Privacy Policy

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you.

Data Collection on This Website

Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find their contact details in the Imprint of this website.

How do we collect your data?
Your data is collected when you provide it to us (e.g., via email). Other data is automatically collected by our IT systems when you visit the website. This is primarily technical data (e.g., internet browser, operating system, or time of page access).

2. Controller

Ivan Pervushin
Marxstr. 10b
45527 Hattingen
Germany

Email: contact@zug-ticket-kaufen.de

3. Hosting

This website is hosted by an external service provider (host). The personal data collected on this website is stored on the host's servers. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website access, and other data generated through a website.

Hosting provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany
Server location: Germany (Nuremberg/Falkenstein)

The use of the host is in the interest of secure, fast, and efficient provision of our online services. This constitutes a legitimate interest within the meaning of Art. 6 (1) lit. f GDPR.

Host's privacy policy:hetzner.com/legal/privacy-policy

Server Log Files

On every request our web server (Traefik) logs the time, requested address, HTTP method and status code, response time, your IP address, the user agent (browser and device type) and the referrer. These log files are deleted after six days at the latest. They serve secure operation and attack detection. Legal basis: Art. 6 (1) lit. f GDPR.

Attack Prevention (CrowdSec, Fail2ban)

To protect against automated attacks we analyse the log files for typical attack patterns and temporarily block conspicuous IP addresses. We use CrowdSec and Fail2ban on our server for this. With CrowdSec, detected attacks (the attacker's IP address, type of attack, time) are transmitted to CrowdSec SAS, France; in return we receive a list of known attacker addresses. No session content and no data of inconspicuous visitors is transmitted. Legal basis: Art. 6 (1) lit. f GDPR (security of the service). Privacy information from CrowdSec: crowdsec.net/privacy-policy

4. Web Analytics with Umami

This website uses Umami, a privacy-friendly open-source web analytics software.

What is Umami?

Umami is an alternative to Google Analytics that is specifically designed for privacy. Umami collects no personal data and uses no cookies.

Operation: We run Umami ourselves on our own server (subdomain analytics.pervushin.de). No data is transmitted to Umami Software, Inc. or any other third party.
Server location: Germany (Hetzner Online GmbH, see section 3)

What data is collected?

  • Page views (which pages are visited)
  • Referral source (where visitors come from)
  • Approximate location (country/region, not exact)
  • Device type (desktop, mobile, tablet)
  • Browser and operating system

What is NOT collected?

  • No IP addresses are stored
  • No cookies are set
  • No personal identification data
  • No cross-site tracking

Legal basis: The use of Umami is based on our legitimate interest in statistical analysis of user behavior (Art. 6 (1) lit. f GDPR). Since Umami does not collect personal data and does not set cookies, no consent is required.

Consent Management (Klaro)

This website uses Klaro, an open-source tool for managing your cookie consent preferences. Klaro is self-hosted on our server and does not transfer any data to third parties. It stores your consent decisions in a local cookie in your browser.

Provider: Klaro (open source, self-hosted)
Legal basis: Art. 6(1)(c) GDPR (legal obligation to obtain consent)

5. Web Analytics with Google Analytics

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

What is Google Analytics?

Google Analytics uses cookies to analyze the use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server and stored there.

What data is collected?

  • Page views and time spent
  • Referral source (where visitors come from)
  • Approximate location (country/region)
  • Device type, browser and operating system
  • Interactions on the website

IP Addresses and Transfer to the USA

Google Analytics 4 does not store users' IP addresses. The IP address is technically transmitted when the connection is made but is not logged. The usage data collected may nevertheless be transferred to servers of Google LLC in the USA. This is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR); Google LLC is certified under it. Without your consent, no connection to Google is made.

Your Consent

Important: Google Analytics is only loaded with your explicit consent. When you first visit this website, you will be asked whether you agree to the use of analytics cookies. You can revoke or adjust your consent at any time via the .

Legal basis: The use of Google Analytics is based on your consent (Art. 6 (1) lit. a GDPR). You can revoke your consent at any time.
Google's privacy policy:policies.google.com/privacy

6. Error Monitoring with Sentry

To detect and fix technical errors we use Sentry. We operate our own Sentry instance (Sentry Self-Hosted, domain sentry.xingu-ad.net) on a server of Hetzner Online GmbH in Helsinki (Finland, EU). No data is transmitted to Sentry, Inc.

What data is collected?

When an error occurs on a page, an error report is transmitted. It contains the page URL, the error message with its call stack, browser and operating system type, and the time. Your IP address is technically transmitted when the connection is made; it is not stored as a user identifier (sendDefaultPii is disabled). No cookie and no entry in your device's local storage is created. Error reports are deleted after 30 days.

Legal basis: Art. 6 (1) lit. f GDPR. Our legitimate interest is the stability and security of the service. You may object under Art. 21 GDPR (contact: see imprint).

Error recording (Sentry Replay) – consent only

In addition, we can record the last seconds of your session when an error occurs, in order to reproduce it. Text input and media are masked or hidden. The recording is transmitted only on an error and stores a session identifier in your browser's session storage. It is off by default and only activated with your consent (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG). You can withdraw it at any time via the ; the withdrawal takes effect from the next page view.

6a. Hotel Recommendations with Stay22

On detail pages for trains, stations, connections, cities and events we show a hotel recommendation link from Stay22 that takes you to accommodation offers from our affiliate partners (including Booking.com, Airbnb, Expedia) based on the destination context.

What is Stay22?

We render Stay22 as a plain, server-rendered link — not an embedded map or iframe from stay22.com. Only when you actively click the link does Stay22's offer overview ("Allez") open in a new tab. If you book there, we receive a commission — at no extra cost to you.

What data is collected?

Before you click, no connection to Stay22 is established andno cookie is set by us — the link is purely static. The click itself is only recorded as an anonymous event in our own cookie-free analytics (Umami, see section 4). Only after the click, on Stay22's own site, does their privacy policy apply — the data processing there (including any cookies) is outside our control.

Historical note: Earlier versions of this page embedded Stay22 as an interactive map iframe that set its own cookies and required consent. That implementation was removed (low conversion, third-party cookie blocking) and replaced with the plain link described above — a consent banner is not required for this link.

Provider: Stay22 Inc., 4388 Saint-Denis, Montreal, QC H2J 2L1, Canada
Legal basis: legitimate interest in providing relevant travel offers (Art. 6 (1) lit. f GDPR) — since no data is transmitted to Stay22 before the click, no consent is required.
Stay22 privacy policy:stay22.com/privacy

7. Affiliate Networks and Partner Tracking

This website is financed through affiliate partnerships. When you click on links to our partners, you are redirected through affiliate networks that record the click and any resulting booking. The following services may be used:

Omio (Affiliate Tracking via Impact)

When you click on Omio links, you are redirected through the Impact affiliate network (domain omio.sjv.io). Impact and Omio may set cookies to attribute the booking to our portal. We also pass the parameter subId1=zugticket so clicks from this site can be distinguished from other sites operated by the same publisher.
Provider (network): Impact Tech, Inc., Santa Barbara, CA, USA
Impact privacy policy:impact.com/privacy-policy
Provider (merchant): Omio (Omio Deutschland GmbH), Berlin, Germany
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in financing the service)

Awin (FlixBus Tracking)

When you click on FlixBus links, you are redirected through the Awin network. Awin sets a cookie to attribute the booking to our portal.
Provider: Awin AG, Eichhornstr. 3, 10785 Berlin, Germany
Privacy policy:awin.com/gb/privacy
Legal basis: Art. 6(1)(f) GDPR (legitimate interest)

Partnerize (Trainline Tracking)

When you click on Trainline links, you are redirected through the Partnerize network (prf.hn). Partnerize sets a cookie to attribute the booking.
Provider: Partnerize Ltd, Newcastle upon Tyne, United Kingdom
Privacy policy:partnerize.com/en/privacy-policy
Legal basis: Art. 6(1)(f) GDPR (legitimate interest)

Note: Affiliate cookies are only set when you actively click on a partner link. Without clicking such a link, no tracking by these networks takes place. The commission has no effect on the price you pay.

8. Comment function on train detail pages

On individual train pages you can post experiences and delay reports. No registration is required — we store no user account and no password. Providing an e-mail address is optional and only needed if you want to receive the Trustpilot review invitation described below.

What data is stored?

  • Name / nickname — freely chosen, shown publicly with the comment.
  • Comment text — published after automated moderation (see below).
  • Optional for delay reports: travel date, delay in minutes, reason.
  • Optional — e-mail address — stored only if you enter it voluntarily AND additionally tick the Trustpilot consent checkbox. Without both steps the field remains empty in the database. The address is not displayed publicly and is used only for the purpose described in the "Trustpilot review invitation" section below.
  • IP address — stored exclusively as a cryptographic hash (SHA-256) with a server-side key, never in plaintext. The hash is used only for anti-spam / anti-abuse purposes (e.g. a limit of 5 comments per hour) and cannot be reversed to recover the original IP.
  • Timestamp of submission.

Trustpilot review invitation (optional)

If, when submitting a comment, you enter your e-mail address and tick the relevant consent checkbox, we send you a short confirmation e-mail. That confirmation e-mail is additionally blind-copied (BCC) to a technical Trustpilot address (…@invite.trustpilot.com), so that Trustpilot can subsequently send you an invitation to review zug-ticket-kaufen.de by e-mail.

Legal basis is Art. 6(1)(a) GDPR (consent). Without an active tick in the form,no e-mail is sent and no address is transmitted to Trustpilot.

Provider: Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen, Denmark. Data is processed within the EU. Trustpilot's privacy terms are available at legal.trustpilot.com.

Withdrawal: You can withdraw consent at any time — either via the opt-out link in the Trustpilot invitation mail or by an informal message to the address listed in the imprint. Your stored e-mail address will then be deleted without undue delay.

Automated content moderation

Every submitted comment is automatically reviewed before publication by a self-hosted language model (Ollama / Llama 3.1), which detects spam, abuse and inappropriate content. The review runs on our own servers in Germany; no data is transmitted to external AI providers. Depending on the review outcome, your comment is either published immediately, moved to a manual review queue, or rejected.

Spam protection (ALTCHA)

To prevent automated submissions we use ALTCHA, an open-source captcha replacement based on a cryptographic proof-of-work puzzle. ALTCHA runs entirely on our own servers without any external service embedding, sets no cookies, does not read browser fingerprints, and transmits no data to third parties. The puzzle is solved in the background by your browser; you typically do not notice it.

Legal basis & retention

Legal basis is Art. 6(1)(f) GDPR (legitimate interest in operating a functioning, spam-free community feature). Published comments remain visible indefinitely as they serve other users as information. Rejected or hidden comments are deleted after 90 days.

Your rights

Because we deliberately do not store IP addresses or user identities, we can only identify individual comments by the displayed name/nickname and the text. To request deletion of a specific comment, please contact us at the address listed in the imprint and provide the name, train number, and approximate time of the comment.

9. General Information and Mandatory Disclosures

Data Protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

Server Location

The servers for this website are located in Germany (Hetzner data centers in Nuremberg/Falkenstein). The data of this website is processed and stored there.

Transfers to Third Countries

A transfer to third countries only takes place in these cases:

  • Google Analytics (section 5, consent only): USA, based on the EU-US Data Privacy Framework (Art. 45 GDPR).
  • Affiliate networks (section 7, only after you click a partner link): Impact (USA) and Partnerize (United Kingdom). For the USA the Data Privacy Framework adequacy decision applies where the provider is certified, otherwise standard contractual clauses (Art. 46 GDPR); the United Kingdom has an adequacy decision.
  • Stay22 (section 6a, only after you click the link): Canada, for which an adequacy decision exists for commercial organisations.

In all these cases the connection starts from your browser after you consented or actively clicked a link. We do not transmit data from our servers to these providers.

10. Your Rights

You have the right at any time to:

  • Access information about your data stored with us (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Object to processing (Art. 21 GDPR)
  • Data portability (Art. 20 GDPR)

If you believe that the processing of your data violates data protection law, you can file a complaint with a supervisory authority.

11. External Links

This website contains links to third-party external websites (e.g., bahn.de, nightjet.com). When you click on these links, you leave our website. We have no control over the privacy practices of these websites and accept no responsibility for their content. Please read the privacy policies of the respective websites.

12. Local Storage in Your Browser

We only store information on your device where it is required for a function you requested (§ 25 (2) no. 2 TDDDG) or where you consented:

  • klaro-consent (local storage): your cookie choice.
  • preferred_lang and dismissed_locale_banner (cookies, 1 year): your chosen language and dismissal of the language hint.
  • ztk_saved_routes and ztk_recent_trains (local storage): your saved routes and recently viewed trains. They stay on your device.
  • ztk_ab_variants (local storage, only with Google Analytics consent): remembers which of two designs of a booking button you see. Without consent nothing is stored.
  • Sentry Replay session identifier (session storage, consent only, see section 6).
  • Google Analytics cookies (_ga, _ga_*, consent only, see section 5).

13. Zugticket App (iOS and Android)

The "Zugticket" app displays the website in an embedded view. This privacy policy, including the cookie settings, applies to the data processed there. In addition:

  • Location: Only when you trigger the "location" function in the app and grant the permission do we determine your approximate position to find the nearest station. The matching runs on your device; the coordinates are not sent to our servers and not stored (Art. 6 (1) lit. a GDPR). You can withdraw the permission in the system settings at any time.
  • Notifications: Reminders are scheduled locally on your device. No data is transmitted to us or third parties for this. You can withdraw the permission in the system settings at any time.
  • Network access: The app needs an internet connection to load the website. The hosting information in section 3 applies to each request.
  • The app contains no advertising identifier and no tracking across other apps or websites.

14. Currency of This Privacy Policy

This privacy policy is currently valid and has the status: September 2026.

Due to further development of our website or changes in legal requirements, it may become necessary to amend this privacy policy.