On the grounds of the GDPR and the Police Data Act, you have rights in relation to the personal data that GVB processes on your behalf. In some cases, you may exercise your privacy rights yourself via your MijnGVB account, and otherwise you may submit a request to GVB by completing and sending the rights of data subjects form.
To prevent personal data from being provided to the wrong person or requests being submitted by people other than yourself, GVB needs to determine your identity. Please therefore provide the requested copy of your valid passport or ID card on which the BSN number and passport have been rendered illegible. The copy of your ID is for the sole purpose of verifying your identity and will be deleted as soon as your identity has been verified.
GVB will evaluate your request in accordance with GDPR or the Police Data Act. Within 1 month of receiving your request, you will receive a response from us in which we will notify you of how we can fulfil your request. If we reject your request, you will receive a message containing the reason for the rejection. If the request appears complex or concerns a large number of requests, GVB may extend the period from 1 month to 2 months. You will be notified of this within 1 month.
To handle and settle the request or complaint, we process your contact details and on request or in the event of a complaint, or additional data relating to a complaint. We retain the data concerning your complaint or request in order to exercise your privacy rights and the data necessary for settling them up to a maximum of 1 year after the calendar year in which they were settled. These will then be deleted.
The basis for processing for the execution of your privacy rights is a statutory obligation of GVB, which is laid down in the GDPR and the Police Data Act.
Protection of privacy rights
You have the following rights under GDPR (your rights on the grounds of the Police Data Act deviate from this and are described in the section “Implementation of activities in the context of the Police Data Act”.
Right to inspect
You always have the right to know which of your personal data GVB is processing and to inspect such data. You may request a written overview of your personal data from GVB. We will notify you of what we are using your personal data for, how long we retain it and to what third parties GVB is providing personal data. View your travel history yourself via My OV-chip at www.ov-chipkaart.nl or if you travel with your Debit or Credit card on ovpay.nl.
Right to rectification
If your personal data that we use is incorrect or incomplete, you may ask GVB to alter or supplement the personal data. Certain data can easily be altered or supplemented via your MijnGVB-account. For other data that doesn't appear in your account, you may submit a request for rectification. Third parties to whom GVB has provided your personal data will be kept up to date by us of the correction or addition.
Right to removal
You also have the right to request to have your personal data removed from our systems. GVB is responsible for this, unless we are obliged by law to retain certain personal data during a particular period and are not therefore allowed to remove it. Third parties to whom GVB has provided your personal data will be notified by us of the removal.
Right to restriction
In certain cases, you have the right to request a restriction of the processing of your personal data. Use of your data will then be stopped temporarily up to a certain point in time. Third parties to whom GVB has provided your personal data will be notified by us of the restriction.
Right to objection
You may object to the (further) processing of your personal data due to reasons associated with your personal situation. GVB will then have to balance interests between your privacy interest and the interest of GVB in being allowed to (further) process your personal data. If GVB complies with your objection, your personal data will no longer be processed for those purposes.
Right to data portability
You may submit a request to transfer your personal data that is used at GVB in a structured and ordinary digital file to someone else. In that case, GVB can give you a copy of the personal data we have from you so that you can transfer it to someone else yourself, or you can have GVB transfer the data to someone else.
Right not to be subjected to an automated individual decision-making process
You have the right not to be subjected to a decision that is only reached on the basis of automatically processed data and that has consequences for you. In that case, it is not a person taking the decision but the computer. In those cases, you may request a new decision where a person assesses your data.
Submission of complaint to Dutch Data Protection Authority
If you believe that your privacy rights are being violated or that GVB is contravening them, you have the right to submit a complaint to the Dutch Data Protection Authority. Further information can be found on the websitewww.autoriteitpersoonsgegevens.nl