Information on the processing of personal data when using the railMybox websites
and the railMybox platform

Status: 11.03.2024

1 GENERAL

1.1. In the following, we inform about the processing of personal data when using our websites and our platform. Personal data is any information relating to an identified or identifiable natural person (hereinafter “you”), e.g. name, address, e-mail addresses and user behavior.

2 YOUR RIGHTS

2.1. You have the following rights with respect to us regarding personal data concerning you:

• Right to information: You can request information in accordance with Art. 15 GDPR about your personal data that we process.
• Right to rectification: If the information concerning you is not (or no longer) accurate, you can request a rectification in accordance with Art. 16 GDPR. If your data is incomplete, you can request that it be completed.
• Right to erasure: You can request the erasure of your personal data in accordance with Art. 17 GDPR.
• Right to restriction of processing: According to Art. 18 GDPR, you have the right to request a restriction of the processing of your personal data.
• Right to object to processing: You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of Article 6(1)(f) GDPR. The controller will then no longer process the personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defense of legal claims. The collection of data for the provision of the website and the storage of log files are absolutely necessary for the operation of the website.
• Right to data portability: In the event that the requirements of Art. 20 (1) GDPR are met, you have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to third parties. The collection of data to provide the website and the storage of log files are absolutely necessary for the operation of the website. They are therefore not based on consent pursuant to Art. 6 (1) a GDPR or on a contract pursuant to Art. 6 (1) b GDPR, but are justified pursuant to Art. 6 (1) f GDPR. The requirements of Article 20 (1) of the GDPR are therefore not met.
• Right to complain: If you believe that the processing of your personal data violates data protection law, you have the right to complain to a data protection supervisory authority of your own choice in accordance with Article 77(1) of the GDPR. This includes the data protection supervisory authority responsible for the controller: The Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str 22, 20459 Hamburg, 040/428 54 – 4040, mailbox@datenschutz.hamburg.de.

3 PROCESSING OF PERSONAL DATA WHEN CONTACTING RAILMYBOX

3.1. If you contact us by e-mail or via our contact form, the data you provide (e.g. your e-mail address, your name and your telephone number, if applicable) will be processed by us and stored in particular to answer your questions. We handle support requests via the Freshdesk service of Freshworks GmbH, Alte Jakobstraße 85/86, Hof 1, Haus 5, 10179 Berlin (see point 5 of this declaration).

The legal basis for data processing depends on the reason and content of the respective contact request. In the case of inquiries that are related to an existing contractual relationship or the initiation of such a relationship, the legal basis is Art. 6 (1) lit. f GDPR. Our legitimate interest is to process your requests.

We delete the data generated in connection with support requests after storage is no longer required or restrict processing if there are legal retention obligations. The concrete respective periods depend on the reason and content of your contact request.

4 VERARBEITUNG PERSONENBEZOGENER DATEN BEIM BESUCH EINER DER RAILMYBOX-WEBSEITEN

4.1. This declaration applies to the web pages:

• railMybox.com
• railMybox.io

4.2. In the case of mere informational use of the website, i.e. if you do not register to use the railMybox platform, log in or otherwise provide us with information, we collect and process the following data, which is technically necessary for us to display our website to you and to ensure stability and security:

• IP address
• Date and time of the request
• Time zone difference from Greenwich Mean Time (GMT)
• Content of the request (concrete page)
• Access status / HTTP status code
• Data volume transferred in each case
• Website from which the request comes
• Browser
• Operating system and its interface
• Language and version of the browser software

For the technical operation of our website, we use Amazon Web Services (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855, Luxembourg, “AWS”). In addition, we also use services of WP Engine, Irongate House, 22-30 Duke’s Place, London, EC3A 7LP, United Kingdom, for this purpose. In each case, these are processors within the meaning of Art. 28 GDPR.

4.3. Cookies use

4.3.1. When you use our website, cookies are stored on your terminal device. Cookies are pieces of information that we can read, in particular to recognize your terminal device.

4.3.2. You can consent to the use of cookies and third-party services in detail via our cookie consent menu. The cookie consent menu contains a cookie statement with a more detailed description of the cookies used, such as their respective purpose.

4.3.3. For this purpose, we use the service Borlabs Cookie; a technically necessary cookie (borlabs-cookie) to store your cookie consents. Borlabs Cookie does not process any personal data. However, the borlabs-cookie cookie stores the consent you gave when you entered the website. If you wish to revoke these consents, simply delete the cookie in your browser or correct your settings in the Consent Manager menu. In some cases, a “reload” of the website may be necessary. When you re-enter/reload the website, you will be asked again for your cookie consent.

4.3.4. However, you can also set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be limited. If cookies are used by third-party companies or for analysis purposes, we will inform you about this separately within the framework of this data protection declaration and, if necessary, request your consent.

4.3.5. Regardless, you can find more information about cookies at www.allaboutcookies.org. The website www.allaboutcookies.org can give you detailed instructions on how to set and delete cookies, depending on the browser type. At the bottom of this page, where we can name them, we have shown references to cookie settings in various browsers.

4.3.6. If you consent, the legal basis for the processing of your data is Section 25 (1) TTDSG and Article 6 (1) a GDPR. In addition, you consent pursuant to Art. 49 para. 1 GDPR that providers in the USA also process your data. In this case, it is possible that the transmitted data will be processed by local authorities. Data required for the operation of the website is processed on the basis of Art. 6 (1) lit. f GDPR. Our legitimate interest is to enable the website operation.

4.4. Use of Google Analytics

4.4.7. With your consent, our website uses Google Analytics, a web analytics service provided by Google Inc (“Google”). Google Analytics uses cookies that enable an analysis of your use of our website. The information generated by the cookie about your use of our website is usually transmitted to a Google server in the USA and stored there. In the event that IP anonymization is activated on our website, however, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On our behalf, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator.

4.4.8. The IP address transmitted by your browser as part of Google Analytics is not merged with other data from Google.

4.4.9. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

4.4.10. We use Google Analytics with your consent in order to analyze and regularly improve the use of our website. We can use the statistics obtained to improve our offer and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US data privacy framework. The actual legal basis for the use of Google Analytics is Art. 6 para. 1 lit. a GDPR. In addition, in accordance with Art. 49 para. 1 GDPR, you consent to Google processing your data in the USA if necessary. In this case, it is possible that the transmitted data will be processed by local authorities.

4.4.11. Third-party provider information: Google Dublin, Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001. User terms and conditions: https://www.google.com/analytics/terms/de.html, Privacy policy overview: https://www.google.com/intl/de/analytics/learn/privacy.html, and Privacy policy: https://www.google.de/intl/de/policies/privacy.

4.5. LinkedIn Insight Tag

4.9.1. On our website we use the conversion tool “LinkedIn Insight-Tag” of LinkedIn Ireland Unlimited Company (LinkedIn Ireland). This tool creates a cookie in your web browser, which enables the collection of, among other things, the following data: IP address, device and browser properties, and page events (e.g. page views). LinkedIn Ireland does not transmit any personally identifiable information to us, but provides anonymized reports on website audience and viewing performance. In addition, LinkedIn Ireland offers the possibility of retargeting via the insight tag. With the help of this data, we can display targeted advertising outside of our website without identifying you as a user of the website.

4.9.2. Our legal basis for processing your data is your consent pursuant to Art. 6 para. 1 p. 1 lit. a GDPR. In addition, you consent pursuant to Art. 49 (1) GDPR that LinkedIn may process your data in the USA. In this case, it is possible that the transmitted data will be processed by local authorities. You give your corresponding consent via our cookie banner. Please note that LinkedIn Ireland may also process your data outside the EU/EEA. According to a recent ruling by the European Court of Justice (ECJ), there is no adequate level of data protection in the USA and thus a risk to the protection of your data. For example, under certain circumstances, your data may be processed by US authorities for control and monitoring purposes. If you nevertheless wish to consent to the use of this tool, you can select this via the cookie banner.

4.9.3. For more information about the LinkedIn Insight tag, please see the following link. For more information about privacy at LinkedIn Ireland, please see the LinkedIn Ireland Privacy Policy.

5 PROCESSING OF PERSONAL DATA VIA OUR SUPPORT SERVICE WITH LIVECHAT “FRESHCHAT”.

5.1. We use Freshchat from Freshworks Inc, 1250 Bayhill Drive, Suite 315, San Bruno, CA 94066, USA (“Freshchat”) for our support.

5.2. Via Freshchat, you can quickly resolve service issues with us via live chat and tickets.

5.3. By using this offer, the data you provide in each case will be transmitted to Freshchat and stored on its servers. Freshchat also transmits this data to companies of Freshworks, among others, in the USA and also other third countries, in order to be able to offer Freshchat.

5.4. We have concluded a contract with Freshchat with so-called EU standard contractual clauses as of 01.10.2021, in which Freshworks undertakes to process user data only in accordance with our instructions and to comply with the EU data protection level.

5.5. The legal basis for the aforementioned processing of data is Art. 6 (1) f) GDPR. The processing is carried out for the purpose of reviewing and responding to your inquiries. We have a legitimate interest in the described data processing, which lies in being able to offer direct and effective customer communication.

5.6. Your data will be deleted as soon as the respective request is completed and there are no legal retention obligations. You can find out more about Freshchat and data protection here: https://www.freshworks.com/privacy/

6 PROCESSING OF PERSONAL DATA ON THE PLATFORM

If you register or log in to use the closed user area of railMybox (also referred to as “platform”), we collect the following data in addition to the data listed in section 3:

6.1. Registration and general user profile

The use of our platform requires a profile for each user. In this context, we process:

Data category	Processing purpose
Personal data, e.g. names, contact details (including company addresses, telephone numbers) and passwords	We process this data in particular for user identification and administration and to process the services provided via our platform.

We process this data for the respective user on the legal basis of Art. 6 (1) lit. f GDPR.

6.2. Further information on principals

When you register as a client, we collect and process additional information. This includes:

Data category	Processing purpose
Company details such as company name and legal form, VAT identification number	We need this information to provide our services, to bill you and to make payments.
Additional company information (e.g. website address, second telephone number, voluntary)	We use this information to provide additional services to your business or to use a second way to contact you.
Payment information such as a bank account and billing address	We need this information to send and receive payments.
Type of company (e.g. shipper, forwarder, shipowner, wholesaler)	We need this information to provide our services, to bill you and to make payments.

We validate the VAT number on a website of the European Commission (VAT Information Exchange System (VIES)),
https://europa.eu/youreurope/business/taxation/vat/check-vat-number-vies/index_en.htm.

6.3. Further information about the transport

In connection with transport processing, we also process the following data:

Data category	Processing purpose
Load specification, loading point information	We need this information to process transports, i.e. to provide our services to the client.
Transport specific contact information	We need this information to process transports, i.e. to provide our services to the client.
Proof of Delivery	We need this information (such as the name of the driver, signature of a responsible person of the consignee of the load) to process transports, i.e. to provide our services to the client.

If you are a client yourself, the legal basis is Art. 6 (1) lit. b GDPR. If you are acting on behalf of a client or a recipient of a delivery, the legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest is to be able to provide our services to the client.

7 USE OF SOCIAL MEDIA

7.1 LinkedIn

7.1.1. As the operator of a LinkedIn page, we, railMybox GmbH, together with the operator of the social network, LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, hereinafter: LinkedIn, the responsible party within the meaning of Art. 26 of the General Data Protection Regulation (GDPR). When you visit our LinkedIn page, personal data is processed by the responsible parties. In the following, we will inform you about what data is involved, how it is processed and what rights you have in this regard.

7.1.2. Decisive for the use of the portal of LinkedIn are the terms of use of LinkedIn at https://www.linkedin.com/legal/user-agreement and the other terms and policies listed there. In particular, the privacy policy can be found at: https://www.linkedin.com/legal/privacy-policy and the Cookie Policy can be found at https://www.linkedin.com/legal/cookie-policy.

7.1.3. For questions regarding the processing of your personal data, for information, blocking, deletion or correction of data, as well as the revocation of consent given and objections, please contact the responsible persons. Information on the handling of personal data by LinkedIn on the LinkedIn portal can be found in their privacy policy at https://www.linkedin.com/legal/privacy-policy, in their cookie policy at https://www.linkedin.com/legal/cookie-policy and from their help pages at https://www.linkedin.com/help/linkedin?trk=microsites-frontend_legal_privacy-policy&lang=de or https://www.linkedin.com/help/linkedin?trk=microsites-frontend_legal_user-agreement&lang=de.

7.1.4. LinkedIn shows you ads customized for you both inside and outside their services. You can choose to be shown personalized ads, but not opt out of other ads.

7.1.5. LinkedIn targets ads (and measures their performance) both inside and outside LinkedIn to members, visitors, and others, directly or through various partners. To do this, LinkedIn uses the following data, either combined or separately (in some cases, this requires your consent, which is requested separately):

• Data from advertising technologies both inside and outside our services, pixels, tags, cookies and device identifiers;
• Information provided by members (for example, contact information, job title, and industry);
• Data from your use of our Services (for example, search history, feed, content you read, who you follow or who follows you, contacts, participation in groups, page visits, videos you watch, clicks on an ad, etc.), including as described in Section 1.3;
• Information from advertising partners, vendors and publishers; and
• Information that may be inferred from the data listed above (e.g., use of a profile’s job titles to infer an industry, career level, and compensation grade; use of graduation data to infer age or use of first names or pronoun usage to infer gender; use of your feed activity to infer your interests; or use of device data to recognize you as a member).

7.1.6. LinkedIn shows you ads labeled Sponsored Content that look like similar, non-sponsored content, except that they are labeled as advertisements (for example, as “ad” or “sponsored”). When you take a social action on these ads (such as “liking,” commenting, or sharing), your action is associated with your name and can be seen by third parties. This includes the provider (EUROGATE Intermodal GmbH) of the advertisement. If you perform a social action on LinkedIn services, this action may (depending on your settings) be mentioned in the context of associated advertisements.

7.2. Use of our Facebook and Instagram offers.

7.2.1. We are jointly responsible for the use of our Facebook and Instagram offers with Meta Platforms Ireland Limited (Facebook Ireland Limited) – hereinafter referred to as Meta – , 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, https://www.facebook.com/help/contact/540977946302970, as joint controllers pursuant to Art. 26 GDPR and the Facebook Page Insights Supplement (https://www.facebook.com/legal/terms/page_controller_addendum).

7.2.2. Meta. processes (personal) data when using Facebook products – including when visiting our Facebook or Instagram page – even from persons who are not registered with any of the Facebook services. Which (personal) data these are in detail, how, for which purposes and on which legal basis they are processed, is described by Facebook in its data policy (https://www.facebook.com/privacy/policy/?section_id=13-HowToContactMeta) which applies to all Facebook products. Information on how to contact Meat and on the settings options for advertisements, cookies, etc. can also be found there. The data may be transferred to countries outside the European Union.

7.2.3. For more information about the cookies Meta uses when having a Facebook account, using Facebook products (including the Website and Apps), or visiting other websites and apps that use Meat products (including the “Like” button or other Facebook technologies), Facebook provides the Cookie Policy (https://www.facebook.com/policies/cookies/). Information on how to manage information available about you can also be found at this link: https://www.facebook.com/policies/cookies/

7.2.4. When you visit our Facebook or Instagram page, Meta collects, among other things, your IP address. Together with other information that Meta receives through cookies, Meta provides us, as the operator of the Meta service, with statistical information about the use of the respective service (so-called page insights). These are aggregated data that show how users interact with the site. These Page Insights may be based on personal data collected by Meta in connection with a user’s visit to or interaction with our respective Meta Service and its content. Meta provides more information about this here: https://www.facebook.com/about/privacy.

7.2.5. We can use Page Insights to anonymously evaluate reach, page views, time spent on video posts, actions (likes, comments, sharing posts), and by age, gender, and location (as indicated by users in their respective Facebook (meta) profiles). In this context, settings can be made for the evaluation of the reach or corresponding filters can be set with regard to the selection of a time period, the consideration of a specific post as well as demographic groupings (e.g. female, 20-30 years old). This data is anonymized, aggregated and abstracted. These settings therefore do not allow us to draw conclusions about individuals. The evaluation serves to optimize the offer on our pages for the purpose of public relations. The
legal basis for this data processing is Art. 6 para. 1 lit. a and f GDPR.

7.2.6. We, as the provider of the information service, do not collect or process any other data from the use of the pages.

7.2.7. Irrespective of the rights against us, you have a right of appeal to the Irish Data Protection Commission (responsible for Meta Platforms Ireland Limited (Facebook Ireland Limited)), to (Art. 77 GDPR).

7.2.8. If you have specific questions about the protection of your data, please contact our Data Protection Officer or the Data Protection Officer of Meta Platforms Ireland Limited (Facebook Ireland Limited)) https://www.facebook.com/help/contact/540977946302970,

7.3. Use of our X channel

We use the technical platform and services of X X Corp. , 1355 Market Street, Suite 900, San Francisco, CA 94103 U.S.A. for the short message service offered here. Responsible for the data processing of persons living outside the United States is X X International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland.

We would like to point out that you use the X short messaging service offered here and its functions on your own responsibility. This applies in particular to the use of the interactive functions (e.g. sharing, rating).

7.3.1. Data processed by X:

Information about which data is processed by X and for what purposes it is used can be found in the privacy policy of X: https://X.com/de/privacyX.com/de/privacy

We have no influence on the type and scope of the data processed by X, the type of processing and use or the transfer of this data to third parties. We also have no effective control options in this respect.

By using X, your personal data will be processed by X Inc. in the United States, Ireland and any other country in which X Inc. does business, regardless of your place of residence.

X processes your voluntarily entered data such as name and user name, e-mail address, telephone number or the contacts in your address book when you upload or synchronize it.

On the other hand, X also analyzes the content you share to determine which topics you are interested in. Stores and processes confidential messages that you send directly to other users and can determine your location based on location data, wireless network information or your IP address in order to send you advertising or other content.

For evaluation purposes, X Inc. may use analysis tools such as X or Google Analytics. We have no influence on the use of such tools by X Inc. If tools of this kind are used by X Inc., we have neither commissioned, approved nor supported this in any other way. The data obtained from this analysis is also not made available to us. Only certain non-personal information about tweet activity, such as the number of profile or link clicks from a particular tweet, is visible in our account. We have no way of preventing or disabling the use of such tools on your X account.

Due to the fact that X Inc. is a non-European provider with a European branch only in Ireland, it is bound by European data protection regulations. This applies, for example, to your rights to information, blocking or deletion of data or the possibility of objecting to the use of usage data for advertising purposes.

You have the option of restricting the processing of your data in the general settings of your X account and under “Privacy and security”. On mobile devices (smartphones, tablet computers), you can also restrict X’s access to contact and calendar data, photos, location data, etc. in the settings options there. However, this depends on the operating system used.

Further information on these points is available on the following X support pages:

• https://support.X.com/articles/105576#X.com/articles/105576#
• https://help.X.com/de/search?q=datenschutzX.com/de/search?q=datenschutz

You can find out more about the possibility of viewing your own data at X here: https://support.X.com/articles/20172711#X.com/articles/20172711#

Information about the conclusions drawn about you by X can be found here: https://X.com/your_X_dataX.com/your_X_data

Information on the available personalization and data protection setting options can be found here (with further links):

• https://X.com/personalizationX.com/personalization

You also have the option of requesting information via the X data protection form or the archive requests:

• https://support.X.com/forms/privacyX.com/forms/privacy
• https://support.X.com/articles/20170320#X.com/articles/20170320#

We do not collect any data ourselves via your X account. However, the data you enter at X, in particular your user name and the content published under your account, will be processed by us to the extent that we may retweet your tweets or reply to them or write tweets from us that refer to your account. The data you freely publish and disseminate at X is thus included by us in our offer and made accessible to our followers.

Further information on X and other social networks and how you can protect your data can also be found at www.youngdata.de.

7.3.2. X utilization concept:

Our public relations work also takes place on X. With this usage concept, we assume responsibility for the use of social media as a non-public body. Please also note our privacy policy.

X is a social network for short messages, photos and videos. Registered users can publish short messages free of charge via this service. These tweets have a limited length and are generally visible to everyone.

Users can “follow” other users so that they can read their messages in their own X feed.

The advantages of X are its wide reach and – in contrast to some other social networks – its legibility without the need for the user to register, as well as its usability without the use of a real name.

You can find more information about X here: https://about.X.com/de.htmlX.com/de.html

7.3.3. Purpose of the use of X

The X channels are a useful addition to the existing communication channels, such as the website, press releases, print products and events. The X channels primarily inform users about the latest news from our business operations.

For some target groups, the “classic” instruments alone (print, website, mailing) were no longer sufficient. We found that with X we can reach a wide range of interested parties much more directly, quickly and on a daily basis, especially as interested recipients can subscribe to corresponding tweets. The X channel enables us to disseminate our messages far and wide, to network better with other institutions and sources of information and to react immediately to what is happening.

Furthermore, direct dialogue with readers enables us to obtain opinions and feedback in order to optimize our business activities.

7.3.4. Type and scope of use of X

We use our X account to inform users about news from our business operations.

7.3.5. Responsibilities for editorial/technical support:

Responsibility for editorial support lies with our management and the associated communications and media team.

7.3.6. Alternative information and contact options:

We would like to point out to users that the X channel is merely an additional option for contacting us or receiving information from us. Alternatively, the information offered via X can also be accessed via the corresponding links on our website or on the other linked websites. You can contact us with all inquiries. Please use the information provided above.

7.3.7. Self-commitment

We evaluate this usage concept once a year with regard to whether and how it is used. This evaluation of the usage concept takes into account the usage figures and ranges as well as the target group structure of the networks.

7.4. YouTube video usage

7.4.1. We have integrated YouTube videos into our online offer, which are stored on https://www.YouTube.com and can be played directly from our website.

7.4.2. With your consent, YouTube receives the information that you have accessed the corresponding subpage of our website by visiting the website. In addition, the data mentioned under No. 4.2 of this declaration are transmitted. This occurs regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be directly assigned to your account. If you do not want the assignment with your profile at YouTube, you must log out before activating the button. YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact YouTube to exercise this right.

7.4.3. We use YouTube with your consent in order to analyze and regularly improve the use of our website. We can use the statistics obtained to improve our offer and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US data privacy framework. The actual legal basis for the use of Google Analytics is Art. 6 para. 1 lit. a GDPR. In addition, in accordance with Art. 49 para. 1 GDPR, you consent to Google processing your data in the USA if necessary. In this case, it is possible that the transmitted data will be processed by local authorities.

7.4.4. For more information on the purpose and scope of data collection and its processing when you visit our YouTube channel directly, please refer to the privacy policy https://www.youtube.com/intl/ALL_de/howyoutubeworks/user-settings/privacy/. There you will also find further information about your rights and setting options to protect your privacy.

8 Google Maps map service

8.1. On this website, we use the offer of Google Maps with your consent. This allows us to show you interactive maps directly on the website and enables you to use the map function comfortably.

8.2. If you have consented, Google receives the information that you have accessed the corresponding sub-page of our website by visiting the website. In addition, the data mentioned under No. 4.2 of this statement will be transmitted. This occurs regardless of whether Google provides a user account through which you are logged in or whether no user account exists. If you are logged in to Google, your data will be directly assigned to your account. If you do not want the assignment with your profile at Google, you must log out before activating the button. Google stores your data as usage profiles and uses them for the purposes of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact Google to exercise this right.

8.3. For more information on the purpose and scope of data collection and processing by the plug-in provider, please refer to the provider’s privacy policy. There you will also find further information on your rights in this regard and setting options for protecting your privacy: https://www.google.de/intl/de/policies/privacy. Google also processes your personal data in the USA.

8.4. We use Google Maps with your consent in accordance with Section 25 (1) TTDSG and Art. 6 (1) (a) GDPR. For the exceptional cases in which personal data is transferred to the USA, Google has submitted to the EU-US data privacy framework. In addition, in accordance with Art. 49 para. 1 GDPR, you consent to Google processing your data in the USA if necessary. In this case, it is possible that the transmitted data will be processed by local authorities.

9 NEWSLETTER

9.1. Data used: Title, first name, last name, company, address, zip code, city, e-mail address.

9.2. We use the services of sendinblue for sending newsletters. The provider is Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin.

9.3. sendinblue is a service with which the sending of newsletters can be organized and analyzed. If you enter data for the purpose of receiving newsletters (e.g. e-mail address), this data is stored on sendinblue’s servers in Germany.

9.4. With the help of sendinblue, we can analyze our newsletter campaigns. When you open an email sent with sendinblue, a file contained in the email (so-called web beacon) connects to the servers of sendinblue. This makes it possible to determine whether a newsletter message has been opened and which links, if any, have been clicked on. In addition, technical information is recorded (e.g. time of retrieval, IP address, browser type and operating system). This information cannot be assigned to the respective newsletter recipient. It is used exclusively for the statistical analysis of newsletter campaigns. The results of these analyses can be used to better adapt future newsletters to the interests of the recipients.

9.5. If you do not want any analysis, you must unsubscribe from the newsletter. For this purpose, we provide a corresponding link in each newsletter message. Furthermore, you can also unsubscribe directly on the website under Newsletter Unsubscribe, by e-mail to support@railMybox.de or by sending a message to the contact details provided in the imprint.

9.6. The data processing is based on your consent (Art. 6 para. 1 lit. a GDPR and § 7 UWG). You can revoke this consent at any time by unsubscribing from the newsletter. The legality of the data processing operations already carried out remains unaffected by the revocation.

9.7. For more details, please see sendinblue’s privacy policy at: https://de.sendinblue.com/datenschutz-uebersicht/.

10 DURATION OF THE PROCESSING

10.1. Your personal data will be deleted after expiry of the statutory retention periods, which result, for example, from the German Civil Code (BGB), the German Commercial Code (HGB) and the German Fiscal Code (AO). If data is not affected by this, it will be deleted when the respective processing purpose has been achieved.