Data protection declaration – Registered Skyss Travelcards

Personal data is all information that can be used to identify you. Below, you will find more information about how Skyss processes your personal data and about your rights in relation to Skyss.

Purpose

The purpose of Skyss’s processing of personal data is to offer you as a customer an easy and secure way of buying ticket products, to ensure that you are charged the correct fare in relation to your use, to offer different ticket types, and to replace any tickets on lost Skyss Travelcards and give refunds for lost Skyss Travelcards.

Grounds for processing personal data

Skyss’s processing of your personal data in connection with registered Skyss Travelcards requires a legal basis for the processing.

Processing of your personal data is necessary to meet the service agreement which is entered into between you and Skyss when you order a registered Skyss Travelcard and accept the terms and conditions of use, cf. the General Data Protection Regulation Article 6. 1b).

It is voluntary to use a registered Skyss Travelcard and providing the data required to be able to use the card. If you do not want Skyss to process personal data about you, you can choose an unregistered (anonymous) Skyss Travelcard instead. You can buy the same types of tickets on an unregistered Skyss Travelcard at no extra charge. However, no refund is given for lost unregistered Skyss Travelcards.

What personal data does Skyss process?

When you order a registered Skyss Travelcard, your name, date of birth, address and email address will be collected and stored by Skyss.

For registered Skyss Travelcards, Skyss stores the ticket type and validity period indicated on the card (season tickets, individual tickets or cash travel) as well as the payment history.

Skyss also stores travel history data generated when the Skyss Travelcard is used. Storage of travel history requires that you validate your card when boarding. Validating the Skyss Travelcard when boarding is voluntary. Travel history information includes the stop at which you boarded the bus/light rail/boat, date and time of boarding, card number, ticket type used and the price of the individual journey.

Skyss only uses travel history together with your other personal data if you demand a refund on the Skyss Travelcard or in conjunction with other enquiries from you. Skyss will not use travel information together with your other personal data to produce statistics, in connection with settlement with a cooperating company, or, generally speaking, with troubleshooting. 

Sources of personal data

All personal data processed in connection with registered Skyss Travelcards are collected from you.

Disclosure to third parties

Skyss does not disclose your personal data to third parties unless there are legal grounds for such disclosure, for example a ruling or written order from the prosecuting authorities.

Anonymised travel history can be used for statistical purposes. Anonymised data is not considered personal data, and can therefore be submitted to third parties. 

Access to personal data

The personal data processed about you will only be accessible to authorised personnel with an official need at Skyss.

Storage and erasure

All data are stored in Norway. The servers are operated by personnel in Norway. All data stored are kept in accordance with applicable legislation. Skyss works in accordance with the principles for automatic data protection and data protection as a default setting. This implies among other things that your personal data are not stored for longer than necessary to meet the purpose of the service.

Travel history

Travel history is stored for 104 days. After 104 days, the travel history is anonymised by removing the link between the registered Skyss Travelcard and your personal data.

Payment history

All sales documentation is stored for five years after the end of the accounting year, cf. the Bookkeeping Act Section 13 with pertaining regulations.

Basic information

The name, date of birth, address and email address that were collected when the registered Skyss Travelcard was ordered will be stored as long as you use the card actively as a customer.

This basic information will be erased when the card has not been in use for three years. The Skyss Travelcard will then be blocked, and any remaining value on the card will be erased.

Security

Skyss has implemented data security measures and internal procedures to verify that no personal data fall into the wrong hands or are used for other purposes than those described in this data protection declaration. 

Your rights in relation to Skyss

You have the right to be informed of Skyss’s processing of your personal data. This data protection declaration is therefore available at all times on our website.

Right of access

You may request information on how Skyss processes your personal data, including information on why Skyss processes your personal data, from where we have obtained your personal data, what categories of personal data Skyss processes, to whom Skyss discloses your personal data and how long Skyss stores your personal data.

All the information mentioned above is found in this data protection declaration. You may also request access to the personal data that Skyss processes about you.

Right to correct

You may request that incorrect or incomplete personal data be corrected or supplemented.

Right of erasure

You may request that Skyss erase your personal data if the terms for this are met, for instance if Skyss has processed your personal data in an unlawful way or for longer than necessary.

Right of limited processing

You may request that the processing of your personal data be limited if you contest the accuracy of the personal data, the legality or necessity of the processing or if you have objected to the processing and Skyss has accepted your objection.

The processing will be limited from the time the objection is submitted and during the period of time it takes Skyss to assess the objection. If the processing shall be limited, Skyss is only allowed to store the limited personal data, and any other processing can only happen with your consent. This applies unless Skyss is required to process personal data in connection with judicial matters, to protect the rights of others, or if the processing is of public interest.

Right to object

You may object to the processing of your personal data if you believe Skyss does not have the right to process your personal data. In such cases, Skyss may only continue processing the data if Skyss can substantiate a justifiable interest that carries more weight than your interests, rights or liberties. The personal data may in any case be processed if Skyss is legally obligated to do so or if processing is necessary in order to establish, assert or defend a legal claim.

Right of data portability

You may request that the personal data you have submitted to Skyss for processing based on your consent or to meet a contract to which you are bound be sent to you in a structured, ordinary or machine readable format. You also have the right to request that Skyss transfer such information to another controller. 

Right to complain to the Norwegian Data Protection Authority

You can complain to the Norwegian Data Protection Authority if you are dissatisfied with Skyss’s reply or believe that Skyss is processing your personal data in breach of the applicable data protection regulations. Information on the complaint procedure is available here.

Contact information

If you have any questions relating to Skyss’s processing of your personal data or you would like to access, correct, erase or request limited processing or data portability, please use the contact form here.