TLS is the organisation that you pay in return for credit on your OV-chipkaart.

Transcription

1 Privacy Policy Trans Link Systems B.V. (hereinafter also TLS ) considers it vitally important that your data is handled carefully when the OV-chipkaart is used. TLS processes personal data in accordance with the Personal Data Protection Act, and has reported the processing of personal data for the OV-chipkaart to the Dutch Data Protection Authority (Dutch DPA). If you have any questions regarding the processing of your data, please us at privacy@ov-chipkaart.nl. You can find out how public transport companies process your data by consulting the privacy policy of those organisations. TLS is in no way responsible for or liable in respect of the privacy policy of public transport companies or third parties that offer services involving use of data on or from your OV-chipkaart. We recommend that you read through the privacy policy of those parties. What does TLS do? TLS is the card issuer that manufactures and distributes the OV-chipkaart. TLS also provides certain services, such as customer service and blocking a personal OV-chipkaart following loss or theft. TLS is the organisation that you pay in return for credit on your OV-chipkaart. TLS sees to the effective operation of the OV-chipkaart system and the processing of all transactions that you make with your OV-chipkaart, such as checking in, checking out and reloading credit. Information provided by TLS regarding the OV-chipkaart is available on the website where you can also register for Mijn OV-chipkaart if you have a personal OV-chipkaart. With Mijn OV-chipkaart, you can view an online transaction overview, for example. TLS gives you the option of using your OV-chipkaart as a form of identification. The OVchipkaart and the OV-chipkaart s numbers are then used by other organisations for the following purposes: to identify you as a customer to keep their records up to date to enable them to send you a bill for their services. OV-chipkaart: personal or anonymous As a card holder, you can choose between a personal and an anonymous OV-chipkaart. Set out below is an explanation of the differences in terms of privacy. The personal OV-chipkaart The personal OV-chipkaart is an OV-chipkaart used by a single specific individual. A photo of this person plus their date of birth, name and gender are printed on the card. The chip in the OV-chipkaart also contains data, namely the date of birth, chip number, credit, and the last ten travel transactions and last two reload transactions made with the card. If you have purchased a personal product (for example a subscription) from a public transport company, this data is also stored on the chip.

2 The anonymous OV-chipkaart The anonymous OV-chipkaart is not personal and can be used by more than one person, but not simultaneously. None of the card holder s data is saved on the card or the OV-chipkaart s chip. The chip does record the last ten travel transactions and last two reload transactions made with the card as well as the non-personal products. Are you always identified by TLS? If you use an anonymous OV-chipkaart, you can pay and travel on public transport without being identified. TLS respects your anonymity. You can also consult the website anonymously. No data is collected regarding the identity of visitors to this site. If you disclose your identity to TLS then you are no longer anonymous. Examples include contacting OV-chipkaart Customer Service or completing the contact form on because you have questions regarding the OV-chipkaart. The details that you fill in on the form or provide over the telephone will only be used to answer your questions. If you request that information be sent to you by post, TLS may save the details regarding that dispatch of information. What data is processed by TLS and in what circumstances? TLS does not process more data than is necessary. See also the question: What does TLS need your data for? TLS does not process your data for marketing purposes and thus will not send you any offers for products or services offered by TLS or other parties. Which data is processed by TLS depends on the type of OV-chipkaart that you have and the manner in which you use your OV-chipkaart. TLS processes the following card numbers of all OV-chipkaart holders: the internal card number (chip ID) the number printed on the card (engraved ID) TLS also processes the following data printed on the card of holders of a personal OV-chipkaart: name date of birth gender passport photo In addition, TLS processes the other data included on the application form, such as contact information (address, telephone number, etc.) and a bank account number, for example. If the card holder purchases a personal product from a party involved, such as a subscription, TLS also processes the product data. When the OV-chipkaart is used on public transport, TLS processes the following data: Card numbers (internal chip ID and engraved ID) Reload transactions (reloading credit on the card) Check in / check out transactions Data regarding personal travel products (such as subscriptions) TLS keeps this data separate from the data it keeps regarding card holders who have a personal OVchipkaart. TLS only links the data together if special circumstances apply (see What does TLS need

3 your data for ). When the OV-chipkaart is used as a means of identification TLS only provides your OV-chipkaart s internal number to a participant in the OV-chipkaart system and on condition that you have expressly given permission for this. TLS tests in advance: whether the data is provided for legitimate purposes, whether the card holder has been asked for permission. TLS keeps track of to whom, for what purposes and when the data was provided. Of course, it is up to you to decide whether you wish to purchase or continue to purchase these services from parties outside public transport. Whose data does TLS process? TLS processes the data of: card holders. account holders: persons who assume the financial obligation to pay for the card (such as parents, carers, employers or you yourself). persons who apply for a card for someone else (such as parents and carers who apply for a card for their children). persons who make enquiries with customer service. In some situations, TLS does not obtain your data directly from you. For example: if somebody else applies for a card on your behalf (a parent or carer, for example). if you are a regular customer with a public transport company that provides you with the personal OVchipkaart as a service. In that case, TLS acquires your data once the OV-chipkaart has been applied for. each time you use your OV-chipkaart for public transport purposes, for example to reload your credit or to check in and check out, TLS acquires data regarding the transactions with your OV-chipkaart. What does TLS need your data for? TLS processes your data in various situations for various purposes: If you apply for a personal OV-chipkaart, TLS needs your personal data to produce the card. If your personal OV-chipkaart is stolen or lost, you can ask TLS to block it so as to prevent misuse by others. If you lose your personal OV-chipkaart or it becomes damaged, you can ask TLS to replace it, which entails TLS producing a new personal OV-chipkaart with the personal data and any personal travel products that you had on your old card. Any credit that remained on your old card is transferred to your account. TLS processes data (including transactions) to facilitate administration of the credit on your OV-chipkaart and to make payments to the relevant public transport companies. If you wish to make use of automatic reload, TLS then processes some personal data such as your bank account number. If the collection of payment for automatic reload fails, TLS can process your data in order to block the credit on your card and to write to you to request payment of the debt (or arrange for this letter to be sent).

4 If you arrange for the credit on your card to be paid out, TLS processes your data to determine that you are the entitled party. TLS processes data to fulfil statutory obligations, such as retention obligations in respect of financial obligations. TLS processes personal data for management activities, such as: performing administrative procedures ensuring the effective operation of the OV-chipkaart system identifying and combating OV-chipkaart fraud compiling anonymous management information that cannot be traced back to individuals If you wish to purchase a particular service from a public transport company or a third party and that company or third party needs to process your data for this purpose, TLS can provide your data so as to enable that service to be provided. This may be the case where, for example, the public transport company does not yet have any of your personal data and you wish to take part in a savings scheme offered by that public transport company. Another example would be where you purchase services from third parties with your OV-chipkaart, such as hiring a bicycle or a car. In that case, TLS can provide the number of your OV-chipkaart, so that these parties can identify you as the card holder, can update their records and can send you a bill for their services. TLS only provides your data to parties that participate in the OV-chipkaart system. Finally, TLS processes personal data when providing customer services via the telephone, or the internet (contact form), for example if you request information about your credit or register for Mijn OV-chipkaart. How is data processed for Mijn OV-chipkaart? If you register for Mijn OV-chipkaart, TLS registers your details as authorised user. This involves your name, user name, password and card number. If you are an authorised user and hold a personal OV-chipkaart, you can see which data has been registered by TLS as regards you as card holder (name, address, card number, etc.). You can also see the public transport transactions you ve made with the OV-chipkaart. These may be viewed from the point that you request an online transaction overview via Mijn OV-chipkaart. Data is shown from that point onwards for a maximum period of 18 months. You are shown this data by TLS as data processing controller, as a service from the collective public transport companies that participate in the OV-chipkaart system. If you wish, you can change your settings, so that you can also view the locations and names of the products you have purchased from a public transport company. This data originates from the public transport companies and is shown to you by TLS on behalf of those companies. When you grant authorisation, you can see, for example, where you reloaded your OV-chipkaart and the location that you travelled to and from. You also see the names of the stations, zones and OV travel products that you have used for travel purposes. You could use this data when submitting expense claims, for example. Are you an authorised user and an account holder with an automatic reload contract with TLS but not the holder of the OV-chipkaart? If so, you can see which data TLS has registered for you as account holder. For example, you will see for which OV-chipkaart (one or more) you are the account holder, as well as the names of the persons to whom these cards are registered. The card holder can authorise TLS to show you more information, such as the sums loaded onto each OV-chipkaart and

5 when this occurred, as well as sums refunded by TLS. The card holder can also authorise TLS to show the account holder the credit transactions, being the payments made to and from the credit on the card. Cookie policy The website uses temporary cookies. A cookie is a small and simple data file stored on your computer s hard drive. These cookies do not contain any personal data and their only function is to make it easier to use the site. Statistical information that is important for the purposes of improving the website (e.g. number of visitors, downloads) is collected. Is your data only processed by TLS? If you apply for a personal OV-chipkaart, in the first instance your identity is only known to TLS. You can have a personal product from a participant in the OV-chipkaart system loaded onto your personal OV-chipkaart, such as a subscription from a public transport company. In that case, that public transport company will also process your personal data. The public transport company itself is responsible for this. If you use your OV-chipkaart as a means of identification, third parties who are involved in this will also process your data. TLS is in no way responsible for or liable in respect of the privacy policy of these public transport companies or third parties. We recommend that you read through the privacy policy of those parties. TLS can make use of third party services in its processing of your data. These parties may only process your data provided that they comply with TLS s instructions. TLS checks various matters including whether these processors fulfil the security obligations. In what circumstances can TLS pass your personal data on to others? If necessary for the effective operation of the OV-chipkaart system, TLS can provide your personal data to other parties within the OV-chipkaart system, such as public transport companies. TLS can provide data to participants in the OV-chipkaart system that are permitted to process your personal data for legitimate purposes. TLS can also provide your personal data to a participant in the OV-chipkaart system if you wish to purchase a service from that party and it is necessary to process your data for that purpose, for example if the public transport company does not yet have any of your personal data and you wish to take part in a savings scheme. TLS will only provide your data with your express permission. If you make use of third party services via your OV-chipkaart, for example you hire a bicycle or a car, TLS can provide your card numbers with your express permission. In this way, you can be identified as the purchaser, enabling the services to be administered, including financially. In addition, a situation may arise in which TLS is legally obliged to provide personal data to government bodies, regulators or, for example, the police or judicial authorities. For how long is your personal data kept? TLS keeps transaction data for a retention period of 18 months: for the settlement of cash flows between participating public transport companies (clearing and settlement). for internal management, accounts receivable management and management of the credit on the card.

6 to safeguard the integrity of the OV-chipkaart system and to be able to detect any OVchipkaart fraud. to fulfil the statutory retention obligations, including fiscal retention obligations. to be able to deliver a service to card holders How is your personal data protected? TLS takes appropriate measures (technical and organisational) to protect your personal data against: destruction (accidental or wrongful). loss. falsification. unauthorised access or distribution. any other form of wrongful processing of your personal data. In that respect, TLS balances the risks, technical possibilities and costs of administration. What are your rights? You have the right to ask TLS whether your data is processed. If that is the case, you can request a written summary of that data. Is your personal data incorrect? Then you can ask TLS to amend your data. Do you think that TLS is not permitted to process your data? Then you can ask TLS to delete your data. Please send your request to privacy@ov-chipkaart.nl with a copy of your identification document. We will let you know within four weeks whether we can comply with your request. You can also send other questions about privacy to this address. Privacy policy of third parties The website contains a number of links to other websites. TLS s privacy policy does not apply to those websites. We advise you to familiarise yourself with the privacy policy of the websites you visit in all cases. Do you have any questions? Do you have any questions regarding TLS s processing of your personal data? If so, please send an to privacy@ov-chipkaart.nl. Amendments This version of the privacy policy was drawn up in May TLS reserves the right to make amendments to this privacy policy. The most recent version of this privacy policy is available at all times at Trans Link Systems Stationsplein LE AMERSFOORT, the Netherlands P.O. Box BV AMERSFOORT

7 This is an unofficial translation of Privacy Policy of Trans Link Systems B.V. If and insofar as this translation is not in conformity with the Privacy Policy the Privacy Policy will prevail. The text of the Privacy Policy can be made available to you upon your first written request.