PRIVACY NOTICE
We are an innovative and dynamic company on a mission to simplify sustainable mobility internationally. Our application offers a user friendly ticketing solution for travellers, transport authorities and public transport operators.
We invite you to read our privacy notice below to learn more on how we are committed to respect your privacy and protect your personal data.
Data Controller
FAIRTIQ Ltd.
Aarbergergasse 29
3011 Bern
Switzerland
CEO: Dr. Gian-Mattia Schucan, Anne Mellano
UID: CHE-370.720.489
Data Protection Officer
FAIRTIQ Ltd
Data Protection
Aarbergergasse 29
3011 Bern
Switzerland
FAIRTIQ is the operator and controller in connection with the FAIRTIQ App («application») and processes personal data in accordance with
● the Federal Act on Data Protection (FADP) and the Ordinance to the Federal Act on Data Protection (DPO), if the customer obtains services from FAIRTIQ in Switzerland;
● the EU General Data Protection Regulation 2016/679 (GDPR), including the applicable data protection legislation of the EU member states, if the customer obtains services in the European Union or the European Economic Area; and
● other applicable privacy legislation, if the customer obtains services outside the European Union or Switzerland.
When purchasing tickets for fellow passengers in accordance with section III A 2 of the General Terms and Conditions, the customer acts as a controller according to Art. 5 lit. j FADP/Art. 28 GDPR and FAIRTIQ takes on the role of the processor.
Within the framework of ‘Service Après Vente‘ and the clarification and control of abuse, FAIRTIQ and the partner companies / partnering tariff communities are independently responsible controllers (see section I. Data Transfer). In exceptional cases, a joint controllership responsibility applies, which is indicated accordingly in the application.
General information about the customer
● First and last name, date of birth according to the applicable tariff regulations;
● Mobile phone number;
● Email address (mandatory depending on the applicable law and tariff regulations and if a purchase receipt is needed, voluntary in all other cases);
● Ticket settings: chosen class and discount level;
● Deposited zone subscriptions or discount authorisations (optional);
● User ID;
● IP-address and device ID;
● Information on abusive or other fraudulent behaviour;
● Interactions with customer care.
Details of fellow travellers in accordance with GTC, section III. A. 2.
● First and last name, date of birth;
● Settings for the selected / registered tickets, deposited zone subscriptions and discount authorisations.
Means of payment data
● Payment method;
● Partially anonymized payment method details.
Travel data
● Tracing and activity data (based on a motion sensor, if active);
● Registered electronic tickets (ticket data);
● Bluetooth beacon signals;
● Calculated journey.
The recording of travel data starts with opening the application and ends at the latest 5 minutes after the check-out process has been completed. The completion of the check-out process is signalled in the application.
Purchase data
● Purchased products;
● Charged amount;
● Date and time;
● Payment ID and token.
Information about the device
● Device: brand and model;
● Operating system;
● Battery level.
Usage data
Data may be collected about how customers interact with the services. This includes data such as the date and time of access, app functions or pages accessed, app crashes and other system activity, and browser type.
FAIRTIQ exclusively collects and processes data in connection with the application and the purchase of electronic tickets.
Personal data transferred by the customer to FAIRTIQ via the application are processed by FAIRTIQ for the following purposes:
● To provide electronic ticketing applications, in particular the purchase and processing of electronic tickets, the identification and payment of decisive rides, including customer coupons (e.g., FAIRTIQ bonus), for customer service (help desk) and functions serving to support the check-out process. Furthermore, the data is also processed to combat abuses (prevention from and investigation of unlawfully obtained journeys).
● To capture the nearest public transport stop before check-in, location data and Bluetooth signals are collected when the application is active in the foreground of the device display. This data is stored in temporary log files. Bluetooth signal detection is only enabled in selected regions. Further information is available at https://fairtiq.com/docs/beacon_signals.pdf. A delayed shutdown of the collection of activity and location data (see above, section D. Processed personal data) serves combating abuse and the continuous improvement of the functions used to support the check-out process, thus optimising the services provided by FAIRTIQ to the customer. The completion of the check-out process is signalled in the application.
● For the provision of discounted rides, i.e. the generation of an individual code for a free journey of a new customer.
● For the further development of the application and the services. In particular, FAIRTIQ may use the location and activity data in pseudonymised form for 12 months (see section K. Data retention period) in order to further develop the application. The data collected after the check-out process (see section D. Processed personal data > Travel data) is only processed in anonymized form for this purpose.
● For the means of communication with the customer and commercial purposes.
● In relation to legal proceedings and requirements.
● For research purposes (academia), in particular for non-personal scientific research purposes (see section I Data transfer).
The customer has the right to object to the use of personal data for the purposes of optimising the application and the services or evaluating its use. FAIRTIQ strongly advises to send the request directly via the application (menu item ‘Contact > Others’).
In the case of requests via email (feedback@fairtiq.com) or contact form (https://fairtiq.ch/en/contact), the processing of the request is subject to the unambiguous identification of the customer by means of an SMS validation code (identification process initiated by FAIRTIQ). Fellow travellers are encouraged to inform FAIRTIQ of any request via the customer in order to enable identification.
The processing of personal data for electronic tickets and the provision of discounted travel is required to fulfil the services of FAIRTIQ (performance of a contract). The further development of the service and the utilisation analysis are in the legitimate interest of FAIRTIQ and serve the optimisation of the user experience and the dissemination of the application. The provision of data to academia is in the legitimate interest of FAIRTIQ and in the public interest (Art. 6 para. 1 lit. e GDPR) with regard to the data processing by academic institutions. Fraud detection and prevention is in the legitimate interest of FAIRTIQ. Communication with the customer serves to support the customer's use, to inform the customer about services in relation to the application and to improve the offer and serves the performance of a contract and/or is in the legitimate interest of FAIRTIQ. Sending newsletters and the related processing of data are based on the customer’s consent.
We are subject to a variety of legal obligations. Primarily, these are legal requirements (e.g. commercial and tax laws, regulations), but also regulatory or other official requirements where applicable. The purposes of processing may include identity and age verification, fraud and money laundering prevention, the prevention, combating and investigation of terrorist financing and criminal offences endangering assets, the fulfilment of control and reporting obligations under tax law, as well as the archiving of data for the purposes of data protection and data security as well as auditing by tax and other authorities. In addition, the disclosure of personal data may become necessary in the context of official/court measures for the purposes of gathering evidence, criminal prosecution or the enforcement of civil law claims.
The legal basis for the processing of personal data of customers within the European Union is Art. 6 para. 1 a), b), c), f) GDPR.
In order to detect and prevent fraudulent behaviour, we are using automated decision-making processes and profiling mechanisms. Examples:
● The system checks whether the means of transport is in motion when check-in and check-out are performed to ensure that the complete journey is recorded and charged. If the system detects incorrect behaviour multiple times, the account is automatically blocked.
● If a past journey cannot be charged to the deposited means of payment, the check-in will automatically be blocked until the journey can be charged.
FAIRTIQ may use automated decision-making processes as part of its customer service. This is done to answer standard enquiries promptly. The system generates the answers based on the content of the customer service enquiries.
Affected persons have the right
● to request the intervention of a natural person in the decision-making process;
● to express their own point of view;
● to have the decision reviewed or challenged outside of the legal process.
FAIRTIQ strongly advises to send the request directly via the application (menu item ‘Contact > Others’).
In the case of requests via email (feedback@fairtiq.com) or contact form (https://fairtiq.ch/en/contact), the processing of the request is subject to the unambiguous identification of the customer by means of an SMS validation code (identification process initiated by FAIRTIQ).
FAIRTIQ protects personal data against foreseeable risks and unauthorised access with suitable technical and organisational measures. FAIRTIQ minimises the use of personal data.
For security reasons, the data for the means of payment are stored only at the service provider of the payment service and not on the mobile phone of the customer. Furthermore, the registration of the means of payment takes place directly with the contractual payment partner of FAIRTIQ without the intervention of FAIRTIQ.
To service providers of FAIRTIQ: Subprocessors commissioned by FAIRTIQ for the tasks specified in section E. Processing purposes and modalities process the personal data of the customers (including storage). FAIRTIQ has entered into data processing agreements with these service providers to ensure the protection of personal data. A list of subprocessors is available at https://fairtiq.com/docs/subprocessor_list.pdf
To payment providers: Information about the mode of payment is not recorded on the mobile phone, in the application, with FAIRTIQ or any partner association (see section D. Processed personal data for exceptions). The registration of the means of payment in connection with the application is directly arranged by the payment provider (Datatrans AG, Stadelhoferstrasse 33, 8001 Zurich, Switzerland, info@datatrans.ch and Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, the Netherlands, dpo@adyen.com. Further information on data processing by Adyen is available at https://www.adyen.com/policies-and-disclaimer/privacy-policy
To NOVA: If the application is used to purchase a ticket within the GA travelcard validity area (Switzerland, Liechtenstein and the border belt) and the Swisspass / Swisspass ID is registered in the application, the calculated travel route including time stamps will be forwarded to the public transport sales and distribution platform NOVA in personalised form (using Swisspass ID, which enables a link to purchases via other digital public transport sales platforms). NOVA is operated by Swiss Federal Railways SBB on behalf of Alliance Swisspass. SBB may use the clients’ personal data for its own purposes (e.g. to combat misuse). Information on the processing of personal data by SBB can be found at https://www.sbb.ch/en/meta/legallines/data-protection.html.
FAIRTIQ and SBB AG, Hilfikerstr. 1, 3000 Bern 65, Switzerland act as independent controllers within the meaning of Art. 5 lit. j FADP / Art. 4 para. 7 GDPR. FAIRTIQ has no influence on and bears no responsibility for data processing by SBB.
To Google Pay and Apple Pay: On the application, the option to pay with Google Pay or Apple Pay is offered depending on the region of use. This is performed via the payment provider Adyen.
For the purpose of payment processing, the customer deposits the required payment data with Google Pay or Apple Pay. FAIRTIQ only stores an ID created by the payment provider and a token to process future payments.
The provision of the payment data is necessary and mandatory for the conclusion or execution of the contract. If the payment data is not provided, a conclusion of the contract and / or the execution by means of Google Pay or Apple Pay is impossible. The data required for payment processing are transmitted securely via the "SSL" procedure and processed exclusively for payment processing.
The data accruing in this context will be deleted after the storage is no longer necessary or the processing will be restricted if there are legal obligations to retain data. FAIRTIQ is obliged to store the payment and order data for a period of up to ten years due to mandatory commercial and tax regulations.
When using Google Pay or Apple Pay, data may also be processed in the USA. In the opinion of the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. A transfer may therefore be associated with various risks for the legality and security of the data processing.
Further information on data processing by Apple Pay is available at https://support.apple.com/en-ie/HT203027
Further information on data processing by Google Pay is available at https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en
To partners: FAIRTIQ forwards the required personal data to the allied transportation company / tariff community to fulfil the customer care, to combat abuse, and to communicate with customers (see the ‘Partner Companies’ on fairtiq.com). In this context, the relevant partner companies are independently responsible for the personal data processing.
FAIRTIQ forwards ticket data to partners for the purpose of payment and accounting. Furthermore, FAIRTIQ forwards location data in an anonymised form to partners for improving their products and their public transport offer, for the partially personalised communication of information and offers as well as for further statistical evaluation purposes.
Information in accordance with art. 13 para 1 & 2 GDPR related to the processing of personal data by partners, in case of a transfer to partners acting as independent controllers, is available on the partners’ website. A list of partners per region is available at https://fairtiq.com/docs/fairtiq_Privacy_principles_annex_1.pdf
For research purposes (academia): FAIRTIQ is entitled to disclose pseudonymised personal data to universities from Switzerland, the EU or the EEA for non-personal scientific research purposes under the following conditions:
A. FAIRTIQ shall take measures to prevent the identifiability of the data subjects by pseudonymization.
B. The results of the research may only be published or otherwise passed on if no conclusions can be drawn about the data subjects.
The customer has the right to object against the disclosure of their data for research purposes at any time and without any disadvantage (please consult section P. Right of Objection for further information).
FAIRTIQ is entitled to contact the customer concerning topics affecting FAIRTIQ. This includes:
● Information in connection with the offer or about its amendment
● Information to help customers use the app
● Surveys on the use of FAIRTIQ. Participation in surveys is voluntary.
If the customer has given consent, FAIRTIQ is allowed to contact the customer concerning further offers and information not necessarily related to FAIRTIQ. The customer can revoke the consent at any time.
Depending on the type of contact, the messages may contain tracking pixels that enable a log file recording for the statistical evaluation of the contact. FAIRTIQ can see if and when a message has been opened and which links in the message have been activated.
The customer can unsubscribe from being contacted by writing FAIRTIQ at app.privacy@fairtiq.com or following the unsubscription link or the instructions in each message that FAIRTIQ sends to the customer.
The travel, purchase and means of payment data and the information about the device in accordance with Section D. Processed personal data shall be retained for 12 months after the end of the journey for fulfilling the services, for after-sales services of FAIRTIQ and the partner transportation companies and tariff communities, for the purpose of combating abuse and for improving the services, in particular the price optimisation. Subsequently, deletion/anonymisation of this data is performed and the connection to a data subject is no longer possible.
The general information about the customer and details of fellow travellers shall be retained for the purpose of combating abuse, for the means of communication with the user and for commercial purposes for two years from the last journey or from joining a campaign (depending on what occurs later).
The data can also be saved in backup files and temporary databases (caches) after deletion. The final deletion takes place when the backup files are overwritten (typically within days).
Location data collected to capture the nearest public transport stop before check-in shall be retained in temporary files for a few days.
Data which is relevant under tax law and for accounting purposes of FAIRTIQ or the partner companies shall be retained by FAIRTIQ and/or the partner companies in accordance with the legally prescribed retention periods (usually 10 years plus duration of the current accounting year) and subsequently deleted.
If the customer has been excluded from using FAIRTIQ due to a justified suspicion of misuse, FAIRTIQ has the right to store the personal data in accordance with section D. Processed personal data in order to prevent repeated misuse and to enforce their legal claims, including the date and reason for the exclusion, even against the customer's deletion request until the rights have been exercised or the limitation period has expired. If the exclusion is reversed (e.g., because the suspicion of abuse turns out to be unfounded), the retention period of 12 months until the anonymisation of the travel data starts anew.
In the case of outstanding invoices, FAIRTIQ has the right to retain personal data according to section D. Processed personal data until the invoice and any additional claims have been fully settled or the limitation period has expired.
If the customer does not purchase a ticket with the application during the period of one year at a time, FAIRTIQ has the right to delete the customers’ user account. The customer must then repeat the registration process before they can use FAIRTIQ to purchase electronic tickets again. With the deletion of the user account, they also lose access to their travel and payment history with FAIRTIQ.
If the customer does not purchase a ticket with the application within four months, FAIRTIQ has the right to delete the customer's payment method data. The customer must then repeat the registration of a valid means of payment before being able to purchase electronic tickets with FAIRTIQ again.
Subject to the foregoing storage provision and if FAIRTIQ or a partner company does not require the data to safeguard and exercise their rights, provided that the data is no longer necessary for the purposes for which it was collected or otherwise processed, or provided that there are no overriding legitimate grounds for processing, the customer has the right to request the deletion of their personal data at any time.
FAIRTIQ strongly advises to send the request directly via the application (menu item ‘Contact > Account deletion‘).
With the request for deletion, the customer expressly waives the right to use customer service with regard to past trips and to complain about any trips affected by the request.
In the case of deletion requests via email (feedback@fairtiq.com) or contact form (https://fairtiq.ch/en/contact), the deletion is subject to the unambiguous identification of the customer by means of an SMS validation code (identification process initiated by FAIRTIQ).
Deletion requests for fellow passengers’ personal data shall be submitted by the customer to enable the identification of the fellow passengers.
The customer has the right to correct and limit the data stored for the respective customer account, if the data is faulty or a limitation does not affect the processing purposes. The customer can adjust the general account information according to section D. Processed personal data directly in the app.
Modifications are not possible during an ongoing journey.
The customer and fellow passengers have the right to request information about the data stored on the customer’s account and its transmission.
FAIRTIQ strongly advises to send the request directly via the application (menu item ‘Contact > Others’).
In the case of deletion requests via email (feedback@fairtiq.com) or contact form (https://fairtiq.ch/en/contact), the processing of the request is subject to the unambiguous identification of the customer by means of an SMS validation code (identification process initiated by FAIRTIQ).
Deletion requests for fellow passengers’ personal data shall be submitted by the customer to enable the identification of the fellow passengers.
The customer has the right to object at any time to the processing of personal data concerning them for reasons arising from their particular situation, if the data processing is carried out on the basis of art. 6 para. 1 lit. f GDPR. This also applies to profiling and automated decision making based on these provisions. If the customer objects, FAIRTIQ will no longer process their personal data unless compelling legitimate grounds for the processing can be demonstrated which override the interests, rights and freedoms of the customer, or the processing serves to assert, exercise or defend legal claims.
If the customer's personal data are processed for the purpose of direct marketing, the customer shall have the right to object at any time to the processing of personal data concerning them for the purpose of such marketing; this shall also apply to profiling insofar as it is related to such direct marketing. If the customer objects, their personal data will subsequently no longer be used for the purpose of direct advertising.
FAIRTIQ strongly advises to send the request directly via the application (menu item ‘Contact > Others’).
In the case of deletion requests via email (feedback@fairtiq.com) or contact form (https://fairtiq.ch/en/contact), the deletion is subject to the unambiguous identification of the customer by means of an SMS validation code (identification process initiated by FAIRTIQ).
Deletion requests for fellow passengers’ personal data shall be submitted by the customer to enable the identification of the fellow passengers.
Data subject rights are not absolute and may be subject to exemptions or derogations under applicable data protection laws.
The customer further has the right to lodge a complaint with the competent supervisory authority, as follows:
● in Switzerland, with Swiss Federal Data Protection and Information Commissioner (FDPIC);
● In the EU, with the competent authority of the member state relevant for the data subject.
Personal Data is processed in the EEA, Switzerland or any other country for which an adequacy decision has been issued by the European Commission respectively which are listed in Annex 1 of the General Data Protection Regulation (GDPR) (in particular the USA).
If FAIRTIQ transfers data to a country without adequate data protection level, FAIRTIQ will, as provided for by law, use appropriate contracts (namely on the basis of the so-called Standard Contract Clauses of the European Commission) and appropriate or suitable safeguards (available on request via app.privacy@fairtiq.com) and / or rely on the statutory exceptions of consent, contract execution, the establishment, exercise or enforcement of legal claims, overriding public interests, published personal data or because it is necessary to protect the integrity of the persons concerned.
Details are available at https://fairtiq.com/docs/subprocessor_list.pdf
In case of questions or uncertainties about data protection, FAIRTIQ’s data protection representation in the EU is available for interested parties at the following address. FAIRTIQ Austria GmbH, Data Protection, Straubingerstraße 12, 5020 Salzburg, Austria, app.privacy@fairtiq.com
FAIRTIQ regularly checks this data protection notice. To be informed about the latest version, it is recommended to check it regularly via https://fairtiq.com/de-de/politik/app-privacy.
The current version of the data protection declaration can be viewed and printed at https://fairtiq.com/en-ch/policy/app-privacy-policy