Rail Freight Forward Privacy Statement

Rail Freight Forward (hereinafter referred to as “RFF”) is a coalition of European rail freight companies listed below, which are committed to drastically reduce the negative impact of freight transport on the planet and mobility through innovation and a more intelligent transport mix. RFF has the ambition to increase the modal share of rail freight to 30% by 2030 as the macro-economically better solution for European growth. It strives to engage railway undertakings, infrastructure managers and policymakers across Europe in acting to realize this modal shift.

BLS Cargo AG, with the registered office at Genfergasse 11, 3000 Bern, Switzerland, with the value added tax identification number/VAT ID: CHE116287061 (hereinafter referred to as “BLS Cargo”), together with

ČD Cargo a.s., with the registered office at Jankovcova 1569/2c, 17000 Prague, Czech Republic, with the value added tax identification number/VAT ID:  LU17233026 (hereinafter referred to as “CD Cargo”), and

CFL CARGO S.A., with the registered office at Terminal Intermodal Eurohub Sud, L-3434 Dudelange, Luxembourg, with the value added tax identification number/VAT ID: LU17233026 (hereinafter referred to as “CFL cargo”), and

Community of European Railway and Infrastructure Companies AISBL, an international non-profit association under Belgian Law, with the registered office at Avenue des Arts, 53, 1000 Brussels, Belgium, registered under number 0459.235.909 (hereinafter referred to as “CER”), and

DB Cargo AG, with the registered office at Edmund-Rumpler-Str. 3, 60549 Frankfurt a. Main, Germany, with the value added tax identification number/VAT ID: DE 188158403 (hereinafter referred to as “DB Cargo”), and

European Rail Freight Association asbl, with the regustered office at Rue Montoyer 23, 1000 Brussels, Belgium, with the value added tax identification number/VAT ID: BE 0478 440 721 (hereinafter referred to as "ERFA"), and

Forum Train Europe FTE, with the registered office at Hilfikerstrasse 3, 3000 Bern 65, Switzerland, with the value added tax identification number/VAT ID: CHE-113.732.745 (hereinafter referred to as "FTE"), and

Green Cargo AB, with the registered office at Box 39, 171 11 Solna, Sweden, with the value added tax identification number/VAT ID: SE 556119643601 (hereinafter referred to as “Green Cargo”), and

International Rail Transport Committee (CIT), with the registered office at Weltpoststrasse 20, 3015 Bern, Switzerland, and with the value added tax identification number/VAT ID: CHE-105.092.033 (hereinafter referred to as "CIT Rail"), and

Lineas, with the registered office at Koning Albert II-laan 37 Bld du Roi Albert II, 1030 Brussels, Belgium, with the value added tax identification number/VAT ID: BE 0896067192 (hereinafter referred to as “Lineas”), and

LTE Logistik- und Transport- GmbH, with the registered office at Karlauer Gürtel 1, 8020 Graz, Austria, with the value added tax identification number/VAT ID: ATU 50110506 (hereinafter referred to as “LTE”), and

LTG Cargo "Lietuvos geležinkeliai", with the registered office at Mindaugo str. 12, 03603 Vilnius, Lithuania, with the value added tax identification number/VAT ID: LT100538411 (hereinafter referred to as "LTG Cargo"), and

MEDWAY S.A., with the registered office at Avenida da República 66, 1050-197 Lisbon, Portugal, with the value added tax identification number/VAT ID: PT509017800 (hereinafter referred to as "MEDWAY"), and

Mercitalia Rail, with the registered office at Viale dello Scalo San Lorenzo 16, 185 Rome, Italy, with the value added tax identification number/VAT ID: IT06473711007 (hereinafter referred to as “Mercitalia”), and

Ost West Logistik Netzwerk GmbH, with the registered office at Getreidemarkt 14/32, 1010 Vienna, Austria, with the value added tax identification number/VAT ID: ATU65736527 (hereinafter referred to as “Ost West Logistik”), and

PKP Cargo Spółka Akcyjna, with the registered office at Grójecka 17, 02-021 Warszawa, Poland, with the value added tax identification number/VAT ID: PL 9542381960 (hereinafter referred to as “PKP Cargo”), and

Rail Cargo Austria AG, with the registered office at Am Hauptbahnhof 2, 1100 Vienna, Austria, registered with Vienna Commercial Court, with the value added tax identification number/VAT ID: ATU58044244 (hereinafter referred to as “Rail Cargo Group”), and

Renfe Mercancías, S.A., with the registered office at Avda. Ciudad de Barcelona, 4 - 28007 Madrid, with the value added tax identification number/VAT ID: A-86868114 (hereinafter referred to as "Renfe Mercancías"), and

Schweizerische Bundesbahnen SBB Cargo AG, with the registered office at Bahnhofstrasse 12, 4600 Olten, Switzerland, with the value added tax identification number/VAT ID: CHE100866483 (hereinafter referred to as “SBB Cargo”), and

SNCF Logistics, with the registered office at 24, rue Villeneuve, 92583 Clichy La Garenne, France, with the value added tax identification number/VAT ID: FR35552049447 (hereinafter referred to as “SNCF”), and

Union International des Chemins de fer (UIC), with the registered office at 16 Rue Jean Rey, 75015 Paris, France, with the value added tax identification number/VAT ID: FR43784601841 (hereinafter referred to as "UIC"), and

Verband Deutscher Verkehrsunternehmen e.V. (VDV), with the registered office at Kamekestrasse 37-39,
50672 Cologne, Germany, with the value added tax identification number/VAT ID: DE814379852 (hereinafter referred to as "VDV"), and

Železničná spoločnosť Cargo Slovakia a.s., with the registered office at Drieňová 24, 820 09, Bratislava, Slovakia, with the value added tax identification number/VAT ID: SK2021920065 (hereinafter referred to as “ZSSK Cargo”),

hereinafter jointly referred to as “RFF coalition members”,

may, in certain cases, collect and processes your personal data.

RFF coalition members will collect and process your personal data if you belong to one of the following groups of individuals: participants to RFF events, RFF contacts and other people RFF has a relationship with or may need to contact (hereinafter referred to as “data subjects”).

Principles that RFF coalition members follow in processing your personal data

  • RFF coalition members are committed to collect and process your personal data in compliance with applicable European and national data protection laws, including the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
  • RFF coalition members are transparent about processing your personal data;
  • RFF coalition members only collect your personal data for legitimate purposes that are specified below. If RFF coalition members intend to further process your personal data for a purpose other than that for which the personal data were collected, RFF coalition members will inform you about it prior to that further processing;
  • RFF coalition members strictly limit collection, processing and retention of your personal data to what is necessary for RFF coalition members to be able to achieve the goals of the RFF campaign in accordance with its mission and vision;
  • RFF coalition members put effort in keeping your personal data accurate and up-to-date by performing regular corrections;
  • RFF coalition members keep your personal data for no longer than it is necessary for the purposes for which your personal data were collected;
  • RFF coalition members take reasonable steps to ensure appropriate security of your personal data by adequate IT security measures.

This privacy statement explains what personal data, on which bases and for which purposes RFF coalition members collect and process on behalf of RFF, in particular through railfreightforward.eu (hereinafter referred to as “RFF coalition website”).

What personal data RFF coalition members collect and process on behalf of RFF

Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

RFF coalition members collect and process your personal data which is necessary to be able to achieve the goals of the RFF campaign. Most of such personal data you provide to RFF coalition members directly, such as when you register for an event RFF organises.

The precise personal data RFF coalition members collect and process on behalf of RFF depends on the context of your interactions with RFF coalition members. The personal data RFF coalition members collect and process on behalf of RFF can include the following:

  • Name and contact information. RFF coalition members may collect your first and last name, email address, postal address, phone number, and other similar contact data.
  • Content of emails. RFF coalition members may collect the content of your email communications sent to RFF coalition members in relation with the RFF campaign.
  • Photo and video. If you attend an event organised by RFF Campaign parties, your image may be captured and become a part of photo and video materials RFF coalition members produce.
  • Dietary information. If you attend an event organised by RFF coalition members on behalf of RFF, RFF coalition members may ask you to provide information on your allergies and diet constraints in order to provide you with the meal that suits your dietary needs.
  • Professional information. RFF coalition members may collect data on the company which you represent and your function.

What data is being collected by RFF coalition website

  • Browsing data. The computer systems and software procedures used in the functioning of RFF coalition website may acquire certain data, the transmission of which is implicit in the use of internet communication protocols. This category of data includes IP addresses or the domain names of the data subjects’ computers and terminals, addresses in URI/URL (Uniform Resource Identifier/Locator), notation for the requested resources, the time of the request, the method used to send the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response from the server (successful, error, etc.), as well as other parameters relating to the operating system and the data subject’s computer environment. These data, which are needed to use the web services, are also processed for the purpose of obtaining statistical information about the use of the services (most visited pages, number of visitors per time slot or per day, geographical area of origin, etc.), as well as to check the correct functioning of the services offered. Such browsing data are not kept for more than 7 days and are deleted immediately after aggregation, with the exception of the cases when judicial authorities request such data.
  • Data communicated by the user. Sending of emails to contact addresses, as well as submission of the forms on RFF coalition website by a data subject, means that this data subject’s contact details, as well as any personal data included in respective communication, will be stored in order to respond to such communication.
  • Google ReCaptcha. RFF coalition website uses Google’s reCAPTCHA service, which aims to distinguish human beings from robots in order to prevent improper use of web forms by spam bots. The reCAPTCHA may use cookies and other information such as IP address, date, time, language, screen size and resolution, as well as movements of the mouse on the page. For more information on this service you may visit the following web page published by Google: https://policies.google.com/privacy?hl=en.
  • AddToAny. RFF coalition website uses the AddToAny service, which is a plug-in that allows to integrate social networks and Google Analytics reporting on the website. For more information on this service you may visit the following web page published by AddToAny: https://www.addtoany.com/buttons/faq/#gdpr.
  • Cookies. RFF coalition website does not have cookies that may affect the confidentiality of the data subject’s browsing experience or acquire data subject’s identification details. Third-party cookies[1] are active on RFF coalition website, with the following analytics cookies being installed on RFF coalition website:
    • “_ga”: These cookies collect information in aggregate form in order to distinguish one data subject from another, without identifying the data subject, and to count the visits to the RFF coalition website;
    • “_gat”: These cookies collect data about the data subject’s browsing in aggregate form, in order to limit the RFF coalition website requests and speed up requests for access;
    • “_gid”: These cookies collect information in aggregate form in order to identify the session.

The expiry dates of above listed cookies are set by relevant third parties. You may find more information in regard to above listed cookies by visiting the following web pages: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage
https://policies.google.com/privacy?hl=en.

Third-party cookies used by RFF coalition website are anonymous as whmedia S.a.s. anonymizes all IP addresses, which means that Google is not be able to match the data subject’s IP address with other data collected via RFF coalition website. Such data are only obtained to trace and examine the data subjects’ behaviour on the RFF coalition website and to compile statistics based on the information gathered anonymously via data used in aggregate form. To see Google’s policy in regard to the Google Analytics service and to give your consent for the use of these cookies, you may visit the following webpage: https://policies.google.com/privacy?hl=en.

RFF coalition website does not use any profiling cookies.

How RFF coalition members use your personal data

RFF coalition members have a legitimate interest in collecting and processing personal data of data subjects in order to achieve the goals of the RFF campaign and for the following purposes:

  • For public relations purposes: RFF coalition members process personal data of the data subjects for the purposes of carrying out its advocacy activities on behalf of RFF;
  • For targeted communication purposes: RFF coalition members process personal data of the data subjects to communicate on the topics related to the RFF campaign, to share publications and invitations to RFF’s activities and events;
  • For organising events: RFF coalition members process personal data of individuals that participate in the events organised by RFF coalition members on behalf of RFF for the purpose of managing such events and in some cases gathering subsequent feedback or other input;
  • For press purposes: RFF coalition members process personal data of individuals working as journalists or in related areas to disseminate press materials on behalf of RFF;

Your rights in regard to your personal data:

You have the following rights in regard to your personal data that RFF coalition members process:

  • Confirm whether RFF coalition members process your data: You can ask RFF coalition members to provide you with (the categories of) your personal data that is being processed by them on behalf of RFF;
  • Copy or port your personal data: You can ask RFF coalition members for a copy of your personal data that is being processed on behalf of RFF as well as for a copy of personal data you provided to RFF coalition members directly, in a structured, commonly used and machine-readable format or that RFF coalition members transmit those data directly to another undertaking[2];
  • Correct or complete your personal data: You can ask RFF coalition members to update, correct or complete your personal data that RFF coalition members process on behalf of RFF in case it is inaccurate or incomplete;
  • Erase your personal data: In certain cases[3] you can ask RFF coalition members to erase all or some of your personal data RFF coalition members process on behalf of RFF;
  • Object to processing of your personal data: You can ask RFF coalition members to stop processing all or some of your personal data RFF coalition members process on behalf of RFF at any time. RFF coalition members will no longer process such personal data unless there are overriding legitimate grounds for such processing.
  • Restrict processing of your personal data: In certain cases[4], you can ask RFF coalition members to restrict processing of all or some of your personal data RFF coalition members process on behalf of RFF;
  • Complain to a data protection authority: You can complain about collection and processing of your personal data by RFF coalition members to a data protection authority in the Member State of your residence, place of work or place of the alleged infringement of your rights.
  • Withdraw your consent at any time: You can withdraw your consent at any time if RFF coalition members process your personal data on behalf of RFF based on your consent. Withdrawing your consent will not affect the lawfulness of any processing RFF coalition members conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent (performance of a contract or legitimate interests);
  • Ask for more information regarding your personal data: You can ask RFF coalition members to provide supporting and explanatory information in regard to:
    • why RFF coalition members process your personal data on behalf of RFF;
    • which categories of your personal data RFF coalition members process on behalf of RFF;
    • to whom and where RFF coalition members transfer your personal data on behalf of RFF;
    • the retention period for your personal data;
    • your right to correct your personal data, to erase it, to restrict its processing or to object to processing of your personal data by RFF Campaign parties;
    • right to lodge a complaint to a data protection authority;
    • from which source RFF coalition members obtained your personal data in case RFF coalition members didn’t collect it directly from you;
    • whether RFF coalition members use any automated decision-making process in regard to your personal data.

If you wish to exercise any of the above rights please contact RFF coalition members at the following email addresses: info [at] railfreightforward.eu . Please attach a copy of your ID to such email in order for RFF coalition members to verify your identity. RFF coalition members will respond to your request free of charge and within 30 days. RFF coalition members will charge a fee to cover the administrative costs of providing the information or will refuse to act on the request only in case your request is manifestly unfounded or excessive, in particular because of its repetitive character.

Security of your personal data

RFF coalition members are committed to protecting your personal data. To protect your personal data from unauthorized access, use or disclosure RFF coalition members employ, in particular, the following IT security measures: firewall, strong password protection, regular software updates, antivirus programs. Apart from that, cyber security policies are observed by all RFF coalition members’ employees at all times. Furthermore, RFF coalition members ensure that all necessary measures of protection of the RFF website are being taken, namely:

  • monthly maintenance and checks;
  • monthly back up of the database of RFF website;
  • the administrator level access to the website is limited to a small number of RFF coalition members’ employees and is protected with a strong password that is being changed regularly.

Where RFF coalition members process your personal data

RFF coalition members process your personal data on behalf of RFF in the following countries:

  • Austria (Rail Cargo Group, LTE, Ost West Logistik)
  • Belgium (CER, ERFA, Lineas)
  • Czech Republic (CD Cargo)
  • France (SNCF, UIC)
  • Germany (DB Cargo)
  • Italy (Mercitalia)
  • Lithuania (LTE Cargo)
  • Luxembourg (CFL cargo)
  • Poland (PKP Cargo)
  • Portugal (MEDWAY)
  • Slovakia (ZSSK Cargo)
  • Spain (Renfe Mercancías) 
  • Sweden (Green Cargo)
  • Switzerland (BLS Cargo, CIT, FTE, SBB Cargo)

RFF coalition members transfer your personal data outside of the European Economic Area (EEA) only if adequate level of protection of such personal data is ensured.

To whom RFF coalition members transfer your personal data

In order to organise and administer events of RFF, RFF coalition members may transfer your contact information to co-organiser(s) or hosting venue(s) of the event. In order to manage its RFF-related communications, RFF coalition members may transfer personal data of the data subjects to a marketing automation platform outside of the EU which treats all personal data received from the EU in accordance with the Privacy Shield framework’s applicable principles.

How long RFF coalition members retain your personal data

RFF coalition members only retain your personal data on behalf of RFF for as long as it is strictly necessary to achieve the purpose(s) for which those data were collected. As soon as RFF coalition members become aware of the fact that the individual does not belong to one of the groups of individuals listed above, RFF coalition members will erase all the personal data of such individual.

 

[1] Third-party cookies are cookies created by a website other than the one the user is browsing.

[2] You have the right to port your personal data or ask it to be ported by RFF coalition members only when (a) RFF coalition members process your personal data based on your consent or when processing is necessary for the performance of a contract to which you are party; and (b) the processing is carried out by automated means.

[3] You can ask RFF coalition members to erase your personal data if (a) it is no longer necessary for RFF coalition members to process your personal data; (b) you withdrew your consent on which the processing was based and there is no other legal ground for the processing; (c) you objected to the processing and there are no overriding legitimate grounds for the processing; (d) your personal data have been unlawfully processed; (e) your personal data have to be erased for compliance with a legal obligation.

[4] You can ask RFF coalition members to restrict processing of your personal data if a) you contested the accuracy of your personal data, for a period enabling RFF coalition members to verify its accuracy; (b) the processing is unlawful and you opposed the erasure of your personal data and requested the restriction of their use instead; (c) RFF coalition members no longer needs your personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; (d) you have objected to processing pending the verification whether the legitimate grounds of RFF coalition members override yours.