Privacy Policy

The controller within the meaning of Art. 4 No. 7 GDPR is:

1. Nahverkehrsservice Sachsen-Anhalt GmbH (NASA GmbH)
2. represented by the managing director Mr. Peter Panitz
3. Am Alten Theater 4
4. 39104 Magdeburg
5. Deutschland
6.  
7. Phone.: +49 (0)391 53631-0
8. Fax: +49 (0)391 53631-99
9.  
10. E-Mail: info@nasa.de
11. Website: www.nasa.de

We have appointed an external data protection officer. You can contact our data protection officer using the following contact details:

1. Mrs. Meggie Dachner
2. DATA 4.0 Gesellschaft für Datenschutz und Datensicherheit mbH
3. Dornbergsweg 2
4. 38855 Wernigerode
5. Deutschland
6.  
7. E-Mail: m.dachner@data40.de
8. Phone.: +49 (0)3943 509949-0

1. Description and scope of data processing

Each time our app is accessed, our system automatically collects data and information from the operating system of the accessing end device.

This data record consists of:

• IP address of the user and
• the date and time of access.

The requests are stored in the log files of our systems for sixty days. No further storage of this data together with other personal data of the user takes place.

2. Purpose of data processing

Temporary storage of your IP address is necessary to enable delivery of our apps to the user's device. For this purpose, the IP address must remain stored for the duration of the session.

The data is stored in log files to ensure the functionality of our apps. We also use the data to ensure the security of our information technology systems. The data is not analyzed for marketing purposes in this context.

3. Legal basis for data processing

The legal basis for the temporary storage of your IP address and the log files is our legitimate interest pursuant to art. 6 para. 1 sentence 1 lit . f GDPR.

1. Description and scope of data processing

If you contact us via the contact form, we will process the personal data transmitted with the inquiry. You can see which data this concerns in detail in the input fields of our form. In addition, all other data that you voluntarily provide us with in the context of your inquiry will be transmitted.

2. Purposes and legal bases of data processing

Your contact details are processed solely for the purpose of handling your inquiry.

3. Legal basis for data processing

The legal basis for the processing of the data transmitted in the course of your inquiry is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR.

If your inquiry is aimed at concluding a contract, the legal basis for this data processing is the initiation or fulfillment of a contract in accordance with Art. 6 (1) lit. b GDPR.

4. Recipients of personal data

No transfer to third parties takes place.

5. Duration of storage

Your request data will be deleted as soon as it is no longer required for the aforementioned purpose and there are no retention obligations that prevent deletion.

The GDPR grants you certain rights when your personal data is processed. If you wish to exercise these rights, please send your request by email – clearly identifying yourself – to our data protection officer or by post to our business address

1. Right to revoke the declaration of consent (art. 7 para. 3 GDPR)

You have the right to revoke your consent at any time. Revoking your consent will not affect the lawfulness of the processing carried out based on your consent before its revocation.

2. Right to confirmation and information (art. 15 GDPR)

You have the right to request confirmation as to whether personal data concerning you is being processed; If this is the case, you have the right to information about this personal data and to the information listed in detail in art. 15 GDPR.

3. Right to rectification (Art. 16 DSGVO)

You have the right to request the immediate rectification of inaccurate personal data concerning you and, where applicable, the completion of incomplete personal data.

4. Right to deletion (art. 17 GDPR)

You have the right to request that personal data concerning you be deleted immediately if one of the reasons listed in art. 17 GDPR applies

5. Right to restriction of processing (art. 18 GDPR)

You have the right to request that processing be restricted if one of the conditions listed in art. 18 GDPR is met.

6. Right to information (art. 19 GDPR)

If you have asserted the right to rectification or deletion of your data or to restrict processing to the person responsible, the person responsible is obliged to inform all recipients to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients upon request by the person responsible.

7. Right to data portability (art. 20 GDPR)

In certain cases, which are listed in detail in art. 20 GDPR, you have the right to receive the personal data concerning you in a structured, common and machine-readable format or to request that this data be transmitted to a third party.

8. Right to object (art. 21 GDPR)

If data is collected on the basis of art. 6 para. 1 sentence 1 lit. f of the GDPR (data processing to protect the legitimate interests of the person responsible or a third party), you have the right to object at any time for reasons arising from your particular situation to object to the processing. We will then no longer process the personal data unless there are demonstrably compelling legitimate reasons for the processing that outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

9. Right to complain to a supervisory authority (art. 77/78 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, your place of work or the place of the alleged infringement, if you are of the opinion that the processing of your personal data is contrary to violates the GDPR.

In the state of Saxony-Anhalt, the responsible supervisory authority is the State Commissioner for Data Protection for Saxony-Anhalt, Leiterstrasse 9, 39104 Magdeburg.

In order to protect your data as comprehensively as possible from unwanted access, we take technical and organizational measures in accordance with the current state of the art. We use an encryption method in our app. Communication between the app and our server is transmitted via the Internet using SSL/TLS encryption.

Our app is subject to technological progress. We therefore reserve the right to adapt our data protection information in line with changes to our security and data protection measures and any extended data processing, and to provide you with the currently valid version here.

Stand: November 2025

Magdeburg, 14th September 2025

Nahverkehrsservice Sachsen-Anhalt GmbH