Privacy policy

1. OBJECTIVE

The purpose of processing personal data for the Mobillett application:

Nordland County Council (hereafter referred to as the “data controller”) is responsible for the personal data processed via Ticket Nordland.

The Ticket Nordland app is provided by WTW AS (hereafter referred to as the “data processor”), which processes your personal data on behalf of the data controller in accordance with a separate data processing agreement, ref. item 5.

2. LEGAL BASIS

The use of Ticket Nordland is voluntary. If you decide not to make use of this solution, you may choose to purchase a ticket using alternate options, such as purchasing on board the vehicles of Nordland County Council. You may pay by cash (not available on Bodø city Routes) or by payment card.

It is also possible to pay with a Travel Card, which has been validated in advance via Nordland County Council´s web solution (reisnordland.no) or validated with cash (does not apply to Bodø city routes) or validated with a bank card on board the vessel.

We need to process your personal data in order for you to use the app and fulfil the legal service agreement you enter into with the data processor once you open the app and accept the Terms and Conditions. Before registering in the app, you will be informed that your personal data will be processed in accordance with this Privacy Policy.

3. PERSONAL DATA

The app processes the following general personal information about you:

Mobile number and password: This information must be registered to your user profile to enable us to offer a service with a secure and verified login. Your mobile number is required to ensure that you can access your active season tickets or receipts for past purchases in case you lose your mobile device. Your mobile number serves as your unique user ID when using the app and is the only personal information required for your user profile.

Name and connected users: It is optional to enter names in the app. This option is available to people who want to connect users to their Mobile account. Connected users can pay for tickets using the money you deposited in your Mobile account. You only need to enter you cell phone number to assign a connected user to your Mobile account. If you wish, you can also add a name or a nickname for this user so that it is easier for you to distinguish between different connected users.

Email address: Adding your email address to your user profile is optional. We only need your email address if you want to have your receipts emailed to you. You can delete or amend this information at any time under “Settings” in the app.

Sales documents: All sales documents are stored in accordance with the Norwegian Bookkeeping Act. The travel information associated with your ticket purchase is only retrieved when initiated by the registrant, e.g. when submitting a complaint or other query that requires us to look more closely at all the details of your purchase.

Credit and debit cards: When you pay with a credit or debit card, a connection with the payment service provider is created to allow you to register your card in the Ticket Nordland app without storing your full card details in the app. If you choose to save one or more cards to your profile, only the payment service provider has access to your full card details. The app will only store the first six and last four digits of the card number along with the expiry date. This information is essential in order to allow you to recognize your card, to enable us to generate the information that should be included on your receipt, and to allow us to respond efficiently to any refund entitlements.

Details for Mobile Account: With Mobile Account, you can enter a desired amount that you or your potential sub-users can use to purchase tickets. The system processes information about the balance and transactions related to your Mobile account, including history of refilling account, purchases, refunds, and credits.

Technical information: When you use the Ticket Nordland app, your IP address, the time of your query, info about your web browser or mobile phone, the version number and mobile platform for the app, including your chosen language, will be stored in the application log. This information is required in order for the app to work on your particular platform/mobile and is stored to ensure that the service works as intended. It also provides us with necessary information to help resolve any faults. We do not use analytical tools (e.g. Google Analytics) that identify and log the behaviours of identifiable users. The only analytical function is crash reporting using the HockeyApp, which provides completely anonymous crash reports and helps us swiftly rectify the problem if the app were to crash.

Travel information: When you grant the app access to your phone’s GPS, the positioning data will only be used locally on your mobile device No positioning data logged in the app is shared with the back-end system. The only travel information to be processed is the information about the departure point/zone and destination point/zone required to document the purchase and work out the correct price. The travel information associated with your purchase is stored and anonymized together with the other transaction data.

4. STATISTICS

Information is used for statistics, but the information is anonymized and thus cannot be linked back to the user. Nordland County Council is required by law to provide the state and municipal authorities with traffic statistics; ref. § 2-2 of the Statistics Act and § 49 of the Local Government Act. Furthermore, statistics are used to improve and develop our services and what we offer our customers. Examples of what the statistics provide us: How many people travel between zones, the number of purchases per ticket category and how many people buy tickets using their cell phone platform (Android or iOS). The public transport company gathers information from ticket purchases via the Ticket Nordland app. The travel information from your ticket purchase will not be used together with personal data to produce statistics.

5. DATA PROCESSOR

WTW AS, the supplier of the Ticket Nordland app, acts as data processor on behalf of Nordland County Council. A data processing agreement has been entered into by WTW AS and Nordland County Council. The data processing agreement ensures that WTW processes all personal data in accordance with the provisions given by Nordland County Council in this privacy statement.

Nordland County Council and WTW AS process personal data in accordance with Norwegian law, including the Personal Data Act, relevant accounting legislation and the industry standard for e-ticketing.

6. OTHER DATA PROCESSORS ASSOCIATED WITH TICKET NORDLAND

The personal data collected or generated via Ticket Nordland will not be processed by systems belonging to sub-contractors other than WTW and the payment service provider(s) you choose to use.

7. PERSONAL DATA SOURCES

All personal data processed by the Ticket Nordland App service is uploaded or generated by you. No information is obtained from external registers or services.

8. ACCESS TO PERSONAL DATA

TThe processed personal data is only accessible on a need-to-know basis to authorized personnel at Nordland County Council and its sub-contractors, including ticket inspection providers, payment service providers, WTW AS and the server operator.

No information will be either disclosed to any third parties in Norway or abroad not mentioned in this privacy policy.

9. RIGHTS AND REQUESTS FOR INFORMATION

We must tell you how your personal data is processed. This Privacy Policy can therefore be accessed from the app’s menu at any time. As a user of the Ticket Nordland, you have the right to:

• access the personal data being processed,
• demand that incorrect personal data be corrected or removed,
• receive a copy of the personal data that you have disclosed and transfer it to another data controller (data portability),
• contact the data controller if you wish to provide feedback or ask questions about the processing of your personal data,
• complain directly to the Norwegian Data Protection Authority if you feel that the processing of your personal data is in breach of prevailing legislation.
• Please note that your mobile number is linked to your user profile. To change your mobile number, simply reset the app and create a new user.
• Any other personal data that you have provided can be amended or deleted at any time under “Settings” in the app.

10. STORAGE AND DELETION

All data is stored in WTW’s server center in Norway. The servers are operated by personnel in Norway. All data stored in the back-end system is kept in accordance with prevailing legislation. Your personal data will not be stored for longer than is necessary to fulfil the communications purposes for which the app is intended. Both the data controller and the app developer, WTW AS, have put in place information security measures and internal procedures to ensure that no personal data goes astray or is used for purposes other than those described in this privacy policy.

Both the data controller, Nordland County Council, and its data processors observe the principles of privacy by design and privacy by default. This implies that your personal data should not be stored for longer than is necessary in order to fulfil the purpose of the service.

Profile information: our profile information will be stored for as long as you remain an active customer. You may request your user profile to be deleted from the Ticket Nordland System at any time. You must then register again if you wish to use the service at a later date. Your mobile number will be verified when logging in for the first time on a new device. If you have entered other personal data in the app, you may edit this data in your profile at any time under “Settings”.

Transaction history and sales documents: All sales documents are stored for 5 years from the end of the financial year in line with prevailing accounting legislation, including the Bookkeeping Act and associated regulations. Receipts for your most recent purchases can always be accessed through the app. As required by the payment service providers, Nordland County Council is obliged to grant you access to the sales documents for all service purchases for a period of 20 months. After 20 months, the sales documents will be archived and anonymized so that it is no longer possible for you or anyone with authorized access to the Ticket Nordland System to retrieve information linked to the user.

Technical information and application log: he application logs are stored for an appropriate period of time to ensure that the service works as intended and those customers receive the service they are entitled to. In the event of a complaint about a fault with service, for instance, the relevant application log may be kept for longer to enable it to monitor the time period in question and complete the processing of the complaint.

11. SECURITY

All communication between the solution and the applications on the end user’s handsets is encrypted. All access to the online system is encrypted. All internal data transfers between the various components in the system are encrypted. Data may only be retrieved via APIs that have been encrypted and made secure with access keys. Access to the data via Nordland County Council’s interface is role-based and personal with incident logging to ensure traceability. The administration interface for the solution has been designed with different access levels so that individuals who require access through Nordland County Council or WTW will be able to access only the amount of information they need or WTW will be able to access only the amount of information they need.

12. CONTACT INFORMATION

If you require further information about how your personal data is processed, please contact Nordland County Council, transport division on email post.samferdsel@nfk.no.

Please note that this privacy policy will be updated when changes are made to the system. The latest version of the Privacy Policy is always available in the Ticket Nordland app, allowing you to keep up to date with how your personal data is processed.