Subject:

Privacy statement OVpay app

Date:

31 Mar 2025

Version/status:

1.8

 

At Translink, we want you, the passenger, to be able to move freely and choose the way you travel. We can help you achieve this, but sometimes we need to know something about you. Among other things, we believe that privacy revolves around freedom and the ability to decide for yourself how and by whom your personal data are used.

 

This privacy statement sets out how we deal with your personal data when you use the OVpay app. You will also find out who are the Controllers for processing your personal data, which of your personal data are processed, and what influence you have over this.

 

As of 1st of April 2024 Keolis and Translink facilitate travelling with the OV-pas for a group of travellers. As of mid-April RET and Translink facilitate the OV-pas as well for a group of travellers.  The other Public Transport Companies will follow via a phased approach. The OV-pas will be accepted all over in the Netherlands in the second half of 2024.

 

1. Glossary

We use terms several terms which we explain in this section.

Controller: the company (or several companies) that determine(s) the ‘purpose’ and the ‘means’ for processing personal data.

OV-pas: a contactless card issued by Translink that the passenger uses and pays for public transport by checking in and out at designated card readers at stations, stops and in vehicles.

Payment Information: the amounts (in euros) that have been debited from your account after you have used the Payment Card or OV-pas to check in and out on public transport in the Netherlands;

Payment Card: the (physical or digital card on a smart device) contactless payment card issued by the bank or contactless credit card issued by an (inter-) national credit card company with which you use and pay for public transport by checking in and out at designated card readers at stations, stops and in vehicles. The most up-to-date information, including on affiliated payment services, is available on www.ovpay.nl.

Payment reference number: a 14-digit code (combination of letters and numbers) created uniquely for each payment (when travelling with a Payment Card). This code is allocated to the amount that is debited from your bank account.

Processor: a company that processes the personal data on behalf of another company (the Controller). Although this is a task that the controller can do itself, it has opted to delegate it to another party.

Public Transport Companies: Arriva, EBS, GVB, HTM, Keolis, NS, Qbuzz, RET and Transdev all  have (a) public transport concession(s) (based on the Dutch Passenger Transport Act 2000). In addition Aqualiner offers public transport in the region Rotterdam-Drechtsteden via Waterbuses.

Travel Information: information about your journey(s) on public transport including station/stop and date/time.

Translink: Trans Link Systems B.V., with its registered office at Stationsplein 151-157, 3818 LE Amersfoort;

 

2. What are personal data?

As soon as data can be traced directly or indirectly to a person, these data are referred to as personal data. Examples of personal data include your name, email address, date of birth and bank account number. Your username and journey information can also be regarded as personal data.

 

3. How do we deal with personal data?

Personal data relate to you. That is why we handle them with care. We also do not process more personal data than is absolutely necessary. Naturally, we process and secure personal data in accordance with the requirements of the General Data Protection Regulation (GDPR) and other laws and regulations. We have regular checks carried out to protect the privacy of passengers.

 

Translink engages other companies (as Processors) to perform services such as payment service providers and IT service providers. Translink has concluded contracts with these companies because they have access to your data when performing these services. The contracts contain clear arrangements, covering aspects such as confidentiality, so that we can be sure that your data will be used only for the purposes stated in point 4 below.

 

We have also implemented technical and organisational measures to protect personal data. Translink does not sell your personal data to other parties for marketing, sales and other business-related activities. We also will not give your personal data away for these purposes.

 

4. Why do we process (personal) data? Who is/ are the Controller(s)?

Translink and the Public Transport Companies process (personal) data to be able to perform the agreement that you enter into with us. You do this when you agree to the conditions for use of the OVpay app.

 

You and Translink enter into an agreement so that you can create a My OVpay account through the OVpay app and use self-service. You create an OVpay account in your app by using your email address and password.

 

To use self-services you have to link one or more of your Debit Cards or OV-passes to your My OVpay account. This can be done via:

1.    A Payment reference number and corresponding amount. This combination however only works within 31 days of travelling (Payment Card);

2.    PAN and expiration date of your Debit Card and then use it for travelling;

3.    IBAN and pass sequence number of your Debit Card then use it for travelling within 60 days;

4.    OV-pas card number and verification code.

 

You can consult your Travel and Payment information through your My OVpay account for up to 18 months after you have checked in and out with your Payment Card or OV-pas on public transport. When you use the OVpay app, we take no automatic decisions with legal effect based on your personal data.

 

If you do not want Translink and the Public Transport Companies to process your personal data for the My OVpay account in the OVpay app, we recommend that you do not download or use the OVpay app. To consult your Travel and Payment Information, you can then use the (more) limited self-service through zelfregelen.ovpay.nl.

 

After installing the OVpay app on your mobile phone, the available self-service consists of:

·    creating and terminating your personal My OVpay account;

·    being able to log in and out of your personal My OVpay account;

·    adding and removing one or more Payment Cards or OV-passes to/from your personal My OVpay account;

o  your personal account continues to exist after you remove a Payment Card or OV-pas;

·    providing feedback on the functioning of the OVpay app.

 

Furthermore you can use these self-services in your account for which:

 

A.   The joint Controllers are Translink and the Public Transport Companies - based on ‘necessary for the performance of a contract’ - for:

·      viewing journeys you have made after you have checked in and out with your Payment Card or OV-pas on public transport;

·      submitting a journey correction (request) if you missed a check-in/ -out;

·      viewing payments you have made after you have checked in and out with your Payment Card or OV-pas on public transport;

·      Registering and managing of personal data for personal discount profiles such as age discount.

 

B.   Translink is the Controller - based on ’necessary for the performance of a contract’ - for:

·      Creating and using of your My OVpay account, including sending service messages by us regarding the usage;

·      adding and removing one or more Payment Cards and/ or OV-passes to/ from your personal My OVpay account;

·      viewing and/ or settling your outstanding amount when you have checked in and out with your Payment Card or OV-pas on public transport, after the amount for which you travelled could not be debited;

·      producing and shipping a physical OV-pas to the stated delivery address after it has been ordered;

·      issuing an OV-pas and administering and managing balance of the OV-pas;

·      blocking and replacing an OV-pas after e.g. it has been stolen, lost or malfunctioning.

 

As a traveller you can manage notifications for checking in and out as well as for my outstanding debt (legal ground: consent).

 

Translink monitors the activities within the OVpay app to prevent and detect fraud. Translink is the Controller for the processes. Translink has a legitimate interest to prevent, detect and address fraud. This is in the interest of Translink, the Public Transport Companies and other travellers, because fraud causes financial damages to others, Public Transport Companies and Translink and also increases the costs for the travelling with your Payment Card.

 

5. Processing of aggregated personal data for improvements to the OVpay app

Translink collects data to monitor, research and improve the OVpay app and its use. This is always done in aggregated form. This means that we can no longer trace the data and insights to an individual. We do this on the basis of compatible use for statistical purposes.

 

6. Which personal data do we process?

The table provides the personal data we process when using your My OVpay account in the OVpay app.

Self-service

Personal data

Installing the OVpay app on your mobile device

None

Creating and logging in on your personal My OVpay account including sending service messages regarding usage

Email address, password

Adding one or more Payment Cards and/ or OV-passes to your My OVpay account

 

Payment Card: Payment reference number and transaction amount associated with a payment for your journey; or PAN and expiry date; or IBAN and pass sequence number

OV-pas: card number and verification code

Seeing when you have checked in and out, your journeys and journey details

Date of travel, check-in/ -out time, check-in and check-out station/stop, travel costs (amount), Payment Card/ OV-pas, type of vehicle, carrier

Submitting a journey correction (request) if you have missed a check-in/ -out

Stop/station, characteristics that give insight into the type of journey involved (including journey type, data and time of the journey, location of the card tap known to us in relation to the journey, data and time/ direction of the card tap

Viewing payments and payment details for journeys made and any potential blocking of your Payment Card/ OV-pas

Transaction amount and date, journeys made, costs per journey, check-in/ -out time, check-in/ -out station/stop, Payment Card/ OV-pas, Payment reference number, type of vehicle, carrier

Registering and managing of personal data for personal discount profiles age discount

Name, date of birth and photo

Terminating your personal My OVpay account

Email address

Providing feedback on the functioning of the OVpay app

OVpay app version, type (Apple, Samsung, etc.), operating system type including version number

Seeing if and why contactless Payment Card/ OV-pas has been blocked for checking in and out on public transport

Amount of outstanding balance, transaction date, journeys made, costs per journey, check-in/ -out time, check-in/

-out station/stop

Settling an outstanding debt when the amount you are due for travelling could not debited from your banking account

Amount of outstanding balance, transaction date, Payment Card/ OV-pas, Payment reference number

Managing notifications for checking in and out and/ or outstanding debt

check-in and check-out time, check-in and check-out station/stop, outstanding amount

Producing and shipping physical OV-pas to stated delivery address after being ordered

Name and shipping address; OV-pas card number and verification code

Issuing an OV-pas and administering and managing balance mutations of OV-pas

PAN, PAR, OV-pas card number and verification code, OV-pas balance

Blocking and replacing OV-pas after e.g. it has been stolen, lost or malfunctioning.

PAN, OV-pas card number and verification code

 

Travel and Payment Information

If you check in and out with a Payment Card or OV-pas on public transport in the Netherlands, the relevant Public Transport Company with which you travel is the Controller, along with Translink, for processing your Travel and Payment Information.

 

Translink and the Public Transport Companies make these data available to you through your My OVpay account in the OVpay app.

 

Recording customer service calls

If you call Translink or if our OVpay customer service team calls you, we record telephone calls for quality purposes. The recorded calls are kept for a period of three months.

 

7. How long do we retain your personal data?

Your Travel and Payment Information are retained in Translink’s central administration system for 18 months. Your Travel Information and Payment Information are not stored in your My OVpay account and/or the OVpay app but are only retrieved from Translink’s central administration system to be shown in your My OVpay account.

 

Translink retains personal My OVpay accounts in the OVpay app that are no longer in use for a maximum of 18 months. If you have not added any Payment Cards or OV-passes to your My Ovpay account, we can shorten this period. After this period, the account is erased and the personal data will no longer be available. Our customer service can no longer answer questions about your personal My OVpay account after this period.

8. With whom do we share your data?

Both Public transport operators and Translink make use of the services of Processors. Each of us always signs written agreements with an external party (such as IT suppliers and for sending a service mail) who Process Personal Data on our behalf. This is done by entering into a so-called ‘processor’s agreement’, in which among other things we stipulate agreements about the security and usage of your Personal Data.

 

Translink engages EMS for handling payments with your Bank. To process the payment, Translink provides the Technical data and the Payment reference number to EMS who Processes this data as Controller.

 

Translink makes use of the services of iProov for taking your photo in the OVpay app. This photo is required to apply for age discount as part of a discount profile for bus, tram and metro. iProov Processes this data as a Processor.

Translink makes use of the services of Thales  for issuing and producing the physical OV-pas. Thales Processes these data as a Processor.

 

Translink provides to PostNL your name and delivery address to enable to deliver the OV-pas ordered by you. PostNL Processes these data as a Controller.

 

In certain cases, Translink has the obligation based on legal obligations to share your data with third parties. For example, we must legally provide data in the event of a criminal prosecution. We provide data to third parties only if they make a formal demand that complies with legal requirements.

 

Translink also provides information to the police and the judiciary in relation to missing persons because we believe this is in the social interest.

 

9. What are your rights under privacy legislation?

You have the following rights concerning your personal data under the GDPR:

·      right of access

·      right to rectify your data

·      right of restriction

·      right to be forgotten

·      right to object

·      right to data portability

 

Right of access

Under the right of access, you can ask which of your personal data are being stored and why they are being used. If you wish to use this GDPR right, please email your request to privacy@ovpay.nl. Your Travel and Payment Information can be accessed in the OVpay app.

 

Right to rectify your data

You have the right to have your personal data rectified if it is incorrect. You have the option to alter your data in the OVpay app yourself. If you wish to change your login name for the OVpay app (email address), you can open a new personal My OVpay account with a new email address.

 

Right to restrict

In some cases, you have a right to obtain restriction of processing of your personal data. We will end the processing temporarily.

 

Right to be forgotten and right to object

You have the right to the removal of your personal data. You can delete your account and personal data yourself by terminating your personal My OVpay account in the OVpay app.

 

Right to data portability

You have the right to receive your personal data that Translink processes in a structured, commonly used and machine-readable format. In this way, you can easily transfer these data to another organisation offering the same type of service.

 

10. Contact

If you have questions or a complaint about privacy after reading this privacy statement, please contact us at privacy@ovpay.nl. We are here to help you!

 

If you would like more information about how we deal with your personal data, you can contact Translink’s Data Protection Officer at FG@translink.nl or by post at Trans Link Systems BV, attn. the Data Protection Officer, PO Box 1808, 3800 BV Amersfoort.

 

You also have the right to submit your complaint about privacy directly to the Dutch Data Protection Authority, P.O. Box 93374, 2509 AJ The Hague.