For what purpose does GVB use your personal data?
Sometimes we are legally required to process personal data. The following are (non-exhaustive) examples of such processing:
for the required administration of the business operations, including sales data of travel products;
to demonstrate to the Dutch Tax and Customs Administration proceeds over which tax is owed;
to provide the annual season ticket data to the Dutch Tax and Customs Administration each year for income tax declaration;
for the audit of the annual accounts;
to comply with obligations from the Passenger Transport Act 2000 or the General Data Protection Regulation (GDPR), such as the investigation and settlement of data breaches;
to comply with obligations from the Local Rail Act, for investigation after an incident, and to improve traffic safety.
Which personal data does GVB process?
GVB must comply with legislation and regulations and uses the personal data which are necessary to do that. These include contact details, travel product data, receivables data, date of birth, and travel data.
Basis for processing
The basis for the processing of personal data is to comply with a statutory obligation which GVB has.
Retention period
We retain the personal data for as long as necessary to satisfy or comply with the statutory obligation. If a statutory retention period has been determined, we retain the personal data for the duration of the statutory retention period, such as: seven (7) years in accordance with the tax retention period in Article 52 of the State Taxes Act; seven (7) years for the general requirement to keep records in accordance with Article 2:10 Dutch Civil Code.
With whom do we share the data?
On the basis of legislation and regulations which GVB must satisfy, it may be necessary to share the personal data with bodies which are designated for that purpose in the law. Such bodies may include the Dutch Tax and Customs Administration in connection with income tax declaration by annual season ticket holders or in the context of audit and accountability.
We also share data with our accountant. We do that for the audit of the financial statement. Personal data may appear in the data provided
In addition, GVB is required to cooperate and to provide personal data if investigative authorities, such as the police or the Fiscal Intelligence and Investigation Service (FIOD), requisition data. We then investigate closely the authority of the investigative authority in question.
GVB may also independently provide personal data to the police or the judiciary. We do that to protect our rights and property. We may also use personal data in legal proceedings or in proceedings before the Public Transport Disputes Committee for the substantiation of our position.
For the research of traffic safety under the Local Rail Act, the Human Environment and Transport Inspectorate (the supervisor) sometimes also receives research analysis which may include personal data.