The objective of processing personal data in Snelandia Mobillett is as follows:
- To offer travelers a simple and secure way of purchasing ticket products, to provide efficient customer service, and to ensure that ticket inspectors are able to validate tickets.
- Distribute tickets for School transfer.
Finnmark County Council (hereafter referred to as the “data controller”) is responsible for the personal data processed in the Snelandia Mobillett.
Snelandia Mobillett is delivered by WTW AS (hereafter referred to as the “data processor”), which processes your personal data on behalf of the data controller in accordance with a separate data processing agreement, cf. Item 6.
2. Legal basis
Snelandia Mobillett is an optional service. If you choose not to use it, you may purchase tickets via alternative channels.Fulfilling the agreement
The personal information processed in connection with the School Transfer Service is necessary to exercise public authority as the Controller is required. In this, the distribution of school bus tickets is a required service that the Transport Collective is commissioned by the county municipality to provide all school students who are entitled to this, in accordance with the Education Act § 13-4.
3. Personal data
The app processes the following general personal information about you:
Mobile number and password: This information must be registered to your user profile to enable us to offer a service with secure and verified log-in. Your mobile number is required to ensure that you can access your active season tickets or receipts for past purchases in case you lose your mobile device. Your mobile number serves as your unique user ID when using the app and is the only personal information required for your user profile.
Name and sub-users: It is optional to enter names in the app. This is an option for those who want to create sub-users to their Snelandia Mobillett account. Sub-users get the opportunity to pay their tickets using the money deposited in your Snelandia Mobillett Account. You only need to enter the mobile number to link the relevant sub-user to your Snelandia Mobillett account. If you wish, you can also enter a name or nickname for this user so that is I easier for you to separate different users from each other. The sub-user name also appears in the Snelandia Mobillett website, where you can log in to get a complete list of all purchases charged to your Snelandia Mobillett account within the last 20 months.
Email address: Adding your email address to your user profile is optional. We only need your email address if you want to have your receipts emailed to you. You can delete or amend this information at any time under "Settings" in the app.
Sales documents: All sales documents are stored in accordance with the Norwegian Bookkeeping Act. The travel information associated with your ticket purchase is only retrieved when initiated by the registrant, e.g. when submitting a complaint or other query that requires us to look more closely at all the details of your purchase.Payment methods:
Credit and debit cards - When you pay with a credit or debit card, a connection with the payment service provider is created to allow you to register your card in Snelandia Mobillett without storing your full card details in the app. If you choose to save one or more cards to your profile, only the payment service provider has access to your full card details. The app will only store the first six and last four digits of the card number along with the expiry date. This information is essential in order to allow you to recognize your card, to enable us to generate the information that should be included on your receipt, and to allow us to respond efficiently to any refund entitlements.
Phone number - Your phone number will be transferred to your mobile operator´s payment company, Strex, if you wish to pay by phone bill.
Details for Snelandia Mobile Account - With Snelandia Mobilett Account, you can enter a desired amount that you or your potential sub-users can use to pay for tickets. The system processes information about the balance and transactions related to your Snelandia Mobillett account, including history of refilling account, purchases, refunds, and credits.
Technical information: When you use the Snelandia Mobillett-app or Snelandia Mobillett Web your IP address, the time of your query, info about your web browser or mobile phone, the version number and mobile platform for the app, including your chosen language, will be stored in the application log. This information is required in order for the app to work on your particular platform/mobile and is stored to ensure that the service works as intended. It also provides us with necessary information to help resolve any faults. We do not use analytical tools (e.g. Google Analytics) that identify and log the behaviors of identifiable users. The only analytical function is crash reporting using the HockeyApp, which provides completely anonymous crash reports and helps us swiftly rectify the problem if the app were to crash.
Travel information: When you grant the app access to your phone's GPS, the positioning data will only be used locally on your handset. No positioning data logged in the app is shared with the back-end system. The only travel information to be processed is the information about the departure point/zone and destination point/zone required to document the purchase and work out the correct price. The travel information associated with your purchase is stored and anonymized together with the other transaction data.
Information related to School Transfer: In order to be able to distribute personal school transfer tickets with the right premises, the name, address and information about which school the current student belongs to, is processed.
Information used for statistical purposes is de-identified and therefore cannot be linked to you personally. Finnmark County CouncilFinnmark County Council collects information about the ticket purchases made in the Snelandia Mobillett. The travel information associated with your ticket purchase will not be used in conjunction with personal data in order to generate statistics.
6. Data processor
WTW AS, the supplier of Snelandia Mobillett, acts as data processor on behalf of Finnmark County Council. A data processing agreement has been entered into by WTW AS and Finnmark County Council. The data processing agreement ensures that WTW processes all personal data in accordance with the provisions given by Finnmark County Council in this privacy statement.
Finnmark County Council and WTW AS process personal data in accordance with Norwegian law, including the Personal Data Act, relevant accounting legislation and the industry standard for e-ticketing.
7. Other data processors associated with Snelandia Mobillett
The personal data collected or generated in Snelandia Mobillett will not be processed by systems belonging to sub-contractors other than WTW and the payment service provider(s) you choose to use.
Information associated with School Transfer-tickets comes from the application database for School Transfer in Finnmark County Council. The providers of the School Transfer-system are independent data processors for such information based on agreement with the Controller.
8. Personal data sources
All personal data processed by the Snelandia Mobillett service is uploaded or generated by you. No information is obtained from external registers or services.
9. Access to personal data
The processed personal data is only accessible on a need-to-know basis to authorized personnel at Finnmark County Council and its sub-contractors, including ticket inspection providers, payment service providers, WTW AS and the server operator.
10. Rights and requests for information
- access the personal data being processed,
- demand that incorrect personal data be corrected or removed,
- receive a copy of the personal data that you have disclosed and transfer it to another data controller (data portability),
- contact the data controller if you wish to provide feedback or ask questions about the processing of your personal data,
- complain directly to the Norwegian Data Protection Authority if you feel that the processing of your personal data is in breach of prevailing legislation.
- Please note that your mobile number is linked to your user profile. To change your mobile number, simply reset the app and create a new user.
- Any other personal data that you have provided can be amended or deleted at any time under "Settings" in the app.
11. Storage and deletion
Both the data controller, Finnmark County Council, and its data processors observe the principles of privacy by design and privacy by default. This implies that your personal data should not be stored for longer than is necessary in order to fulfil the purpose of the service.
Profile information: Your profile information will be stored for as long as you remain an active customer. You may request your user profile to be deleted from the Snelandia Mobillett System at any time. You must then register again if you wish to use the service at a later date. Your mobile number will be verified when logging in for the first time on a new device. If you have entered other personal data in the app, you may edit this data in your profile at any time under "Settings".
Transaction history and sales documents: All sales documents are stored for 5 years from the end of the financial year in line with prevailing accounting legislation, including the Bookkeeping Act and associated regulations. Receipts for your most recent purchases can always be accessed through the app. As required by the payment service providers, Finnmark County Council is obliged to grant you access to the sales documents for all service purchases for a period of 20 months. After 20 months the sales documents will be archived and anonymized so that it is no longer possible for you or anyone with authorized access to the Snelandia Mobillett System app to retrieve information linked to the user.
Technical information and application log: Parts of the application log are stored for an appropriate period of time to ensure that the service works as intended and that customers receive the service they are entitled to. In the event of a complaint about a fault with service, for instance, the relevant application log may be kept for longer to enable it to monitor the time period in question and complete the processing of the complaint.
All communication between the solution and the applications on the end user's handsets is encrypted. All access to the online system is encrypted. All internal data transfers between the various components in the system are encrypted. Data may only be retrieved via APIs that have been encrypted and made secure with access keys. Access to the data via Finnmark County Council’s interface is role-based and personal with incident logging to ensure traceability. The administration interface for the solution has been designed with different access levels so that individuals who require access through Finnmark County Council or WTW will be able to access only the amount of information they need.
13. Contact information
If you require further information about how your personal data is processed, please contact the Data protection officer at Finnmark County Council, Box 704, 9815 Vadsø – email: firstname.lastname@example.org