Passenger Privacy Statement, September 2026
HTM and Your Personal Information
HTM always handles personal data with care and security. We process data that individuals enter themselves on online forms, such as information for applying for an annual pass, as well as data related to questions, complaints, claims, and found and lost items. To ensure the safety of you as passengers and our employees, we use camera footage in our vehicles and at some stops, and in some cases, our enforcement officers (BOAs) wear body cameras.
This privacy statement describes how we process personal data and for what purposes we use it. Above all, HTM complies in all cases with the General Data Protection Regulation (GDPR) and the GDPR Implementation Act, the Police Data Act (WPG), and the Passenger Transport Act (and Decree) of 2000.
The processing of personal data for the performance of police duties falls under the WPG. Special Investigating Officers (BOA) employed by the HTM must, where applicable, comply with the legal obligations of the WPG and assist the police (in their investigative duties). This includes data we collect for the investigation of criminal offenses, the maintenance of public order, or the provision of assistance.
To do so, it may be necessary for us to process personal data such as your contact information or surveillance footage.
If you travel without a valid ticket or otherwise fail to comply with applicable transportation terms and conditions, our BOAs may process your personal data to issue a citation and impose a fine. The personal data processed by the BOAs in this context is subject to the WPG.
How do we process personal data?
The processing of personal data serves several purposes, as listed below. Personal data is not automatically used for all purposes simultaneously.
Purposes:
• Fulfilling the agreement entered into, such as the purchase and use of passes and other tickets
• Information and service: travel information (such as emails about construction work, schedule changes, detours, and service disruptions), handling questions, requests, complaints, lost and found items, or requests for refunds related to the use of the OV-pas, the OV-chipkaart and/or debit card, as well as, among other things, requests for photo/video permissions and sponsorship requests.
• Public safety: to ensure the safety of passengers and employees on our trams and buses and at stops, including investigations into perpetrators of violence.
• Service improvement: processing data that cannot be traced back to specific individuals for purposes such as market research, location tracking for the use of HTM services, management information, analysis, general strategy, developing products and services to improve service delivery, and conducting marketing campaigns.
• Fraud prevention: including investigations into the unauthorized use of the public transit pass, public transit chip card/payment card containing an HTM subscription or HTM product, or the proper use of the “Refund for Delays” program.
• Financial administration: carrying out accounts receivable management (such as calculating, collecting, or crediting invoices for subscriptions or other travel products and maintaining contact with debtors) and revenue accounting.
• Historical & statistical purposes: including the number of passengers boarding and alighting.
• Compliance with applicable laws and regulations, including the Passenger Transport Act 2000 and tax laws and regulations.
HTM processes personal data based on the following grounds set forth in the GDPR:
• Consent of the individual;
• Performance of the contract,
• Legitimate (business) interest
• Legal obligation.
How long do we retain personal data?
HTM applies various retention periods, all of which are in compliance with the GDPR. The relevant retention periods are listed in the tables below.
Requests for photos, videos, and sponsorship that contain personal data are deleted once the request has been processed.
Personal Data Is Secured
HTM has implemented measures to protect personal data against loss or unlawful processing. These measures range from physical safeguards, such as a burglar alarm and access control, to various organizational and technical security measures. Unauthorized HTM employees or third parties do not have access to personal data. Access to your data is restricted to authorized employees and is granted only when necessary for the performance of their duties and in accordance with an established authorization policy.
Disclosure of Data to Third Parties
Under applicable laws and regulations, HTM is required to cooperate with law enforcement agencies, such as the police, the tax authorities, or the FIOD, if they request personal data. In such cases, HTM carefully verifies the authority of the relevant investigative authority and will, of course, comply with the requirements set forth in the GDPR/WPG when fulfilling this legal obligation.
HTM may also independently disclose personal data to the police or judicial authorities to protect HTM’s rights and property.
Furthermore, the data may be used as supporting evidence in legal proceedings or proceedings before the Public Transportation Disputes Committee. HTM does not disclose more data to third parties than is necessary.
To ensure the smooth nationwide processing of (travel) transactions and the financial settlement for revenue sharing among public transportation companies, HTM shares your (transaction) data and product data with Translink Systems B.V. (Translink). You can find more information about this later in this privacy statement and at https://www.ov-chipkaart.nl/enhttps://www.ovpay.nl/nl/
In addition, HTM engages other parties to perform services. These are processors who may process personal data on behalf of and for the benefit of HTM. HTM enters into specific agreements with these processors regarding the processing of personal data, such as security and data retention, confidentiality, and the stipulation that data may only be used to carry out the specific assignment received from HTM. Examples include payment service providers, collection agencies, cloud and hosting providers, IT service providers, etc.
When you use the weather service on the HTM app, a pop-up window opens. You will now be redirected to the Buienalarm platform. You will not automatically return to the HTM app. To do so, you must close the Buienalarm window.
When you click on and view this weather service, your data is processed by Buienalarm.nl. Please see their privacy statement: https://www.infoplaza.com/nl/disclaimer-en-privacy
Your Privacy Rights
Everyone has the right to access their personal data that HTM processes about you. Upon request, HTM can provide a written overview of the personal data known to HTM. For individuals under the age of 16, a parent or guardian must submit the request
A request can be submitted by email (gegevensbescherming@htm.nl) along with a copy of your ID (with the BSN number and photo crossed out) and a copy of your public transit chip card (with the photo crossed out). You can also submit your request using the HTM Personal Data Form. If you do not wish to send a copy of your ID as described above, you can also identify yourself at the HTM service desk with a completed form. They can forward this to gegevensbescherming@htm.nlen and indicate that your ID has been verified by them.
HTM will respond to the request within the statutory timeframe, even if HTM is unable to fulfill the request. The email address mentioned above can also be used for other questions regarding privacy.
Is your personal information incorrect or incomplete? Please use the form above.
In personal accounts on the HTM web store, you can specify which information you do or do not wish to receive. Do you believe that HTM has not acted appropriately in response to your rights? If so, file a report with the Dutch Data Protection Authority: file-a-complaint-with-the-ap
Below is an overview of the various services where your data is also processed if you use them.
1. Privacy Policy for the Public Transportation Chip Card
2. OVpay Privacy
3. Privacy: Information Management
4. Privacy on the HTM Website and HTM Apps
5. Privacy Policy for MIJN-HTM and Product Sales
6. Privacy: HTM Video Surveillance
7. Privacy When Reporting Damage
8. Privacy under the Police Data Act
1. Privacy of the OV-chipkaart
There are two different types of OV-chipkaarten: the personalized OV-chipkaart and the anonymous OV-chipkaart. In addition, there is also a single-use OV-chipkaart that is valid for a limited period or for a specific trip. This single-use OV-chipkaart is also intended for anonymous use.
The personal OV-chipkaart is a registered card with a passport photo (the newer cards no longer contain a photo, but the photo is still visible to the inspector on their handheld device during ticket checks). The personal OV-chipkaart is used for so-called person-specific products, such as an HTM annual pass or an age-based discount.
Users of a personal OV-chipkaart are known to the card issuer, Trans Link Systems B.V. (Translink). Translink processes the personal data associated with OV-chipcards and related transactions. For more information about Translink’s privacy policy, please visit the website https://www.ov-chipkaart.nl/privacy
HTM is not liable for Translink’s privacy policy.
HTM, the other transit operators, and Translink are joint data controllers for the processing of personal data related to the core processes within the OV-Chip Card system. To this end, we have entered into a cooperation agreement among ourselves that sets out the division of roles, responsibilities, and agreements regarding these core processes. For each core process, it has been determined which data must be processed to ensure an effective and efficient Public Transportation Chip Card System and who requires that data.
HTM may use your chip card identification in cases of suspected non-payment, to prevent fraud, or in cases of suspected and/or proven fraud. Providing your OV-Chip Card identification means that Trans Link Systems (TLS) will receive the internal card number (chip ID) associated with the
number (engraved ID) printed on your card. TLS does not provide your name, address, place of residence, or any other data that TLS processes about you. As a public transit operator, we have a legitimate interest in this.
There is no link between HTM’s subscription records and Translink’s travel data.
Data such as name, address, and place of residence on a personal public transit chip card containing an HTM pass are processed in the HTM pass administration system. Transaction data (such as check-in/check-out data, location, and chip ID) are processed in the public transit chip card system. The HTM subscription records system is not linked to the public transit chip card system, and HTM can only access data in the public transit chip card system at your explicit request or in the event of (suspected) fraud involving a public transit chip card, and then only by authorized personnel.
This data is accessed through an online portal. Access to this portal is provided by Translink, which acts as a joint data controller for this purpose together with the transit operators. Without your consent, HTM will not be able to access the travel data from your trips with other transit operators.
How long do we retain personal data?
We distinguish between transaction data and data we use for our subscription administration.
Transaction data (data generated when using the OV-chipkaart)
With regard to transaction data, the related personal data is never retained for longer than 18 months.
Subscription Administration
Personal data (including contact information) required to issue a subscription is processed as part of subscription administration. In accordance with the General Tax Act, the retention period for this data is 7 years.
See also https://www.ov-chipkaart.nl/ for more background information
2. OVpay Privacy Policy
When traveling with your debit card and public transit pass, we may use terms you are not (yet) familiar with. We have therefore listed these terms and their meanings at the end of this privacy statement.
The nine Dutch public transit operators (“Operators”) and Translink jointly offer two additional ways to travel by public transit. This involves purchasing a fare by checking in and out with your debit card or your public transit pass. In this privacy statement, we use the term “Card” to refer to both the debit card and the public transit pass.
For the debit card, we do this in collaboration with several payment service providers. With these payment service providers, your debit card is linked to a public transportation travel function in the Netherlands. You pay for your trips through the bank account associated with your debit card.
With the public transit pass, you pay for your trips using the balance associated with your pass or pay later if you travel on credit. The OV-pas is issued by Translink, and Translink also manages the balance. If you have questions about the OV-pas—such as how it works, how to purchase one, or your balance—you can contact Translink. For questions regarding trips you’ve taken, you can contact the transit provider you’re traveling with or Translink.
Terms and Conditions
If you travel by checking in and out with your Pass, you and […] enter into a transportation agreement to which the [General Terms and Conditions for City and Regional Transportation (AVS)] [AVR-NS] apply. When using the Payment Card, the “OVpay Terms and Conditions for Checking In/Out with Your Payment Card and Credit Card” also apply. When using the OV-pas, the “General Terms and Conditions for the OV-pas” apply.
If you use an age-based discount on the bus, tram, or metro, or a discount or free-travel product (such as a pass), the relevant product terms and conditions also apply. If you use travel on account, the terms and conditions for this service also apply, for which you enter into an agreement with your payment service provider.
Personal Data.
As soon as data can be traced directly or indirectly to a person, it is referred to as Personal Data. Examples include your name, (email) address, and date of birth. Your travel data or username may also be classified as Personal Data.
Processing trip and payment data is necessary when checking in and out with your Pass. This allows you to travel and pay on public transportation. […] and Translink can also provide you with services. If you do not want us to have access to this necessary trip and payment data, you will not be able to travel or pay with a Pass and will need to use another standard ticket.
The processes were designed based on the principle of “privacy by design.” This means that Translink and the transit operators have designed and configured the systems to protect your privacy as a traveler as effectively as possible.
Pseudonymization and Re-identification
Immediately after you check in, the unique identification number (PAN) of your Pass is pseudonymized. This means that each Pass is assigned its own unique number. This unique number is used for various purposes, such as purchasing a public transit pass, traveling, paying, customer service, inspections, and summary reports.
Translink has a central administrative system where, on behalf of the transit operators, it records tickets, calculates the fare, and tracks the total amount you spent on travel that day. This system assigns each transit operator its own unique identification numbers for your Pass. As a result, transport providers have no insight into the trips you’ve taken with other transport providers. Payment service providers only have insight into the trips you’ve taken to the extent that they invoice you for these trips and are permitted to set the price they charge for them themselves (i.e., they may deviate from the price the carrier itself charges for that trip when traveling on a prepaid balance). In cases where the payment service provider is required to charge the same price as the carrier, the payment service provider does not see any trip details, but only the carrier’s name, the date, and the fare.
Without additional information, pseudonymized data cannot be traced back to your Card Information. Pseudonymization is a measure taken to reduce the risks to you as a traveler when your Personal Data is processed. Transportation providers and Translink have entered into agreements to minimize this risk of re-identification; for example, in principle, transportation providers cannot view a traveler’s travel history with another transportation provider. However, a pseudonym can sometimes be linked to a person if there is a valid reason to do so—for example, because the traveler identifies themselves to the transit operator.
How does traveling and paying with the Payment Card and Public Transportation Pass work?
A. Purchasing a Public Transportation Pass (balance)
You can purchase a physical public transit pass via the OVpay app and www.ovpay.nl. [You can also purchase one from various transit operators via their website, service desk, and/or ticket vending machine.] [You can also purchase one from us via […]]. When you order a public transit pass, it is assigned a unique number in Translink’s central administrative system. This is necessary to track the balance on the card and to deduct the cost of trips from the balance on the public transit pass. The balance changes when someone travels using the public transit pass and when money is deposited into or withdrawn from the account.
For the physical public transit pass, Translink needs a name and shipping address so it can send it to you. This personal information for shipping is retained for 30 days. This is so that Translink can produce a new public transit pass and send it to you if anything goes wrong during the production and shipping process.
You can also purchase a physical OV-pas (and load it with credit) at a number of nationwide retailers, namely Primera and Albert Heijn. You can pay with either cash or a debit card. You can only top up a public transit pass at these retailers if it was purchased there (and therefore has a barcode). Translink does not process any personal data when a pass is purchased in this manner. Translink also does not know who purchased the public transit pass. Translink therefore knows which trips were made with such a public transit pass, but not the identity of the person or persons who made those trips.
Loading, managing, and refunding the balance on the public transit pass.
Through the OVpay app and www.ovpay.nl, you can load up to €150 onto your public transit pass. [You can also load funds onto your pass through various transit operators’ websites and service counters.] [You can also top up your OV-pas balance with us via […]]. This also allows you to check your balance.
If you’ve lost your OV-pas, or if it’s been stolen or is defective, you must report this via the OVpay app or OVpay customer service. To do so, Translink needs the OV-pas details: the card number and the verification code. These are printed on your OV-pas—one on the front and the other on the back. The OV-pas will then be blocked and can no longer be used for travel. If you do not have (or no longer have) the card number and verification code for an OV-pas, you unfortunately cannot block it.
If you request a new OV-pas through your OVpay account or a user account with a transit provider, the balance will automatically be linked to the new OV-pas. This is not the case if you order your replacement OV-pas separately without an account (for example, through a retailer).
An expired public transit pass is automatically blocked and can no longer be used for travel.
Automatic reloading of public transit passes.
With automatic reloading, the balance of a specific public transit pass is automatically replenished. To set this up, you enter into an agreement with Translink. You authorize Translink to reload the balance of the relevant public transit pass with the agreed-upon amount each time. This reload occurs automatically once upon activation. After that, it occurs when:
• You check in with a transit provider using the transit pass and the balance is too low to pay the minimum required fare with the transit provider you are traveling with;
• The balance is too low to pay the fare after traveling with that public transit pass on a carrier;
• The balance is €10 or less.
Automatic reloading can only be requested and activated through an OVpay account in the OVpay app and on the OVpay website. It cannot be requested through other channels, such as a transit provider or payment service provider.
The person who enters into the automatic top-up agreement may be the user of the public transit pass, but this is not required. You can also enter into the agreement on behalf of a family member. However, the agreement must always be linked to one specific public transit pass.
Traveling on account with the OV pass.
Traveling on account means paying later for trips you take with your public transit pass. To do this, you enter into a separate agreement with a payment service provider. This agreement outlines your payment terms, such as the timeframe within which you must pay and the payment method (for example, direct debit or recurring transfer). You are therefore a customer of the payment service provider.
Translink bills the payment service provider for the travel costs you’ve incurred. The payment service provider then pays the costs for each trip you’ve taken on account (via Translink) to the transit operator. The Payment Service Provider settles these costs with you afterward. The amount the Payment Service Provider charges you may differ from the fare charged by a Carrier for the same trip when traveling on a prepaid balance.
Failure to comply with the Payment Service Provider’s terms and conditions (including payment terms) may result in your ability to travel on account using your public transit pass being (temporarily) blocked. You will still be able to travel using the balance on your OV-pas, provided there is sufficient balance linked to it to travel with Transport Operators.
The Payment Service Provider is solely responsible for the data it receives from Translink and Transport Operators. It will inform you directly about how it handles your personal data; therefore, this information is not included in this privacy statement. In most cases, Transport Operators and Translink cannot link this data to you. However, if you purchase a product from a Transport Provider or create an account in an app from Translink or a Transport Provider, this is possible.
Whether or Not a Personalized Product Is Linked to the Public Transportation Pass
In principle, a physical public transit pass can be used for travel by anyone who possesses the card. You can also link a personalized product to the public transit pass, such as an age-based discount on buses, trams, and subways, or an unlimited travel product (such as a pass). If you link one or more personalized products to a public transit pass, only the person to whom the personalized product or discount profile belongs may use it to travel.
When ordering via the OVpay app or OVpay.nl, you can have an identifier printed on the physical OV-pas. This identifier can be your name, but it can also be something else, such as “family pass” or “pass 2.” This helps you recognize the card. It does not make the card personalized. This means that someone else may also use this public transit pass, as long as it is not a Personalized Product or Discount Profile. Adding a label is not possible for public transit passes purchased from a retailer.
Personalized Product and Discount Profile
Both Payment Cards and Public Transportation Passes support Personalized Products and Discount Profiles. The options for these vary by product and by transit provider. To use such a product or profile, you must first create a personal profile via the OVpay app or website or that of a transit provider. Depending on the product or profile, you’ll need your email address, name, date of birth, and/or a passport photo.
Student Travel Product on a Public Transit Pass
The student travel product will become available on an OV-pas for an increasing number of students in the coming quarters. If you do not yet have an OV-pas, you must first purchase one. You must also create a personal profile by providing your email address, name, and date of birth. After that, you can apply for the student travel product. RSR will then check its records to verify your eligibility. It will also verify with Translink—as the administrator of your personal profile—whether this profile matches the information on file with RSR. If so, RSR will link the student travel pass to your public transit card.
B. Public Transportation Card Data Protection
In principle, the public transit pass is not linked to you as an individual. As a result, if you have a physical public transit pass, you can use it to travel—as long as no personalized product or discount profile is linked to the pass.
Because the public transit pass is not linked to a single person by default, anyone in possession of your public transit pass may also be able to use certain services. This includes viewing past trips, refunding credit, reporting the loss or theft of the transit pass, or correcting a missed check-out via the OVpay app, ovpay.nl, or a transit provider’s website or app.
If you want to prevent someone else from using these services for your public transit pass without your permission, you can enable additional data protection. You can do this by linking the public transit pass—using the pass number and verification code—to your OVpay account. The additional data protection will then be automatically enabled. You can also activate this protection without an OVpay account via ovpay.nl or through a transit provider.
To create an OVpay account, you’ll need an email address and a password. When you link your public transit pass, you’ll receive an email at the address you provided. Once you’ve confirmed this email, the public transit pass will be linked to your account. An OV-pas can only be linked to one OVpay account at a time. If you want to link the OV-pas to a different OVpay account, you must first unlink it from the current account. However, you can link a public transit pass simultaneously to an OVpay account and to an account with one or more transit operators.
If you do not enable additional data protection, you can still use services via ovpay.nl. You can also visit ticket machines and service counters operated by various transit providers.
C. Traveling
Traveling for the First Time with Your Payment Card
The first time you check in with your payment card, an automatic check is performed to determine whether a public transit travel function in the Netherlands is linked to that payment card. This also happens if you haven’t traveled with that payment card for a period of 14 days and then check in again.
Translink also checks with your debit card’s bank to see if the card has been blocked. If so, we will block the public transit travel function on your debit card, and you will not be able to use it to travel. This is a decision made by the bank. The transit operators and Translink cannot change this block.
Traveling with Your Debit Card and Public Transportation Pass
When you check in with your card, the card reader reads the technical data. We then verify whether you can travel with this card and provide you with feedback via the card reader. For example, a debit card will be declined if you are not authorized to travel on public transportation in the Netherlands with that particular card issuer. Presenting your card to a card reader is called a “tap.”
If you are eligible to travel with the Pass, personal data is sent to Translink via the card reader of the transit operator you are traveling with when you check in and out. In addition to the technical data, this includes the date, time, and stop or station where you checked in or out. Translink records all check-ins and check-outs and is responsible for reconstructing the trip and determining the fare. Your trip is compiled and the fare calculated using this data and—if applicable—additional data from Personalized Products and Discount Profiles.
To use the “age discount on buses, trams, and subways” discount profile, you must provide your name, date of birth, and a passport photo. You can do this in the OVpay app, on the OVpay website, or in the app of a bus, tram, and/or subway operator. If you do not want the Transportation Companies and Translink to have access to this required Personal Data, you will not be able to use the age discount on buses, trams, and subways.
Validity Checks for Payment Cards and Public Transportation Passes
Every time you check in with your public transit pass, several automatic checks are performed. For the public transit pass, we verify whether there is sufficient balance on your pass to travel by public transit. The minimum required balance may vary by transit operator and is determined by the operator.
In addition, every time you check in with your debit card or public transit pass, an automatic check is performed against the watchlists to ensure the card has not been blocked. These lists are managed by Translink and distributed to transit operators. Translink adds a card to this list if
• it turns out that the Card you used on public transportation is on a watchlist maintained by the bank (for the debit card) or by Translink and carriers (for the public transit pass), for example, because it has been reported as stolen or lost;
a transaction for the use of public transportation with the Pass did not go through, for example because you did not have sufficient funds in your bank account or on your public transportation pass at the time of the transaction;
multiple transactions from a debit card linked to the same bank account have not been processed;
it turns out that you are using a Personalized Product or Discount Profile and you do not meet the applicable conditions.
Park and Ride (P&R)
In many places, you can park your car at a P&R parking lot and then continue your journey by public transit. When paying your parking fees, you can present the card (such as a public transit pass or debit card) you used for your trip at the payment terminal. The P&R provider will then ask Translink to check its systems to verify whether you traveled by public transit and whether you are eligible for a discount on the parking rate. This discount depends on the location and the agreements between the P&R provider and the municipality.
Translink never shares your travel data with the P&R provider. It merely indicates whether the discount can be applied. The P&R provider then processes this discount and settles the parking fee with you.
Trips made using a debit card do not entitle you to a discount at NS P&R parking lots.
D. Payment
Paying with Your Betaalpas
When you check in and out using your Betaalpas, Translink calculates the fare for the trips you take. Translink, in collaboration with the payment processor Fiserv (formerly EMS) and your bank, processes the payment for the trips you’ve taken. On the night following the Travel Day on which you traveled, the total amount due for all trips you took on a single Travel Day is submitted in a single transaction via Fiserv to your bank. Translink provides Fiserv and your bank with the technical data and payment reference for processing the payment.
However, during the Travel Day, Translink will settle your trips immediately if the total fare amount exceeds a threshold determined by the carriers. The fare amounts due are then immediately debited from your bank account. After successful payment, any trips you make as a passenger thereafter will be billed at the end of the Travel Day, unless the threshold amount is reached again in the meantime.
Upon successful payment, you can view the amount debited on your (digital) bank statement and you will receive a payment reference. This reference is unique to each payment and is preceded by the letters “NLOV.” You can find the account statement by logging into your secure online banking portal.
Because you can use certain services with the Payment Reference in combination with the corresponding amount, this also means that if you share it with another person or organization, they may be able to view the trips you have taken.
Paying with Your Public Transportation Pass
When you check in and out with your public transit pass, Translink calculates the fare for the trips you take. Translink also processes payment for the trips you’ve taken when using a prepaid balance. After checking out, the cost of the trip is immediately deducted from the balance linked to your transit pass. If the payment is successful, you can immediately see the amount deducted in the OVpay app and on www.ovpay.nl, provided you’ve linked your transit pass to a personal account there.
A Failed Payment
If the payment fails with your pass—for example, because the balance is too low—Translink will block either the public transit pass or the travel function linked to the payment card. You will then no longer be able to travel with your card until the outstanding amount has been paid and/or until the minimum balance required for travel with a transit card has been met.
Paying the Outstanding Balance for the Payment Card
Over a period of 62 calendar days, repeated payment requests will be made to debit the amount due from your bank account. If the payment is successful, the block will be lifted. Both during this period and afterward, you as a passenger can also pay the outstanding amount yourself.
• To do this, present your Betaalpas to a transit operator’s card reader at the station, at the stop, or on the vehicle. A payment request will then be sent to your bank via Translink and Fiserv. This can be attempted a maximum of once per day;
• You can pay the outstanding amount in the OVpay app, provided your debit card is linked to a personal account there. A payment request will then be sent to your bank via Translink and Fiserv;
• [You can pay the outstanding amount in the […] app. A payment request will then be sent to your bank via Fiserv].
Regardless of the method used, if the payment is successful, you’ll be able to travel again with your debit card approximately 15 minutes later.
Paying the Outstanding Balance for Your Public Transportation Pass
You can unblock your public transit pass by paying the outstanding balance in the OVpay app or by loading credit through one of the other available channels (such as a transit operator or retailer). A payment request will then be sent to your bank via Fiserv. If the payment is successful, you’ll be able to travel again with your transit pass in about 15 minutes. Please make sure you also have the minimum required balance on your OV-pas to travel with the relevant transit operator.
Travel Function Block
You can check whether a card’s travel function is blocked by presenting your card at a carrier’s card reader and checking the message on the display, or by contacting OVpay customer service. Of course, as long as the travel function of the pass is blocked, you can always use another ticket to travel on public transportation.
E. Summary Reports
All transport operators receive daily summary reports from Translink to verify the accuracy of their own transactions and payments, detect and correct any errors, and ensure the integrity of the public transit system. These reports cover transactions (such as check-ins, check-outs, or failed taps), trips (combining a check-in with a check-out), and payments within the relevant carrier’s service area. Translink also ensures that each Carrier receives all payments daily for the trips made with your Pass.
F. Service
We understand that you may have questions about, for example, a trip, charges incurred, or a missed check-in or check-out. Or perhaps you’d like to review your trips from the past period(s). You can do this by viewing and requesting (parts of) your trips:
• In the […] App or through […] customer service; or
• Through the OVpay website, OVpay App, and OVpay customer service.
To assist you personally, for the Payment Card, you’ll need the Payment Reference along with the corresponding amount from your bank statement. We do not know your card number, and we cannot search by your IBAN. For the OV-pas, you’ll need the card number and verification code. These are printed on the OV-pas.
App and website
In both the […] app and the OVpay app, you can link one or more cards. To do this, first create an account in the app using your email address and a password of your choice.
You can link your payment card in the […] app and the OVpay app, as well as via www.ovpay.nl, using:
1. A payment reference and corresponding amount. This can only be done within 31 days after you’ve traveled and made a payment.
2. The PAN and expiration date of your debit card. You must enter these in your account and then use that debit card to travel.
3. The IBAN and card number of your debit card. You must enter these in your account and then use that debit card to travel within 60 days.
Services via the app and website
Through your online account, you can view your check-ins and check-outs, the fare for trips taken and payments made, your payment status, and whether your card has been blocked. In the OVpay app, you can also correct a missed check-in or check-out and settle any outstanding balance.
In the OVpay app and on www.ovpay.nl, you can view, among other things, the full travel history of all trips you’ve taken with your cards on the entire public transit network over the past 18 months. In a transit provider’s account portal (web or app), you can only view the trips you’ve taken with your Passes on that specific provider’s network, also covering the last 18 months.
In the […] App and the OVpay app, you can also set up notifications for when you check in and out, and in the OVpay app, you can also receive a notification if you have an outstanding balance.
In the OVpay app, at www.ovpay.nl, and in the […] app, you can also create an age profile that allows you to use age-based discounts on buses, trams, and subways if you are eligible for these discounts.
Public Transportation Pass
Through the OVpay app, the OVpay website, and the websites or apps of various transit providers, you can purchase an OV-pas and view, add, or request a refund of your balance. Through the OVpay app or OV Customer Service, you can report that you’ve lost your OV-pass, found it, or that it’s been stolen or is defective.
Customer Service
You can direct questions about traveling with a Pass to the customer service department of […] or OVpay customer service. Customer service representatives do not have access to your payment card (account) information. OVpay Customer Service does have access to your OV-pas details, including balance changes; this is so they can assist you with your questions. A representative will always explicitly ask for your information if it is necessary to answer your questions.
The transit operators and Translink have established mutual agreements so that any transit operator can assist you with questions about trips taken with other transit operators. It has been agreed that you can contact the customer service department (by phone or at a service counter) of any transport provider with questions about all trips and transactions you’ve made in the last 62 days.
For questions about a missed check-in or check-out, please contact OVpay Customer Service.
Our service representatives will only have access to the information necessary to answer your questions.
G. Inspection
Everyone who uses public transportation must have a valid Ticket. When you check in with your Pass, your Ticket is linked to that Pass at that moment via a digital registration with Translink. Special Investigating Officers (“BOA”) regularly check passengers on public transportation vehicles, at stops, and at stations to ensure they have a valid ticket. This also includes verifying the validity of your Personalized Product and Discount Profile. If a BOA checks your ticket, you must hold your Pass up to the card reader on the BOA’s inspection device.
In order for the BOA to provide you with assistance and/or, if applicable, leniency, the BOA will ask for your separate consent. The BOA can then view the last 10 transactions involving the use of your Pass on public transportation on their device (going back up to 62 days). This data is displayed on the device for a maximum of five minutes or disappears as soon as another Pass is held up to the card reader.
If you are using a Personalized Product or Discount Profile, this will be visible to the BOA during an inspection. This product or profile is only visible if it applies to the trip you are currently taking. In all other cases, the BOA will not see this information.
If you use a Personalized product or Discount Profile while traveling for which you are not eligible, the BOA may block it. You will then no longer be able to use it. You can correct your information (or have it corrected) in the OVpay app, through OVpay customer service, or through the customer service department of the transit provider you traveled with. Afterward, you can use the product or profile again.
An enforcement officer (BOA) may, on behalf of Translink, confiscate and/or block a public transit pass if it has been reported as lost or stolen; if you attempt to travel with a public transit pass whose validity date has expired; if you are in violation of the General Terms and Conditions for Public Transit Passes; and/or if there is a suspicion of fraud or misuse involving the public transit pass and/or the products linked to it.
Legal Basis for Processing
Checking in and out with your Pass is done to charge the fare. The legal basis for the processing of personal data is the performance of a contract. This refers to the transportation agreement to which the [General Terms and Conditions for City and Regional Transportation] [AVR-NS] apply, as well as the “OVpay Terms and Conditions for Checking In/Out with Your Debit Card and Credit Card” or the “General Terms and Conditions for the Public Transportation Pass.” This depends on which payment method you use. If you use a product or profile, additional (product) terms and conditions apply.
The provision of cross-service (see F. Service) is based on the legitimate interests of the Carriers and Translink. We would like to ensure that your questions are answered as thoroughly and efficiently as possible through a single point of contact rather than multiple ones. It is in the interest of both you as a traveler and the Carriers and Translink that we are able to handle your questions about traveling with multiple Carriers effectively and efficiently.
The legal basis for setting up notifications and managing outstanding balances in the […] app and/or the OVpay app and OVpay website is your consent.
Translink and all carriers have a legitimate interest in maintaining watchlists of passes. Translink distributes these lists to each carrier, which uses them during check-in and check-out to verify whether you are eligible and permitted to travel with that pass on public transportation. (See also B/ Travel/ Verification of the Validity of Payment Cards and Public Transportation Passes).
Who are the Data Controllers? What Personal Data do we use?
Your Personal Data is processed by […] and Translink. The carriers and Translink are joint data controllers for the processing of personal data related to traveling with your pass. The mutual agreements are set forth in a cooperation agreement between the carriers and Translink. The joint controller arrangement applies to the following processes and associated Personal Data:
Process: Tapping
Legal basis: Performance of a contract
Who: The carrier with whom you are traveling and Translink
Purpose: Pass status check and validation of the tap
Retention periods: Up to 24 hours
Personal data: Technical data (PAN, PAN serial number, and expiration date); tap data
Process: Processing of card swipes (transaction processing)
Legal basis: Performance of a contract
Who: The transit provider you are traveling with and Translink
Purpose: - Processing of tap transactions;
- Qualifying taps: tap-in/tap-out/tap-driven debt recovery;
- Compiling trips based on check-in/check-out (travel transaction data); determining the fare; preparing travel transaction data/tap-driven debt recovery for payment;
- Splitting trips and creating synthetic partial trips per public transit operator so that the partial trips can be assigned to the correct operator and the fare can be determined.
Retention periods: 18 months
Personal data: Technical data (PAN, PAN serial number, and expiration date); pseudonymization tokens; travel transaction data
Process: Managing public transit pass balance and balance changes
Legal basis: Performance of a contract
Who: The transit provider you travel with and Translink
Purpose: To deduct from the balance on a public transit pass for
- Trips made and corrected
- Amounts deposited and withdrawn
Retention periods: 5 years (balance amount) after the public transit pass expires
Personal data: Pseudonymization tokens; balance; balance changes
Process: Managing and applying watchlists
Legal basis: Legitimate interest (insufficient public transit pass balance; outstanding debt with other carriers; e.g., stolen/lost pass); performance of a contract (outstanding debt with the carrier)
Who: The carrier with which a debt exists and Translink, or all carriers and Translink
Purpose: Management by Translink and application by Transport Providers of watchlists to deny access to public transit to
- Stolen and lost passes;
- Passes with an outstanding balance;
- Public transit passes with insufficient balance for the relevant mode of transportation.
Retention periods: N/A (old lists are not retained)
Personal data: Pseudonymization tokens; reason for being on the list
Process: Central Passenger Support (self-service) — with or without a service account
Legal basis: Performance of a contract
Who: The transit operator(s) with whom you traveled and Translink
Purpose: - To provide transparency regarding travel and payment transactions and outstanding balances via the OVpay website and OVpay app;
- To facilitate the process for missed check-outs via the OVpay website, OVpay app, and OVpay customer service;
- Processing data required for the age profile to receive a discount on buses, trams, and subways when traveling with your Pass;
- To purchase a personalized (discount) product and apply it when traveling with your Pass.
Retention periods: No data is retained on the OVpay website or in the OVpay app once the service has been provided;
Two months after the expiration of the last active personalized product or discount profile.
Personal data: Payment identifier; payment transaction data; outstanding balance; travel transaction data; pseudonymization tokens; name, date of birth, and/or passport photo
Process: Decentralized passenger support (self-service) — with a service account at the public transit company
Legal basis: Performance of a contract
Who: The transit operator(s) with whom you traveled and Translink
Purpose: To provide data subjects with insight via the public transit company’s website and app into:
- travel transactions and payment transactions with the relevant public transit company (transactions from the past 18 months);
- outstanding debt and the underlying transactions (if applicable) with other public transit companies
Retention periods: No data is retained on the public transit company’s website or in its app once the service has been provided
Personal Data: Payment reference; payment transaction data; outstanding debt; travel transaction data
Process: Decentralized passenger support service via customer service—cross-service
Legal basis: Legitimate interests of the transit operators and Translink
Who: The transit provider(s) with whom you traveled and Translink
Purpose: To inform data subjects via the public transit company’s customer service (in person or by phone) about:
- Outstanding balance; - Travel and payment transactions with other public transit companies (cross-service) over the past 62 days
Retention periods: Until service is provided, the public transit company’s customer service department has read-only access to transaction data
Personal data: Payment reference; payment transaction data; outstanding balance; travel transaction data
Process: Inspection/verification of a valid ticket
Legal basis: Performance of a contract
Who: The transit operator with whom you are traveling and Translink, or the transit operator(s) with whom you have traveled and Translink
Purpose: - to verify, based on check-in/check-out data, whether a passenger has a valid ticket while using public transportation; and, if applicable, to verify the validity of the applicable Discount Profile and/or Personalized Product;
- If there is no valid check-in or check-out, to review the last ten public transportation transactions made with the same Pass in order to determine any follow-up action by the public transportation operator.
Retention periods: Data is automatically deleted as soon as (i) the inspection device receives confirmation that the Pass has or has not been used to check in or out and 5 minutes have elapsed, or (ii) a subsequent Pass is presented for inspection, or (iii) the inspection (app) is closed.
Personal Data: Technical data (PAN, PAN serial number, and expiration date); pseudonymization tokens; travel transaction data; product data; name or name, date of birth, and/or passport photo
Process: Mobile service for passengers
Legal basis: Performance of a contract; Legitimate interests of carriers and Translink
Who: The transit provider you are currently traveling with or the transit provider(s) you have traveled with, and Translink
Purpose: Upon request from a passenger, a ticket inspector may scan the Pass to provide information about the last ten public transportation transactions made with the same pass
Retention periods: Data is automatically deleted as soon as (i) the inspection device receives confirmation that the Pass has or has not been tapped in or out and 5 minutes have elapsed, or (ii) a subsequent pass is presented for inspection, or (iii) the inspection (app) is closed.
Personal Data: Technical data (PAN, PAN serial number, and expiration date); pseudonymization tokens; travel transaction data
Process: Compilation and provision of reports on travel transaction processing
Legal basis: Legitimate interest of Translink; legitimate interests of transport operators; legal obligation of transport operators
Who: The carrier(s) with whom you traveled and Translink
Purpose: To monitor the integrity of the public transit system (e.g., transaction validation); to enable the administration of transportation agreements, the settlement of transactions, as well as financial administration and accountability
Retention periods: 18 months (legitimate interest); 7 years (legal obligation)
Personal data: Travel transaction data (such as check-in/check-out; date/time; location; mode of transportation; trips and fares per trip); pseudonymization tokens.
With whom do we share your data?
Both the Carriers and Translink use the services of Data Processors, and each always enters into written agreements with external parties (such as IT providers) that process Personal Data on our behalf. This is done by entering into a so-called “data processing agreement,” which sets out, among other things, arrangements regarding the security and use of Personal Data.
Translink uses the services of Fiserv to process payments with your bank. In doing so, Translink provides the technical data and the payment reference. Fiserv processes this data in its capacity as a data processor.
Translink uses the services of iProov to take the passport photo in the OVpay app. This passport photo is required to apply for the Discount Profile for age-based discounts on buses, trams, and the metro. iProov processes this data in its capacity as a Processor.
Translink uses the services of Thales to issue and produce the physical public transit pass. Thales processes this data in its capacity as a Data Processor. Translink shares your name and delivery address with PostNL so that they can deliver the public transit pass you ordered. PostNL processes this data in its capacity as a Data Controller.
In addition, in some cases, transportation providers and Translink are required by law and regulations to disclose your data to third parties, such as in response to a criminal investigation by law enforcement.
Security of Personal Data
The Carriers and Translink protect your Personal Data, for example, against unauthorized access, loss, and theft. All parties have policies in place to ensure that payments made with the Pass on public transportation are structured in such a way that an appropriate level of security is applied by default.
To secure Technical Data, the Carriers and Translink adhere to PCI DSS. This is an international security standard designed to protect payment card data and prevent the misuse of card data—and thereby prevent damage. The carriers and Translink take appropriate technical and organizational measures to secure systems, processes, and (personal) data.
Your Technical Data is processed exclusively in a pseudonymized form in the card readers of […] and in Translink’s central administration system.
Automated Decision-Making
Automated decisions are made in three cases:
An outstanding fare
As a passenger, you must always pay the fare due. If your payment cannot be processed, the Pass (or its travel function) will be automatically blocked. You will still be able to check out for a trip, but you will no longer be able to check in for a new trip. You can file an objection to this automated decision, which resulted in your Card being blocked. You can do this through OVpay customer service. They will review why your Card was blocked and unblock it if warranted.
A Debit Card Blocked by a Bank
If a debit card used on public transportation has been reported by a bank as stolen or lost, or if there is another reason why the bank has blocked this card, the travel function of the debit card will be automatically blocked. This is part of the general terms and conditions for using your debit card as agreed upon with your bank. Neither the transit operators nor Translink can change this block. If you have any questions about this, please contact your bank.
A public transit card (temporarily) blocked by Translink
If a public transit card has been reported as stolen or lost to Translink, if you do not have sufficient balance to travel with the relevant transit operator, or if there is any other reason why this card has been blocked by Translink, it will be automatically blocked. This is also described in the terms and conditions for using the public transit pass. After topping up your balance or reporting that the card has been found, you can travel again with the public transit pass. A stolen public transit pass will be permanently blocked.
Contact point for questions or to exercise your rights regarding travel with a Payment Card and Public Transportation Pass
Questions
If you have questions about the processing of your personal data when traveling with a card, please contact the relevant departments at […] and Translink.
[…] and Translink can only answer specific questions by using the details associated with your Pass. If you have created an account in an app, linked your Pass to that account, and provided your information during the process, we can also assist you in this way.
For general questions about traveling with a Pass, please contact OVpay customer service by calling 0900-1433 or emailing www.ovpay.nl/contact.
If you would like more information about how […] or Translink handles your personal data, you can contact the data protection officer at either organization:
For […]: [email], for Translink: fg@translink.nl
Definitions
General Terms and Conditions for City and Regional Transportation: (the general terms and conditions for the transportation of passengers via public city and regional transit (by bus, tram, light rail, metro) and regional rail service provided by the following operators: Arriva, EBS, GVB, HTM, Keolis, Qbuzz, RET, and Transdev).
App: a mobile application developed and offered by a single Carrier or jointly by Carriers and Translink (under the name OVpay) that allows passengers with a Pass to create and view their online account, link their Pass to it, and thus, among other things, easily view travel transactions and payments and submit service requests. The terms of use of the relevant App apply to the use of an App.
AVR-NS: NS’s terms of carriage (the General Terms and Conditions for the Carriage of Passengers and Hand Luggage of the Dutch Railways).
Bank: a financial institution that offers payment services and where the bank account is held to which the traveler’s payment card—used on public transportation—is linked. This also includes a credit card company or other regulated financial institution that offers payment services as a financial institution and that issued the debit card.
Payment service provider: a party that enables you to travel on account using the OV-pas. When traveling on account, you can pay later for the trips you take on public transportation with the OV-pas, for example, via direct debit or periodic bank transfer.
Payment Card: a contactless debit or credit card (physical or digital) issued by a financial institution that allows you to use and pay for public transportation by checking in and out at the designated card reader at the station, at the stop, or inside the vehicle. This also includes a credit card issued by a credit card company that you, as a passenger, use to access and pay for public transportation.
Payment ID: This is a code consisting of a combination of a total of fourteen letters and numbers, which is unique for every payment made for trips using a debit card. The code is always preceded by the letters NLOV and is linked to the amount debited from your bank account when you pay with a debit card.
Joint Controller: When two or more Controllers jointly determine the purposes and means of processing, they are Joint Controllers as defined in the GDPR.
Discount Profile: the profile that Translink and the transit provider you are traveling with can access to verify and check whether you are eligible for a discount. In the Discount Profile, you provide your name or date of birth and, if applicable, a passport photo.
Public Transportation Pass: a contactless pass issued by Translink that allows you to use and pay for public transportation by checking in and out at the designated card reader at the station, at the stop, or inside the vehicle.
Card: the Payment Card and the Public Transportation Card
Personalized product: A product is personalized if the specific terms and conditions of that product so stipulate. Personalized means that only the person in whose name the product is registered may travel with it and use the OV-pas linked to it.
Personal Data: all information relating to an identified or identifiable natural person as defined in the GDPR.
Pseudonymization: the processing of personal data in such a way that the personal data can no longer be linked to a traveler without the use of additional data, provided that this additional data is stored separately and technical and organizational measures have been taken to ensure that the Personal Data is not linked to an identified or identifiable traveler as defined in the GDPR.
Travel Day: the period beginning at 12:00 a.m. and ending the following day at 3:05 a.m.
Technical Pass Data: This technical data consists of the Pass numbers, namely the PAN, the PAN serial number, and the Pass’s expiration date. The PAN is a unique pass identification number. The PAN serial number is stored in the Pass’s chip and is not visible.
Translink: the organization that, among other things, registers tickets, calculates fares, manages balances, collects and settles payments on behalf of transportation providers, and provides services to passengers. Trans Link Systems B.V. has its registered office and principal place of business in Amersfoort.
Ticket: a document that grants access to and provides payment for the use of the Carrier’s transportation services through electronic registration of the trip or a portion thereof with Translink.
Carrier(s): the Dutch public transportation companies listed on the OVpay.nl website.
Processing: any operation or set of operations performed on Personal Data or a set of Personal Data, whether or not carried out by automated means, as defined in the GDPR.
Processor: a natural person or legal entity, a public authority, a service, or another body that processes Personal Data on behalf of the Controller as defined in the GDPR.
Data Controller: a natural person or legal entity, a public authority, a service, or another body that, alone or jointly with others, determines the purposes and means of the processing of Personal Data as defined in the GDPR.
3. Privacy Information Management
What do we use your data for?
HTM, other public transit companies, and Translink want to ensure that public transit is as efficient and effective as possible. That is why these public transit companies and Translink have an interest in gaining insight into passengers’ travel patterns.
This insight is also important for third parties, such as government agencies responsible for (public) transportation and committed to improving services for passengers. We obtain this insight through statistical research. HTM, the other public transportation companies, and Translink (collectively “we” or “us”) have jointly determined which personal data may be used to gain this insight and how such personal data may be used. We also refer to this as “Information Management.” These agreements are set forth in a cooperation agreement between the public transportation companies and Translink.
The public transportation companies and Translink are joint data controllers for the processing of personal data for the purposes of the Information Management System.
What personal data do we use?
To conduct statistical research on passengers’ travel patterns, we use only so-called transaction data. If we process your customer data, such as your name or date of birth, we do not use that data for statistical research. Below, you can read about what personal data we process for statistical research when you travel using a public transit chip card, public transit pass, payment card, or other ticket.
We use only so-called transaction data to conduct statistical research on passengers’ travel patterns. If we process your customer data, such as your name or date of birth, we do not use that data for statistical research. Below, you can read about what personal data we process for statistical research when you travel using an OV-chipkaart, OV-pas, payment card, or other form of transit ticket. Under privacy laws, we are permitted to use transaction data for statistical research because this is necessary to serve our legitimate interests and the legitimate interests of third parties, such as government agencies. The legitimate interest is to optimize public transportation and improve services for passengers.
OV-chipkaart / OV-pas
Transaction data is generated when you check in and out with your OV-chipkaart at a transit company. This data is used to process your travel transactions. The transaction data is read using the chip ID in your card. You can find the transaction data in your OV-chipkaart transaction history (Mijn OV-chipkaart.nl).
We store the transaction data for statistical research in a separate database at Translink. Before we store the data there, we ensure that it has been pseudonymized. During this pseudonymization process, the identifying characteristics in the data are encrypted. As a result, the data cannot be traced back to an individual without additional information. After the data has been pseudonymized, Translink creates research datasets on behalf of public transit operators. These consist of a set of statistical data. Using these aggregated, statistical research datasets, Translink or other specialized companies can create information products. These research datasets and information products do not contain any personal data.
Payment Card
Transaction data is generated when you check in and out with a payment card at a transit company. This data is used to process your travel transactions. You can find the transaction data for your debit card in the OVpay app. If you do not use the OVpay app, you can view your payment card transaction data on the OVpay website. There, you can enter the “service reference ID” listed on your bank statement for public transit trips.
We store the transaction data in a separate database at Translink for statistical analysis. Transaction data involving a debit card cannot be traced back to an individual without additional information. Under Translink’s supervision, we have research datasets created. These consist of a set of statistical data. Using these aggregated, statistical research datasets, Translink or other specialized companies can create information products. These research datasets and information products do not contain any personal data.
Central Point of Contact
We have established a central point of contact where you can direct any questions you may have regarding the processing of your data for the creation of research datasets and information products. You can contact us at privacy@ov-chipkaart.nl, where you can also submit a request to exercise your GDPR rights.
If you do not want us to use your transaction data for statistical research on travel patterns, you can indicate this by sending an email to privacy@ov-chipkaart.nl. You can request the form by sending an email to privacy@ov-chipkaart.nl.
With whom do we share data?
HTM, other public transportation companies, and Translink use the services of data processors. We always enter into written agreements with data processors by signing a so-called data processing agreement, in which we set out, among other things, arrangements regarding the security and use of your personal data. Pseudonymization makes it more difficult to link the data to specific individuals.
Based on the research datasets, Translink or other specialized companies can create information products. For example, they can identify trends in passenger flows, which can be used to determine where new public transit routes should be established. We may share these types of information products with government agencies and third parties responsible for (public) transportation and improving services for passengers. The information products do not contain any personal data.
We do not transfer your personal data for this purpose to legal entities or individuals outside the European Economic Area.
How long do we retain your data?
We retain the transaction data and the pseudonymized transaction data for a maximum of 18 months after the trip you took.
See also: Data analysis (translink.nl) for more background information
4. Privacy on the HTM Website and Apps
Data regarding the use of the website (htm.nl) and the apps (HTMapp and HTM Fietsapp), as well as the feedback we receive from our visitors, help us further develop and improve our website and apps.
4.1. HTM Website
Click Behavior
Our website tracks general statistical data regarding its use. The purpose of this is to determine how many visitors view the HTM website, how much time they spend on the website, which pages are visited most frequently, which information is downloaded most often, etc. This allows us to optimize the website’s design so that we can further improve the services we provide through the website, for example, to give our customers more targeted information.
Personal data is never collected via the internet without an explicit request or consent, such as when requesting information.
Use of Cookies
Visitor data is tracked on the website to measure interest in the various sections of the site. This allows HTM to tailor the website to visitors’ interests and experiences and to make accessing and using the website easier. HTM uses temporary cookies for this purpose; these are small files stored on your computer’s hard drive. The cookies do not contain any personal data. Cookies can be disabled in any web browser (Chrome, Internet Explorer, Safari, and/or Firefox). All parts of our website will still be readable, but functionality may be reduced.
Google Analytics
We use the Google Analytics pixel, but the information it collects is made completely anonymous. The IP address is anonymized by default, and this information is not shared with third parties, not even with Google itself. We do not create profiles based on user behavior for marketing purposes, nor do we track data across multiple devices. The cookie that is placed expires when the session ends.
Marketing and Necessary Communications
HTM offers the option to subscribe to a newsletter via the opt-in feature on our website. If you have a MijnHTM account (see Section 5 of this privacy statement), you can manage your opt-in settings through your account. If you do not have a MijnHTM account, you can subscribe via the website and unsubscribe via the email you receive from us. The processing of personal data in connection with the newsletter is based on your explicit consent. In this context, we process your email address to send you the newsletter. You can withdraw your consent at any time by unsubscribing via the unsubscribe link provided in the newsletter or through your MyHTM account. If you purchase products from us and have a MyHTM account, HTM may notify you if these products no longer function (properly) or if there is other important product-related information. This processing of personal data is based on the product agreement (the contractual relationship between HTM and the customer). In that case, no consent is required to contact you, as HTM is obligated under the agreement to inform you of this.
4.2. HTM App(s)
HTM offers some of its services through apps. To ensure the app functions properly, HTM may request consent upon installation to access and process certain personal data. The collection and processing of this data via apps is also covered by this privacy statement.
HTM does not track click behavior or store cookies in the HTM app.
Location Tracking
You have the option to enable location services in the HTM app. By doing so, you grant permission
to plan a trip from your current location. You, as the user, can adjust these permissions at any time.
Notifications (found in the Favorites section)
In the HTM app, you’ll find a “Favorites” section. Here, you can select your favorite routes and choose which ones you’d like to receive more information about. You can turn these settings on or off yourself.
Buying barcode tickets in the app
The app allows you to purchase and pay for barcode tickets.
HTM uses third-party processors to handle barcode tickets. To ensure the confidential handling of your personal data, a data processing agreement has been entered into with these third parties.
Tapconnect is the provider of the mobile ticketing service, and Buckaroo is HTM’s payment platform and, in that capacity, acts as a data processor for HTM.
After paying Buckaroo, you’ll see an overview of the tickets you’ve purchased in the HTM app under the “Tickets” section. Please note that if you delete and reinstall the app, the ticket will no longer be valid or visible.
You must activate the 2-hour pass. The day pass is valid immediately.
Legal basis and purposes of data processing for barcode tickets.
The processing of data by HTM is necessary to fulfill the agreement regarding the
purchase and use of the HTM Barcode feature while traveling.
The purposes for which HTM processes your data to fulfill the agreement are:
• providing the agreed-upon services;
• providing customer service in response to your questions or requests, for example regarding
• your purchases and trips;
• sending information regarding the use of the HTM Barcode feature and
• the products and services offered through this website;
• improving our services, which also includes incorporating this information
• anonymized and aggregated form in management information and reports;
• maintaining financial records, conducting audits, and
• audits.
4.3. Social Media (Facebook & X (formerly Twitter), also accessible via the HTM app and HTM website)
The website includes buttons that allow you to promote (“like”) or share (“tweet”) web pages on social networks such as Facebook and X. These buttons work using pieces of code provided by Facebook and X, respectively. Cookies are placed through this code. HTM has no control over this. Please read the privacy policies of Facebook and X (which are subject to change) to learn how they process (personal) data through these cookies.
4.4. Technical Security
To optimally protect personal data against unauthorized access or use, HTM uses security technology. This security complies with the requirements set forth by the GDPR.
4.5. Third-Party Privacy Policies
The website contains links to websites of other organizations, such as ov-chipkaart.nl and denhaag.com. HTM assumes no responsibility for how these parties handle personal data.
4.6. Contact and Questions
Questions regarding our cookie consent or updating your information will be handled by our customer service team. We will ensure that the information is updated within one month.
5. Privacy and Self-Service
5.1. My HTM Account
What does HTM use your personal data for?
HTM offers travelers the option to create a MyHTM account. HTM uses your personal data to manage your personal account and to implement any changes you make to your account in its systems, ensuring that your personal data is always accurate and complete. In addition, HTM also processes personal data to display an overview in your account of all the products you have purchased, including their start dates.
In addition to the above, HTM also processes your personal data to allow you to link your token (public transit pass/payment card) to your MijnHTM account. By linking a token, you, as a traveler, gain insight into your travel history associated with that token. Please note that this applies only to trips you’ve taken with HTM. Personal data is also processed to display your travel history.
In addition, personal data is processed when you decide to purchase a (discounted) product. The product must be linked to a token. Without a token, you cannot purchase a travel product.
Finally, financial data—including your account number—is processed when you purchase a recurring product and link it to your token. In this case, you’ll receive an overview of the months you’ve paid for and the months for which an amount is still outstanding.
What personal data does HTM process?
As a traveler, you can create one or more MijnHTM accounts. HTM processes the following personal data when you register a MijnHTM account:
• Customer number;
• Username (email address);
• Password;
Legal Basis for Processing
The legal basis for processing personal data for the purpose of creating a MijnHTM account is “necessary for the performance of a contract—Terms of Use.” To create an account, you must agree to the Terms of Use.
Retention period
HTM retains your data for as long as your MijnHTM account is active. If you wish to delete the account, HTM will ensure that the data associated with the account is destroyed, unless there are compelling interests that prevent the data from being destroyed immediately. Examples include tax obligations or accounts receivable management.
With whom do we share your data?
HTM shares your personal data exclusively with carefully selected data processors and business partners who process this data on behalf of and for the benefit of HTM. These include, among others, cloud and hosting providers and IT service providers.
In addition, HTM shares your personal data with Translink when you use a personalized product, such as a personal public transit chip card, or when you wish to view your travel history.
5.2. Product sales, inspections, accounts payable and receivable management, and customer profiles
What does HTM use your personal data for?
HTM offers its customers the opportunity to purchase personalized products (personal passes and personalized OVpay services) and to use them to travel on HTM’s network. For this purpose, HTM processes your personal data when you purchase a product or subscribe to an OVpay service.
In addition to the above, HTM also processes personal data for the purpose of inspections by our inspectors. This is done using the “Personal Account Data” (PAD) system. As part of the purchase of a personalized product and/or subscription, you will be required—depending on the product terms and conditions—to provide your name, date of birth, and/or passport photo in the PAD.
What personal data does HTM process?
If you decide to purchase a personalized ongoing (discount) product and link it to your token, HTM processes the following personal data:
• Customer number;
• Account number;
• VAS number
• Last login
• Name;
• Address information;
• Country
• Phone number
• Public transportation chip card number
• Valid until
• Alias
• IBAN
• BIC/SWIFT
• Account holder name
• Billing Information
• Mandate type
• Mandate Address
• Issued on
• Mandate reference;
• Transit Account
• Back office token
• Last 4 digits of token
• Public transportation card number and serial number
The processing of this personal data is necessary to fulfill HTM’s tax obligation to maintain customer profiles, link tokens to accounts, and issue direct debits.
As part of its inspection process, HTM processes the following data (depending on the type of personal product):
• Name;
• Date of birth and/or
• Passport photo
Legal Basis for Processing
The legal basis for processing personal data for the purposes of creating a customer profile, linking a token to your account, purchasing a product, and issuing direct debits is “necessary for the performance of a contract—product terms and conditions.” Performance of a contract—product agreement: When purchasing a personalized product, the Customer enters into a contract with HTM.
Retention Period
HTM retains the data in your Customer Profile and Login Account for 18 months. HTM will notify you 17 months after the last account activity. One month before the end of the initial period (i.e., after 17 months of no activity and no active products), an email will be sent to the email address on file notifying you that the account will be deactivated in 30 days, with a request to log in if you do not wish this to happen. If you log in, the counter will automatically reset to 0 months of inactivity.
After the initial 18 months, an email must be sent stating that the account has been set to inactive and that it will be retained for another 6 months before HTM automatically deletes all information not subject to a legal retention period. This email also includes a link to reactivate the account. In short, the data (listed in the table in section 2.2) is retained for a maximum of 2 years after the last account activity.
The data processed for financial settlement purposes is retained for 7 years (separate from the Customer Profile, but within the designated financial records).
The data in the PAD (HTM does not store this) is automatically deleted by the GBO when there is no longer a legal basis for retaining it. Therefore, when the subscription expires, the data is deleted after 2 months. This still allows you, as a traveler, to ask questions or purchase a new product without having to re-enter the data into the PAD during HTM’s ordering process.
With whom do we share your data?
To manage accounts receivable and accounts payable as part of product sales, your personal data is shared with two external parties that handle accounts receivable and accounts payable for HTM.
HTM uses an API connection from Translink for product inspection.
HTM places great importance on the protection of your personal data. For this reason, contractual agreements are made with all processors and partners, setting out clear terms and measures to mitigate risks and ensure data protection. These agreements comply with applicable privacy laws, including the General Data Protection Regulation (GDPR).
6. Privacy and Video Surveillance
One of the measures HTM takes to improve the safety of our passengers is to conduct surveillance, including through the use of cameras. This is an important tool in the investigation and prosecution of criminal offenses or unlawful acts. In addition to ensuring your safety, this camera surveillance also serves to protect our property, fellow passengers, and employees. Furthermore, the camera footage is used to investigate and reconstruct accidents. Where camera surveillance is in use, this is indicated by images on stickers.
Video Surveillance in Trams, Buses, and Stops
Cameras are installed in and on all HTM trams and buses. Some bus stops are also under video surveillance. Video surveillance in the vehicles is intended to enhance the public safety of passengers and employees and to protect HTM’s property. Camera surveillance at stops is intended to increase public safety at the stops, prevent undesirable or unsafe behavior by passengers, and protect property at the stops.
We use the recordings (video and audio) to identify and prosecute individuals who have committed a criminal offense or a tort. Recordings may also be used in cases of injury or tangible or intangible damage resulting from a criminal offense or tort, as well as for training employees involved in camera surveillance.
The camera footage is viewed live by employees who are specifically authorized to do so and are bound by a duty of confidentiality. This takes place in a room that is not accessible to other employees.
Bodycam. Some BOA inspectors are equipped with a bodycam. These are intended to enhance the personal safety of employees and passengers and to protect HTM’s property. We use the recordings to identify and prosecute individuals who have committed a criminal offense or a tort. Recordings may also be used in cases of injury or tangible or intangible damage resulting from a criminal offense or unlawful act, as well as for training employees involved in camera surveillance.
The camera footage is viewed by employees who are specifically authorized to do so and who are bound by a duty of confidentiality. This takes place in a room that is not accessible to other employees.
The purposes of the camera footage are:
• To protect people from crime, nuisance, and accidents;
• Securing stops, buildings, garages, premises, rail yards, vehicles, platforms, and all items therein against theft, break-ins, vandalism, and similar incidents;
• To assist emergency services during emergencies;
• Crowd control at events and in crowded areas;
• Assisting with filing a police report;
• Assisting the police with criminal investigations based on requested footage;
• Post-incident investigations by the Security Department;
• Damage assessment
We also use camera footage to train employees involved in processing camera footage. Additionally, camera footage is used for investigating and reconstructing accidents.
What personal data is processed?
Cameras record footage in which people are visible (and in some cases, with audio). In the
incidents, this allows us to act quickly and to detect and prosecute violations and criminal offenses. The
Camera recordings are only secured, viewed (and, when necessary, listened to and
stored only if an incident has occurred.
Only employees authorized for this purpose by the HTM management may view (and listen to) the footage. This takes place in a room that is not accessible to other employees. If the camera footage is usable for a criminal investigation and/or prosecution, only authorized employees may secure the footage for that purpose. These employees are bound by a duty of confidentiality.
Procedure in the Event of a (Possible) Incident
If an incident occurs that may require follow-up (e.g., filing a police report), we immediately record the time. The recordings from around the noted time are viewed and listened to as soon as possible. If HTM decides to file a report with the police, HTM will provide the recordings to the police if they can serve as (supporting) evidence. In addition, the recordings may also be made available to investigative authorities upon request, within the legal framework.
Legal Basis and Purposes of Processing Camera Footage
The legal basis on which HTM processes camera footage is legitimate interest or compliance with a legal obligation. Without camera footage, it is not possible to investigate incidents retrospectively or to ensure the safety of our passengers and employees. We consider this interest to outweigh any potential infringement on the privacy of a passenger or employee. Furthermore, we have safeguards in place to protect your privacy: we store all footage securely, and only authorized employees have access to it.
How long do we retain the data?
We retain recordings from vehicles and body cameras for up to 24 hours if no incident has occurred. Camera footage from stops is retained for up to 72 hours if no incidents have been reported. Camera footage from the stops at Centraal Station and Hollands Spoor is retained for 28 days.
With whom do we share personal data?
If there is an incident that we wish to report to the police and we expect the footage to provide (supporting) evidence, we review the camera footage as soon as possible. In addition, within the legal framework, we are required to make the camera footage available to law enforcement and investigative agencies if they request it based on a legal authority. This includes the Police, the AIVD, the Inspectorate of Social Affairs and Employment (Inspectie SZW), the Inspectorate for the Environment and Transport, insurance companies, attorneys, and the courts in legal proceedings. In the context of claims, camera footage is made available to insurers handling HTM claims.
7. Damage, Investigation, and Recourse
HTM makes every effort to transport its passengers to their destinations as safely as possible and to ensure a safe working environment. Unfortunately, incidents do occur in which damage is caused to equipment, property belonging to HTM or others, or personal injury is sustained.
What do we use personal data for?
HTM uses personal data to investigate the circumstances and consequences of an incident—for example, to determine the cause of the incident, identify which party is liable, prepare witness statements, assess the validity of a claim, or determine the extent of the damage. The results of the investigation may also be used to implement measures that can help prevent future incidents.
What personal data is processed?
Contact information for claimants, witnesses, experts, advocates, claims adjusters, attorneys, and other parties involved. In addition, travel data, camera footage, and chain-of-custody data may be processed, as well as medical, personal, and financial data in cases of personal injury. Only employees involved in claims handling have access to this data. The data is stored in separate systems subject to an authorization policy.
Legal Basis for Processing
The legal basis for processing personal data in the context of claims handling and prevention is HTM’s legitimate interest and/or your consent to the use of your personal data. Without this data, it is not possible to investigate incidents, settle claims, and prevent further damage. This is also in the interest of the data subject who has suffered harm as a result of the incident. HTM has a business interest in proper claims handling to best protect its financial interests, to provide information to the insurance company, and to prevent future incidents as much as possible. We consider this interest to outweigh any potential infringement of the privacy of a person involved in the incident. Furthermore, we have safeguards in place to protect your privacy: we store all data securely, and only employees involved in the claims handling process have access to the data.
How long do we retain the data?
The retention period is 10 years for property damage claims and 30 years for personal injury claims.
With whom do we share personal data?
The personal data in a claims file is shared only with parties involved in the claims settlement process, such as accident experts, medical experts, claims adjustment firms, attorneys, insurance companies, and the authorities to which a dispute arising from the claims handling process is submitted.
8. Implementation of the Police Data Act
HTM employs special investigative officers (“BOAs”) to enforce public safety on and around public transportation.
What does a BOA do?
Among other things, a BOA checks at stations and on vehicles to ensure that passengers are in possession of a valid ticket. In addition, a BOA also monitors public order, compliance with legal provisions, and travel rules and conditions of carriage. In the event of violations, the BOA takes enforcement action.
If a BOA processes personal data while performing their police duties (such as investigating criminal offenses and maintaining public order), the Police Data Act (“Wpg”) applies rather than the GDPR. This also means that the BOA no longer processes personal data but rather police data. Like the GDPR, the Wpg sets requirements for the processing of police data.
For what purposes do we process personal data under the Police Data Act?
We process police data under the Police Data Act (Wpg) for various purposes.
These purposes are set forth in Article 8 of the Wpg.
For example:
• Issuing a citation if you have committed a criminal offense or if you are traveling without a valid
ticket (fare evasion).
• Handling, administering, and financially processing payments related to official reports, such as granting appeals, applying the leniency policy, applying reductions, and setting up payment plans.
What personal data is processed under the WPG?
When stopping a person and/or issuing a citation, we collect contact information, place and date of birth, a description of the offense including the time and location, Social Security number (BSN), type of identification, and identification number. We also collect financial data when a fine for fare evasion is paid and/or when a payment plan is arranged.
You can file an objection or a request for leniency with us regarding a citation. In that case, in addition to the
information you provided in your request, we will also collect your contact information, place and date of birth, a copy of your OV-chipkaart and/or details from your OV-Pay payment receipt, and the citation number.
Legal Basis for Processing
The legal basis on which the BOAs process your police data under the Wpg is the performance of their daily
police duties (Article 8 of the Wpg).
The BOAs process personal data on the basis of:
• Code of Criminal Procedure;
• the Special Investigating Officer Decree;
• General Local Ordinance (APV).
Finally, the BOAs process personal data for the performance of the agreement. In this regard, the following rules apply:
• the Passenger Transport Act and Decree of 2000
• Terms and Conditions of Urban and Regional Transportation;
• HTM Travel Rules.
How long do we retain your personal data?
The table below outlines the retention periods as well as the authority that an investigative officer/BOA has within these statutory timeframes.
The maximum period during which the police may process personal data with regard to Article 8—processing—is 10 years.
In addition, HTM retains camera footage (see the section on cameras earlier in this statement).
With whom do we share personal data?
Only authorized employees have access to this data. They may only view the data they need
for their work. We may grant access to police or municipal employees. They, too,
are granted access only to the data they need for their work. Employee actions in
systems are logged. In this way, we keep track of who performs which action at what time in a specific
file.
When issuing a citation, we verify your information with the Basic Registration of Persons (BRP). We do this again after sending the first payment reminder for fare evasion.
Sometimes it is necessary for HTM to provide your personal data to third parties. For example, to the Central Judicial
Collection Agency (CJIB) if you have not paid your fine on time, or to the Public Prosecution Service (OM) or the police due to an incident that HTM reports to the authorities.
What are your rights under the Police Data Act?
Under the Police Data Act (Wpg), your rights differ from those under the GDPR. You have the right to
view the personal data that HTM processes about you under the Wpg. To do so, you can request a written overview of your personal data from HTM by sending an email to gegevensbescherming@htm.nl
If your personal data under the Wpg is incorrect or incomplete, you can ask HTM to correct it. In addition, you can have your personal data deleted or request a restriction on the processing of your personal data. You may also file an objection or appeal against the issuance of a citation and the fine imposed (see the guidelines on the HTM website for more information).
We will notify you once your request for correction, deletion, or restriction of the
processing of your data has been fulfilled.
We have the right to reject your request if:
• The request would impede judicial investigations or proceedings;
• It would have adverse consequences for the prevention of criminal offenses, for investigations,
investigations, prosecution, or the imposition of penalties;
• Public safety is at risk;
• The rights and freedoms of third parties are violated;
• National security is at stake;
• HTM has a legal obligation to retain this personal data;
• The request is manifestly unfounded or excessive.
---------------------------------------------------------------------------------
Changes HTM reserves the right to amend this text if necessary. Any changes will always be in accordance with the GDPR.
HTM Personenvervoer NV
Maanweg 94
2516 AA The Hague
Registered in the Commercial Register of the Chamber of Commerce under number 27014495
HTM Privacy Statement updated: March 2026