Privacy policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

ByePast Software Solutions GmbH
Waldstraße 30
72116 Mössingen
Germany
Email: [email protected]
Phone: +49 7473 7021470

We are not legally required to appoint a data protection officer. For questions about data protection, contact us at [email protected].

With every request your browser necessarily transmits data to our server: IP address, date and time, the requested address, the referring page (referrer), HTTP status code, amount of data transferred, and browser and operating system (user agent). We process this data to deliver the website and to keep it secure and stable, for example to fend off attacks.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and error-free operation. Log files are kept only as long as needed for this purpose and are then deleted automatically.

The website runs on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, which acts as our processor under Art. 28 GDPR.

To protect against attacks and to deliver pages quickly, traffic passes through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare processes the connection data listed above, including your IP address, as our processor. To fend off automated access, Cloudflare may set a strictly necessary security cookie (such as “__cf_bm”, valid for 30 minutes).

The legal basis is Art. 6(1)(f) GDPR, and § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) for such a security cookie. Cloudflare is certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR); EU standard contractual clauses apply in addition. More information: www.cloudflare.com/privacypolicy

We load the base maps from OpenFreeMap, a service of Hyperknot Software Kft. (Hungary). As soon as a map is shown, your browser connects to OpenFreeMap's servers and transmits your IP address. According to OpenFreeMap, it does not store IP addresses in its regular server logs and sets no cookies.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a freely usable map base. More information: openfreemap.org/privacy

If you choose the satellite view on the website or in the app, your device loads the aerial and satellite images from the public tile server of the open-source project VersaTiles and transmits your IP address in doing so. Without that choice, no connection to it is made. Here too, the legal basis is Art. 6(1)(f) GDPR. More information: versatiles.org

To understand which pages and features are used, we use the open-source software Umami. Umami runs on our own infrastructure; the data goes to no one else. Umami sets no cookies and stores nothing on your device.

It records the page viewed (without search parameters), the referring page, page title and page language, browser, operating system, device type, screen size and browser language, as well as the country and region derived from the IP address. We also count individual interactions, such as choosing a metric or a search suggestion, with fixed values such as position or page type, but never search terms, free text or locations. The IP address itself is not stored; requests of one visit are grouped by a regularly changing identifier that does not allow any conclusions about you.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving our service. You can object to the measurement at any time, even without writing to us: block the address “transit-eu.com/u/” in your browser or ad blocker.

Two convenience features store settings only locally in your browser (local storage), and only if you use them:

• your choice between the light and the dark design (“theme”)
• the stations you selected last, six at most (“atlas:halte”)

These entries are not transmitted to us and remain stored until you delete them in your browser. The legal basis is § 25(2) no. 2 TDDDG, as the storage is strictly necessary for the feature you requested.

The app loads stations, lines and the vehicle positions for the map area shown from our server; what is said above about server log files and Cloudflare applies to these requests. Like the website, it loads the base maps from OpenFreeMap. The vehicle positions on the live map come from public real-time data of the transport operators and contain no personal data. The app contains no audience measurement, no advertising and no third-party tracking components.

The app stores your settings (such as whether you have a Deutschlandticket, walking speed, step-free routes), the destinations you chose last (eight at most) and the places marked as home or work on your device. They reach us only where a search or the link to bahn.de includes them (see below), or if you sync them with an account. The legal basis is § 25(2) no. 2 TDDDG.

If you download the app from the App Store, Apple processes data under its own responsibility.

When you search for a journey in the app, it sends the start, destination and time to our own journey planner server (MOTIS) at Hetzner, via the address transit-eu.com/motis/: a station, an address you typed or coordinates, and with “My location” your position (see below). If you have set a walking speed or step-free routes, that is sent too. For the place search, the characters you type go there together with the centre of the map area shown, so that results nearby appear first. The journey planner of the ÖPNV Atlas (atlas.byepast.de) uses the same service.

Like all requests, these pass through Cloudflare (see above). Our web server does not log them, and the journey planner keeps no records of individual requests. Place search answers, which are the same for everyone, are kept by our web server for up to a day, filed under the request (search text and map centre), not under your IP address. To fend off overload, it briefly counts in memory how many requests come from an IP address.

The legal basis is Art. 6(1)(b) GDPR: we process the details to carry out the search you requested.

The app uses your location only if you have allowed it in iOS, and only while you are using the app. It uses it to show your position on the map and the stations near you; it calculates both on your device. Your location reaches us only as the start of a journey: when you choose a destination, the journey starts from “My location” unless you choose another start, and the app sends your position as coordinates to the journey planner (see above). The app does not store it among the destinations you chose last. If the map follows your position, the map area for which the app loads vehicles, and whose centre the place search sends along, is near you.

The legal basis for the access is your consent in the iOS prompt (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time in the iOS settings; the app then continues to work without your location.

In the app you can create an account to sync settings, saved places and saved journeys between your devices. The app works just as well without an account. For the account, we store in our database at Hetzner in Germany:

• your email address and, if Apple or Google transmit it, your name; with Google also the address of your profile picture
• when you sign in with Apple or Google, the identifier the provider assigns to you, and the most recently transmitted sign-in token (ID token) with the details it contains
• your sessions: an access key that expires 90 days after its last use at the latest, without IP address and without details of your device or browser
• the synced entries: settings, saved places (such as home and work) and saved journeys, each only in its latest version

If you sign in by email, we send you a sign-in code; there is no password. The code is valid for ten minutes and is stored only as a hash. The email goes through our own mail gateway and is sent via Google Workspace of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor. To curb misuse, we remember in memory for one hour when a code was sent to an address, and briefly limit requests per IP address. Our web server does not log requests to the account.

If you sign in with Apple or Google, Apple or Google is itself responsible for that sign-in; we receive from them only the details in the sign-in token. More information: www.apple.com/legal/privacy, policies.google.com/privacy

The legal basis is Art. 6(1)(b) GDPR. We store the data until you delete the account; you can do so at any time in the app. We then immediately delete the account with all sessions, linked sign-ins and synced entries, and if you signed in with Apple, we also revoke our access at Apple. If Apple informs us that you have deleted your Apple Account, we delete the account as well; if you revoke the app's access there, we end your sessions.

When you start a trip in the app, it shows its progress as a Live Activity on the lock screen. To keep it up to date even when the app is closed, the app registers two details with our push service: the push token iOS assigns to this Live Activity, and the identifier of the journey, from which our journey planner restores it with its stops and times. No account is needed for this, and we do not link the details to an account.

The push service queries the journey from the journey planner every minute and sends changes, for example of platform, delays or cancellations, to your device via the Apple Push Notification service. Apple receives the push token and the content of the display: line, stop, platform and times. The service keeps both details only in memory until the trip has reached its destination or the Live Activity ends, for about a day at most. Our web server does not log the registrations. The app schedules other notifications on your device, without transmitting anything to us for them.

The legal basis is Art. 6(1)(b) GDPR: we process the details to keep the Live Activity you started up to date. In the EU, the push service is provided by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. A transfer to Apple Inc. in the USA cannot be ruled out; Apple is certified under the EU-US Data Privacy Framework. More information: www.apple.com/legal/privacy

For journeys not covered by the Deutschlandticket, the app shows a link “Tickets at bahn.de”. It leads via our address transit-eu.com/go/bahn, which immediately redirects to the search on bahn.de. It passes on the stop where you first board, the one where you last alight, the scheduled departure time and whether you have stated in the app that you hold a Deutschlandticket. Like every request, the redirect appears in our server log files (see above); beyond that we do not evaluate it, and neither an affiliate programme nor tracking is involved.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to hand your search over to bahn.de without you having to enter it again. Deutsche Bahn is responsible for the processing on bahn.de.

If you write to us, for example to [email protected] or [email protected], we process your details to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry aims at a contract, otherwise Art. 6(1)(f) GDPR.

Our mailboxes are operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace), as our processor. A transfer to Google LLC in the USA cannot be ruled out; Google is certified under the EU-US Data Privacy Framework. We delete your message once it has been dealt with, unless statutory retention obligations apply.

Transit EU publishes information from publicly available sources: the timetables of transport operators, public procurement notices (TED and national procurement portals) and data from Wikidata. These may contain personal data, such as the names of managing directors and board members of transport companies, or the name of a sole trader who has been awarded a public contract.

We process this data to make the European public transport market transparent. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the transparency of public contracts and transport services. The sources are listed under Data sources; with every new data release the information is updated or removed. You can object to this processing at any time (see below).

Apart from us, personal data is received only by the service providers named above: Hetzner (hosting, journey planner and database), Cloudflare (delivery and protection), OpenFreeMap (maps), Google (email, including sign-in codes) and Apple (push service for Live Activities). If you sign in with Apple or Google, they are themselves responsible for the sign-in. Transfers outside the EU concern Cloudflare, Google and Apple in the USA and are based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR). We do not sell data and do not pass on data for advertising.

You have the right to

• access the data we process about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to the processing (Art. 21 GDPR, see below)

A message to [email protected] is sufficient. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

An informal message to [email protected] is sufficient.

You are not obliged to provide us with personal data; without the connection data transmitted for technical reasons, however, the website and the app cannot be used, and for an account we need your email address. There is no automated decision-making, including profiling (Art. 22 GDPR).