Privacy policy

GVB believes it is important that the personal information for customers and business acquaintances must be processed and safeguarded in a conscientious manner. This privacy statement describes how we process this information and why we use it.

Personal information

It is paramount that we process your personal information in accordance with the requirements of the Personal Data Protection Act. In addition, GVB is bound by the Code of Conduct for the Processing of Personal Information for an OV-chipkaart that is established for public transport companies and filed by the Royal Netherlands Association of Transport. The code of conduct contains rules that among other things specify that personal information about our passengers is processed in an accurate and meticulous manner.
GVB has registered its personal information processing with the Dutch Data Protection Authority ("CBP") under number m1310221.

General responsibility

The responsible party for the processing of your personal information within the context of the Personal Data Protection Act falls under GVB Exploitatie B.V. This party determines what happens with your personal information within the established legal framework.

Contact information
GVB Exploitatie B.V.
Arlandaweg 106
Postbus 2131
1000 CC AMSTERDAM

GVB Exploitatie BV is registered in the Commercial Chamber of Commerce under number 34259721.

What data is processed by GVB?

GVB processes travel transaction data, payment data, annual season ticket data, OV-chipkaart numbers, contact information of annual season ticket holders, employer contact information (if you have an annual season ticket via your employer), contact information provided for actions and campaigns, account holder data (if different than the annual season ticket holder), and data about questions, complaints, claims, lost and found ojbects, and so on.

Processing purposes

There are many reasons for processing personal information as given below. Your information is not automatically used for all reasons at the same time.

  • implementing the contract entered into, such as the purchase and use the year season ticket
  • customer service including the handling of complaints/differences, questions, queries about travel routines of the involved parties, travel information (such as e-mails with information about work activities, new timetables, diversions and disruptions), handling of lost and found property, reimbursement requests with respect to OV-chipkaart use, and so on
  • business continuity and growth: the provision of offers related to actions/campaigns

  • financial administration, namely debiting administration (such as the calculating, collecting or crediting invoices for season tickets or other travel products and the maintenance of contacts with debtors), and the proceeds administration

  • measures to combat fraud, such as the wrongful use of an OV-chipkaart with a GVB product
  • compliance with laws and regulations, such as the Personal Data Protection Act, Passenger Transport Act 2000, and financial laws and regulations
  • business efficiency, processing of non-personally identifiable information for market research, management information, analysis, development of products and services, overall strategy, and so on 

How long does GVB retain your information?

With respect to the previously mentioned processing goals, GVB has different periods of retention for which the starting point is that personal data is not retained longer than the period needed for the processing goal.

Transaction data (data generated when using an OV-chipkaart) 
With respect to the transaction data that is related personal data is never kept more than 18 months. For some processing purposes, the personal data is no longer accessed earlier than this. After this period (or earlier if the goal is reached), the personal data is modified so that it cannot be traced back to any individual or OV-chipkaart. The retention periods are harmonized with consumer organizations, Ministry of Finance, the tax authority, employers organizations VNO-NCW and the Dutch DPA.
 
Season ticket administration
If you have a GVB annual season ticket, your personal information (including contact information) is also processed as part of our season ticket administration. The retention period for this data is in accordance with the State Taxes Act. 

Your data is safeguarded

GVB has taken measures to protect against loss or unlawful processing of your personal data. These range from physical measures such as burglar alarms and access control to various organizational and technological security actions. No third party or unauthorized employee has access to your personal data. 

Personal data is not provided to third parties

GVB does not make your personal data available to third parties for their own (commercial) use. Nor will your personal data be sold to third parties or transferred to countries outside the European Union.
GVB is required by law to cooperate and make personal data available to assist investigatory authorities such the police, fiscal intelligence and investigation service, and so on. In such cases, GVB conscientiously investigates the authority of the investigative agency and will comply with these legal requirements as these are stipulated in the personal data protection act.
 
Insofar as required to ensure that your OV-chipkaart works properly throughout the land, GVB shares data with collection agencies in the event of non-payment of season tickets and Trans Link Systems B.V. (TLS). More information is available at www.ov-chipkaart.nl

What are your rights?

You are entitled to examine your personal information that is processed by GVB. You can submit a request to receive a printed summary of your personal information that is processed by GVB. You must submit a letter with your request and include a copy of proof of identification and a copy of your OV-chipkaart. Send the letter and two copies to GVB customer service (address: GVB, Customer Service Department, Post box 2131, 1000 CC Amersterdam). You can also view your travel information using "My OV-chipkaart" on www.ov-chipkaart.nl. If the personal information is processed in such a manner that it is incorrect, incomplete or otherwise in conflict with a statutory regulation, you may ask GVB to correct or delete the personal information and you have the right to block your information when you do no longer want to receive information about new products or services. To do so, you may contact GVB Customer Service (tel: 0900 - 8011).