Privacy policy – Basler Verkehrs-Betriebe

1. Privacy Policy

This Privacy Policy applies to Basler Verkehrs-Betriebe (BVB) as well as to companies commissioned by BVB that process personal data.

The security of your data and the associated data protection in compliance with legal requirements are of great importance to BVB—for this reason, the following information explains what personal data BVB processes about you, why this data is needed, and how you can object to the collection of your data.

Personal data (hereinafter also referred to as “data”) refers to all information relating to identified or identifiable natural persons, such as name, address, gender, age, etc.

“Processing” refers to any handling of personal data, such as collection, storage, use, deletion, etc. Processing takes place only to the extent that it is necessary and there is a legal basis for it. This legal basis may arise, for example, from contractual or statutory provisions, an overriding interest, or your explicit consent.

2. Customer Pledge

Public transportation companies handle your data with the utmost trust. Protecting your personal information and privacy is a top priority for us, the public transportation companies. We guarantee that your personal data will be processed in compliance with the law, in accordance with the applicable provisions of data protection law.

Public transportation companies set an example for the trustworthy handling of your data by adhering to the following principles:

You decide for yourself how your personal data is processed.

Within the legal framework, you may object to data processing at any time, revoke your consent, or request that your data be deleted. You always have the option to travel anonymously, that is, without your personal data being collected.

We offer you added value through the processing of your data.

Public transportation companies use your personal data to offer you added value throughout the mobility chain (e.g., tailored offers and information, assistance, or compensation in the event of service disruptions). Your data is therefore used solely for the development, provision, optimization, and evaluation of our services or for maintaining customer relationships.

Your data will not be sold.

Your data will only be disclosed to selected third parties listed in this Privacy Policy and only for the purposes explicitly stated. If we engage third parties to process data, they are required to comply with our data protection standards.

We guarantee the security and protection of your data.

Public transportation companies guarantee the careful handling of customer data as well as the security and protection of your data. We ensure that the necessary organizational and technical measures are in place to this end.

Below you will find detailed information on how we handle your data.

3. Responsibility for Data Processing

The data controller within the meaning of data protection laws is BVB. For data protection-related matters, the BVB’s Data Protection Officer is available to assist you—either by email (datenschutz@bvb.ch) or by mail:

Basler Verkehrs-Betriebe
Data Protection Officer
Claragraben 55
4005 Basel

4. In Which Cases Can Data Be Processed?

Data may be processed

When purchasing services: For contractual reasons, we require personal information for online orders or the purchase of certain services and products in order to provide our services and fulfill the contractual relationship. For example, when purchasing a monthly pass, a single-ride ticket, a guided tour, etc. (see Section 5);
when contacting BVB employees, such as customer service, fare inspectors, the complaints office, etc. (see Section 6);
when using BVB websites or apps (see Section 7)

5. Processing in Connection with the Purchase of a Product

Depending on the product or service purchased, the following data, among others, may be processed:

Name, date of birth, gender (required information)
Mailing address, email address (required information)
Customer number
Date of purchase and travel or period of validity
Price and payment details

The required information (additional information) necessary for the purchase of the respective product or service is marked on the respective order form, for example with an * or the label “Required Information.” By placing an order or purchasing a product, you grant BVB consent to process the personal data (required information) necessary for contract fulfillment.

To administer the contractual relationship, data regarding the services you have purchased (“Service Data”) may also be collected. Depending on the product or service, this includes the following information:

Type of product or service purchased
Price
Location, date, and time of purchase
Purchase channel (Internet, vending machine, counter, etc.)
Travel date or validity period and departure time
Point of departure and destination

Data generated when purchasing services is stored in a central database (see the section on joint responsibility in public transportation) and is also processed for other purposes (for more details, see the relevant sections of this Privacy Policy).

In addition, the data is used during ticket inspections to identify the holder of a personalized ticket and to prevent misuse (for more details, see the section “During Service Inspections” and the section on joint responsibility in public transportation).

The data is used to fairly distribute the revenue generated from the sale of tickets among the companies and associations of the National Direct Transport network.

Our legitimate interest serves as the legal basis for the data processing described above.

6. Contact with BVB Employees

You can contact BVB employees in person, by phone, or electronically.

When interacting with BVB employees in person—for example, at the BVB Customer Service Center, during ticket inspections, or when processing claims (e.g., traffic accidents)—it may be necessary to process the following personal data:

Name, date of birth, gender (required information)
Mailing address, contact information (required information)

Depending on the incident, you may be required to provide additional information, such as insurance details, accident reports, etc.; in such cases, you will be notified in advance that your request cannot be processed without the necessary information.

You also have the option of contacting BVB via an online form. In this case, the entry of certain personal data is mandatory (marked as required on the respective form). We use this information and any additional data you voluntarily provide (such as title, address, phone number, and company name) solely to respond to your inquiry in the best possible and personalized manner. The following personal data must be provided:

Last name and first name
Email address

By providing this and any other voluntarily submitted or entered (required) data, you grant BVB your consent to process the personal data necessary to provide a personalized response to your contact request. This data will not be used for any other purpose, or only with your prior consent.

Our legitimate interest serves as the legal basis for the data processing described above.

If you contact BVB by phone, your call may be recorded for training purposes. You may be notified of the call recording at the beginning of the call. Any recordings will be deleted after six months.

7. Creating a SwissPass Login/Customer Account on www.swisspass.ch

You have the option to create a customer account on swisspass.ch. To do so, the following information is required:

Last name and first name
Date of birth
Address (street, ZIP code, city, and country)
Customer number (if you already have a public transit pass)
Email address and password (login credentials)

Registration allows you to use your login credentials (known as the SwissPass login) to access the numerous online services (webshops and apps) offered by public transportation companies and networks and to use these services without having to go through a separate, time-consuming registration process each time. Services you purchase using the SwissPass login (particularly public transportation tickets and passes) are recorded in your customer account and in a central database (“NDV database”). This data processing is necessary for the fulfillment of the contract governing the use of SwissPass and is therefore based on this legal basis. For more information, please refer to the sections on joint responsibility in public transportation and on disclosure to third parties in this Privacy Policy, as well as in the Privacy Policy on swisspass.ch.

8. Data Processing When Using BVB Websites and Apps

In general, you can visit our websites without having to provide any personal information. When you visit our websites and app, our servers temporarily log each visit in a log file. The following technical data is collected and stored by us until it is automatically deleted after no later than seven months:

IP address of the requesting computer
Date and time of access
Website from which the access originated, including the search term used, if applicable
Name and URL of the file accessed
Search queries performed (timetable, general search function on the website, products, etc.)
Your computer’s operating system (provided by the user agent)
Browser you are using (provided by the user agent)
Device type in the case of access via mobile phones
Communication protocol used

The collection and processing of this data serve to ensure system security and stability, to analyze errors and performance, and for internal statistical purposes, and enable us to optimize our website.

The IP address is evaluated together with other data in the event of attacks on the network infrastructure or other unauthorized or abusive use of the website for the purposes of investigation and defense, and may be used in the context of criminal proceedings to identify the users in question and to take civil and criminal action against them.

Finally, when you visit our website, we use cookies as well as applications and tools that rely on cookies. Further details can be found in Section 8 of this Privacy Policy.

When using the “Basel & Regio” app, the data mentioned above is processed as follows:

Personal data and purchased tickets are stored exclusively in our systems.
To enable location-based schedule information, anonymous location data is sent to our scheduling systems. This location data is not stored. If you wish to prevent the transmission of location data, please disable the GPS function on your device.

Our app is also linked to the “TNW Tickets” app from BLT. BLT’s privacy policy is available on their website at www.blt.ch.

Our legitimate interest serves as the legal basis for the data processing described above.

We do not guarantee compliance with data protection regulations for third-party websites linked to from the BVB website.

8.1 Cookies

In certain cases, we use cookies. Cookies are small files that are stored on your computer or mobile device when you visit or use one of our websites. Cookies store certain settings and data regarding your interaction with the website through your browser. When a cookie is activated, it may be assigned an identification number that identifies your browser and allows the information contained in the cookie to be used. You can configure your browser to display a warning on the screen before a cookie is stored, or to prevent cookies from our website from being used, which means you will forgo the benefits of personalized cookies. In this case, certain services may not be available. We use cookies to analyze general user behavior. The goal is to optimize our digital platforms. We aim to make them easier to use and the content more intuitive to find. We want to ensure they are organized and structured in a way that is easier to understand. It is important to us to design our digital platforms to be user-friendly and tailored to your needs. This allows us to optimize the website by providing targeted content or information that may be of interest to you.

Most web browsers automatically accept cookies. However, you can configure your browser so that no cookies are stored on your computer or so that a notification always appears when you receive a new cookie. On the following pages, you will find instructions on how to configure cookie settings:

Google Chrome for Desktop
Google Chrome for Mobile
Microsoft Windows Internet Explorer
Apple Safari for Mobile

Disabling cookies may prevent you from using all features of our website. Our legitimate interest serves as the legal basis for the data processing described above.

8.2 Tracking Tools

To tailor the design of our websites, apps, and emails to user needs and to continuously optimize them, we use the web analytics services provided by Siteimprove and Google Analytics. Our legitimate interest serves as the legal basis for the data processing described below.

In connection with our websites, pseudonymized usage profiles are created and small text files (“cookies”) stored on your computer are used.

The information generated by cookies regarding your use of this website is transmitted to the servers of the providers of these services, stored there, and processed on our behalf. In addition to the data listed above (see “Data Processing When Using BVB Websites and Apps”), we thereby receive the following information:

The navigation path a visitor takes on the website
Time spent on the website or a subpage
The subpage from which the visitor leaves the website
Country, region, or city from which the website is accessed
Device (type, version, color depth, resolution, width, and height of the browser window)
Returning or new visitor

This information is used to analyze website usage.

Below, you can learn more about our most important tracking tools:

8.2.1 Google Analytics

Google Analytics is provided by Google Inc., a subsidiary of the holding company Alphabet Inc., headquartered in the United States. Google Analytics uses methods—such as cookies—that enable the analysis of website usage. The information generated by a cookie regarding your use of this website, as described above, is transmitted to and stored on servers operated by Google, a subsidiary of the holding company Alphabet Inc., in the United States. However, by enabling IP anonymization (“anonymizeIP”) on this website, your IP address is truncated within the member states of the European Union or in other signatory states to the Agreement on the European Economic Area, or in Switzerland, prior to transmission.

The anonymized IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. According to Google Inc., the IP address is never associated with other data relating to the user.

Further information about the web analytics service used can be found on the Google Analytics website.

Instructions on how to prevent the web analytics service from processing your data can be found here.

8.3 Social Plugins

Our website does not use social plugins. If you visit a webpage that contains such a plugin, your browser establishes a direct connection to the servers of the respective social network as soon as you access that webpage. The content of the plugin is transmitted directly from the social network to your browser and integrated into the webpage by your browser. If you are logged in to the social network at the same time, the provider can associate your visit with your profile. If you interact with the plugins, the relevant information is transmitted directly from your browser to the provider and stored there.

The social network provider may use this information for advertising, market research, and to tailor its offerings to your needs. To this end, usage, interest, and relationship profiles may be created—for example, to evaluate your use of our website in relation to the advertisements displayed to you on the social network, to inform other users about your activities on our website, and to provide other services associated with the use of the social network.

If you do not want the social network provider to associate the data collected via our website with your user account, you must log out of the social network before activating the plug-ins.

8.4 Apps

When using the “BVB Basel & Regio” app, the following data is processed as described below:

Personal data and purchased tickets are stored exclusively in our systems.

To enable location-based schedule information, anonymous location data is sent to our scheduling systems. This location data is not stored. If you wish to prevent the transmission of location data, disable the GPS function on your device.

Our app is also linked to BLT’s “TNW Tickets” app. BLT’s privacy policy is available on their website at www.blt.ch.

8.5 Push Notifications in Apps

We use push notifications in the “Basel & Regio” app to inform you about events that may require your special attention or a response from you.

After downloading the app, your mobile device registers with the corresponding push service. The service then sends the registration ID or token to the registered device. The registration ID or token is sent by the app to the server and stored there in a database. When a push notification is to be sent, the server sends the desired message along with the registration ID or token to the push service, which forwards the push notification to the respective devices.

You can choose whether or not to receive push notifications when you first set up the app. You can turn off push notifications at any time.

9. Retention Period for Personal Data

Personal data is deleted as soon as it is no longer necessary to fulfill the purpose for which it was collected. Contract data is retained only for as long as required by statutory retention obligations. Retention obligations that require us to retain data arise from accounting regulations and tax laws. If legal or practical obstacles prevent deletion, the personal data will be blocked instead of deleted. This means that the data may then only be used to fulfill our retention obligations.

10. Rights Regarding Personal Data

The following rights apply to personal data processed by BVB:

Right to access stored personal data
Right to correct or supplement personal data
Right to restrict (block) or delete personal data
Right to object to the use of data for marketing purposes
Right to withdraw consent
Right to data portability

The BVB Data Protection Officer is responsible for ensuring these rights are exercised:

Basler Verkehrs-Betriebe
Data Protection Officer
Claragraben 55
4005 Basel

Email: datenschutz@bvb.ch

Data subjects whose personal data we process have the right to file a complaint with a competent supervisory authority. The supervisory authority for data protection in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).

11. Joint Responsibility in General and in Public Transportation in Particular

BVB is responsible for processing your data. As a company and a member of the Northwest Switzerland Fare Network (TNW), we are legally obligated to provide certain transportation services in cooperation with other transportation companies and networks (“Direct Traffic”).

For this purpose and for other purposes described in this Privacy Policy, data is shared at the national level within the so-called National Direct Service (NDV), an association of over 240 public transportation companies (TU) and networks. The individual TCs and associations are listed at this link. Data from the purchase of services and contact requests is stored in a central database managed by SBB on behalf of the NDV, for which we are jointly responsible with the other companies and associations of the NDV (“DV Database”).

For services you purchase using the SwissPass login, the data is then stored in another central database (“SwissPass database”), for which we are jointly responsible with the transport companies (TU) and the NDV consortia, with the database itself being managed by SBB on behalf of the NDV. To ensure efficient service delivery and collaboration among the parties involved, data from the various databases may be consolidated as needed. To enable you to use “single sign-on” (SSO)—a single login for all applications that offer access to their services via the SwissPass login—the aforementioned login, card, customer, and service data are also exchanged between the SwissPass central login infrastructure and us as part of the authentication process.

The scope of access to the shared databases by individual universities of technology and consortia is governed and limited by a joint agreement. The sharing of data through central storage and its processing by the other universities of technology and consortia within the NDV is generally limited to contract fulfillment, ticket inspection, after-sales service, and revenue distribution. In addition, the data collected when purchasing NDV services [Link to: in progress] is also processed for marketing purposes in certain cases. This includes analyzing the data to further develop and promote public transportation services in a way that meets user needs. If data is processed or contact is made with you for this purpose, this is generally carried out only by the specific transit authority (TU) or network from which you purchased the relevant NDV service. Processing or contact by the other transport companies and networks participating in the NDV occurs only in exceptional cases and under strict guidelines, and only if the analysis of the data indicates that a specific public transportation offer could provide added value for you as a customer.

On behalf of the NDV, SBB manages the marketing mandate for the NDV’s services (e.g., GA and Halbtax) and may contact you regularly in this capacity.

Our legitimate interest serves as the legal basis for the data processing described here.

12. Disclosure of Data to Third Parties

We do not sell your data. Data is disclosed exclusively within the limits permitted by law. Therefore, personal data may be disclosed to third parties if necessary for contract fulfillment, as part of administrative measures, due to legal requirements, or as a result of official orders. Your personal data will then be disclosed only to selected service providers and only to the extent necessary to provide the service. These include IT support service providers, issuers of subscription cards, shipping service providers (such as Swiss Post), service providers tasked with allocating transit revenue among the participating transportation companies (particularly in connection with the creation of so-called allocation keys as defined by the Swiss Passenger Transport Act), our hosting provider (see the section “Use of the Website”), and the providers listed in the sections on tracking tools.

Personal data may therefore also be disclosed to third parties abroad. These third parties are obligated to comply with data protection regulations to the same extent as the BVB.

If the level of data protection in a country does not meet Swiss standards, contractual measures will ensure that the protection of personal data is at least equivalent to that in Switzerland.

In addition, your data may be disclosed if we are legally required to do so or if it is necessary to protect our rights, in particular to enforce claims arising from our relationship with you.

If you book cross-border travel, your data will also be disclosed to the respective foreign providers. However, this disclosure is limited to the extent necessary to verify the validity of tickets and to prevent misuse.

Our legitimate interest serves as the legal basis for the data processing described here.

Your personal data will not be disclosed to other third parties outside the public transportation sector. The only exceptions (to the extent described below) are SwissPass partners and companies that have been authorized by public transportation companies, based on a contractual agreement, to act as intermediaries for public transportation services. These intermediaries will only have access to your personal data if you wish to purchase a public transportation service through them and have given them your consent to access your data. Even in this case, they are granted access to your data only to the extent necessary to determine whether you already have tickets or passes for the planned travel period that are relevant to your trip and the third-party service you have requested. The legal basis for this data processing is therefore your consent. You may revoke your consent at any time with future effect.

If you take advantage of offers from a SwissPass partner using your SwissPass, information about any services you may have purchased from us (e.g., a GA, Half-Fare, or regional travel pass) may be shared with the SwissPass partner to verify whether you are eligible for a specific offer from that partner (e.g., a discount for GA holders). In the event of loss, theft, misuse, forgery, or card replacement after purchasing a service, the relevant partner will be notified. This data processing is necessary for the fulfillment of the contract regarding the use of the SwissPass and is therefore based on this legal basis. For more information, please refer to the privacy policy on swisspass.ch as well as the privacy policy of the respective SwissPass partner.

13. Data Security

Appropriate technical and organizational security measures are taken to protect the personal data stored by BVB against manipulation, partial or complete loss, and unauthorized access by third parties. These measures are continuously improved in line with technological developments.

We also take internal data protection very seriously. Our employees and the external service providers we engage have committed to maintaining confidentiality and complying with data protection regulations. We take appropriate measures to protect your data. However, the transmission of information via the Internet and other electronic means always carries certain security risks, which is why BVB cannot guarantee the security of information transmitted in this manner.

Electronic personal data is generally stored on servers in Switzerland or the EU. If data is to be stored in countries that provide adequate protection only under certain conditions or that do not provide sufficient protection, appropriate safeguards must be obtained in accordance with the applicable legal provisions.

14. Changes to This Privacy Policy

BVB reserves the right to freely amend and supplement this policy.

Last updated: February 2024

Appendix 1: Information on Data Processing in Connection with Job Applications

This information on data processing in connection with job applications applies to BVB.

The processing of your data is essential for entering into an employment contract with BVB. The security of your data and the associated data protection in compliance with legal requirements are of great importance to BVB—for this reason, the following information explains how BVB processes your data in connection with job applications.

Personal data (hereinafter also referred to as “data”) refers to all information relating to identified or identifiable natural persons, such as name, address, gender, age, etc.

1. Responsibility for Data Processing

The data controller within the meaning of data protection laws is:

Basler Verkehrs-Betriebe
Claragraben 55
4001 Basel

2. Processing of Data Obtained from You

In connection with job applications, we process the following data that you provide to us:

Personal contact information (e.g., name, address, phone number)
Information about your education and qualifications
Information about previous employers within the scope of legal authority
Additional information contained in documents you submit

We also process other data that you provide to us during the recruitment process (e.g., during a job interview).

You agree to the processing and transfer of your data exclusively for the application process (consent). You confirm that the information you provide is true. You are also aware that providing false information may result in the termination of a potential employment relationship.

When you visit our websites, our web servers automatically store the IP address assigned to you by your Internet service provider, the website from which you are visiting us, the pages you visit on our site, as well as the date and duration of your visit.

3. Processing of Data Obtained from Third Parties

If references to third-party sources are provided in application materials or during the recruitment process, these may be consulted and processed within the scope of our legal authority.

4. Purpose of Data Processing

Your data will be used only for the purposes communicated to you at the time of collection, or if there is a corresponding legal obligation to do so.

Your data will be processed to the extent necessary to complete the application process and with a view to establishing an employment relationship (e.g., personnel recruitment, hiring, starting a new position) or in connection with a potential job change within BVB.

This also applies mutatis mutandis if you have provided us with your data as part of a speculative application.

5. Retention Period for Personal Data

Your data will be deleted as soon as it is no longer necessary to fulfill the purpose for which it was collected. If legal or practical obstacles prevent deletion, the personal data will be blocked instead of deleted.

6. Rights Regarding Personal Data

The following rights apply with respect to personal data processed by BVB:

Right to access stored personal data
Right to correct or supplement personal data
Right to restrict (block) or delete personal data
Right to withdraw consent
Right to data portability

The contact person for exercising these rights is the BVB Data Protection Officer:

Basler Verkehrs-Betriebe
Data Protection Officer
Claragraben 55
4001 Basel

Email: datenschutz@bvb.ch

7. Disclosure of Data to Third Parties

Your data is hosted by a third party (provider) under a data processing agreement, typically in Switzerland or the EU.

Your data is disclosed exclusively within the scope permitted by law. If necessary for contract fulfillment, as part of administrative measures, due to legal requirements, or as a result of official orders, your data may also be disclosed to other third parties, including those located abroad. These third parties are obligated to comply with data protection requirements to the same extent as BVB. If the level of data protection in a country does not meet Swiss standards, contractual measures ensure that the protection of personal data is at least equivalent to that in Switzerland.

We also take internal data protection very seriously. Our employees and the external service providers we engage have committed to confidentiality and compliance with data protection regulations. We take appropriate measures to protect your data.

8. Data Security

To protect stored personal data against tampering, partial or complete loss, and unauthorized access by third parties, both BVB and the data processor implement appropriate technical and organizational security measures. These measures are continuously improved in line with technological developments.

Nevertheless, the transmission of information via the Internet and other electronic means always entails certain security risks, which is why BVB cannot guarantee the security of information transmitted in this manner.

9. Changes to This Privacy Policy

BVB reserves the right to freely amend and supplement this policy.

Last updated: February 2024