Privacy policy agreement for t:card

1 INTRODUCTION

AtB AS (henceforth «AtB») is a mobility company for the public transport in Trøndelag County. AtB is responsible for planning, organizing, purchase and marketing of public transport services. AtB is registered as a limited company and is fully owned by Trøndelag County Authority.

2 ABOUT THE AGREEMENT

This Privacy Policy Agreement explains how AtB collects and processes personal data from their customers and/or users of the public transport (henceforth referred to as “customer”) through use of a t:card. Personal data is defined as any data about an identified or identifiable physical person, in this case the customer, according to article 4 of the data protection regulation.

The agreement satisfies the requirements in Norway as of 2018 in accordance to the data protection regulation (GDPR) and industry norm for the processing of personal data in regard to electronic ticketing (henceforth referred to as the “industry norm”).

The agreement contains information the customer has a right to review according to articles 12-14 of the data protection regulation, and general information about how AtB treats your personal data.

In addition, you will find information about how you can access personal data AtB has collected about you and how you can proceed if you want us to correct or delete your information

3 PROCESSING OF PERSONAL DATA BY ATB; T:CARD

3.1 Data Controller

AtBs CEO has the overall responsibility for the processing of the customers personal data according to the Personal Data Act and is thereby defined as the data controller. AtB will ensure that the customers personal data will be treated following the personal data act and other regulations at any time.

3.2 What personal data is AtB processing about customers using a t:card?

3.2.1 Unregistered t:card (anonymous journeys)

By default, you do not need to give up personal data to be able to travel with AtB. AtB offers anonymous ticketing for those who wish. In this case, AtB will not process personal data about you. You can use the same travel products on an anonymous card as you can on a registered card without extra cost.

If you wish to travel anonymously with a t:card, you must follow these steps:

Register a new customer profile on https://www.atb.no/
Choose a username and email that does not identify you (e.g. memyself@gmail.com)
Enter only username and email
Order a new t:card on AtBs website (the information will be deleted after a maximum of 30 days)
Register the number of your new t:card in your anonymous profile
Choose a travel product on the website and use a payment card to fulfill the purchase (it is not possible for AtB to identify a customer through such a card transaction
Alternatively, you can come to our service center and pay in cash

When ordering a t:card from our homepage, we ask you to enter your name and address in a contact form that we refer to when sending your t:card. Your contact information is stored apart from the card number of your t:card. AtB does not know the number of the t:card sent to you, i.e. it will not be possible to find journey data about you as a customer. You may optionally choose to get your name and birth date printed on your card without affecting your anonymity. The information will only be used in cases where someone visits our service center and asks for a refund of the remaining values on the card. If a name is printed on the card, the customer asking for the refund will be asked for identification.

If you wish to travel anonymously, it is crucial to create a new profile. If you choose to use an already existing profile and change it to an anonymous profile, it will be possible to recreate your identity by investigating the logs in our ticketing system.

3.2.2 Registered travel cards

Travel cards can be registered by creating a profile on our homepage or at our service center. Registration is optional. If you choose to use a registered travel card, AtB needs to request and use some personal data about you.

The customer information are contact details you enter in the contact form (name, address, postal code and place, birth date, email address, mobile phone number, username and password), furthermore information about the cards date of issue, purchase date for travel products as well as the card number. The information will be saved in our customer database.

If your travel card is to be registered, the aforementioned personal information is provided voluntarily by yourself. The information is saved by AtB as long as necessary to provide the service, or as long the customer relationship exists, as stated in point (e) of article 5 (1) of the data protection regulation.

AtB only saves contact details provided by yourself. You can request to end your customer relationship and ask us to delete the information you have registered. You can easily do this by contacting our customer service by phone, mail, email or by visiting us and ask for help to delete your information. AtB will then delete all your personal data that we have saved.

In addition to the contact details mentioned above, AtB logs information about the journeys of our customers, so called «journey data». This includes information about:

Starting point of the journey
Number of zones for the journey
Timestamp when the card is read (ticket validation)
Ticket type in use
Travel card number
Line and route used for the journey

These journey data are compiled in a specific database and are connected to a travel card. If the travel card is registered to a person, these journey data will also be personal data.

If a user profile is created on AtBs homepage, atb.no, several travel cards can be connected to the same profile. If names are connected to these cards, the only person that can obtain journey data is the person the specific card is registered to. The person registered to the user profile can only access information about the purchase of different travel products, purchase history etc. This applies to customers being 15 years or older, in which case the customer must give permission for others to access journey data on their own travel card. For customers under the age of 15, parents can grant this permission.

Journey data for a travel card are saved 104 days, in accordance to the industry norm for the processing of personal data in regard to electronic ticketing. After this, the journey data will be transferred to an archive and it will be impossible to trace the journey data to a travel card. The journey data will be anonymized, so that no person can be identified, but it will be possible to create statistics based on the information so that AtB can expand their travel services where needed.

3.3 Purpose of processing personal data

AtBs overall purpose with the processing of different personal data connected to the use of registered t:cards, is to be able to provide good and effective travel card services to our customers when providing public transport services.

This purpose consists mainly of the following:

Send t:cards ordered by the customer, optionally with printed name and birth date
Issue different travel products on the card
Transfer remaining value to a new travel card in case your card is lost or stolen (optionally the remaining value can be reimbursed)
Ensure easier identification of possible errors in case of a complaint or other issues that may occur when using the travel card.

Information about travel routes will be used for analysis related to statistical purposes, as well as for reporting to Trøndelag County who evaluate budgets, capacity and future transport demands on different routes.

3.4 Treatment basis

AtBs treatment of personal data is based upon the customers registration of a travel card. The customer enters an agreement with AtB when buying a travel product. AtB will save these data for as long as the customer maintains a customer profile with a registered travel card. The customer can then buy a new travel card product at any time. The basis of agreement is pursuant point (b) of Article 6 (1) of the personal data regulation, providing treatment when treatment is necessary to fulfill an agreement the registered person is a part of, or to implement actions on behalf of the registered person prior to entering an agreement.

Treatment for statistical purposes is pursuant point (e) of Article 6 (1) of the personal data regulation and § 8 of the Norwegian Personal Data Act, since it is necessary for statistical purposes in the interest of the public.

3.5 Information security and secure saving of personal data

AtB follows the requirements for information security in chapter 2 of the personal data regulation and the regulations of the industry norm. Access to customer data and journey data is therefore limited.

AtB can use journey data together with customer data when it is initiated by yourself. This can occur in case of a complaint on the travel guarantee, complaints on fines or other inquiries on your behalf.

AtB will not use journey data together with customer data to create statistics, when charging business partners and usually not when troubleshooting.

3.6 Deletion of personal data

If the customer uses a registered travel card, information about name, address, email address, phone number, birth date and mobile phone number can be deleted upon customer request. This can be done by contacting customer service by phone, mail, email or by visiting the service center.

All registered journey data will be anonymized or deleted after a certain amount of time, according to the regulations from the Data Protection Authority and following the aforementioned industry norm.

3.7 Approach to access requests, correction or deletion

You have the right to access personal data about yourself and you can demand correction of wrong or incomplete information about yourself. Furthermore, you can demand deletion of unnecessary information about yourself.

If you wish to access or correct/delete your personal data saved by AtB, you will have to request this in written form – either to: atb@atb.no, by mail or in person at our service center in Prinsens gate 41.

When contacting us by mail, please use the following address:

AtB AS v/ Kundesenteret
Prinsens gate 39
7012 Trondheim

Errors in your personal data treated by AtB can easily be corrected if you contact the service center.

If you wish to delete your customer relationship including your personal data, you can do this too by contacting the service center.

The phone number to the AtB service center is: +47 478 02 820

Our customer service can help you to get in touch with AtBs privacy representative if you have specific questions about AtBs treatment of your personal data in cases where you cannot find an answer in this Privacy Policy Agreement. If you need to get in touch with the privacy representative directly, you can send a letter to AtB marked «personvernombud» or send an email to: personvernombud@atb.no, or call +47 478 02 820 and ask to be forwarded to the privacy representative.

AtB will answer your request as soon as possible and within 30 days. We will ask you to confirm your identity or to give further information before you can claim your rights towards us. We do this to make sure that we only grant access to your personal data to yourself and not to someone claiming to be you.

3.8 Other rights

You have the right to object against the treatment of personal data. At any given time, due to reasons of your specific situation, you can object against treatment of personal data about yourself. The treatment must be pursuant point (e) or (f) of Article 6 (1), including profiling according to the mentioned regulations. AtB can no longer treat your personal data unless the company can prove important and rightful reasons to treat your data that overgo your interests, rights or freedom, or to define, claim or defend legal claims.

You have the right to data portability as stated in article 20 of the personal data regulation. The registered person shall have the right to receive personal data about him or her that AtB has received in a structured, commonly used and machine-readable format and has the right to transmit those data to another data controller without hindrance from the data controller to which the personal data have been provided. This requires that the processing is based on consent pursuant point (a) of Article 6 (1), point (a) of Article 9 (2) or an agreement pursuant point (b) of Article 6 (1) in the personal data regulation. The processing is to be carried out by automated means.

To exercise your rights, the approach will be as described above in point 3.7.

If you experience that our processing of personal data does not adhere to our description here or that we do not adhere to the Data Protection Act in other ways, we ask you to contact us. If needed, you can file a complaint to the Norwegian Data Protection Authority (DPA). You can find information about how to contact the DPA on their website: www.datatilsynet.no

3.9 Use of Data Processors

AtB may share your personal data with «Data Processors». Data processors are subcontractors that process personal data on behalf of AtB, as stated in the Data Protection Act §2. This applies to suppliers of ticketing and other systems where you as a customer may enter your personal data. Either in the form of a user profile connected to your journeys or when complaining about a rejected inquiry for our travel guarantee or a fine where AtB will have to proceed a case after you have made an inquiry.

These data processors cannot use personal data in any other way than to provide the service as agreed upon with AtB in a Data Processing Agreement. AtB takes special precautions to ensure that our data processors act according to the Data Processing Agreement, this Privacy Policy Agreement and the Norwegian Data Protection Act.

AtB will only make use of data processors located in Norway, EU/EEA countries or countries that have sufficient privacy laws.

The following subcontractor is used for all AtBs services and products connected to t:card:

Fara AS
Sjøgangen 6
7010 Trondheim
Org.nr.: 989112007

3.10 Transfer of personal data to third parties

In some cases, AtB can provide personal data to the police or other public authorities. This requires a legal basis or a court order. In addition to this, AtB will provide the Travel Complaint Handling Body (Transportklagenemnda) with personal data if an inquiry for our travel guarantee or a fine is appealed by the customer after AtB has rejected the inquiry or the complaint.

AtB will neither sell, nor transfer personal data about you to third parties in other ways than described in this agreement or in accordance to the law. This also applies to information provided during optional registration.?

4 AUTOMATIC REGISTRATION OF CUSTOMER DATA WHEN VISITING OUR WEBSITE

As one of many websites, AtB uses cookies and similar technologies on our website. As a result, certain types of data about you as our customer will be registered and stored automatically when you visit our website. These data are used to register and analyze “traffic patterns” on our website. The information is used to identify how visitors navigate on our sites, how much time they spend on a site, what services they use and where they are from.

Common data being recorded is information about browser and operating system in use, and the domain or IP-address you are connected to. This information is used to create statistics about visitors use of the site and will be deleted continuously. Such customer information is anonymous. AtB does not store information that can give away the customers identity.

For further information regarding this, please refer to our website: Privacy policy and cookies.