Data protection information

What about data protection?

Personal data relating to you will be processed at various points for the purposes of project execution. Personal data is any information on the basis of which you can be identified, either directly or indirectly. Data is processed in accordance with the EU’s General Data Protection Regulation (GDPR) and Germany’s Federal Data Protection Act (BDSG). In addition to personal registration, this relates to the camera technology used, which serves to guarantee vehicle control and passenger safety. In their capacity as data controllers, the project partners Hamburger Hochbahn AG, IAV and Siemens Mobility have concluded an agreement regarding joint data processing.


Who is the controller?

The following project partners are responsible for data processing:

1. Hamburger Hochbahn AG

Steinstrasse 20

20097 Hamburg


2. IAV GmbH Ingenieurgesellschaft Auto und Verkehr

Carnotstrasse 1

10587 Berlin


3. Siemens Mobility GmbH

Otto-Hahn-Ring 6

81739 München


4. Deutsches Zentrum für Luft- und Raumfahrt e.V.

Linder Höhe

51147 Köln


Who is your contact?

Your first point of contact for all data protection issues and for the exercise of rights as a data subject is Hamburger Hochbahn AG:

Hamburger Hochbahn AG (see above)



What is the legal basis for each form of data processing?

Data processing is performed in accordance with the following legal bases:

  • Point (f) of Art. 6 (1) GDPR; sentence 1 nos. 2 and 3 of Section 4 (1) BDSG (legitimate interests)
  • Point (j) of Art. 9 (2) GDPR in conjunction with Section 27 BDSG (scientific purposes, specifically to conduct a scientific research project)
  • Point (a) of Art. 6 (1) GDPR (consent)


What legitimate interests are pursued?

The legitimate interest relates to the execution of a research project to improve the current state of the art regarding automated driving as well as to surveillance of the interiors of the vehicles used in order to guarantee the safety of the persons carried, of the property of the transport company and also generally in the public sphere.


For what specific purpose is data processed?

Camera technology: Cameras are used in the HEAT project for the purposes of scientific research regarding user requirements and optimisation potential. Camera technology is additionally used to guarantee passenger safety, to manage safe operations, to prevent and solve criminal offences and for the protection of property. The cameras are located in the vehicle interiors and exteriors.

Passenger registration: The passenger must register in order to use the HEAT shuttle. An app has been developed for passenger registration; this is the responsibility of IAV GmbH Ingenieurgesellschaft Auto und Verkehr. The app-specific data privacy notice is made available within the app. This can additionally be found here. Insofar as the app is not to be used, a paper form may alternatively be completed for the purpose of passenger registration.

The data will not be used for any other purposes (e.g. marketing).


For how long will the data be stored?

If you revoke your consent (in relation to your registration as a passenger), your data will be erased insofar as it is no longer required for data retention purposes and insofar as its erasure is not precluded by any statutory record retention obligations. All other personal data will be erased at the end of the project in 2021.


Will data be forwarded to third parties?

Under certain circumstances, camera surveillance data will be shared with the local law enforcement agencies. Data will not be shared with any other third parties.


What are your rights as the data subject?

In accordance with the data protection laws as applicable, you may, among other things, have the right to:

  • revoke your consent at any time,
  • request confirmation as to whether we are processing personal data relating to you and receive information regarding the personal data we process,
  • demand the rectification of incorrect personal data,
  • demand the erasure of the personal data processed by us,
  • demand restriction of the processing of personal data and
  • object to your personal data being processed on grounds relating to your particular situation.

We ask that you contact the address stated above directly regarding the establishment of your rights as a data subject.

Notwithstanding this, every data subject has the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to them infringes the GDPR. The data subject can assert this right to a supervisory authority in the Member State of their habitual residence, place of work or place of the alleged infringement. The competent supervisory authority in Hamburg is:

The Hamburg Commissioner for Data Protection and Freedom of Information

Ludwig-Erhard-Strasse 22, 7th floor
20459 Hamburg
Tel.: +49 (0)40 428 544 040