Privacy Policy

Scope of the data privacy policy

This privacy policy applies to the following companies:

  • Compagnie du chemin de fer Montreux - Oberland Bernois SA: MOB, in Montreux
  • Transports Montreux - Vevey - Riviera SA: MVR, in Montreux, represented by MOB

Contact details of the responsible person and the company's data protection officer

This privacy policy applies to data processing by:

  • Post: Legal Department, MOB SA, Rue de la Gare 22, 1820 Montreux, Switzerland
  • Email: info@mob.ch

Processing of personal data (nature, purpose and use)

MOB processes personal data in strict compliance with applicable legislation, in particular the Federal Act on Data Protection (FADP, RS 235.1).

The standards of the European Union General Data Protection Regulation (GDPR) are also respected by MOB.

When purchasing services

In this context, the company needs personal information for online orders or the purchase of certain services and products in order to provide services and execute the contract, e.g. when purchasing a subscription or an individual ticket. When purchasing personalised services, the company may collect the following data for each product or service. Mandatory fields in the relevant form are marked with an asterisk.

  • Personal photo
  • Gender, name, email address of the buyer or traveller
  • Other information such as postal address, date of birth
  • Phone number
  • Payment method/mode
  • Acceptance of general terms and conditions

In addition, the ET collects data relating to the services you purchase for the purposes of contract performance. This includes, among other things, the following information, depending on the product or service.

  • Type of product or service purchased
  • Price
  • Place, date and time of purchase
  • Purchase channel (Internet, machine, counter, etc.)
  • Travel date or validity period and departure time
  • Place of departure and destination.

These data processing activities are legally based on the obligation to perform the contract.

The data generated when purchasing services is stored in a central database, but also processed for marketing and market research purposes, among others.

The data is also used in the context of ticket checks to identify the holder of a personal travel document and prevent abuse. The data is also made available to the company's after-sales service to identify and assist you in case of a request or difficulty, or to process any compensation claims. Finally, the data makes it possible to fairly distribute the proceeds from the sale of travel documents among the participating transport companies and tariff communities. These data processing activities are legally based on our legitimate interest.

When accessing our websites

Each time you visit our website, our hosting provider's servers temporarily store each session in a log file. The following technical data is then collected:

  • IP address of the requesting computer
  • Date and time of access
  • Website that immediately preceded the connection and, where applicable, the search keyword used
  • Name and URL of the file consulted
  • Searches carried out (timetables, fares, general search function on the site, products, etc.)
  • Operating system of your computer (provided by the user agent)
  • Browser used (provided by the user agent)
  • Type of device in case of access from a mobile phone
  • Transfer protocol used

The collection and processing of this data makes it possible to secure and make the system reliable, to carry out error and performance analyses, to produce internal statistics and to optimise our Internet offering. They also allow us to organise our website according to our target groups, i.e. to offer targeted content or information that may interest you.

The IP address also makes it possible to preset the language of the website. In addition, it is analysed together with other data for information purposes and to combat attacks on the network infrastructure or other unlawful or abusive use of the website. Where applicable, it is used for identification purposes in the context of criminal proceedings and in civil and criminal actions brought against the users concerned.

Finally, we use cookies as well as support applications and tools (based on the use of cookies). You will find more information on this subject in the sections of this data protection declaration devoted to cookies and tracking tools.

These data processing activities are legally based on our legitimate interest.

We cannot guarantee compliance with data protection provisions on external websites accessible via a link on our website.

When using a contact form

You have the option of using a form to contact us. To do so, you must provide the following personal data:

  • First and last name
  • Email address

We use this data and other information provided on an optional basis (title, address, phone number and company) only to respond as best as possible to your request. Your optional response on how you learned about our offering is used for statistical purposes. Regarding the legal bases, we justify these data processing activities on the basis of our legitimate interest or, if you contact us with a view to concluding a contract, on the basis of pre-contractual measures you ask us to take.

Newsletter

If you wish to receive the newsletter offered on the site, we need an email address, as well as information allowing us to verify that you are the owner of the email address provided and that you agree to receive the newsletter. No other data is collected. We use this data exclusively for sending the requested information and do not pass it on to third parties. The consent given for the storage of the data, the email address and their use for sending the newsletter may be revoked at any time, for example via the 'unsubscribe' link in the newsletter.

During a telephone conversation with our counters

When you call our counters, you may be asked to provide us with personal data, such as:

  • First and last name
  • Date of birth
  • Address
  • Phone number
  • Email address

We use this data provided on an optional basis only to respond as best as possible to your request. The subject of your request may be recorded for statistical or service improvement purposes.

Regarding the legal bases, we justify these data processing activities on the basis of our legitimate interest or, if you contact us with a view to concluding a contract, on the basis of pre-contractual measures you ask us to take.

When creating a SwissPass customer account

You have the option of creating a customer account on www.swisspass.ch. To do so, we need you to provide us with the following data:

  • First and last name
  • Date of birth
  • Address (street, postcode, town and country)
  • Customer number (if you already have a public transport subscription)
  • Email address and password (login details)

These data processing activities are necessary for the performance of the SwissPass usage contract and are based on this legal basis. You will find more information on this subject in the sections of this data protection declaration devoted to shared responsibility in the context of public transport as well as in the data protection declaration on the swisspass.ch website.

The processing of data is based on your request and is carried out in accordance with Art. 6(1)(b) GDPR for the purposes indicated for the performance of the contract and pre-contractual measures.

Transfer of data to third parties (including data processors and sub-processors)

For contract performance

We do not resell your data. To the extent permitted by law pursuant to Art. 6(1)(b) GDPR, and for the proper conduct of our contractual relations with you, your personal data is only passed on to selected service providers, and only to the extent that it is indispensable for the provision of the service. These are IT support providers, subscription card issuers, transport providers (e.g. Swiss Post), providers responsible for distributing revenue between participating transport companies (in particular within the framework of establishing distribution keys under the Passenger Transport Act), and our Internet service provider (see section on website use).

Cookies

We use cookies on our website. These are small files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our site. A cookie does not always mean that we can identify you.

The use of cookies makes it possible to record the frequency of use, the number of users and behaviour on our site, to increase security during use of the site and to facilitate access to our content.

We also use temporary cookies that are stored on your device for a specific period of time to facilitate navigation on the site. If you visit our site again to use our services, it will automatically recognise that you have already visited it and what entries and settings you have made, to save you from having to enter them again.

Cookies required for the execution of the electronic communication process or for the provision of certain desired functions (e.g. the shopping cart function) will be stored on the basis of Art. 6(1)(f) GDPR.

You can configure your browser settings so that cookies are not stored on your computer. Completely disabling cookies may prevent you from using all the features of our website.

By continuing to use our website and/or by accepting this privacy policy, you agree that we store cookies and that personal usage data is collected, stored and used, even after the end of the browser session. You can revoke this consent at any time by enabling the browser settings for rejecting third-party cookies.

Analysis tools

Google Analytics

Our website uses the Google Analytics website analysis service, provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States. Google Analytics uses cookies (see Cookies). These allow Google to analyse the use of our content in the United States, including IP addresses. We would like to point out that Google Analytics has been extended on this site by the code 'gat._anonymizeIp();' in order to ensure anonymous collection of IP addresses (IP masking). If anonymisation is active, Google truncates IP addresses in the member states of the European Union or in other contracting states to the Agreement on the European Economic Area. It is therefore impossible to know your identity. The complete IP address is sent to a Google server in the United States only in certain exceptional cases, to be then truncated on site. Google complies with the data protection provisions of the 'Swiss-USA Privacy Shield' agreement and thus has an adequate level of data protection. Google uses the information we collect to evaluate the use of our websites, write reports on it for us and provide us with other related services. For more information, please consult: https://google.com/intl/en/analytics/privacyoverview.html, and in particular regarding the deactivation of Google Analytics at https://tools.google.com/dlpage/gaoptout.

Google Analytics cookies are stored on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in analysing user behaviour in order to optimise both our offering and the associated advertising.

Your rights

You have the following rights:

Access to information on the personal data we have processed about you. You may in particular request information on the purposes of the processing, the nature of the personal data, the categories of recipients to whom your data has been disclosed, the planned retention period, the right of rectification, deletion, restriction of processing or objection to processing, the existence of a right of complaint, the origin of your data if it was not collected by us, as well as the existence of automated decision-making including profiling and, where applicable, meaningful information about their details (Art. 15 GDPR). In the case of disproportionate investment, we reserve the right to require that you provide proof of identity as well as payment of actual costs in advance.

To quickly request the correction or completion of inaccurate personal data stored with us (Art. 16 GDPR).

To request the deletion of personal data we hold about you, unless the processing is required to exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims (Art. 17 GDPR).

To request the restriction of processing of your personal data, to the extent that you dispute the accuracy of the data, their processing is unlawful, you object to their deletion and we no longer need the data, but you need them for the assertion, exercise or defence of legal claims or you are opposed to their processing pursuant to Art. 21 GDPR (Art. 18 GDPR).

To receive the personal data you have provided in a structured, common and machine-readable format or to request the transmission to another responsible person (Art. 20 GDPR).

To revoke your consent at any time once given. As a result, we are no longer authorised to continue processing the data on the basis of this consent in the future (Art. 7(3) GDPR).

To file a complaint with a supervisory authority (Art. 77 GDPR).

Right of objection

If your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right pursuant to Art. 21 GDPR to object to the processing of your personal data, provided this is due to your particular situation or if the objection is directed against direct marketing. In the latter case, you have a general right of objection, which we implement without specifying a particular situation.

Data security

Your personal data will be transmitted by SSL encryption from this site to us. We protect our website through technical and organisational measures against unauthorised access.

Retention period

We will retain your personal data for as long as we deem necessary or appropriate to comply with applicable law or as long as necessary for the purposes for which it was collected. We will delete your personal data as soon as it is no longer necessary and in all cases after the expiry of the maximum legal retention period of five to ten years. Data that is no longer necessary, for which there is no legal obligation to keep records, is destroyed once the purpose and justification for its use have lapsed.

Update and amendment of this privacy policy

We reserve the right to amend this privacy policy at any time or to adapt it to new processing methods.