass on your personal data to the following recipients:
- Internally, only authorised employees are granted access to an applicant’s data via an authorisation concept.
- to a system house commissioned by us to operate an online application platform as part of order processing:
rexx systems GmbH,
Süderstrasse 75-79, 20097 Hamburg - as part of a sanctions list comparison to a service provider commissioned by us in order to avert possible damages or penalties (including EC Regulation 2580/2001, EU Regulation 881/2002, EU Regulation 753/2011) from our company:
Siemssen Consulting GmbH,
Stresemannstraße 46, 27570 Bremerhaven, Germany - in connection with cooperation in HR/applicant management with affiliated companies
-
- Railpool Lokservice GmbH & Co KG,
Grusonstraße 46, 22113 Hamburg
Tankweg, 21129 Hamburg - KTG GmbH,
Am Unkelstein 46, 47059 Duisburg - NTT AS,
Kværnerveien 6, 0195 Oslo - Railpool GmbH Branch Italia,
Piazza Sandro Pertini 4/4, 17100 Savona - Railpool Polska Sp. z o.o.,
Ul. Górecka 1, 60-201 Poznań - Railpool France SAS,
15 rue Traversière, 75012 Paris
- Railpool Lokservice GmbH & Co KG,
For communication with applicants, we use the Microsoft 365 service, including Microsoft Teams from the service provider Microsoft Operations Ltd. in Dublin, Ireland. Further information on data processing by Microsoft can be found at: https://privacy.microsoft.com/de-de/privacystatement
4. duration of storage
We will delete your personal data as soon as the purposes of the processing and the legal basis for its storage no longer apply, or you object to the use of your personal data (in the case of processing on the basis of legitimate interests) or you withdraw your previously granted consent. However, your personal data may also be stored beyond this, in particular in the following cases:
- if contractual, legal or statutory retention periods prevent deletion
- for the assertion, exercise or defence of legal claims
- if this is necessary under European or national law to fulfil a legal obligation to which we are subject.
The following retention periods in particular result for us from statutory provisions:
- After decision on non-appointment: 180-day retention period for application documents.
If the applicant has consented, the application documents will be included in an applicant pool and stored there for a maximum of 1 year from the date of consent. They will be deleted when the purpose no longer applies or when the applicant withdraws their consent.
In the event of recruitment, your personal data will be deleted when the purpose no longer applies, at the latest after termination of the employment relationship, provided that there are no statutory retention periods to prevent deletion.
for customers, suppliers, service providers and interested parties
1. processing of your personal data
1.1 Your personal data that is processed by us
We process personal data of customers, suppliers, service providers and interested parties. This is necessary for business operations. The following data is processed: We process the following personal data for the initiation of a contract:
- Salutation
- First name
- Surname
- Titles and academic degrees
- Position in the company
- Company name
- Business address
- Bank details
- Tax ID
- Customer number
- Your e-mail address,
- Your mobile phone number
- Your landline number
- Your fax number
- All personal data provided to us in the course of communication
- Creditworthiness data
We collect data from interested persons and customers in the following ways:
- Enquiries via the contact form on the Railpool website
- Enquiries by message to Railpool employees, e.g. by e-mail or other communication channels.
- Enquiries at trade fairs or other events where data is passed on to Railpool employees with the aim of establishing contact.
- Own research on potential interested parties in business directories, contact details on websites or professional networks.
- Independent booking of an appointment by an interested person.
- Requesting personal data from the person themselves or receiving personal data from an employee of the customer company after concluding a contract with Railpool. This may also concern employees of service providers of the customer company.
1.2 Purposes of data processing
Your personal data will be processed for the following purposes as part of the existing customer relationship and contract initiation:
- To process your enquiry as an interested party.
- To prepare and implement pre-contractual measures
- To add your contact details to our customer and contact database.
- Contact (e-mail, telephone)
- Initiation, implementation and termination of a contractual relationship
- Customer administration and customer care
- To provide you, our customer, with the best possible service. This includes, in particular, communicating with you by e-mail, mobile phone, landline or fax.
- To ensure smooth invoicing of the services provided. For this purpose, your personal data is processed in order to be able to issue invoices.
- To fulfil our legal obligations. This includes, for example, the transfer of your personal data to the tax office.
- For the purpose of carrying out marketing initiatives such as: Invitations to events
- For the fulfilment of post-contractual measures.
- For the assertion, exercise or defence of legal claims.
- To find out how satisfied you are with our products and services
- Measures for business management and further development of our products
1.3 Legal basis for data processing
Processing of your personal data on the basis of consent
Insofar as we obtain your consent for the processing of your personal data, the processing of your personal data is carried out on the basis of Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with Art. 5, 7 GDPR. Art. 5, 7 GDPR.
Processing for the purpose of performing the contract with you
Insofar as we process your personal data for the purpose of contract fulfilment, Art. 6 para. 1 sentence 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of pre- and post-contractual measures.
Processing for the fulfilment of a legal obligation
Insofar as the processing of your personal data is necessary to fulfil a legal obligation to which our company is subject, Art. 6 para. 1 sentence 1 lit. c GDPR serves as the legal basis. Our legal obligation to process data arises, for example, from retention obligations under tax and/or commercial law.
Processing on the basis of legitimate interest
The legal basis for the purpose of direct advertising may be Art. 6 para. 1 sentence 1 lit. f GDPR if our legitimate interests exist, unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, prevail. The legitimate interests pursued by us in this regard – in addition to the purposes listed under 1.2 – include
- To provide you with the best possible information about our products, offers and services by means of direct marketing;
- In order to be able to carry out due diligence with our potential business partner
- in order to be able to carry out a sanctions list comparison with a contracted service provider in order to avert possible damages or penalties (including EC Regulation 2580/2001, EU Regulation 881/2002, EU Regulation 753/2011) from our company:
Siemssen Consulting GmbH,
Stresemannstraße 46, 27570 Bremerhaven - To obtain customer feedback to improve the customer experience, improve our products and services
The legal basis for processing activities in connection with the assertion, exercise or defence of legal claims is also our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.
2. recipients or categories of recipients of the personal data and third country transfers
As part of the processing of your personal data, we may pass on your personal data to the following recipients. We only transfer your personal data to external recipients if you have given your consent or if this is permitted by law.
External recipients of your personal data are in particular
- Freelancer
- Order data processor
- Authorities e.g. tax offices, courts, trade supervisory office, data protection supervisory authorities, Federal Office of Economics and Export Control (BAFA)
- Billing partner
- Credit institutions
- Post & parcel service provider
- Lawyer, tax consultant
- Auditor
- Associated companies
Your personal data will be transmitted to the following service providers:
- Microsoft Operations Ltd. in Dublin, Ireland
- SugarCRM Inc. San Francisco, CA
- DocuSign, Inc., San Francisco, USA
3. duration of the storage of personal data
We do not store your personal data for longer than is necessary for the purpose for which it was collected. This means that data is destroyed or deleted from our systems as soon as it is no longer required. We take appropriate measures to ensure that your personal data is only processed under the following conditions:
- For the duration that the data is used to provide you with a service
- As required by applicable law, a contract or with respect to our legal obligations
- Only for as long as necessary for the purpose for which the data was collected or longer if required by contract, applicable law, using appropriate safeguards.
A requirement may exist in particular if the data is still needed to fulfil contractual services, to check and grant or defend against warranty and guarantee claims. If the data is no longer required for the fulfilment of contractual or legal obligations, it is regularly deleted unless its – temporary – retention is still necessary, in particular to fulfil legal retention periods of up to ten years (e.g. from the German Commercial Code or the German Fiscal Code). In the case of statutory retention obligations, deletion will only be considered after expiry of the respective retention obligation.
4. obligation to provide the data
For the (planned) conclusion and execution of a contract with you, you must provide the personal data that is necessary for the establishment and execution of the contractual relationship and the fulfilment of the associated contractual obligations or that we are legally obliged to collect. Without this data, we will generally not be able to conclude and fulfil the contract with you.
WE ARE HERE FOR YOU
IMMEDIATELY AND IN PERSON
Tel.: +49 89 510 85 77-0
Telefax: +49 89 510 85 77-222
E-Mail: sales@RAILPOOL.eu
RAILPOOL GmbH
Seidlstraße 23
80335 Munich