Privacy statement

GVB believes it is important that the personal information for customers and business acquaintances must be processed and safeguarded in a conscientious manner. This privacy statement describes how we process this information and why we use it.

Privacy statement

We are open and honest about the data we collect and why we do so. This privacy statement, among other things, describes what personal information is processed, the reason why, and how the data is used. If you have questions after reading this privacy statement about your personal information , click here to read how you can contact GVB.. We are more than happy to answer your questions.

First and foremost, we ensure that your personal information is processed in accordance with the requirements of the General Data Protection Regulations, the General Data Protection Regulations (Implementation) Act, and the Telecommunications Act. In addition, GVB is affiliated with the "Code of Conduct for the Processing of Personal Information for an OV-chipkaart" that is established for public transport companies and filed by the Royal Netherlands Association of Transport. The code of conduct contains rules that among other things specify that personal information about our passengers is processed in a responsible and meticulous manner.

This privacy statement applies to all personal information received from our own websites, when using our transport resources, contacting customer service, when purchasing GVB travel products, recorded videos, handling of claims, participating in campaigns and actions, and also, for instance, via social media or apps.

GVB may modify this privacy statement from time to time. The modifications will be made recognizable by issuing a new version.

General Responsibility for the processing of personal information
The responsible party for processing f your personal information within the context of the General Data Protection Regulations is GVB Exploitatie B.V., headquarted in Amsterdam, The Netherlands. This party determines what happens with your personal information within the established legal framework.

Contact information
GVB Exploitatie B.V.
Arlandaweg 106
Postbus 2131
1000 CC AMSTERDAM

GVB Exploitatie BV is registered in the Commercial Chamber of Commerce under number 34259721.

What personal information is processed by GVB?
As part of GVB providing public transport services, it processes data needed to provide the services and the data received from you, such as travel transaction data, payment data, season ticket data, and contact details, and, when necessary, information needed to draw up an official report or to issue a fine. If you contact our customer service, we process information to handle your question, complaint, or claim.
If you created a MyGVB user account, GVB receives the related personal information. GVB records videos using video cameras are installed at our stations and in our vehicles and ferries.
In addition, GVB also collects information from your computer or mobile phone. This can be the IP address and location data needed by the GVB app. In some cases, we also receive information about you from other, such as your employer when they purchase an annual season ticket for you. This is a brief overview of the personal information that we process. Click this link to read more detailed information about this.

Why does GVB process your personal information?
GVB process your personal information for multiple purposes, but does not automatically does so for all these purposes.

GVB needs your personal information to implement an agreement we entered into with you, for example, an annual season ticket or providing a discount when you use a travel product that provides a discount. GVB must also use your personal information when you contact our customer service with questions, complaints, or information requests. This is to ensure we handle your request in the best possible manner. Phone calls with customer service may be recorded for training purposes.

If you contact the Data Protection Officer or send a message to the privacy e-mail address to exercise your rights under the General Data Protection Regulations, your personal information will be process to handle your question, requests, or complaints.

In addition, personal information is used to financial settle a annual season ticket and to contact you when, for instance, a (regular) payment is not received by GVB. Personal information must also be saved so that GVB can report its revenues to the Tax and Customs Administration as is required by law.

If you are a customer, GVB can also use your personal information for marketing purposes by sending your public transport related offers or to inform you about (promotional) campaigns and actions. You can always opt out at any time quickly and easily by clicking "Afmelden" (i.e. unsubscribe) at the bottom of each market message. Sometimes, GVB may ask you to participate in a market research study, in which case your personal information will only be processed after you provide your permission.

Your personal information can also be used to detect and combat fraud with the OV-chipkaart (for example, improper use of an OV-chipkaart with a GVB travel product) or when purchasing travel products in the GVB webshop. Sometimes, your personal information is also needed for security reasons to detect and estimate security risks in GVB's OV-chipkaart system.

If you created a personal user account on mijngvb.nl, GVB processes your information to manage and implement the changes you made in your account so that we can ensure your information is always correct and complete.

GVB believes it is important that your feel safe in our stations and in our vehicles and ferries. This is why GVB uses video cameras. Camera surveillance is used for your safety and to protect our properties and employees. Videos may be used as evidence. In addition, videos can be used to investigate and reconstruct an accident. Finally, video cameras next to metro drivers allow drivers to know when it is safe to depart from a metro stop or station.
More details information about GVB camera surveillance

GVB can use your personal information for statistical purposes. This allows us to improve and optimize our services, efficiency, and quality. And, develop new products and services so that we can serve you even better.

If you visit a GVB office or workplace, GVB will record your personal information so that we know who is present in our offices and workplaces to monitor access and in the event of an emergency.

Finally, GVB can use your personal information for legal purpose, such as resolving legal disputes or to comply with the law and regulations.
Click ere to read about the reasons why we collect and use your personal information.

What are the legal principles for the processing of your personal data?
To legally process your personal information, GVB adheres to the following legal principles:

  • Implementation of the agreement: processing of your personal information can be required to implement the agreement you entered into with GVB. This could be a transport agreement, or the product agreement in the event you purchased a GVB product. For example, GVB is required to transport you when you have a valid travel pass and satisfy the other preconditions in the transport agreement. GVB can also impose a fine on you if you do not comply with the terms of a transport agreement. If you have a product that entitles you to a discount, GVB must carry out the necessary actions to ensure you receive a discount when you travel. When handling questions about your product, GVB is also implementing the agreement that you entered into.
  • Complying with legal obligations: In certain cases, GVB must process your personal information to comply with legal obligations. For example, GVB is required by the tax laws to maintain season ticket administration that includes sales data related to season tickets and travel products.
  • Legitimate interest: we can also process your personal information because it is needed for our legitimate interest, such as detecting fraud or supporting a legal claim made by GVB. And, to improve our website, webshop, the MyGVB environment, or safeguarding our OV-chipkaart equipment and system network and information security.
  • Permission: when you consent, we can use your personal information for marketing purposes, or to send you our newsletter. You can always revoke your consent at any time by click "Afmelden" (i.e. unsubscribe) at the bottom of each marketing message or newsletter.

How long does GVB retain your personal information?
GVB has different retention periods for the different processing objectives. In any case, GVB does not save your personal information any longer than necessary to achieve the intended objective. If the objective is met before the defined retention period, the personal information will no longer be accessed for that specific objective. In certain cases, a legal retention period applies that GVB must comply with. Once the predefined (legal) retention period expires (or the objective is met earlier), the personal information is converted in such a manner that it can be used to identify individuals or OV-chipkaarts.
More information about GVB retention periods.

Does GVB provide your personal information to third parties?
We appreciate that you have confidence that your personal information is in good hands with GVB. To this end, GVB does not and will not sell your personal information to third parties. In certain cases, GVB must provide your personal information to third parties, for example, the insurance company when a claim for damages is submitted, Translink Systems BV to report a lost or stolen card so it can be blocked, other public transport companies to provide customer support, and the Tax and Customs Administration.

In addition, in certain cases, GVB provides your personal information to third parties that process personal information at the request and on behalf of GVB. GVB makes agreements with these processors so that they comply with confidentiality and that they only use your personal information to carry out the specific task assigned to them by GVB. These processors may not use your personal information for any other purpose or provide it to third parties. This involves payment services providers, collection agencies, cloud and hosting platforms, IT services providers, polling organizations, and agencies that carry out campaigns that support GVB, and research and consultancy agencies that calculate the division of revenues from collective products provided by public transport companies.

To ensure that national OV-chipkaart system works properly and the financial settling of revenue divided among public transport companies, GVB shares transaction data with Translink Systems BV. More information about the processing of your personal data with respect to the OV-chipkaart is available below in this privacy declaration under Privacy and OV-chipkaart and Information management.

The law and regulations requires GVB to cooperate and provide personal information to law enforcement agencies, such as the police, Fiscal Intelligence and Investigation Service. In such cases, GVB meticulously checks the authority of the law enforcement agency and will comply with the legal requirements as established in the General Data Protection Regulations. GVB can also independently provide your personal information to the police or department of justice to protect its rights and properties, or to support its opinion in legal proceedings or proceedings before the Public Transport Dispute Commission.

Where is your personal information stored?
As far as possible, your personal information is processed or stored within the Netherlands or the European Union. For data sent outside the European Union, GVB only contracts parties that provide sufficient protection of your personal information in accordance with the General Data Protection Regulations. For a few other countries, this is established by the European Union (for example, for American parties that covered by the Privacy Shield). For parties in countries where this is not established, we work with special contracts. For more information about this, you can contact the Data Protection Officer.

How does GVB protect your personal information?
GVB has taken suitable security measures to protect your personal information against unintentional or wrongful elimination, loss, modification, or unauthorized access to your personal information. These measures vary from physical measures, such as burglar alarms and access control to diverse organizational and technical security measures. Only authorized employees or third parties have access to your personal information when needed to carry out their work.

What are your rights?
You are entitled to view you personal information that GVB processes at all times. You may request a printed overview of your personal information from GVB by sending an e-mail to privacy@gvb.nl. You can also view your travel data via www.ov-chipkaart.nl.

If your personal information is incorrect or incomplete, you can ask GVB to correct your personal information. In addition, you are entitled to request that your personal information be deleted, to request that the processing of your personal information be restricted, object to your personal information being processed, or request data portability. More information about the manner in which you exercise your rights.

Questions, complaints, and disputes
If you have questions or complaints about the processing of your personal information by GVB, have comments of suggestions about this privacy statement, or want to exercise your rights (including the right to view, correct, or delete), you can contact us. For complaints and to directly contact the GVB's Data Protection Officer, you can send an e-mail to fg@gvb.nl.

For questions, suggestion, or comments or to exercise your rights, you can send an e-mail to privacy@gvb.nl. We will respond as quickly as possible.

For questions related to your OV-chipkaart, you can contact GVB Customer Service by completing the web form or call 0900-8011 (phone accessible Monday through Friday (except on national holidays) 09:00 – 19:00).

In addition, for complaints or disputes in the event that the "Code of Conduct for the Processing of Personal Information for an OV-chipkaart" applies, you can also contact Consumer Complaints Board

Print statement
If you would like to print out the entire statement, download this PDF.