General information about data processing
The, to the Paribus Group belonging, NRail GmbH (hereinafter referred to as “NRail”, or “we”) thanks you for visiting our website and for your interest in our company and our products. We take the protection of your private data very seriously and want you to feel safe when visiting our website. As the person responsible for data protection, we would like to inform you below about the type and scope of the processing of personal data.
The protection of your privacy when processing personal data is an important concern for us, which we take into account in our business processes. We generally process personal data only insofar, as this is necessary to provide a functional website including our content and services and / or you contact us using the email addresses provided on our website, the contact form or when logging in as part of the user master data provide.
Personal data is collected to ensure the functionality of our website and to optimize our website for you. The legal basis for the processing is – unless the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, conflict with this – Art. 6 para. 1 lit. f GDPR.
When processing personal data that is necessary to fulfill a contract (usually the data usage contract), Art. 6 Para. 1 lit. b EU General Data Protection Regulation (GDPR) serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.
Insofar as none of these legal regulations apply to the processing of personal data, the processing of personal data can only be carried out with your special consent. The legal basis in this case is Art. 6 Para. 1 lit. a GDPR.
The personal data will be deleted or blocked as soon as the purpose of storage no longer applies. A storing can also take place if this has been provided for by the European or national legislator. The data will also be blocked or deleted if a prescribed storage period expires, unless there is a need for further storage of the data for the conclusion or fulfillment of a contract.
Personal data is only transmitted to state institutions and authorities within the framework of mandatory European and national legislation. Our employees are committed to confidentiality.
Collection and processing of personal data on our website
Server log files
We automatically collect and store information in so-called server log files, which your browser automatically transmits to us. These are:
- Visited website
- Browser type and browser version
- Operating system used
- Source / reference from which you came to the page
- Date and time of access
- Amount of data sent in bytes
- IP address used
This data is not merged with other data sources.
This data is recorded on the basis of Art. 6 Para. 1 lit. f GDPR. We have a legitimate interest in the technically error-free presentation and statistical evaluation and optimization of our website – the server log files must be recorded for this. NRail reserves the right to check the server log files retrospectively if there are specific indications of illegal use.
The legal basis for the processing of personal data using cookies is Art. 6 Para. 1 lit. f GDPR.
This cookie is required to store consent in the context of the cookie banner. It is saved for 1 year after consent has been given under the cookie banner; unless you, the user, delete this cookie in your browser or change your decisions regarding the granting of your consent in the context of the cookie banner by loading the cookie banner again via the following link (insert link). In addition, the cookie is deleted after 1 year. No personal data is saved.
We also offer you the option of deactivating the collection of your website usage data for this website by clicking on the following link Deactivating the collection of data by Google Analytics for this website. In this case, a special opt-out cookie will be used that prevents future collection of your user data when you visit this website.
Local storage functions on the login page my.nrail.de
Furthermore, we use, in order to enable you a functional and attractive use of our website based on our legitimate interest according to Art. 6 Para. 1 lit. f GDPR, my.nrail local storage functions on the login page. Data is stored locally in the cache of your browser, which continues to exist and can be read even after the program has ended – given that you do not delete the cache. If you do not want us to use local storage functions, you can control this in the settings of your respective browser depending on the platform via the operating system. There you will get an overview of your saved files. The following information is e.g. saved after your entry: First name, last name, email address, profile picture.
You can manage local storage content in the browser using the “Chronicle” or “Local files” settings, depending on which browser you are using. We would like to point out that this may result in functional restrictions.
Social plugins from YouTube are used on this website. These are offers from Google Inc. (1600 Amphitheater Parkway, Mountain View, CA 94043, USA (“Google”)). When you visit a page that contains such a plugin, your browser connects to YouTube and the content is loaded from these pages. Your visit to our website may be tracked by YouTube, even if you do not actively use the social plugin function. YouTube provides detailed information on the scope, type, purpose and processing of your data on its website. Here you will also find further information on your rights and setting options to protect your privacy. Data protection information from Google: https://www.google.com/intl/de/policies/privacy
Collection and processing of personal data when contacting us by email, contact form and when logging in when entering the user master data
The legal basis for the processing of this data is Art. 6 Para. 1 lit. f GDPR. If the e-mail contact / contact form is aimed at the conclusion of a contract or if the data serve to carry out the contract, an additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR.
Collection and processing of personal data when applying
If you apply directly to NRail GmbH, we will forward the application documents to Paribus Holding GmbH & Co. KG, as the headquarters for the parent company belonging to the Paribus Group with a uniform human resources department. We process personal data about you for the purpose of your application for an employment relationship, insofar as this is necessary as part of the forwarding to Paribus Holding. Furthermore, Paribus Holding processes the personal data about you for the purpose of your application for an employment relationship, insofar as this is necessary for the decision on establishing an employment relationship with us. This can be general data about you (such as name, address and contact details), information about your professional qualification and school education or information about further vocational training or other information that you provide to us in connection with your application. In addition, Paribus Holding can process job-related information that you have made publicly available, such as a profile on professional social media networks. The legal basis is Section 26 (1) in conjunction with 8 p. 2 Federal Data Protection Act (new) (BDSG (new)). If Paribus Holding does not collect the data directly from you and you have an active profile on an online job platform – such as StepStone – or if you disclose an inactive or only partially active profile to us as part of the application process, Paribus Holding can process personal data apart from the named above.
Paribus Holding processes your application in particular via StepStone, so that on our behalf StepStone Deutschland GmbH and its subcontractors, which you can find in the StepStone GTC, are recipients. As part of the processing of your application by StepStone on our behalf, security services from Akamai Technologies, Inc are used, which may result in a transfer to the USA. Akamai is Privacy Shield certified, so there is an adequate level of data protection. The certification can be found online in Privacy Shield List of the EU-U.S. Privacy Shield.
Furthermore, Paribus Holding can process personal data about you, insofar as this is necessary to defend against legal claims from the application process against us or Paribus Holding. The legal basis is Art. 6 Para. 1 lit. f GDPR, the legitimate interest is, for example, an obligation to provide evidence in a procedure under the General Equal Treatment Act (AGG).
In the event of an employment relationship between you and us, we and Paribus Holding may, in accordance with Section 26 (1) of the German Federal Data Protection Act (BDSG), further process the personal data already received from you for the purposes of the employment relationship if this is necessary for the implementation or termination of the employment relationship or in order to exercise or fulfil the rights and obligations of employee representation arising from a law or collective agreement, works or service agreement (collective agreement).
Paribus Holding stores your personal data for as long as it is necessary to decide on your application. If an employment relationship between you and us does not materialize, Paribus Holding can also continue to store data insofar as this is necessary to defend against possible legal claims. The application documents will be deleted two months after the announcement of the rejection decision, unless longer storage is required due to legal disputes. The provision of personal data is neither legally nor contractually prescribed, nor are you obliged to provide the personal data. However, the provision of personal data is required to conclude a contract for an employment relationship with us. This means that if you do not provide Paribus Holding with personal data when applying, we will not enter into an employment relationship with you.
Disclosure of personal data to third parties
The Paribus Group companies will treat your personal data confidentially. This data is received by the Paribus Group company you contact or when you contact us via our general e-mail address centrally at the Paribus Group and, if necessary, is passed on to other Paribus Group companies for the purposes mentioned. Any further disclosure to third parties will only take place if we are legally obliged to do so, we commission an external service provider to process your information and data is processed on the basis of contracts in accordance with Art. 28 GDPR. An example of this is the sending of letters or emails or the processing by host providers or providers of applicant management systems. These service providers only receive the information that is needed to perform their tasks. You may not use them for other purposes and are obliged to (new) treat the information in accordance with the GDPR and the Federal Data Protection Act. We also conclude corresponding confidentiality agreements and, if applicable, contract data processing contracts with each partner. In all other cases, we will inform you if personal information is to be passed on to third parties, giving you the opportunity to give your consent.
Rights of the user
You can request information from us about your personal data stored by us, at any time free of charge. In addition, you are entitled to have this data corrected or completed if necessary, should it prove to be incorrect or incomplete and, if necessary, also exercise your right to restrict the processing of your data or the deletion, provided the respective requirements are met Request your personal data. This does not apply if storage is required due to legal regulations. If deletion cannot be carried out, data processing is restricted. Your request should be sent to the following contact details:
NRail GmbH, Königstraße 28, 22767 Hamburg, phone +49 40 8888 00 6-0, email:
You also have the right to object to the processing of your personal data at any time. This does not apply to data whose collection is absolutely necessary for the provision and operation of the website. If you have contacted us by e-mail or applied to us via an online job platform, you can also object to the storage of your personal data at any time. In such a case, the conversation cannot be continued, and the application process cannot be continued. After receiving your objection, we will no longer use, process and transmit the data concerned for purposes other than to process the concluded contracts. The lawfulness of the processing carried out before the revocation remains unaffected.
If you want to object to the collection, processing or use of your data by NRail GmbH in accordance with these data protection regulations as a whole or for individual measures, you can send your objection to the following contact details: NRail GmbH, Königstraße 28, 22767 Hamburg or by email: data
Responsible body in terms of data protection
The responsible body for the collection, processing and use of your personal data within the meaning of the General Data Protection Regulation (GDPR) and the BDSG (new) is NRail GmbH, Königstraße 28, 22767 Hamburg.
Data protection officer
If you have any questions regarding the processing of your personal data, you can contact our data protection officer at the responsible office (email: ), who is also available with her team in the event of requests for information, suggestions or complaints.