rebus Regionalbus Rostock GmbH
Parumer Weg 35
18273 Güstrow
Phone: +49 3843 6940-0
Email: info@rebus.de
Represented by Managing Director Thomas Nienkerk
Data Protection Officer
Jan Thomas Jacobi
Phone: +49 3843 6940-295
Email: datenschutz@rebus.de
This statement applies to all personal data that you provide to us
- when you download and use the Rubi app (listed as “rubi” in the Apple App Store and Google Play Store),
- when using the web-based booking platform (in your browser),
- or when making a reservation by phone.
When you download the Rubi app from the App Store or Google Play, the store operators collect the following data: username, email address, customer number, time of download, and a device identifier. This data transfer is the responsibility of Apple/Google; we do not store this data further.
When you visit our booking website, a connection is established with our servers. In doing so, we collect and process:
- Your IP address, date and time of access, browser type, operating system
- referrer URL (which page you visited previously)
The purpose is to ensure technical functionality, security (protection against DDoS and bot attacks), and optimization of the web application. Legal basis: Art. 6(1)(f) of the GDPR.
A customer account is required for the app and website. We collect:
- Required information: Last name, first name, cell phone number (Art. 6(1)(b) GDPR – performance of a contract)
- Optional information: Email address (Art. 6(1)(a) GDPR – Consent)
Personal data is transmitted in encrypted form using TLS.
On our web platform, we use:
- Technically necessary cookies (for session management and login persistence; Art. 6(1)(f) GDPR)
- Tracking cookies and analytics services (e.g., Google Analytics) only with your consent (Art. 6(1)(a) GDPR)
- To ensure that the analytics functions are designed with data protection in mind, IP anonymization is enabled in Google Analytics. This means that the IP address is truncated within the EU prior to processing. You can revoke your consent at any time via our cookie settings in your browser.
To fulfill the contract, we collect the following information at the time of booking and during the trip:
- Information regarding the starting point, pickup location, and destination
- Date and time of the trip
- Number of seats required (including wheelchair space or proof of a regional transit pass)
- Trip duration and kilometers traveled
To the extent that GPS data is used, the processing is based on Article 6(1)(a) of the GDPR. We process technical information about the device (operating system) based on Article 6(1)(f) of the GDPR (to ensure technical functionality). All other booking-related data is processed in accordance with Article 6(1)(b) of the GDPR.
In your customer account (app & web), you can view the following information under “Booked Trips”:
- Current or past rides
- Route, pick-up and drop-off times, pick-up and drop-off locations
- Route and vehicle used
- Authorization code and fare
This transparency is based on Article 6(1)(b) of the GDPR.
We use the Google Maps API provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to display interactive maps in the app and on the web and to determine the distance to your vehicle. With your consent (Art. 6(1)(a) of the GDPR), we transmit anonymized GPS coordinates to Google so that the estimated fare can be calculated and the vehicle’s location displayed. Google processes this data in accordance with its Terms of Service (www.google.com/help/terms_maps.html) and its Privacy Policy (policies.google.com/privacy). It is not possible to trace this data back to you personally.
In the Rubi app, we use Firebase (Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) to analyze technical crash reports and measure the performance of app features. No personal data is transmitted to Firebase. Push notifications are sent via Firebase Cloud Messaging (Android) and Apple Push Notifications (iOS). For this purpose, a pseudonymized key (app ID and device identifier) is processed. This identifier constitutes personal data within the meaning of Art. 4(1) of the GDPR. Processing requires your consent pursuant to Art. 6(1)(a) of the GDPR, which you may withdraw at any time in your device settings. Data is transferred to Firebase in the U.S. based on the EU Standard Contractual Clauses pursuant to Article 46(2)(c) of the GDPR. Detailed documentation regarding the data transfer impact assessment is available and may be viewed upon legitimate interest.
When booking by phone, please provide your first and last name, cell phone number, pickup and drop-off addresses, date, time, and seating preferences. An email address may be provided voluntarily.
- Required information: Art. 6(1)(b) GDPR (performance of a contract)
- Optional information: Art. 6(1)(a) GDPR (consent)
You can pay in cash on board or present your personal Deutschlandticket or a valid VVW network ticket. No personal payment data is stored. The processing of personal data in connection with ticket inspection is based on Article 6(1)(b) of the GDPR, as it is necessary for the performance of the contract of carriage. Upon boarding the vehicle, passengers must present their authorization code without being asked. This can be done by verbal declaration, by displaying it on a mobile device, or by presenting a printed copy. Passengers purchase a ticket from the driver or present an existing ticket. For verification purposes, the driver may inspect or take possession of the ticket. Information processed in this context (e.g., ticket number, validity, and, if applicable, the name on personalized tickets) is used exclusively to verify the passenger’s right to travel. No further storage or automated analysis takes place, unless otherwise required by law.
We use service providers as data processors (Art. 28 GDPR), including:
- ioki GmbH (hosting of the app platform)
- External service providers (mailings, printing, data center)
Data transfers to third countries take place only if an adequate level of data protection exists (Art. 45 GDPR) or if suitable safeguards are in place pursuant to Art. 46 GDPR (in particular, EU Standard Contractual Clauses). Access to the relevant agreements is possible upon demonstration of a legitimate interest.
Personal data is stored only as long as necessary for the respective purpose or as required by statutory retention obligations. Once the purpose no longer applies, we will delete or block the data. Trip-related data (e.g., booked routes) is routinely deleted after three years, provided there are no legal or contractual reasons preventing such deletion.
Personal data is protected through measures such as TLS encryption, firewalls, access controls, and regular security audits. In addition, the platform operator (ioki GmbH) uses a certified information security management system in accordance with ISO/IEC 27001 and conducts penetration tests from time to time.
You have the right to access, correct, delete, restrict the processing of, and transfer your personal data, as well as to withdraw any consent you have given. If you have any questions regarding the processing of personal data, please contact our Data Protection Officer (see Section 1).
No automated individual decision-making within the meaning of Article 22 of the GDPR or profiling procedures take place.
Without prejudice to other legal remedies, you have the right to file a complaint with a supervisory authority, such as the State Commissioner for Data Protection and Freedom of Information of Mecklenburg-Western Pomerania, Schloss Schwerin, Lennéstraße 1, 19053 Schwerin.
Phone: +49 (0)385 59494-0
Email: info@datenschutz-mv.de
Website: www.datenschutz-mv.de
We update this Privacy Policy in response to new legal requirements, technical developments, or changes in our business operations. You can find the current version at any time in the Rubi app, on the online booking platform, and on our website.
Effective: August 20, 2025
