At a glance
We process personal data that you provide to us.
We process general personal data concerning you, e.g. name and contact details.
We do not process location data.
We process personal data that we collect in relation to you.
We process personal data concerning you that we receive from third parties.
We use your personal data with your consent for marketing and advertising purposes.
We use your personal data for the purpose of developing and improving products and services.
We do not analyse your behaviour or draw any inferences concerning your interests and preferences.
We pass on your personal data to other companies that process your data for us in accordance with contracts concluded with us.
We also process your personal data outside of Switzerland and the EU.
SBB AG Immobilien, Hilfikerstrasse 4, 3000 Bern 65, Switzerland, operates this website and the services offered on it and is thus responsible for processing your data.
This Privacy Policy applies to the processing of personal data by SBB AG Immobilien within the scope of the Swiss Data Protection Act and the General Data Protection Regulation (GDPR) of the European Union.
It gives you the most important information you need to know: What data we process, for what purpose we need the data, how we protect them, what added value you gain from the data processing, and how you can object to it.
Personal data include all details and information that refer to an identified or identifiable person. In addition to your contact details such as name, telephone number, postal address or e-mail address, this includes further information such as your date of birth.
When we refer to the processing of your personal data in this Privacy Policy, we mean all the ways in which your personal data is handled. This includes data storage, processing, use, erasure, etc.
What personal data do we collect and use?
Data you give us
These are data that you provide to us, for example when registering for inclusion in the list of prospective tenants, when creating a customer account, when making enquiries, when applying for a property or when submitting reports through the tenant portal. We use this data:
- to inform you about available properties (according to your interest in apartments, office space or commercial space)
- to contact you
- to process your enquiry
- to process your application
- to process your reservation
We collect the following data upon registration for inclusion in the list of prospective tenants for apartments:
- Title
- First name
- Surname
- Postcode, place of residence
- Reference number of the desired apartment
These data are stored in a database and are used for the purpose of marketing the building. You can remove yourself from the list of prospective tenants at any time by clicking on the link included in the confirmation e-mail.
We collect the following data whenever you express any interest in office space, commercial space and pop-up space using the contact form:
- Company
- Title
- First name
- Surname
- Telephone number
- Street
- House number
- Postal code, Town
- Message
- Concept
- Reference number for the desired space or the area required in m2
- Additional requirements for the desired space
These data are stored in a database and are used for the purpose of letting the space. After the initial contact, these data are supplemented by us with further data acquired during any subsequent contact (e.g. with the contact history). We will maintain this data on our list of prospective tenants to enable us to contact you about a suitable property.
We collect the following data in the event that you submit an enquiry using the contact form on this website other than a form for expressing an interest in a rental property (apartment, office or commercial space):
- Company
- Title
- First name
- Surname
- Telephone number
- Street
- Postal code, Town
- Message
These data are temporarily stored on the website for 6 months and then automatically erased. An e-mail is generated by your request and forwarded to the relevant persons / organisations.
We collect the following personal data when you use the form on the tenant portal to send a report (report damage & enquiries & orders):
- Customer number
- Techn. SwissPass login ID
- First name
- Surname
- E-mail address
- Telephone number
- Rental property number
- Content of the report
- Photos relating to the report
- Documents relating to the report
The data are transferred from the tenant portal to the SBB ERP system for processing by our employees. Depending on the nature of report, we may store it for the duration of the contract and then archive it.
When you apply for space (an apartment, parking space, studio etc.), we collect the following personal data from you and the other parties to the contract for the purpose of assessing your application:
- Title
- Academic title
- First name
- Surname
- Language
- Date of birth
- Marital status
- Nationality
- Residence permit
- Mobile & landline number
- Previous address
- Number of adults and children moving in
- Employment
- Employer reference details (optional)
- Gross annual income
- Current housing situation
- Reference details for previous landlords (optional)
- Identity document (ID, passport or residence permit)
- Extract from the debt enforcement register/CreditTrust certificate
In addition, other non-personal data are collected. If your application is successful, the data processed solely for the purpose of assessing the application will be deleted (e.g. identity document, extracts from the debt enforcement register, gross annual income, reference data, employment, previous address). If your application is not successful, your data, including the application, will be deleted.
If you are applying for an apartment in a new building, this can be done through a letting agency instructed by us. The letting agency is obliged under contract to comply with the SBB AG Privacy Policy.
If you apply for commercial space (retail, office, catering, healthcare), we process the following personal data from you and the other parties to the contract for the purpose of assessing your application:
- Title
- First name
- Surname
- Company
- Language
- Mobile phone number
- Landline number
- Reference number for the desired space
- Concept/commercial model
- Income statement
- Technical unit datasheet
If your application is successful, the data processed solely for the purpose of assessing the application will be deleted. If your application is not successful, your data, including the application, will be deleted.
We collect the following data in the event that you sign up for our newsletter:
- Title
- First name
- Surname
You can also enter your interests voluntarily where applicable. We process these data in order to personalise the information and offers we send you and to tailor them more effectively to your interests.
We use third-party e-mail marketing services that use tracking tools when sending e-mails. We collect the data for statistical purposes and subsequent dispatch as well as to optimise the content of our messages.
The following data are used:
- Information about the address file used
- Subject and number of newsletters sent
- Addresses to which the newsletter has not yet been sent
- Addresses to which the newsletter has been sent
- Addresses with failed dispatch
- Opening rate
- Addresses that have opened the newsletter
- Addresses that have unsubscribed from the newsletter distribution list
- Clicking behaviour
At the end of each newsletter there is a link through which you can unsubscribe from the newsletter at any time. When you unsubscribe, you can tell us your reason for doing so if you wish. After unsubscribing, your e-mail address will be blocked to prevent further newsletters from being sent to your e-mail address.
In order to prevent the use of the web beacon in our newsletter, please adjust the settings to stop HTML being displayed in messages.
We collect the following data when you submit a booking request for a station tour using the form:
- Date and time
- Group name
- Number of participants
- Are there people with impaired mobility in the group
- Personal details of the contact person
- Title
- First name
- Surname
- Company
- Telephone number
- Street
- Postcode and city/town
- Group type
This data is stored in a database and processed by our partner agency for the purpose of carrying out the station tour.
We collect the following data when you pay for a station tour via the link:
- Booking purpose
- Personal details of the contact person
- First name
- Surname
- Payment type
- Payment date
The payment is made via an external payment service provider (Payrexx AG). The payment service provider may process the following data: first name, surname, address, bank details incl. credit card numbers, TANs, checksums.
The terms and conditions and the data protection information of the respective payment service providers apply to the payment transactions; this information can be accessed on the respective website or transaction application. We also refer to these for further information and assertion of revocation, information and other data subject rights.
You can find further information in the Payrexx AG privacy policy.
With your SwissPass customer account, you can log in to our website and use various services. For this purpose, we receive the following data from SwissPass via data exchange Single Sign-On as part of the authentication process:
- Firstname and name
- Date of birth
- Gender
- Adress (street, postcode, city and country)
As part of the authentication process, login, customer and performance data are exchanged between the central login infrastructure of the Association of Public Transport and this website. This applies to the name, date of birth, address, email address and performance data.
Insofar as the EU-GDPR applies, the legal basis for the processing of personal data is the contractual performance requirement.
For more information, please see the privacy policy on swisspass.ch.
When you send a request for a quotation for a distribution or stand campaign via the form, we collect the following data:
- Desired areas
- Dates and times of the actions
- Information about the campaign
- Information on the companies involved
- Name of the company, organisation, party, association
- Adresse
- UID number
- Personal details of the contact person
- Title
- First name
- Last name
- Business e-mail
- Contact number
This data is stored in a database and processed for the preparation of quotations and the implementation of campaigns.
We collect the following data when you report your sales figures via the tenant portal:
- Sales & sales receipt figures
- Reason for inconsistencies
- Collection period
- Customer number
- SwissPass login ID
- Lease agreement number
- Date of collection
The data are transmitted from the tenant portal to the SBB ERP system and stored with your lease agreement. After the end of the contract, the data will be archived with the lease agreement.
If you have a login to access the sales reporting portal, we collect the following data:
- First name
- Last name
- Telephone number
- E-mail address
- Password (encrypted)
- Company
- Business partner ID
- Authorisation group
- Login time and logged-in application
This data is stored and used in the SAP IAS system. When logging in to the sales reporting portal, only the necessary data is transmitted using the OpenID Connect protocol so that a person can be identified on the portal.
The following data will be collected/processed when you use the tenant portal:
- Title
- First name
- Surname
- Telephone number
- E-mail address
- Company (optional)
- Customer number
- Lease agreement numbers
- Role in relation to the lease agreement (you could be the main tenant, for example)
- Technical SwissPass login ID
- Last time of login
- IP address
The data are provided, transmitted and processed by the SBB ERP system. You can amend certain data (telephone number, e-mail address).
If you reserve a common room, parking space or laundry room via the tenant portal, we collect the following personal data:
- Customer number
- SwissPass login ID
- First name
- Surname
- E-mail address
- Telephone number
- Reservation property number
- Number of people (common room only)
- Reason for the reservation (common room only)
The data are transmitted from the tenant portal to the SBB ERP system. Past reservations will be archived after one year.
When you complete a transaction in the tenant portal (create a report, receive a message, make a reservation, need a login verification code, etc.), the system sends you an e-mail. When sending and opening these e-mails, we collect/process the following data:
- E-mail address
- Customer number
- Time of opening
- Time of receipt
- Link clicks
We use the Microsoft Dynamics Customer Insights system Journey to send this e-mail, which collects the above data. We collect the data for statistical purposes and to optimise the content of our messages.
In every e-mail, you will receive a link with the option to opt out of tracking.
Data collected during maintenance / when entering a contact person / emergency contact in the tenant portal
If you maintain emergency contacts / contact persons for your lease agreements, we collect the following data:
- Title
- First name
- Surname
- Street
- House number
- Town/city
- Postal code
- Mobile phone
- Landline phone
- E-mail address
- Language
- Role in lease agreement (e.g. emergency contact)
The person is entered as the contact person in the SBB ERP system, is assigned the selected role and is linked to your lease agreement. The contact person data are only processed for the purpose of the role in question (e.g. emergency contact in the event of an emergency and if the tenant cannot be reached). You can edit and delete this person’s data at any time.
We collect the following data whenever you express any interest in our real estate listings using the contact form on this website:
- Company
- Title
- First name
- Surname
- Telephone number
- Street
- House number
- Postal code, Town
- Message
- Concept (for commercial space)
- Reference number for the desired space
These data are stored in a database and are used for the purpose of letting the rental property. After the initial contact, these data are supplemented by us with further data acquired during any subsequent contact (e.g. with the contact history).
Data that are automatically collected whenever you visit this website
You do not have to reveal any data to surf on our website pages. What happens automatically: Our servers record every access, store the following data for 12 months and then automatically delete the data again.
- The IP address of the computer requesting access;
- the name of the owner of the IP address range (usually your Internet access provider)
- the date and time of access;
- the website from which our website is being accessed (referrer URL), including the search term where applicable;
- the name and URL of the file being requested;
- the status code (e.g. error message);
- the operating system on your computer;
- the browser you are using (type, version and language);
- the transmission protocol being used (e.g. HTTP/1.1) and
- your username from the registration/authentication process, where applicable.
We collect and process these data in order to guarantee system security and stability and to assess error and performance analyses. We also use the IP address to set the default language on the website. The IP address is also analysed together with the other data following any attempt to access the network infrastructure or in the event of any other unauthorised or improper use of our website in order to establish what has occurred and to prevent subsequent attacks and, where applicable, will be used for the purposes of identification during criminal proceedings and in civil and criminal procedures against the users concerned.
Finally, whenever you visit this website, we use cookies and other applications and tools based on cookies. You can find further details below in this Privacy Policy.
SBB AG does not provide any warranty concerning compliance with data protection regulations of non-SBB websites to which links are provided from SBB websites.
We use the map service of Mapbox, Inc. on this website. When you open a page with a Mapbox map, your browser connects to a Mapbox server in order to display this map. When this connection is established, Mapbox collects the following technical data in particular:
- Your IP address of the requesting computer,
- the date and time of access,
- the website from which the access was made,
- the name and URL of the map accessed,
- the operating system of your computer,
- the browser you use (type, version and language),
Further information can be found in the privacy policy of mapbox.com.
We use the video hoster bunny.net on this website to display some videos. When you click on a video, your browser connects to the server of our video hoster in order to display the video. During this connection, Bunny.net collects the following technical data in particular:
- Your IP address of the requesting computer,
- the date and time of access
- the website from which the access was made
- the name of the video accessed
- the operating system of your computer
You can find more information in the data protection declaration of bunny.net.
Our website uses the “Friendly Captcha” service offered by Friendly Captcha GmbH (Am Anger 3-5, 822237 Wörthsee, Germany). This service is a privacy-friendly solution that makes it difficult to run automated programs and scripts (bots) on our website. We have integrated the Friendly Captcha code into our website in forms so that the visitor’s device can connect to Friendly Captcha servers and receive a computational task. The device solves the task (puzzle) and sends the result to our web server, which then contacts Friendly Captcha’s server through an interface to check the result. Depending on the result, we can safely process or reject requests through our website.
In the process mentioned above, Friendly Captcha processes and stores the following data:
- anonymous IP address of the requesting computer,
- information about the browser and operating system used,
- anonymous counters per IP address for controlling cryptographic tasks and the website from which access took place.
This data is used exclusively to protect against spam and bots. Friendly Captcha does not set cookies on the visitor’s device and does not read any. IP addresses are only stored in encrypted form and do not allow us or Friendly Captcha to infer the identity of an individual. If personal data is collected, it will be deleted no later than 30 days.
For more information on data protection when using Friendly Captcha, visit https://friendlycaptcha.com/legal/privacy-end-users/ .
Do we pass on data to third parties?
Yes, however, we will only disclose your personal data if you have given your express consent, if there is a legal obligation to do so or if it is necessary for us to do so in order to enforce our rights, in particular to enforce claims arising under the relationship with you.
Where applicable, we may also disclose data to various service providers (e.g. host providers, cloud service providers) as part of our provision and maintenance of the website and the services offered on it. These service providers will only use your data for the purposes mentioned and will likewise comply with the applicable data protection and data security requirements.
If our website contains any links to third-party websites, we no longer have any influence over the collection, processing, storage or use of personal data by third parties once you have clicked on these links and do not accept any responsibility in this regard.
Do we transfer data abroad?
We are entitled to transmit your personal data to third parties (contracted service providers) abroad. These are obliged to comply with data protection law to the same extent as we are. If the level of data protection in a country does not match that in Switzerland, we shall ensure under contract that your personal data are protected to the same extent as in Switzerland at all times.
What are your rights in relation to your personal data?
You have the following rights in relation to your personal data:
- Information about your stored personal data
- Rectification, supplementation, blocking or erasure of your personal data (if due to legal storage obligations we can only erase your data at a later date, they will be blocked in the meantime)
- Delete your customer account or have it deleted
- Object to the use of your data for marketing purposes
- Withdraw your consent for future data processing
- Transmission of your data
If you have any questions regarding data protection, please contact our data protection officer (this will be kept confidential).
Use our contact forms:
Go to the form for information and deletion requests Go to the form for general enquiries about data protection
Alternatively, contact us in confidence by post:
SBB AG
Data Protection Office
Hilfikerstrasse 1
3000 Bern 65
This is how to reach our data protection representative in the EU
MLL Brussels SPRL
222, Av. Louise
1050 Bruxelles [Brussels]
Belgium
How do we protect your data?
We employ suitable technical and organisational security measures to protect the personal data we store against manipulation, partial or total loss and unauthorised access by third parties. Our security measures are continuously improved in line with technological development.
We also take data protection within SBB very seriously. We have required our staff and the service providers we contract to maintain confidentiality and to comply with data protection regulations.
We will take appropriate precautionary measures to protect your data. However, the transmission of information over the Internet and other electronic means always entails certain security risks and we cannot offer any guarantee as regards the security of information transmitted in this way.
What are cookies?
Cookies help in many respects to make your visit to this website simpler, more pleasant and more worthwhile. Cookies are information files which your web browser automatically stores on your computer’s hard drive when you visit our website. They do not damage your computer’s hard drive and cannot collect any other data stored on it.
How do we use cookies?
For example, we use cookies to temporarily store the details you enter when filling in a form on our website or your choice of website language so that you do not need to re-enter this information when you access another subpage. Where applicable, cookies may also be used to identify you as a registered user once you have registered on the website to avoid you having to log in again when you access another subpage.
On the following page we have listed all cookies used: Cookies
Most web browsers accept cookies automatically. However, you can configure your browser so as to prevent cookies from being stored on your computer or so that a message always appears when you receive a new cookie. Deactivating cookies means that you may not be able to use all of the features on this website.
What are tracking tools?
Tracking tools (also known as tags) are an important indicator for our websites. Can the contents be captured intuitively? What is the surfing behaviour of users like? How can we make it easier to find information? Many of these questions can be answered using tracking tools.
We use tracking tools so that
- we can better understand how you navigate through our websites (and where there may be stumbling blocks).
- we know if you’re reading our e-mails.
- we can offer you better online marketing services.
In conjunction with cookies, tracking tools can analyse user behaviour in relation to online offers.
What tracking tools do we use?
We use Microsoft Dynamics Customer Insights to track the e-mails we send. This applies to transaction-relevant e-mails (e.g. enquiry receipt confirmations) and marketing-relevant e-mails (e.g. campaigns). We process the following data:
- IP address
- Technical customer number
- E-mail sending, receipt, time of opening
- Click on links
In every e-mail, you will receive a link with the option to opt out of tracking.
You will find the Microsoft Dynamics Customer Insights data protection and privacy notice here.
On our websites and apps we use the web analytics service of the company Piano Analytics based in France to optimise the websites and apps. You can request that your data are not be processed by Piano Analytics by clicking on “Cookie settings”.
The following data will be processed:
- Anonymised IP address
- Anonymous tracking data (browser behaviour, click behaviour, login status and login type, device access, etc.)
Place of data processing: EU
Ensuring security
The last three digits of the IP address are deleted immediately after it is collected and before it is further processed to ensure the information is anonymous. The IP address is not linked to any other information that allows visitors to be identified.
For more information on the data collected with Piano Analytics, see atinternet.com.
We use an Adobe tag management system in order to ensure the controlled management of analytical and online marketing software on this website and to improve the technical performance of this website. The tag management system controls, according to definable rules, which software components (tags) used on the website, as described in this Privacy Policy, are used in which form. In this way, we ensure that only the aforementioned tags are used and that they only collect data in the manner described here.
The tag management system passes on data to the tags mentioned and in the manner described. Cookies may also be used as part of this process. However, no data are stored in the tag management system.
Further details concerning the Adobe Launch Tag Management System privacy policy can be found here: https://www.adobe.com/privacy.html
How long is your data stored?
We store personal data only for as long as necessary to provide services that you have requested or with respect to which you have granted your consent, and to the extent indicated in this Privacy Policy.
We retain contract data for as long as required by the relevant legal retention obligations. Retention obligations that require us to retain data arise from accounting and tax regulations.
Where is your data stored?
Your data is normally stored in databases within Switzerland. However, in some of the cases listed in this Privacy Policy, the data is also processed by service providers whose head offices are located outside Switzerland. If the country in question does not offer an adequate level of data protection, we use contractual arrangements with these companies to guarantee that your data is adequately protected by these companies. In addition, transfers outside the EEA/EU are secured by using the authorised standard data protection clauses.
Contact person
If you have any questions concerning data protection on this website, please do not hesitate to get in touch with our contact for data protection law.
Use our contact forms:
Go to the form for information and deletion requests Go to the form for general enquiries about data protection
Alternatively, contact us in confidence by post:
SBB AG
Data Protection Office
Hilfikerstrasse 1
3000 Bern 65
This is how to reach our data protection representative in the EU
MLL Brussels SPRL
222, Av. Louise
1050 Bruxelles [Brussels]
Belgium
Last updated: June 2024
