Subject:	Privacy statement OVpay app
Date:	12-Sep-2024
Version/status:	1.7

At Translink, we want you, the passenger, to be able to move freely and choose the way you travel. We can help you achieve this, but sometimes we need to know something about you. Among other things, we believe that privacy revolves around freedom and the ability to decide for yourself how and by whom your personal data are used.

This privacy statement sets out how we deal with your personal data when you use the OVpay app. You will also find out who are the Controllers for processing your personal data, which of your personal data are processed, and what influence you have over this.

1. Glossary

We use terms several terms which we explain in this section.

Controller: the company (or several companies) that determine(s) the ‘purpose’ and the ‘means’ for processing personal data.

Payment Information: the amounts (in euros) that have been debited from your account or after you have used the contactless Payment Card to check in and out on public transport in the Netherlands;

Payment Card: The (physical or digital card on a smart device) contactless payment card issued by the bank or contactless credit card issued by an (inter-) national credit card company with which you use and pay for public transport by checking in and out at the designated card reader at the station, at the stop or in the vehicle. The most up-to-date information, including on affiliated payment services, is available on ovpay.nl.

Payment reference number: a 14-digit code (combination of letters and numbers) created uniquely for each payment. This code is allocated to the amount that is debited from your bank account or spending limit.

Processor: a company that processes the personal data on behalf of another company (the Controller). Although this is a task that the controller can do itself, it has opted to delegate it to another party. If a processor then asks another company to process the personal data, that company is a subprocessor.

Public Transport Companies: the nine companies that have a public transport concession (based on the Dutch Passenger Transport Act 2000), namely Arriva, EBS, GVB, HTM, Keolis, NS, Qbuzz, RET and Transdev. In addition Aqualiner offers public transport in the region Rotterdam-Drechtsteden via Waterbuses.

Travel Information: information about your journey(s) on public transport including station/stop and date/time.

Translink: Trans Link Systems B.V., with its registered office at Stationsplein 151-157, 3818 LE Amersfoort;

2. What are personal data?

As soon as data can be traced directly or indirectly to a person, these data are referred to as personal data. Examples of personal data include your name, email address, date of birth and bank account number. Your username and journey information can also be regarded as personal data.

3. How do we deal with personal data?

Personal data relate to you. That is why we handle them with care. We also do not process more personal data than is absolutely necessary. Naturally, we process and secure personal data in accordance with the requirements of the General Data Protection Regulation (GDPR) and other laws and regulations. We have regular checks carried out to protect the privacy of passengers.

Translink and the Public Transport Companies engage other companies (as Processors) to perform services such as payment service providers and IT service providers. Translink and the Public Transport Companies have concluded contracts with these companies because they have access to your data when performing these services. The contracts contain clear arrangements, covering aspects such as confidentiality, so that we can be sure that your data will be used only for the purposes stated in point 4 below.

Translink and the Public Transport Companies have also implemented technical and organisational measures to protect personal data.

Translink and the Public Transport Companies do not sell your personal data to other parties for marketing, sales and other business-related activities. We also will not give your personal data away for these purposes.

4. Why do we process (personal) data when using the OVpay app? Who is/ are the Controller(s)?

Translink and the Public Transport Companies process personal and other data to be able to perform the agreement that you enter into with us. You do this when you agree to the conditions for use of the OVpay app. You and Translink enter into an agreement so that you can create a My OVpay account through the OVpay app and use self-service.

You can consult your Travel and Payment information through your My OVpay account for up to 18 months after you have checked in and out with your Payment Card on public transport. When you use the OVpay app, we taken no automatic decisions with legal effect based on your personal data.

If you do not want Translink and the Public Transport Companies to process your personal data for the My OVpay account in the OVpay app, we recommend that you do not download or use the OVpay app. To consult your Travel and Payment Information, you can then use the (more) limited self-service through zelfregelen.ovpay.nl.

After installing the OVpay app on your mobile phone, the available self-service consists of these basic components:

· creating and terminating your personal My OVpay account;

· downloading the OVpay app conditions for use and (this) privacy statement;

· changing your (forgotten) password;

· being able to log in and out of your personal My OVpay account;

· adding and removing one or more Payment Cards to/from your personal My OVpay account;

· your personal account continues to exist after you remove a Payment Card;

· providing feedback on the functioning of the OVpay app.

You can use these self-services in your My OVpay account for which:

A. The joint Controllers are Translink and the Public Transport Companies - based on the legal ground necessary for the performance of a contract - for:

· viewing the journeys you have made after you have checked in and out with your Payment Card on public transport;

· submitting a journey correction (request) if you have missed a check-in or check-out

· viewing the payments you have made after you have checked in and out with your Payment Card on public transport

· Registering and managing of personal data for personal discount profiles such as age discount at urban and regional transport.

B. Translink is the Controller - based on the legal ground necessary for the performance of a contract - for:

· Creating and using of your My OVpay account;

· adding and removing one or more Payment Cards to/ from your personal My OVpay account;

· viewing your outstanding amount when you have checked in and out with your Payment Card on public transport, after the amount for which you travelled could not be debited from your account;

· settling an outstanding debt when the amount you are due for travelling could not debited from your banking account.

As a traveller you can manage notifications for checking in and out as well as for my outstanding debt (legal ground: consent).

Translink monitors the activities within the OVpay app to prevent and detect fraud. Translink is the Controller for the processes. Translink has a legitimate interest to prevent, detect and address fraud. This is in the interest of Translink, the Public Transport Companies and other travellers, because fraud causes financial damages to others, to Translink and the Public Transport Companies and also increases the costs for the travelling with your Payment Card.

5. Processing of aggregated personal data for improvements to the OVpay app

Translink collects data to monitor, research and improve the OVpay app and its use. This is always done in aggregated form. This means that we can no longer trace the data and insights we derive from them to an individual. We do this on the basis of compatible use for statistical purposes. We measure the following in the OVpay app:

· number of times a button/item has been pressed;

· number of times a page has been opened (navigation);

· number of errors that occur, both technical and functional.

6. Which personal data do we process if you purchase self-services through the OVpay app?

The table below provides an overview of the personal data we process if you use self-services in your My OVpay account in the OVpay app.

Self-service	Personal data
Installing the OVpay app on your mobile device	None
Viewing, accepting and downloading the conditions for use and privacy statement	None
Creating and logging in on your personal My OVpay account	Email address, password
Changing your password because you have forgotten it or for another reason	Email address, password
Adding one or more Payment Cards to your My OVpay account	Payment reference number and transaction amount associated with a payment for your journey, for which you checked in and out using your Payment Card
Removing one or more Payment Cards from your personal My OVpay account	None
Seeing when you have checked in and out, your journeys and journey details	Date of travel, check-in and check-out time, check-in and check-out station/stop, travel costs (amount), Payment Card, type of vehicle, carrier
Submitting a journey correction (request) if you have missed a check-in or check-out	Selected stop/station, characteristics that give insight into the type of journey involved (including journey type, data and time of the journey, location of the card tap known to us in relation to the journey, data and time of the card tap known to us and the direction of the card tap (i.e. check-in or check-out)
Viewing payments and payment details for journeys made	Transaction amount and date, journeys made, costs per journey, check-in and check-out time, check-in and check-out station/stop, Payment Card, Payment reference number, type of vehicle, carrier
Registering and managing of personal data for personal discount profiles age discount	Name, date of birth and name
Registering and managing of personal data for personal discount profiles.	Name or name and photo and/ or date of birth
Terminating your personal My OVpay account	Email address
Providing feedback on the functioning of the OVpay app	OVpay app version, phone brand and type (Apple, Samsung, etc.), operating system type including version number
Seeing if and why contactless Payment Card has been blocked for checking in and out on public transport	Amount of outstanding balance, transaction date, journeys made, costs per journey, check-in and check-out time, check-in and check-out station/stop
Settling an outstanding debt when the amount you are due for travelling could not debited from your banking account	Amount of outstanding balance, transaction date, Payment Card, Payment reference number
Managing notifications for checking in and out and/ or outstanding debt	check-in and check-out time, check-in and check-out station/stop

Travel and Payment Information

If you check in and out with a Payment Card on public transport in the Netherlands, the relevant Public Transport Company with which you travel is the Controller, along with Translink, for processing your Travel and Payment Information.

Translink and the Public Transport Companies make these data available to you through your My OVpay account in the OVpay app.

Recording customer service calls

If you call us or if our OVpay customer service team calls you, we record telephone calls for quality purposes. The recorded calls are kept for a period of three months.

7. How long are your personal data retained?

Translink retains personal My OVpay accounts in the OVpay app that are no longer in use for a maximum of 18 months. After this period, the My OVpay account is erased and the personal data will no longer be available in your My OVpay account. Our customer service can no longer answer questions about your personal My OVpay account after this period.

NOTE: Your Travel and Payment Information are retained in Translink’s central administration system for 18 months. Your Travel Information and Payment Information are not stored in your My OVpay account and/or the OVpay app but are only retrieved from Translink’s central administration system to be shown in your My OVpay account.

8. With whom do we share your data?

Both Public transport operators and Translink make use of the services of Processors. We always sign written agreements with external parties (such as IT suppliers) who Process Personal Data on our behalf. We do this by entering into a so-called ‘processor’s agreement’, in which among other things we stipulate agreements about the security of your Personal Data and about the use of the Personal Data.

Translink engages the services of EMS for handling payments with your Bank. To process the payment, Translink provides the Technical data and the Payment reference number to EMS who Processes this data in its capacity as Controller.

Translink makes use of the services of iProov for taking your photo in the OVpay app. This photo is required to apply for age discount as part of a discount profile for bus, tram and metro at urban and regional transport. iProov Processes this data as a Processor.

In certain cases, Translink has the obligation bases on legal obligations to share your data with third parties. For example, we must legally provide data in the event of a criminal prosecution. We provide data to third parties only if they make a formal demand and only if that demand complies with legal requirements.

Translink also provides information to the police and the judiciary in relation to missing persons because we believe this is in the social interest.

9. What are your rights under privacy legislation?

You have the following rights concerning your personal data under the GDPR:

· right of access

· right to rectify your data

· right of restriction

· right to be forgotten

· right to object

· right to data portability

Right of access

Under the right of access, you can ask which of your personal data are being stored and why they are being used. If you wish to use this GDPR right, please email your request to privacy@ovpay.nl. Your Travel and Payment Information can be accessed in the OVpay app.

Right to rectify your data

You have the right to have your personal data rectified if it is incorrect. You have the option to alter your data in the OVpay app yourself. If you wish to change your login name for the OVpay app (email address), you can open a new personal My OVpay account with a new email address.

Right to restrict

In some cases, you have a right to obtain restriction of processing of your personal data. We will end the processing temporarily.

Right to be forgotten and right to object

You have the right to the removal of your personal data. You can delete your account and personal data yourself by terminating your personal My OVpay account in the OVpay app.

Right to data portability

You have the right to receive your personal data that Translink processes in a structured, commonly used and machine-readable format. In this way, you can easily transfer these data to another organisation offering the same type of service.

10. Contact

If you have questions or a complaint about privacy after reading this privacy statement, please contact us at privacy@ovpay.nl. We are here to help you!

If you would like more information about how we deal with your personal data, you can contact Translink’s Data Protection Officer at FG@translink.nl or by post at Trans Link Systems BV, attn. the Data Protection Officer, PO Box 1808, 3800 BV Amersfoort.

You also have the right to submit your complaint about privacy directly to the Dutch Data Protection Authority, P.O. Box 93374, 2509 AJ The Hague.