Privacy statement
The protection of your personal data is important to us. In general, our websites can be used without providing any personal data. However, if you wish to use specific services offered via our websites or apps, the processing of personal data may be required. Where no legal basis exists for such processing (e.g. the performance of a contractual agreement), we will ask for your consent.
This privacy statement explains which of your personal data we process on our websites and in our apps, the purposes for which this data is processed, and the rights to which you are entitled in connection with the processing of your personal data (e.g. your right to object).
Our privacy statement has a modular structure. It consists of a general section (A. General information), which contains information that generally applies to the processing of personal data when using our digital services, and specific sections relating to the respective processing activity or service described therein, in particular visits to our websites (B. Visiting our websites) and the use of our apps (C. Use of our apps). Finally, we provide information about your rights as a data subject under the GDPR (D. Your data subject rights).
Structure of the privacy statement
A. General information
B. Visiting our websites
C. Use of our apps
D. Your data subject rights
A. General information
Who is responsible for the processing of your personal data?
The controller responsible for the processing of personal data within the meaning of Article 4(7) GDPR is:
Deutsche Bahn Connect GmbH
Mainzer Landstrasse 169
60327 Frankfurt am Main
The appointed data protection officer is Dr. Marein Müller (Group Data Protection Officer).
If you have any questions or suggestions regarding data protection, please contact us by e-mail at dbconnect-datenschutz@deutschebahn.com
or by postal mail to
Deutsche Bahn Connect GmbH
Mainzer Landstrasse 169
60327 Frankfurt am Main.
If you have any questions, suggestions or feedback regarding our bike-sharing services, please contact us by e-mail at info@callabike.de.
Legal basis for data processing
We collect and process your personal data exclusively for specified purposes. These purposes may arise in particular from the technical provision of our websites and apps, legal obligations, contractual requirements, or explicit user requests.
Where we obtain your consent for the processing of personal data (e.g. when you subscribe to a newsletter), such consent serves as the legal basis pursuant to Article 6(1)(a) GDPR. Where the processing of personal data is necessary for the performance of a contract with you, the legal basis is Article 6(1)(b) GDPR. Article 6(1)(b) GDPR also applies to processing operations required for the implementation of pre-contractual measures, for example in connection with inquiries regarding our products or services.
If our company is subject to a legal obligation requiring the processing of personal data, for example to comply with tax law obligations, such processing is based on Article 6(1)(c) GDPR.
For the purpose of analysing and improving our online services, we process usage data. Depending on the nature of the respective processing activity, the processing is carried out either on the basis of your consent or, where legally permissible, on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR.
Where processing activities are subject to specific statutory provisions, for example in the area of electronic direct marketing (such as sending newsletters to existing customers), the lawfulness of the processing is governed by those specific statutory provisions. In such cases, the GDPR requirements concerning the lawfulness of processing do not apply in addition.
We also have a legitimate interest in maintaining and developing our relationship with you and in providing you with information and offers that we believe may be relevant to your travel preferences and interests. Therefore, where legally permissible, we process your personal data on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR (including with the support of service providers) in order to send you information and offers. We use the email address obtained from you in the context of an existing customer relationship for marketing purposes. In addition, your master data and contact details (first name, surname and email address) may be used for market research purposes unless you object to such use of your data.
You may object to the processing of your personal data for advertising purposes at any time with effect for the future. You may submit your objection using the contact details set out in Section A, for example by email to info@callabike.de.
For each processing activity described below, we indicate the applicable legal basis. In individual cases, the processing of personal data may be based on more than one legal basis.
How long will your data be stored?
We store your personal data only for as long as is necessary to fulfil the purpose for which it was collected (e.g. in connection with a contractual relationship) or where retention is required by law. In the context of a contractual relationship, we will generally retain your data at least until the contract has been fully terminated.
Following the termination of the contractual relationship, we will retain your personal data only to the extent and for as long as necessary to comply with statutory retention obligations or for the establishment, exercise or defence of legal claims. Once these purposes no longer apply, your personal data will be deleted.
Is your data shared with third parties?
To provide our contractual services, it is generally necessary to engage so-called processors, such as data centre operators, printing and mailing service providers, or other parties involved in the performance of the contract who process personal data on our behalf. These service providers are carefully selected, contractually bound by comprehensive data protection obligations, and process personal data solely in accordance with our instructions. Apart from this, your personal data will only be transferred to other recipients where a legal basis exists for such transfer, where you have given your consent, or where the transfer is necessary for the performance or administration of a contractual relationship.
Where personal data is transferred to recipients in countries outside the European Union (EU) or the European Economic Area (EEA), such transfers will only take place in compliance with the requirements of Articles 44 et seq. GDPR. Appropriate safeguards may include, in particular, adequacy decisions issued by the European Commission or the Standard Contractual Clauses adopted by the European Commission.
Personal data may be disclosed to third parties in the following cases:
Debt Collection
In the event of payment irregularities or default, personal data required for the recovery of outstanding debts may be transferred to a debt collection agency where this is necessary for the pursuit of our legitimate interests in enforcing outstanding claims.Payment by Credit Card
If you choose to pay by credit card, the data you enter will be transmitted directly to the systems of our payment service providers.Payment Service Providers
We use payment service providers to process payments. As part of the payment process, the data required for payment processing is transmitted to these service providers in encrypted form.Payment by Direct Debit
If you choose to pay by direct debit, your data will be transferred to the payment service providers used by us for the purpose of verifying your bank account and processing the payment.Customer Satisfaction Surveys and Market Research
We use your contact details to conduct customer satisfaction surveys and for market research purposes, provided that you have not objected to such use of your data.
A list containing the names of recipients of personal data may be requested at any time by contacting dbconnect-datenschutz@deutschebahn.com.
Data processing in general
Regardless of whether you use our websites or our apps, the processing of personal data is required in the following cases:
Registration
When you register for one of our bike-sharing or mobility services (e.g. Call a Bike, StadtRAD), a customer account will be created. We process the personal data collected during registration for the purpose of setting up and managing your customer account as well as for the performance and administration of the respective user relationship.
In addition to the mandatory information required for registration and use of the service, you may provide further information on a voluntary basis. The provision of such voluntary information is not required for registration or for the use of the service.
Mandatory information:
Contact details (email address, mobile phone number)
Date of birth
Payment details (credit card number and expiry date or bank account details (IBAN and BIC))
Depending on the selected tariff, additional information may be collected to verify compliance with registration requirements, such as your BahnCard number or the name of your university. If you choose to pay by credit card, the card security code will be requested to authorise each payment transaction. This information is not stored.
Voluntary information:
BahnBonus number (for the allocation and administration of BahnBonus benefits)
Online activation of the SEPA direct debit procedure
To use the SEPA direct debit procedure, we offer you the option of verifying your bank account details online. For this purpose, we use the services of Tink Germany GmbH, Gottfried-Keller-Straße 33, 81245 Munich, Germany.
As part of the account access verification process (Open Banking), the data you provide (in particular your IBAN, name and email address) will be transmitted to Tink. Any further processing takes place within Tink’s verification interface, where you will be guided through the individual steps and informed about Tink’s processing of your data.
The purpose of the processing is to verify your payment authorisation and to activate the SEPA direct debit procedure. The legal basis for this processing is Article 6(1)(b) GDPR. Tink provides these services independently and processes the relevant data under its own responsibility as a controller. Further information regarding Tink’s processing of personal data is provided during the verification process.
If online verification via Tink is not possible, particularly in relation to certain bank accounts outside the DACH region (Germany, Austria and Switzerland), activation will take place through an alternative verification process conducted by our customer service team. In this context, the information required to verify your identity and contractual eligibility will be processed in order to enable the use of the direct debit procedure. The legal basis for this processing is likewise Article 6(1)(b) GDPR.
Once the relevant verification process has been successfully completed, you may use the direct debit procedure as a payment method.
Bike tracking
The location of a bicycle is recorded when it is rented and returned. This is necessary to determine the start and end of the rental period and to facilitate the performance and billing of the respective rental agreement. The data collected in this context is assigned to the relevant customer account.
In addition, a bicycle may be tracked in the following situations. The location data processed in these cases is not assigned to the respective customer account and is stored and analysed exclusively in anonymised or aggregated form.
Bicycle route tracking to analyse usage patterns across different cities and time periods. These insights help us and participating municipalities make strategic and operational decisions, such as where to place stations or where cycling infrastructure may be required.
During a ride, to update the status LED attached to the bicycle. This LED enables customers to check whether they are located within a valid parking zone.
Random, sample-based location tracking of bicycles for maintenance purposes.
In the event of indications of misuse or for the investigation of theft, the location of a bicycle may be processed.
Contact form
If you submit an inquiry to us via the contact form, the information you provide in the inquiry form, including the contact details you enter, will be stored and processed by us for the purpose of handling your inquiry and responding to any follow-up questions. Your data will be used exclusively for the purpose of answering and processing your inquiry and will subsequently be deleted. The processing of your data is carried out pursuant to Article 6(1)(b) GDPR (for the implementation of pre-contractual measures, such as inquiries regarding our products or services, or for the performance of a contract) or pursuant to Article 6(1)(f) GDPR (based on our legitimate interest in processing and responding to inquiries).
Your data will be used solely for the purpose of handling your request and will be deleted as soon as it is no longer required for the respective purpose and provided that no statutory retention obligations prevent its deletion.
In connection with the use of the contact form, the IP address of the device used as well as the date and time of the inquiry may also be processed and stored in log files. This processing is carried out to ensure the security of our systems, to prevent misuse and fraud, and to analyse technical errors. The legal basis for this processing is our legitimate interest pursuant to Article 6(1)(f) GDPR.
Use of the Chatbot
Our website includes a virtual assistant, the Chatbot. The Chatbot serves as an information channel for bike-sharing-related inquiries. It enables you to communicate with us easily, obtain information and receive prompt responses to your questions. The Chatbot automatically handles a wide range of inquiries based on a knowledge base containing answers to frequently asked questions (FAQs). It may also provide suggestions and guidance during the conversation or refer you to another customer service channel (e.g. email).
The Chatbot assists in answering general customer inquiries. More complex or individual requests may, where appropriate, be referred to other service channels. Providing personal data is therefore neither required nor encouraged when using the Chatbot.
We process the information submitted through the Chatbot solely for the purpose of handling your inquiry and for analysing and improving the Chatbot. This includes, in particular, improving the quality of responses, recognising user inquiries and enhancing the usability of the system. The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest lies in providing an efficient digital information and service offering and in the continuous improvement of the Chatbot.
Chat histories, the time of use (date and time of access), and information regarding the operating system used are stored for a maximum period of 30 days and are subsequently deleted.
Participation in contests
In connection with contests, we process the personal data required to organise, administer and conduct the respective contest. Details regarding the categories of personal data processed and the purposes for which such data is processed can be found in the information provided on the page of the respective contest.
Newsletter
If you subscribe to one of our newsletters, we process the following personal data required for this purpose:
Email address
Your email address is processed for the purpose of sending the newsletter. By subscribing to our newsletter, you consent to the processing of your personal data (the legal basis for this processing is Article 6(1)(a) GDPR). In this context, we may use your email address for marketing purposes. If you object to the use of your data for marketing purposes, your data will only be used in anonymised form for statistical analysis.
When you subscribe to the newsletter, we store
the IP address assigned by your Internet Service Provider (ISP) to the device used at the time of registration; and
the date and time of your newsletter subscription.
This data is processed in order to document your subscription and to enable us to identify any potential misuse of your email address. The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest lies in maintaining legally compliant records of your consent and in preventing and investigating abusive registrations.
In certain cases, we may inform existing customers by email about our own similar products or services, provided that the applicable statutory requirements under Section 7(3) of the German Act Against Unfair Competition (UWG) are met.
You may withdraw your consent to receive the newsletter at any time with effect for the future. You can unsubscribe by using the unsubscribe link included in the newsletter or by sending an email to info@callabike.de.
Encryption
Data and emails transmitted via the Internet are often not encrypted and may therefore not be protected against unauthorised access by third parties. As the confidentiality of information transmitted to us by email cannot be guaranteed during transmission, we recommend using a secure method of communication, such as postal mail, when sending particularly sensitive or confidential information.
Links to external sites
Our website may contain links to third-party websites. If you follow a link to an external website, you will leave the services provided by Deutsche Bahn Connect GmbH.
The respective operators of the linked websites are solely responsible for the content, products and services offered on those websites. Please note that these websites are subject to their own privacy policies and may apply different security standards over which we have no control.
B. Visiting our websites
We appreciate your visit to our websites:
Encryption
Data transmitted via our websites is protected using SSL encryption. When SSL encryption is enabled, data transmitted between your device and our systems cannot be read by third parties. You can recognise an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the padlock symbol displayed in your browser.
Use of cookies
Cookies are small text files that are stored on your device and may contain certain information. When a website is accessed, cookies can be transmitted to the website and thereby enable the recognition of a user. Cookies help to enable the use of websites, make them more user-friendly and provide certain functionalities.
We distinguish between:
Strictly necessary cookies, which are required for the operation and provision of the website; and
Non-essential cookies, which are used, for example, for analytics, statistical or marketing purposes.
Our websites can generally be used without the use of non-essential cookies. Where such cookies are used, this will only take place on the basis of your consent, insofar as such consent is required by law.
Analysis of data by Deutsche Bahn AG
Our websites use the Consent Management System of Deutsche Bahn AG to manage your consent preferences and DB WAS website tracking for analytics purposes.
The processing of personal data in connection with the Consent Management System and the analytics functions is carried out under the responsibility of Deutsche Bahn AG. Further information regarding the data processed, the purposes of processing, the respective legal bases, and the available options for managing and withdrawing your consent can be found under “Manage Analytics” at the bottom of our websites.
C. Use of our apps
Downloading
When you download the app via an app store (Apple App Store or Google Play Store), the information required for the download and provision of the app is transmitted to the respective app store operator. This may include, in particular:
your user name,
your email address,
your customer number,
the date and time of the download,
payment information, and
your individual device identifier.
We have no influence over the collection and processing of this data by the respective app store operator. The respective app store operator is solely responsible for such processing. The privacy policy of the respective provider applies.
Privacy-friendly default settings (privacy by default)
Services that are not strictly necessary for the operation of the app or that do not contribute to its improvement are disabled by default.
Location data
Our app offers various location-based features in order to provide certain services depending on your current location. For this purpose, the app requires access to the location data of your device.
Access to your location will only take place after you have granted the app the necessary permission. Location data is processed for the purpose of providing the functions and services used by you. The legal basis for this processing is Article 6(1)(b) GDPR. You may withdraw or disable the location permission granted to the app at any time via your device settings. In this case, location-based features may no longer be available or may only be available to a limited extent.
The app can generally be used without enabling location access. For example, bicycles and stations can be found via the map view within the app or through our websites. However, certain functions, in particular the booking of a bicycle, require location access to be enabled.
Notifications
The app enables you to receive notifications about important events and updates relating to our services, even when the app is not actively open. For this purpose, we use push notification services provided by the respective operating system providers.
To provide these notifications, technical identifiers and other information required for delivery are processed. In this context, personal data may also be processed by the respective operating system providers. Such providers may process personal data in countries outside the European Union (EU) or the European Economic Area (EEA), in particular in the United States.
The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest lies in informing users about important events and features of our services and in facilitating the use of our app.
You will only receive push notifications if you have enabled this function in the settings of your device or operating system. You may disable notifications at any time with effect for the future by deactivating them in your device settings.
Analysis of data by Deutsche Bahn AG
Our apps use the Consent Management System of Deutsche Bahn AG and DB WAS app tracking for analytics purposes.
The processing of personal data in connection with the Consent Management System and the analytics functions is carried out under the responsibility of Deutsche Bahn AG.
Further information regarding the data processed, the purposes of processing, the respective legal bases, as well as your options for managing and withdrawing your consent can be found under “Manage Analytics” in the “Profile” section of the app.
D. Your data subject rights
Subject to the applicable legal requirements, you have the following rights as a data subject:
You have the right to obtain information about whether and which personal data concerning you is being processed by us (Article 15 GDPR).
You have the right to request the rectification of inaccurate personal data and the completion of incomplete personal data (Article 16 GDPR).
You have the right to request the erasure of your personal data where the legal requirements for doing so are met (Article 17 GDPR).
You have the right to request the restriction of processing of your personal data where the legal requirements for doing so are met (Article 18 GDPR).
You have the right to receive the personal data concerning you that you have provided to us on the basis of your consent or a contract in a structured, commonly used and machine-readable format, or to have such data transmitted to another controller (Article 20 GDPR).
You have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data where such processing is based on Article 6(1)(e) or Article 6(1)(f) GDPR. Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time (Article 21 GDPR).
Where processing is based on your consent, you may withdraw your consent at any time with effect for the future. The lawfulness of processing carried out prior to the withdrawal of consent shall remain unaffected.
If you believe that the processing of your personal data violates applicable data protection laws, you have the right to lodge a complaint with a supervisory authority (Article 77 GDPR). The supervisory authority responsible for Deutsche Bahn Connect GmbH is:
Der Hessische Beauftragte für Datenschutz und Informationssicherheit (Hessian Commissioner for Data Protection and Freedom of Information)
Gustav-Stresemann-Ring 1
65189 Wiesbaden
You may exercise your rights at any time by contacting us using the contact details provided in Section A.
No automated decision-making (including profiling)
No decisions within the meaning of Article 22 GDPR are made solely on the basis of automated processing, including profiling.
Legal obligation to disclose certain data to third parties
In individual cases, we may be required by law to disclose personal data to public authorities or other authorised third parties. The legal basis for such processing is Article 6(1)(c) GDPR.
Updates to the privacy statement
We update this privacy statement whenever changes are made to our services or functionalities, or where this is required due to changes in applicable legal requirements. The version published at the time of your visit shall apply. We therefore recommend that you review this Privacy Statement regularly.
Prevailing version
For ease of understanding, this privacy statement is provided in both German and English. In the event of any discrepancies or differences in interpretation, the German version shall prevail.
Last updated: July 2026