Privacy statement for GVB app

When you install and use the GVB app on your mobile device, GVB processes your personal data via the app. Some personal data are required for the app to work properly. For other personal data, you can decide whether or not you want to provide such data in the app. Below we indicate precisely which personal data we use for what purpose when you use the GVB app.

Why does GVB use your personal data?

GVB processes your personal data so that the app functions as optimally as possible, so we can support you during your trip, and so you can use all the features offered in the app. We can then offer you travel advice and send you push messages about delays and changes to your planned trip, and you are able to purchase travel products in the app.
We also collect personal data to be able to see how the app is used so we can continuously improve the app and have it better fit the needs of its users.

Which personal data is processed by GVB?

When you use our app, the data we use consists of at least the screen resolution and operating system of your device, your IP address and your station search history, and keys which allow us to identify your device. You may also elect to switch on location data so that, for example, we know your location and can show you the nearest bus/tram/metro stop. You can also elect to receive various notifications and push messages from us, such as for receiving Alerts.
In the app, you can purchase travel products such as a ticket with a barcode. We don't process your payment details in the app when you purchase these products, because the payment of a travel product is arranged entirely outside the app.

Basis for processing

Consent is the basis for being able to process your personal data. When you install and use the app on your mobile device, you give GVB permission to process your personal data. As already stated, we must process some personal data in order to offer you certain features in the app. For some features (such as receiving Alerts), however, you may decide whether or not you want GBV to process your personal data.
You may withdraw the consent you have given us at any moment. If you no longer want GVB to process any of your personal data via the app, then you must delete the app from your telephone. You can also withdraw your specific consent for certain parts of the app, such as if you no longer wish te receive Alerts or if you no longer want GVB to save your preferred stops.

Period of retention

We save your personal data only to the extent that they are strictly necessary. For example, we save your current location for one (1) day and we save your personal data, which you complete when you purchase a travel product in the app, for only 15 minutes. We save the other data as long as the app is on your telephone so that the next time you use the app, you don't have to re-enter everything. As soon as you withdraw your consent for GVB to use certain personal data, we also no longer save these data, of course.

Who do we share your data with?

GVB does not sell any personal data to other parties.
Sometimes GVB must provide your personal data to other parties. For example, to the Tax and Customs Authority on the grounds of legislation and regulations, or in legal proceedings or proceedings for the Public Transport Disputes Committee to corroborate our viewpoint. These other parties are personally responsible for the use and processing of the received personal data. GVB does not provide more data to these third parties than is necessary.
We use various third-party services so that you can use the app as optimally as possible. Some examples of these are:
  • The receipt of travel advice via the app;
  • The use of the map to indicate where you would like to go;
  • The purchase of a barcode ticket;
  • The issuance and validation of a barcode ticket;
  • An app analysis program which helps us improve our service provision, with the aim to further optimise our services and make them more user-friendly. GVB always sets as default the most privacy-friendly settings so that there is only a limited impact on your privacy. As a result, no separate consent is required according to the privacy legislation;
  • A crash-analysis program which registers possible bugs and error messages.
These third parties are designated as a processor and we have concluded a processor's agreement with all processors.