Data Privacy

General information about data processing

The, to the Paribus Group belonging, NRail GmbH (hereinafter referred to as “NRail”, or “we”) thanks you for visiting our website and for your interest in our company and our products. We take the protection of your private data very seriously and want you to feel safe when visiting our website. As the person responsible for data protection, we would like to inform you below about the type and scope of the processing of personal data.

The protection of your privacy when processing personal data is an important concern for us, which we take into account in our business processes. We generally process personal data only insofar, as this is necessary to provide a functional website including our content and services and / or you contact us using the email addresses provided on our website, the contact form or when logging in as part of the user master data provide.

Personal data is collected to ensure the functionality of our website and to optimize our website for you. The legal basis for the processing is – unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, conflict with this – Art. 6 para. 1 lit. f GDPR.

When processing personal data that is necessary to fulfill a contract (usually the data usage contract), Art. 6 Para. 1 lit. b EU General Data Protection Regulation (GDPR) serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.

Insofar as none of these legal regulations apply to the processing of personal data, the processing of personal data can only be carried out with your special consent. The legal basis in this case is Art. 6 Para. 1 lit. a GDPR.

The personal data will be deleted or blocked as soon as the purpose of storage no longer applies. A storing can also take place if this has been provided for by the European or national legislator. The data will also be blocked or deleted if a prescribed storage period expires, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract.

Personal data is only transmitted to state institutions and authorities within the framework of mandatory European and national legislation. Our employees are committed to confidentiality.

Collection and processing of personal data on our website

When you visit our website, our web server stores, among other things, the server log data listed in detail below. Storage can also take place if this has been provided for by the European or national legislator.

Server log files

We automatically collect and store information in so-called server log files, which your browser automatically transmits to us. These are:

  • Visited website
  • Browser type and browser version
  • Operating system used
  • Source / reference from which you came to the page
  • Date and time of access
  • Amount of data sent in bytes
  • IP address used

This data is not merged with other data sources.

This data is recorded on the basis of Art. 6 Para. 1 lit. f GDPR. We have a legitimate interest in the technically error-free presentation and statistical evaluation and optimization of our website – the server log files must be recorded for this. NRail reserves the right to check the server log files retrospectively if there are specific indications of illegal use.


Our websites use cookies. These are small text information that are stored on the computer by your browser. In this way, the collection of cookies makes it easier for you to use our services and enables us to better understand your user behavior and to offer content and services tailored to your needs. Some functions of our website cannot be offered without the use of cookies. In addition, some elements of our website require that the accessing browser can be identified even after a page change.

The legal basis for the processing of personal data using cookies is Art. 6 Para. 1 lit. f GDPR.

As a user, you have full control over the use of cookies and can delete the cookies used from your computer at any time. You can also deactivate or restrict the transmission of cookies by changing the settings in your browser. Cookies that have already been saved can be deleted at any time.


This cookie is required to store consent in the context of the cookie banner. It is saved for 1 year after consent has been given under the cookie banner; unless you, the user, delete this cookie in your browser or change your decisions regarding the granting of your consent in the context of the cookie banner by loading the cookie banner again via the following link (insert link). In addition, the cookie is deleted after 1 year. No personal data is saved.

Google Maps

In order for you to be able to use the geo-referenced address book “Railation”, we integrate maps from the service “Google Maps” from the provider Google Ireland Limited. However, the integration only takes place after you have actively approved the use. The processed data can include, in particular, IP addresses and location data of the users. The same applies to the use of geo-referenced elements on Visit for more information or for the privacy policy of the provider Google.

Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited. The legal basis for the use is our legitimate interest (i.e. our interest in the analysis, optimization and economic operation of our website within the meaning of Art. 6 Para. 1 lit.f GDPR). Google uses cookies, which are stored on your computer and which enable an analysis of your use of our website. The information generated by the cookie about your use of our website may be transferred to a Google server in the USA and stored there. However, Google will shorten your IP address beforehand by activating IP anonymization. On our behalf, Google will use this information to evaluate your use of our website and to compile reports on website activity. We have no influence on the scope of the data collection. The purpose and scope of the data collection and the further processing and use of the data by Google as well as your rights and setting options for protecting your privacy can be found in Google’s privacy policy information at The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. You can prevent the storage of cookies by setting your browser software accordingly. However, NRail hereby points out that in this case you may not be able to use all of the content on the website to its full extent. As a user, you can also prevent Google from collecting the data generated by the cookie and related to your use of our website (including a link to your IP address) and from processing this data by Google by deactivating the link below Download and install the available browser plug-in:

We also offer you the option of deactivating the collection of your website usage data for this website by clicking on the following link Deactivating the collection of data by Google Analytics for this website. In this case, a special opt-out cookie will be used that prevents future collection of your user data when you visit this website.

Local storage functions on the login page

Furthermore, we use, in order to enable you a functional and attractive use of our website based on our legitimate interest according to Art. 6 Para. 1 lit. f GDPR, my.nrail local storage functions on the login page. Data is stored locally in the cache of your browser, which continues to exist and can be read even after the program has ended – given that you do not delete the cache. If you do not want us to use local storage functions, you can control this in the settings of your respective browser depending on the platform via the operating system. There you will get an overview of your saved files. The following information is e.g. saved after your entry: First name, last name, email address, profile picture.

You can manage local storage content in the browser using the “Chronicle” or “Local files” settings, depending on which browser you are using. We would like to point out that this may result in functional restrictions.


Social plugins from YouTube are used on this website. These are offers from Google Inc. (1600 Amphitheater Parkway, Mountain View, CA 94043, USA (“Google”)). When you visit a page that contains such a plugin, your browser connects to YouTube and the content is loaded from these pages. Your visit to our website may be tracked by YouTube, even if you do not actively use the social plugin function. YouTube provides detailed information on the scope, type, purpose and processing of your data on its website. Here you will also find further information on your rights and setting options to protect your privacy. Data protection information from Google:

Collection and processing of personal data when contacting us by email, contact form and when logging in when entering the user master data

On our website it is possible to contact us via the email address provided, the contact form and, when logging in, by entering the user master data. In this case, the user’s personal data transmitted with the email will be saved. In this context, there is generally no transfer of the data to third parties, unless the point “transfer of personal data to third parties” of this privacy policy provides for this. The data is used exclusively for the processing and editing of contact or for the execution of the contract. The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is the case when contacting us via e-mail / contact form when the respective conversation with the user has ended, i.e. when it can be inferred from the circumstances that the matter in question has been finally clarified. In the context of a contractual relationship of data made available, the contract termination is decisive taking into account the usual retention periods.

The legal basis for the processing of this data is Art. 6 Para. 1 lit. f GDPR. If the e-mail contact / contact form is aimed at the conclusion of a contract or if the data serve to carry out the contract, an additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR.

Collection and processing of personal data when applying

If you apply directly to NRail GmbH, we will forward the application documents to Paribus Holding GmbH & Co. KG, as the headquarters for the parent company belonging to the Paribus Group with a uniform human resources department. We process personal data about you for the purpose of your application for an employment relationship, insofar as this is necessary as part of the forwarding to Paribus Holding. Furthermore, Paribus Holding processes the personal data about you for the purpose of your application for an employment relationship, insofar as this is necessary for the decision on establishing an employment relationship with us. This can be general data about you (such as name, address and contact details), information about your professional qualification and school education or information about further vocational training or other information that you provide to us in connection with your application. In addition, Paribus Holding can process job-related information that you have made publicly available, such as a profile on professional social media networks. The legal basis is Section 26 (1) in conjunction with 8 p. 2 Federal Data Protection Act (new) (BDSG (new)). If Paribus Holding does not collect the data directly from you and you have an active profile on an online job platform – such as StepStone – or if you disclose an inactive or only partially active profile to us as part of the application process, Paribus Holding can process personal data apart from the named above.

Paribus Holding processes your application in particular via StepStone, so that on our behalf StepStone Deutschland GmbH and its subcontractors, which you can find in the StepStone GTC, are recipients. As part of the processing of your application by StepStone on our behalf, security services from Akamai Technologies, Inc are used, which may result in a transfer to the USA. Akamai is Privacy Shield certified, so there is an adequate level of data protection. The certification can be found online in Privacy Shield List of the EU-U.S. Privacy Shield.

Furthermore, Paribus Holding can process personal data about you, insofar as this is necessary to defend against legal claims from the application process against us or Paribus Holding. The legal basis is Art. 6 Para. 1 lit. f GDPR, the legitimate interest is, for example, an obligation to provide evidence in a procedure under the General Equal Treatment Act (AGG).

In the event of an employment relationship between you and us, we and Paribus Holding may, in accordance with Section 26 (1) of the German Federal Data Protection Act (BDSG), further process the personal data already received from you for the purposes of the employment relationship if this is necessary for the implementation or termination of the employment relationship or in order to exercise or fulfil the rights and obligations of employee representation arising from a law or collective agreement, works or service agreement (collective agreement).

Paribus Holding stores your personal data for as long as it is necessary to decide on your application. If an employment relationship between you and us does not materialize, Paribus Holding can also continue to store data insofar as this is necessary to defend against possible legal claims. The application documents will be deleted two months after the announcement of the rejection decision, unless longer storage is required due to legal disputes. The provision of personal data is neither legally nor contractually prescribed, nor are you obliged to provide the personal data. However, the provision of personal data is required to conclude a contract for an employment relationship with us. This means that if you do not provide Paribus Holding with personal data when applying, we will not enter into an employment relationship with you.

Disclosure of personal data to third parties

The Paribus Group companies will treat your personal data confidentially. This data is received by the Paribus Group company you contact or when you contact us via our general e-mail address centrally at the Paribus Group and, if necessary, is passed on to other Paribus Group companies for the purposes mentioned. Any further disclosure to third parties will only take place if we are legally obliged to do so, we commission an external service provider to process your information and data is processed on the basis of contracts in accordance with Art. 28 GDPR. An example of this is the sending of letters or emails or the processing by host providers or providers of applicant management systems. These service providers only receive the information that is needed to perform their tasks. You may not use them for other purposes and are obliged to (new) treat the information in accordance with the GDPR and the Federal Data Protection Act. We also conclude corresponding confidentiality agreements and, if applicable, contract data processing contracts with each partner. In all other cases, we will inform you if personal information is to be passed on to third parties, giving you the opportunity to give your consent.

Rights of the user

You can request information from us about your personal data stored by us, at any time free of charge. In addition, you are entitled to have this data corrected or completed if necessary, should it prove to be incorrect or incomplete and, if necessary, also exercise your right to restrict the processing of your data or the deletion, provided the respective requirements are met Request your personal data. This does not apply if storage is required due to legal regulations. If deletion cannot be carried out, data processing is restricted. Your request should be sent to the following contact details:

NRail GmbH, Königstraße 28, 22767 Hamburg, phone +49 40 8888 00 6-0, email:

You also have the right to object to the processing of your personal data at any time. This does not apply to data whose collection is absolutely necessary for the provision and operation of the website. If you have contacted us by e-mail or applied to us via an online job platform, you can also object to the storage of your personal data at any time. In such a case, the conversation cannot be continued, and the application process cannot be continued. After receiving your objection, we will no longer use, process and transmit the data concerned for purposes other than to process the concluded contracts. The lawfulness of the processing carried out before the revocation remains unaffected.

If you want to object to the collection, processing or use of your data by NRail GmbH in accordance with these data protection regulations as a whole or for individual measures, you can send your objection to the following contact details: NRail GmbH, Königstraße 28, 22767 Hamburg or by email: data

Responsible body in terms of data protection

The responsible body for the collection, processing and use of your personal data within the meaning of the General Data Protection Regulation (GDPR) and the BDSG (new) is NRail GmbH, Königstraße 28, 22767 Hamburg.

Data protection officer

If you have any questions regarding the processing of your personal data, you can contact our data protection officer at the responsible office (email: ), who is also available with her team in the event of requests for information, suggestions or complaints.