Here you will find general information on data protection (Section A), special data protection information on the use of the website www.heinerliner.de (Section B), on the use of the "HeinerLiner" on-demand app (Section C), on satisfaction surveys of HeinerLiner users and non-users (Section D) and on competitions for HeinerLiner customers (Section E).
A. General information on data protection
1. information on the processing of personal data and responsibilities
HEAG mobilo GmbH appreciates your interest in our HeinerLiner mobility service and the HeinerLiner app ("app"). We ("HEAG mobilo" or "we") take the protection of your personal data seriously and want you to feel safe and comfortable when using the HeinerLiner. We process your personal data in compliance with the relevant data protection legislation. Personal data is all data that can be related to you personally (e.g. name, address, e-mail addresses or user behaviour).
The content of the website and the app has been created with the greatest possible care. In the following, we will inform you about which data we collect when you visit the website and use the app and the respective services obtained from it, for what purpose and to what extent this happens and when it is deleted by us.
2. responsible person pursuant to Article 4 No. 7 EU General Data Protection Regulation (DSGVO)
The controller pursuant to Article 4 No. 7 of the EU General Data Protection Regulation (GDPR) is HEAG mobilo GmbH, represented by the management, Klappacher Straße 172, 64285 Darmstadt, Germany, info@heagmobilo.de.
When using the HeinerLiner app, HEAG mobilo GmbH is jointly responsible with Rhein-Main-Verkehrsverbund Servicegesellschaft mbH ("rms GmbH") (see section C below).
3. company data protection officer:
CTM-COM GmbH, Marienburgstraße 27, 64297 Darmstadt, www.ctm-com.de, datenschutz@ctm-com.de or telephone 06151 - 3942-72.
The website or the app may contain references ("hyperlinks") to websites of other providers. These pages are subject exclusively to the liability of the respective operators. The linked internet offers and their contents are not continuously monitored by HEAG mobilo. We have no influence whatsoever on the content of these websites. If we become aware of any infringements of the law, we will remove the links concerned without delay.
The contents of the website and the app are subject to copyright, trademark and competition law. Reproduction, distribution, making available for retrieval or online access (transfer to other websites or apps) of the layout or content (texts, logos) in whole or in part, in modified or unmodified form, is only permitted with the prior written consent of HEAG mobilo. Unless otherwise agreed, only non-commercial private use is permitted within the limits of copyright law.
4. data subject rights
You have the following rights in relation to personal data relating to you:
- Right of access (Article 15 GDPR),
- Right of rectification (Article 16 GDPR) or erasure (Article 17 GDPR),
- Right to restriction of processing (Article 18 GDPR),
- Right to object to processing,
- Right to data portability.
You also have the right to complain to a data protection supervisory authority about the processing of your personal data. The supervisory authority responsible for us is
The Hessian Commissioner for Data Protection and Freedom of Information
represented by Prof. Dr Alexander Roßnagel
Gustav-Stresemann-Ring 1
65189 Wiesbaden
Phone: 0611-1408 0
poststelle@datenschutz.hessen.de
5. revocation of consent
If the data processing is based on your consent, this consent can be revoked at any time with effect for the future.
You will not incur any costs for the revocation. Your revocation does not affect the lawfulness of the data processing carried out on the basis of the consent until the revocation. Further processing of this data on the basis of another legal basis also remains unaffected.
6. right to object to data processing for the exercise of legitimate interests
In the case of processing of personal data for the purpose of legitimate interests (Article 6(1) sentence 1 lit. f DS-GVO), you may object to the processing of personal data relating to you at any time with effect for the future.
In the event of an objection, we shall refrain from any further processing of your data for the aforementioned purposes, unless there are compelling legitimate grounds for processing which override your interests, rights and freedoms, or processing is necessary for the assertion, exercise or defence of legal claims.
To exercise the rights mentioned in sections 4 - 6, you can contact us at any time by post (HEAG mobilo GmbH, Datenschutz, Klappacher Str. 172, 64285 Darmstadt) or by e-mail to datenschutz@heagmobilo.de contact.
7. reservation of right of modification
We reserve the right to amend this Privacy Policy from time to time. We will update the status of the most recent change at the beginning of the provision accordingly. Where required by law, we will notify you of any changes. Nevertheless, we encourage you to review this policy for any changes when you use our HeinerLiner service.
B. Data protection information on the use of the website www.heinerliner.de
In the following, we provide information about the collection of personal data when using our website www.heinerliner.de.
1. contact, contracted service providers
When you contact us, the data you provide (your e-mail address, your name and telephone number if applicable) will be stored by us in order to answer your questions. We delete the data arising in this context after storage is no longer required, or restrict processing if there are statutory retention obligations.
On the one hand, this data is processed on the basis of your consent pursuant to Article 6(1) sentence 1(a) GDPR; on the other hand, it corresponds to our legitimate interest pursuant to Article 6(1) sentence 1(f) GDPR in order to ensure the security of our systems and prevent misuse. If you contact us with the aim of purchasing a ticket, this is also done on the basis of Article 6 paragraph 1 sentence 1 lit. b GDPR for the purpose of initiating a contract. This data is then stored for as long as it is required to fulfil the contract.
2. Collection of personal data when visiting the website
a) When you use the website for information purposes only, we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security:
- IP address
- Date and time of the request
- Time zone difference from Greenwich Mean Time (GMT)
- Content of the request (concrete page)
- Access Status/HTTP Status Code
- Data volume transferred in each case
- Website from which the request comes
- Browser, language and its version
- Operating system and screen resolution
b) In addition to the aforementioned data, cookies may be stored on your computer when you use our website if you consent to this. A cookie is a piece of information that is stored on your end device (computer, smartphone, etc.) by the browser you use and through which certain information flows to us. They are used to improve our website and make it more user-friendly.
c) Use of cookies:
aa) This website uses the following types of cookies, the scope and functionality of which are explained below:
- Transient cookies (bb)
- Persistent cookies (see cc).
bb) Transient cookies are automatically deleted when you close the browser. These include, in particular, session cookies. These store a so-called session ID, with which various requests from your browser can be assigned to the joint session. This enables your computer to be recognised when you return to our website. The session cookies are deleted when you close the browser.
cc) Persistent cookies are automatically deleted after a predefined period of time, which may differ depending on the cookie. You can delete the cookies at any time in the security settings of your browser.
d) The data processing mentioned in this section is carried out exclusively on the basis of your consent in accordance with Article 6 paragraph 1 sentence 1 lit. a GDPR.
3. further functions and offers of our website
a) In addition to the purely informational use of our website, we offer various services that you can use if you are interested. For this purpose, you usually have to provide further personal data which we use to provide the respective service and for which the aforementioned data processing principles apply.
b) In some cases, we use external service providers to process your data. These have been carefully selected and commissioned by us, are bound by our instructions and are regularly monitored.
c) Furthermore, we may pass on your personal data to third parties if we offer promotions, competitions, contracts or similar services together with partners. You will find more information on this in the description of the respective offer.
d) If our service providers or partners are based in a country outside the European Economic Area (EEA), we will inform you of the consequences of this circumstance in the description of the offer.
4. use of social media
a) We also market the HeinerLiner range on the social media platforms Facebook and Instagram. We also use the YouTube video platform. We do not use any social media plug-ins for this. Instead, our respective pages can be reached via a simple link. You can recognise the provider by its initial letters or the respective company logo.
b) The legal basis for the use of the social media platforms is Article 6 (1) sentence 1 lit. f DS-GVO.
c) If you use the pages of the social media providers, then we have no influence on the data collected and data processing procedures, nor are we aware of the full extent of the data collection, the purposes of the processing or the storage periods. We also have no information on the deletion of the collected data.
d) Each provider stores the data collected about you as usage profiles and uses them for the purposes of advertising, market research and/or demand-oriented design of its website. Such an evaluation is carried out in particular (also for users who are not logged in) for the display of needs-based advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles, whereby you must contact the respective provider to exercise this right. By integrating the providers, we offer you the opportunity to interact with the social networks and other users so that we can improve our offer and make it more interesting for you as a user.
e) The use of data by the providers is independent of whether you have an account with the respective provider and are logged in there. If you are logged in to the provider, the data we collect is directly assigned to your account with the provider. We recommend that you log out regularly after using a social network, as this allows you to avoid being assigned to your profile with the provider.
f) For further information on the purpose and scope of data collection and processing by the plug-in provider, please refer to the data protection declarations of these providers provided below. There you will also receive further information on your rights in this regard and setting options for protecting your privacy.
5. addresses of the social networks and links to their data protection notices
a) The social network Facebook and the social network Instagram are operated by Meta Platforms Inc, 1 Hacker Way, Menlo Park, CA 94025, USA. If a data subject lives outside the USA or Canada, the controller for the processing of personal data is Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Facebook maintains a privacy policy at https://de-de.facebook.com/about/privacy/ https://privacycenter.instagram.com/policy (Instagram) ready.
b) The video platform YouTube is operated by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. Google maintains a privacy policy at https://policies.google.com/privacy?hl=de
C. Data protection information and special notes on using the app
Since February 2025, HEAG mobilo GmbH and Rhein-Main-Verkehrsverbund Servicegesellschaft mbH ("rms GmbH") have been jointly responsible for operating the HeinerLiner app.
The joint controllers only process users' personal data insofar as this is necessary to ensure the functionality of the app. The allocation of tasks has been set out by the joint controllers in a separate agreement. As a data subject, you can now find details on the processing of personal data when using the HeinerLiner app at https://www.rmv.de/c/de/rechtliche-hinweise/datenschutz/datenschutzgrundverordnung/rmv-on-demand.
HEAG mobilo is also referred to there as a "user of the on-demand system" or "participant". If you have any questions, you can use the contact options provided there.
D. Data protection information as part of the HeinerLiner survey
The legal basis for the processing of your personal data as part of the HeinerLiner survey is Article 6 (1) sentence 1 lit. a DSGVO (consent). The survey is intended to make the current use and mobility behaviour of HeinerLiner users transparent and to identify potential for improvement in the future. To this end, non-users are also surveyed.
The following pseudonymised data is collected and processed:
- Regular use of public transport
- Mobility restrictions
- Gender
- Age range
- Postcode Place of residence
- Current activity
- Highest educational qualification
- Net disposable income
Recipients or categories of recipients of the data:
Within our company, those departments that evaluate the survey to improve our HeinerLiner and derive measures from it will receive access to your data. Processors used by us (Art. 28 DSGVO) may also receive data for these purposes. These processors are the Darmstadt University of Applied Sciences (Department of Civil and Environmental Engineering) and companies in the IT services and telecommunications categories.
Data deletion
The pseudonymised data collected about you will be deleted once the survey has been completed and analysed. This is expected to be at the end of 2027.
Your rights
Please refer to Section A No. 4 and No. 5 (Withdrawal of consent given) of this data protection information for your rights. In order to exercise your rights, it is sufficient to send a letter to the above-mentioned data controller.
E. Competitions for HeinerLiner customers
Below we inform you about the processing of your personal data in the context of participation in competitions offered by us for HeinerLiner customers.
1. contact details
Responsible: HEAG mobilo GmbH, Klappacher Str. 172, 64285 Darmstadt
Data Protection Officer: CTM-COM GmbH, Marienburgstraße 27, 64297 Darmstadt, Tel.: 06151 3942-72, E-Mail: datenschutz@ctm-com.de
2. information on the processing of personal data
a) Purpose of the processing of your personal data and the legal basis for processing
Organising competitions to retain and motivate customers. The legal basis for this is the consent of the data subject in accordance with Article 6 (1) sentence 1 lit. a GDPR.
b) The following categories of data are collected
We process the following personal data, which we generally receive from you:
Surname and first name, business or private telephone or mobile phone numbers and business or private e-mail addresses and, if applicable, postal address for sending the prize.
c) Recipients or categories of recipients of the data
Within our company, access to your data is only granted to those departments that need it in order to organise the competition. This is usually the communications department. The data of the winners may be passed on to our customer centre for collection of the prizes.
In addition, it cannot be ruled out that the external IT service provider for the technical support of the competition may become aware of this.
Data is not transferred to countries outside the European Union (so-called third countries).
d) Duration of data storage
Participants' data will be stored for three months after the end of the competition and then deleted. If further retention obligations exist under statutory provisions, these shall apply to the storage.
3. your rights as a data subject
As the data subject of this data processing, you have the following rights that you can exercise against us:
- Right to information,
- Right to rectification or erasure,
- Right to restriction of processing,
- Right to object to processing,
- Right to data portability.
You are welcome to contact us at the e-mail address datenschutz@heagmobilo.de to exercise your rights as a data subject.
You also have the right to lodge a complaint with the competent supervisory authority in the event of a data breach or suspected data breach. You can reach the authority responsible for us as a company using the following contact details
The Hessian Commissioner for Data Protection and Freedom of Information
P.O. Box 3163
65021 Wiesbaden
4. reason for providing your data and possible consequences of not providing it
If you do not provide your personal data, you will not be able to take part in competitions.