The German version prevails; this English version is provided for information purposes only.
In this privacy policy, we, Shuttler GmbH (Shuttler, we or us), explain how we collect and otherwise process personal data. This is not an exhaustive description; other privacy statements or general terms and conditions, conditions of participation and similar documents may govern specific matters. Personal data means any information relating to an identified or identifiable individual.
If you provide us with personal data of other persons (e.g. family members or work colleagues), please make sure that these persons are aware of this privacy policy, and only share their personal data with us if you are allowed to do so and if this personal data is correct.
Shuttler serves the Swiss market and targets customers of transport services within Switzerland. This privacy policy is therefore primarily designed to meet the requirements of the Swiss Federal Act on Data Protection (FADP). Whether and to what extent other laws apply depends on the individual case.
Shuttler is responsible for the data processing described here, unless otherwise stated in individual cases. If you have any data protection concerns, you can send them to us at the following contact address.
Shuttler GmbH, Hardturmstrasse 161, 8005 Zurich. E-mail: contact@shuttler.ch. Website: www.shuttler.ch.
We primarily process the personal data we receive from our customers and other business partners in the course of our business relationship, or that we collect from users when operating our website and other applications.
To the extent permitted, we also take certain data from publicly accessible sources (e.g. press, internet) or receive it from authorities and other third parties. In addition, we may process sociodemographic data (for marketing) and data relating to the use of the website (e.g. IP address, details of your device and its settings, date and time of visit, pages and content accessed, functions used, referring website).
Where bookings are made via a distribution partner (currently Distribusion, Germany; Busbud, Canada), we receive from that partner the passenger data required for the carriage, in particular the name and, where applicable, contact details.
We use the personal data we collect primarily to enter into and perform our contracts with customers and business partners.
In addition, to the extent permitted and appropriate, we process personal data of you and other persons for the following purposes, in which we (and sometimes third parties) have a legitimate interest corresponding to the purpose: offering and further developing our offers, services and platforms; communicating with third parties and processing their inquiries; testing and optimising needs-analysis procedures; advertising and marketing, provided you have not objected to the use of your data; market and opinion research; assertion of legal claims and defence in legal disputes and official proceedings; prevention and investigation of criminal offences and other misconduct; safeguarding our operations, in particular IT, the website and other applications; as well as corporate transactions and compliance with legal obligations.
Insofar as you have given us consent to process your personal data for certain purposes (e.g. when registering for a newsletter), we process your personal data within the scope of and based on that consent, insofar as we have no other legal basis. Consent given can be revoked at any time, but this has no effect on processing that has already taken place.
In the course of our business activities, we disclose personal data to third parties to the extent permitted and where the provision of our services requires it. This concerns in particular the following categories of recipients:
We disclose personal data to public bodies and authorities (e.g. police, public prosecutor, supervisory authorities) where we are obliged or entitled to do so.
Our IT infrastructure and databases are operated on Amazon Web Services (AWS) in the EU (Stockholm region, Sweden). Booking, passenger and accounting data is stored and processed there.
In the course of an ordinary booking and during operations, personal data is disclosed to the following recipients, which process it on our behalf (processors):
Certain recipients process personal data under their own responsibility (independent controllers), not on our behalf:
Where we transfer personal data to a country without adequate data protection within the meaning of Art. 16 f. FADP, we ensure appropriate protection, unless an exception under Art. 17 FADP applies.
Recipients in the EU/EEA (our hosting with AWS in Sweden; Distribusion in Germany) and in Switzerland (our accounting service provider) benefit from recognised adequate protection.
For our recipients in the USA – Stripe, Twilio, Telnyx, Google and Mapbox – we base the transfer on their certification under the Swiss-U.S. Data Privacy Framework, which the Swiss Federal Council has recognised as providing adequate protection.
For recipients in Canada (Busbud), Swiss law recognises adequate protection insofar as the recipient is subject to the Canadian PIPEDA.
For measurement of the use of our website we use Umami (Umami Cloud); data may be processed in the USA. Umami does not set cookies and processes the IP address solely for anonymised reach measurement, not to identify individual persons. No booking or customer data is transmitted to Umami.
We typically use "cookies" and similar technologies on our websites to recognise your browser or device. A cookie is a small file that is stored on your device by the browser you use when you visit our website. In addition to cookies used only during a session and deleted afterwards (session cookies), cookies can also be used to store user settings and other information for a certain period (permanent cookies). However, you can set your browser to reject cookies, store them for one session only, or otherwise delete them early. If you block cookies, certain functions (e.g. language selection, ordering processes) may no longer work.
By using our websites and consenting to receive newsletters and other marketing emails, you consent to the use of these technologies. If you do not want this, you must set your browser accordingly.
For reach measurement we use Umami (Umami Cloud). This allows us to record the use of our website (e.g. page views as well as IP address and browser details on customer-facing pages) in order to understand how our content is used. The data may be processed in the USA. Administration pages are excluded from measurement.
To display our content correctly and in a graphically appealing way across browsers, we use "Google Web Fonts" from Google LLC to display fonts.
On our website we use Google Maps, operated by Google LLC. This allows us to display interactive maps directly on the website and to enable you to use the map function conveniently. For more information on data processing by Google, please see Google's privacy policy.
On our website and in our tracking views, we also use Mapbox to display interactive maps. When the map loads, your IP address is transmitted to Mapbox (USA).
We use Google reCAPTCHA on our website to enhance security and protect against automated abuse. reCAPTCHA is used to determine whether interactions on this website are performed by a human or a bot. The use of reCAPTCHA is subject to Google's privacy policy and terms of service. reCAPTCHA may collect certain browsing data and use cookies.
On our website we use Elementor, software used to create the layout of this website. Cookies are used to store the number of page views and active sessions. The collected data is not used for analysis purposes, but only to ensure that, for example, hidden elements are not displayed again during multiple active sessions.
We process and store your personal data as long as it is necessary for the fulfilment of our contractual and legal obligations or otherwise the purposes pursued with the processing, i.e. for example for the duration of the entire business relationship as well as beyond that in accordance with statutory retention and documentation obligations. In this context it is possible that personal data will be retained for the time during which claims can be asserted against our company and insofar as we are otherwise legally obliged to do so or legitimate business interests require it. As soon as your personal data is no longer required for the above-mentioned purposes, it will as a rule and to the extent possible be deleted or anonymised.
Within the scope of the data protection law applicable to you and insofar as provided therein, you have the right to information, correction, deletion, the right to restrict data processing and the right to object to data processing. Please note, however, that we reserve the right to enforce the restrictions provided for by law, for example where we are obliged to retain or process certain data, have an overriding interest in doing so, or require it for the assertion of claims.
Exercising these rights is generally free of charge. In exceptional cases – in particular where a request involves disproportionate effort – we may charge a reasonable share of the costs within the limits permitted by law; we will inform you in advance.
Exercising such rights generally requires that you clearly prove your identity (e.g. by means of a copy of your identity document, where your identity is otherwise unclear or cannot be verified). To exercise your rights, you can contact us at the address given above.
In addition, every data subject has the right to enforce their claims in court or to lodge a complaint with the competent data protection authority. The competent data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch).
In the context of our business relationship, you must provide the personal data necessary for establishing and carrying out a business relationship and fulfilling the associated contractual obligations (as a rule, there is no legal obligation to provide data). Without this data, we will generally not be able to enter into or perform a contract with you. Also, the website cannot be used if certain traffic-securing information (such as the IP address) is not disclosed.
We may amend this privacy policy at any time without prior notice. The current version published on our website applies. Insofar as the privacy policy is part of an agreement with you, we will inform you of the change by email or other suitable means in the event of an update.
