Who are the controllers?
GVB, the other transport companies and Translink Systems B.V. (“Translink”) are joint controllers for the processing of personal data in relation to key processes within the OV-chipkaart system.
These key processes are the purchase of the OV-chipkaart, the purchase of credit, the purchase of a product, travel and service. GVB has a shared responsibility for this with the other public transport companies and Translink (jointly referred to as “we” or “us”). The mutual distribution of roles, responsibilities and agreements in relation to these five key processes are laid down in a collaboration agreement. The interest of the individual concerned plays a central role and that forms a starting point for the collaboration agreement.
What do we use your personal data for?
The processing of your personal data is necessary in order to:
To enter into an agreement with you and execute it. So that you can purchase an OV-chipkaart, credit or a product, can travel by public transport and we are able to provide your service.
To enable key processes to progress as efficiently and effectively as possible. For example, the purchase of a product and dealing with questions about this by customer service, but also blocking a personal OV-chipkaart when it has been stolen.
Without the processing of your data for the key processes, it is not possible to use the OV-chipkaart system, unless you travel with a paper OV-chipkaart and don't make any further use of the service of the transport companies.
What personal data do we use?
To carry out the key processes, we process the following:
Contact details
Date of birth
Passport photo
Bank details
OV-chipkaart details
(Travel) transaction information
Product information
All of the aforementioned personal data is not always necessary for all key processes. For each key process, it has been determined what data from the above summary is necessary to process for an effective and efficient working OV-chipkaart system and who needs that data. For example, a passport photo for a personal OV-chipkaart requested from Translink won't be shared with the transport companies.
Foundation for processing
Entering into and execution of the agreement with you forms the basis for the processing of your personal data from the OV-chipkaart system.
How long do we store your data?
We retain transaction data up to 18 months after the journey made by you. Transaction data is created when you check in and out with your OV-chipkaart and is read using the chip-ID in your OV-chipkaart. This data is used to settle your travel transactions.
The other data we obtain from the OV-chipkaart system is not retained for any longer than is necessary for the purpose for which it has been obtained.
Who do we share your data with?
The transport companies and Translink bring in third parties in certain cases for the processing of personal data for the key processes, such as for the execution of IT services. These third parties are our processors.
In order to provide customer service (via a call centre), the transport companies and Translink brought in a company with a branch outside of the European Economic Area, namely in Suriname.
The transport companies and Translink also have support for system problems when processing travel transactions from a company outside of the European Economic Area, located in Hong Kong.
The transport companies and Translink have taken appropriate safeguards for both situations to protect your data properly by including the standard contract provisions laid down by the European Commission. For further information or to consult these standard provisions, please contact one of the transport companies or Translink.
Legislation and regulations stipulate that we are required to cooperate and provide personal data if (investigation) bodies such as the police and the judicial services demand data. In such cases, we investigate the authority of the body in question and only provide the requested information only if the claim complies with the rules and the law. We can also provide information to the police and the judiciary when it comes to missing persons.
Point of contact for questions or exercising of your privacy rights
If you have any questions about the processing of your personal data in accordance with the key processes of the OV-chipkaart system or if you wish to submit a request to exercise your privacy rights, you may get in touch with the existing contacts at the transport companies and Translink. Please get in touch if you have any questions or wish to exercise your privacy rights at GVB. View our contact details here.