Data privacy statement of the Zurich Transport Network (ZVV)
This data privacy statement provides information about how data is processed at the ZVV. Please check this statement at regular intervals in case there have been any changes. The most recent version always applies.
The public transport companies within the association handle customer data confidentially.
The protection of your privacy and identity is very important to us at the public transport companies. We can assure you that we will process your personal data in accordance with the law and the applicable provisions of the data protection legislation.
As a sign of how seriously we take the confidential handling of your data, the public transport companies are committed to the principles below:
You are in charge of the decisions concerning the processing of your personal data.
Insofar as permitted by law, you can object to the processing of your data, withdraw your consent to data processing or have your data erased at any time. You always have the option of travelling anonymously, i.e. without your personal data being collected.
We provide you with added value when processing your data.
The public transport companies use your data exclusively for the purpose of delivering a service and providing you with added value all along the mobility chain (such as tailored offers and information, assistance or compensation in the event of a breakdown). This means that your data will only be used for the purposes of developing, delivering, optimising and evaluating our services or for maintaining the customer relationship.
We will not sell your data.
Your data will only be disclosed to selected third parties as referred to in this data privacy statement and only for the purposes explicitly stated. In cases where we commission third parties with data processing, we will obligate them to adhere to our data privacy standards.
We warrant that your data will be kept secure and protected.
The public transport companies assure you that customer data will always be handled with care and that your data will be kept secure and protected. We will ensure that the necessary organisational and technical arrangements are put in place to this end.
Below, you will find some detailed information about how your personal data will be handled by the ZVV. This has been divided up into subsections to help you find the information you need more easily. The following links will take you directly to the relevant section:
- The legal basis for processing data at the ZVV
- Intersectoral cooperation in the area of ‘Direct Transport’
- Purchasing travelcards and tickets
- ZVV check-in ticket
- Delivery of information and notifications
- Inspections, travelling without a valid ticket, abuse
- ZVV-Contact customer centre
- Use of the ZVV website
- ZVV customer account
- ZVV newsletter
- Log files
- AT Internet web analytics
- Application performance management
- External links
- Competitions and promotions
- Participation in surveys
- Social media
- Your rights
The legal basis for processing data at the ZVV
As a dependent institution under cantonal public law, the ZVV is subject to the data protection regulations applicable to public bodies of the canton of Zurich and to supervision by the cantonal data protection officer.
Consequently, the authoritative legislation for data processing at the ZVV consists, primarily, of the Information and Data Protection Act (IDG; LS 170.4) of the Canton of Zurich and its related ordinance (IDV; LS 170.41). In addition, the Federal Act on Data Protection (FADP; SR 235.1) and its related ordinance (DPO; SR 235.11) may also apply. Furthermore, the Federal Act on Passenger Transport (PBG; SR 745.1) contains special data protection provisions that must be observed by public transport companies.
Intersectoral cooperation in the area of ‘Direct Transport’
In its capacity as a public transport association, the ZVV is required by law to deliver certain transport services in conjunction with other transport companies (TC) and associations (‘Direct Transport’). The Direct Transport (DT) integrated transport system allows passengers to travel on the entire network with a single ticket even though it is operated by various TC and associations. Within this context, data is exchanged at a national level between the 240 TC and associations that are jointly responsible for maintaining the Direct Transport system across the whole of Switzerland. Personal data associated with DT products (specifically the GA Travelcard and the Half Fare Card) is stored in a central database that is managed by Schweizerischen Bundesbahnen, Hilfikerstrasse 1, 3000 Bern (SBB) on behalf of the Swiss public transport sector. If you use a SwissPass login, the data will also be stored in the SwissPass database that is likewise managed by SBB. To enable efficient service delivery and collaboration among the parties involved, the data from the various databases may be merged.
This centrally processed DT data is the responsibility of the ZVV together with the other TC and associations involved. The extent to which the individual TC and associations are able to access the shared databases is governed and restricted by a joint agreement.
Any data forwarding that takes place in the context of centralised storage and any processing undertaken by the other TC and associations involved in DT is, as a basic principle, restricted to the following purposes: contract processing, ticket inspections, after-sales service and revenue distribution. In addition, the data that you provide when purchasing Direct Transport services will – in certain cases – also be processed for marketing purposes. Specifically, this includes evaluation of the data so that the public transport services can be enhanced based on passengers’ needs and also promoted. In principle, such processing will only be carried out by the TC from which you purchased the relevant service. Processing for marketing purposes will only be undertaken by the other TC and associations in exceptional cases and under strict conditions. One exception to this is when SBB uses the data to get in touch with customers. SBB is responsible for marketing DT services on behalf of the Swiss public transport sector (specifically the GA Travelcard and the Half-Fare Card) and may contact you regularly in this role.
Purchasing ZVV travelcards and tickets
The following data is collected when you purchase a personal ZVV travelcard:
- Customer master data: gender (title), surname, first name, date of birth, address, telephone number, email address, personal customer number (CMK)
- Purchase data: type of travelcard, class, validity, place and date of issue, price
When you purchase personal e-tickets (via the ZVV ticket shop or ZVV ticket app), the following data is collected:
- surname, first name, date of birth and – where applicable – your personal customer number (if the purchase is linked to your ZVV customer account or if you use your SwissPass login), and
- your email address – where applicable – for the purpose of delivering the tickets/sales receipts (some items of data are optional in the ticket app)
- Purchase data: type of ticket, date/validity, place and date of issue, price
This data is stored in the ZVV back-end e-ticketing system that is operated by MNC on behalf of the ZVV. If you link your existing customer number when purchasing an e-ticket (purchases made via your ZVV customer account), the data will also be stored in the central customer database operated by SBB.
If you use your SwissPass login to purchase services in the ZVV ticket shop or in the ZVV ticket app, your customer data will be retrieved directly from the SwissPass database and stored in the ZVV back-end e-ticketing system.
As a basic principle, the data will be stored for as long as the associated services remain usable and refundable to ensure that the after-sales service can function in any eventuality. The data will then be anonymised or erased.
ZVV check-in ticket
The data listed below is collected as part of the check-in function in the ZVV ticket app. Specifically, this is used to identify the passenger during inspections, for billing/calculating prices, for the after-sales service/customer support, to combat abuse/protect revenue and to optimise the app and offering.
- Customer data: surname, first name, mobile phone number including device type and service provider/network operator.
- Travel data: route and price information ascertained on the basis of the registered check-in and check-out information (station/stop, time, device ID number) that is collected during your journey via your mobile phone’s location services and the travel options (timetable).
- Payment method data: credit card details or data from other payment systems.
The customer and travel data is collected and stored on behalf of the ZVV by BLS AG, Genfergasse 11, 3001 Bern (BLS), which operates the ‘Lezzgo’ background system required for the check-in function.
The payment method data is not stored either by the ZVV itself or by BLS on its behalf. This data is stored directly by the payment service provider: Datatrans AG, Kreuzbühlstrasse 26, CH-8008 Zurich (Datatrans). The transaction reference number will be stored, in an anonymised form, in the ZVV back-end e-ticketing system that is operated by MNC Mobile News Channel SA, Avenue de la Gare 10, 1003 Lausanne (MNC) on behalf of the ZVV.
The customer data has to remain stored for as long as you continue using the check-in function. If you delete the app or no longer wish to use the check-in function, you can ask to have your data erased (for further details, see section ‘Your rights’). The travel data will be erased or anonymised after one year. The anonymised data will be used for the purpose of enhancing and improving the app and for statistical purposes.
Delivery of information and notifications
The ZVV may use customer data for the purpose of delivering important information and details of special offers as well as other notifications (e.g. about a travelcard’s expiry or valid from date), provided that this is necessary and appropriate for fulfilling its legally defined tasks. In principle, such deliveries fall under the responsibility of the ‘Regular Customer Strategic Business Unit’ (Regular Customer SBU) that is managed by VBG Verkehrsbetriebe Glattal and PostAuto AG, Northern Region on behalf of the ZVV. For this, the Regular Customer SBU sometimes relies on external service providers (specifically for printing, packaging and dispatch).
Notifications concerning a travelcard’s expiry or valid from date in the form of an email, SMS or letter are delivered on behalf of the ZVV by MNC Mobile News Channel SA, Avenue de la Gare 10, 1003 Lausanne (MNC). MNC has commissioned Couvertic, Ackerstrasse 46, 8610 Uster with the printing and dispatch of letters. MNC retrieves the customer data required for dispatching the notifications from the central customer database and stores this in its own database. The data remains stored there for 18 months to ensure that customer support can be provided.
The regular ZVV newsletter is only sent to customers who have expressly subscribed to it (click here to learn more about the ZVV newsletter).
If you have a ZVV customer account, you can use it to change the settings for receiving notifications and offers at any time. You can also opt out of receiving information and offers from ZVV at any time by sending a message to this effect to the ZVV-Contact customer service team (send it by email to email@example.com or by post to ZVV-Contact, PO Box, 8040 Zurich).
When sending information and offers within the aforementioned context, the ZVV may also use customer data from the Direct Transport system (for further details, see section Intersectoral cooperation in the area of ‘Direct Transport’).
Inspections, travelling without a valid ticket, abuse
The activities associated with ticket inspections, the imposition of fines for travelling without a valid ticket (including their collection) and combating abuse at the ZVV are carried out on behalf of the ZVV by SBB (S-Bahn operator), VBZ (City of Zurich) and PostAuto AG (wider network area). Within this context, the ZVV and the commissioned transport companies specifically process the following: customer data, ticket and travelcard data, inspection data and, where applicable, further data associated with an abuse of the system.
For the purpose of implementing the scale of charges (increase in the fine in the event of a repeat offence within two years in accordance with the applicable legal and tariff provisions), all data that is collected in the context of incidents involving passengers travelling without a valid ticket will be stored for two years. The data will be stored in a national register of passengers caught travelling without a valid ticket that is operated by PostAuto AG, Bern (PostAuto) on behalf of the public transport sector. Within this context, the available data will be exchanged with other transport companies in Switzerland (and also across borders in the case of international tickets or concessionary passes). Where permitted by law, this also applies to the data of those who have been convicted of a criminal offence in connection with the use of public transport.
ZVV-Contact customer centre
The ZVV-Contact customer centre is operated on behalf of the ZVV by the Verkehrsbetriebe Zürich transport company (VBZ). If you make contact with ZVV-Contact in writing, by telephone or via the contact form on the ZVV website, the employees of ZVV-Contact will collect and process the personal data that you disclose in the course of your enquiry, such as your surname, first name, address, email address, telephone number, and so on. When sending an email to ZVV-Contact, please take care not to communicate any confidential information.
Use of the ZVV website
You can use the ZVV website without disclosing personal data. Usage information – such as the IP address, referrer (website that takes users to www.zvv.ch when they click a link), details of the browser used, date, time and length of visit – is collected automatically. However, your IP address will be anonymised as soon as the data has been collected. Usage information is used for the purpose of identifying trends and improving the ZVV website. The ZVV cannot infer anything about you personally from these evaluations (click here to learn more about web analytics).
You can only use the following offerings on the ZVV website if you disclose your data to the ZVV:
- ZVV customer account
- ZVV newsletter
- The contact form to get in touch with ZVV-Contact
- Placing orders in the ZVV ticket shop (see Purchasing travelcards and tickets)
- Participating in competitions
ZVV customer account
When you set up a ZVV customer account, the data you disclose during the registration process will be stored (surname, first name, email address and – optionally – your address, date of birth and, where applicable, customer number). The data will be stored by Unic AG, Baslerstrasse 60, 8048 Zurich (Unic), which is the company that operates the ZVV customer account on behalf of the ZVV. The customer account is used to maintain the customer relationship and makes it easier to respond to your enquiries. It provides you with a convenient way of accessing the services of the ZVV (particularly for purchasing travelcards and tickets, and making use of SwissPass services) as well as participating in competitions. You can also use your customer account to subscribe to the newsletter.
You access your customer account via a password that you select yourself and that the ZVV cannot view.
You can change, supplement or delete your data in your ZVV customer account at any time. In addition, you can also have your entire customer account deleted at any time, which will erase all the data that you have disclosed in relation to it (for further details, see section ‘Your rights’).
If you enter your customer number when registering in the ZVV customer account, a link will be established to your data in the central customer database operated by SBB (for further details, see section Purchasing travelcards and tickets). The data you disclose during registration will be enriched with that from the central customer database. You can delete your customer number from your customer account at any time, which will also unlink it from the central customer database (the data in the central customer database will remain unchanged).
The ZVV newsletter is used by the ZVV to provide you with regular updates concerning important news and interesting offers. If you subscribe to the ZVV newsletter, the ZVV will store and use the email address you disclose when subscribing. Email addresses are managed and the newsletter is dispatched by the ‘Regular Customer Strategic Business Unit’ that is managed by VBG Verkehrsbetriebe Glattal and PostAuto AG, Northern Region on behalf of the ZVV.
You can unsubscribe from the newsletter at any time. To do this, click the ‘Abmeldung’ (‘Unsubscribe’) link at the end of the newsletter or this link and follow the instructions. If you have a ZVV customer account, you can also cancel the newsletter there whenever you want. Your request to unsubscribe will be registered by the system within one calendar day. Depending on the time of your request, you may receive another newsletter before the unsubscribe operation is registered.
Once you have unsubscribed from the newsletter, you can request the deletion of all the data that you have disclosed in relation to it (email address) at any time (for further details, see section ‘Your rights’).
Depending on which browser you are using, visit one of the following pages to find out how to manage your cookies:
- Microsoft Windows Internet Explorer (select your browser version)
- Microsoft Windows Internet Explorer Mobile
- Mozilla Firefox
- Google Chrome for desktop
- Google Chrome for mobile devices
- Apple Safari for desktop
- Apple Safari for mobile devices
Log files record access to the servers hosting the ZVV website (usage information such as IP addresses, most recently visited pages, etc.). They are recoded in an anonymised form. They are evaluated exclusively for statistical purposes and for error analysis. They are indispensable to the operation of the website. The ZVV cannot infer anything about you personally from these evaluations.
AT Internet web analytics
The ZVV website uses AT Internet, a web analytics service provided by Applied Technologies Internet SAS, Parc d’Activité La Devèze, 8 impasse Rudolf Diesel, 33700 Mérignac, France (AT Internet). AT Internet uses third-party cookies to analyse website usage for the purposes of compiling reports on website activities for the website operators and delivering further services relating to website and internet usage (click here to learn more about cookies).
The cookie-generated information about your use of the ZVV website (including your IP address) will be anonymised as soon as the data has been collected and will be stored on an AT Internet server in France. The anonymised IP addresses will be fully deleted after six months. The AT Internet cookies will remain stored in your browser for 13 months. This allows the ZVV to recognise repeat visitors to its website. Find out more in the AT Internet data privacy statement.
You can prevent the collection of your anonymised usage information by making the corresponding cookie settings in your browser (for further details, see section Cookies). Alternatively, you can opt out on the AT Internet opt-out page. You will find further information about the AT Internet opt-out facility here.
In addition, you can also submit a request to AT Internet at any time to have any personal data that may have been collected about you (in particular your IP address) erased. To exercise this right, contact AT Internet via email (firstname.lastname@example.org) or send a letter to: AT Internet, Attn: Legal Department, Parc d’Activité La Devèze, 8 impasse Rudolf Diesel, 33700 Mérignac, France.
The ZVV uses a tracking tool provided by Adform, Hovedvagtsgade 6, 2, 1103 Copenhagen, Denmark. This relies on pixels integrated into the website to collect data about how the website is being used. These pixels are used to collect browser IP addresses and generate anonymous user profiles. At no point can the data collected be traced to a specific individual. The tracking enables the ZVV to optimise its advertising campaigns and, in turn, to make more cost-effective use of the available advertising media. The user profiles are stored on the Adform server for a maximum of 120 days before being automatically deleted. The data is treated as confidential at all times and is not passed on to any second-party or third-party suppliers or offered for sale. Tracking can be prevented by regularly deleting the cookies from the relevant browser (for further details, see section Cookies).
Application performance management
The ZVV is now using the New Relic Mobile app released by New Relic, 188 Spear Street, Suite 1200, San Francisco, CA 94105. The feature has been enabled on the ZVV ticket app for iOS and Android. Anonymous performance and usage data is being collected from the ZVV ticket app by New Relic Mobile. The data collected cannot be traced back to a single individual and is stored for a maximum of 90 days at a computer centre in the EU. The data collected enables the ZVV to analyse and solve problems reported by customers in the ZVV ticket app more quickly and efficiently.
The ZVV has not checked the websites to which the ZVV website is linked. The ZVV assumes no responsibility for the protection of your privacy or for the confidentiality and security of your data in connection with this content and these offerings, regardless of whether the links take the form of text or banners.
Competitions and promotions
Competitions at the ZVV (particularly those featured at www.zvv.ch/gewinnen) are run by the ‘Strategic Business Units’(SBU) that are managed on behalf of the ZVV by various transport companies:
- The ‘Leisure SBU’ managed by Sihltal Zürich Uetliberg Bahn SZU, PostAuto AG, Northern Region and SBB: ZVV competitions relating to leisure offerings
- The ‘Events SBU’ managed by SBB: ZVV competitions relating to major events
- The ‘Juniors SBU’ managed by Verkehrsbetriebe Zürichsee und Oberland VZO: prize draws for school classes and nurseries and the holiday pass competition
The personal data that is collected in relation to each competition is managed directly by the Strategic Business Unit or transport company responsible. When you participate in competitions, the data you disclose in the course of participating will be stored and used (surname, first name, address, email address and – optionally – your title and telephone number).
In addition to this, the ‘Regular Customer SBU’ – managed by VBG Verkehrsbetriebe Glattal and PostAuto AG, Northern Region – also runs regular ‘thank you’ campaigns for ZVV travelcard holders via (www.zvv.ch/danke). You can only participate in these campaigns if you have a customer account. The necessary personal data for these campaigns (specifically: the dispatch address) will be retrieved from the customer database.
Participation in surveys
You will not receive an invitation to participate in a survey via your stored email address unless you have given your consent. If you have stated your willingness to participate in surveys, you may receive an email from the ZVV or from a commissioned market research institution inviting you to complete a survey. You will receive invitations of this kind no more than twice in the same calendar year.
Your title, surname, first name and email address will be used to send you an invitation by email. In cases where your personal details are passed on to a market research institution so that it can conduct the survey, these will be used for the survey only and for no other purpose, and will be deleted by the market research institution on completion of the survey.
Whenever you are invited to participate in a survey, participation (i.e. the process of completing the questionnaire) is always voluntary.
Regardless of whether the survey is conducted by the ZVV or by a commissioned market research institution, the evaluation process is always carried out anonymously, i.e. your personal data will never be stored together with your answers.
The ZVV maintains a Facebook fan page as well as a Twitter and an Instagram account so that it can communicate important information and news as well as interact with customers and other interested parties. The ZVV will always adhere to the data protection provisions when handling personal data, including within the context of its social media offerings. The ZVV will process data that you have disclosed voluntarily (e.g. in a comment or in a message) insofar as this is necessary for the purpose of responding to your concern or request.
The ZVV cannot control how the operators (Facebook, Twitter, Instagram) handle the data stored on their platforms. You can view the applicable data privacy policies of Facebook, Twitter and Instagram by clicking the following links:
The ZVV recommends that users of these social networks take a careful look at the relevant data privacy policies by following the links and that they make the appropriate personal settings to protect their data.
You have the right to submit an access request to find out from the ZVV whether data and, if so, exactly what data concerning you is being processed and for what purpose. You also have the right to request the erasure of any data concerning you if the data is no longer required for the purpose for which it was collected, or if you have objected to or withdrawn your consent to data processing. In addition to this, you can also request the rectification or destruction of any incorrect data concerning you at any time.
To exercise these rights, please contact the ZVV-Contact customer service team by sending an email to email@example.com or a letter to ZVV-Contact, PO Box, 8040 Zurich. You must prove your identity when you submit a request of this kind. When getting in touch via email, please take care not to communicate any confidential information. Your enquiry will be forwarded to the ZVV legal service if necessary and processed as quickly as possible.
If you have any access or erasure requests concerning your data within the central customer database operated by SBB, you can also send these to firstname.lastname@example.org. Please take care not to send any confidential information by email. You can also obtain verbal information from a staffed sales counter by showing an official form of identification.
If you have any access requests concerning your data within the national register of passengers caught travelling without a valid ticket, you can also send these to email@example.com. Via this channel, you can obtain information about all the incidents stored about you, including any outside of the ZVV network.
This data privacy statement was updated on 8 December 2020.