Privacy Policy
1. ABOUT THE POLICY
The present privacy policy explains how Brakar collects and uses personal data about its customers. In this context, “personal data” refers to all information that can be linked to the customer/user/school pupil as an individual, cf. Section 2, subsection 2 of the Norwegian Personal Data Act.
The policy contains information to which you, as a customer, are granted access pursuant to Section 19 of the Norwegian Personal Data Act, and general information about how Brakar processes your personal data, cf. Section 18, first paragraph of the Norwegian Personal Data Act.
In addition, it features information about how you can access personal data that Brakar possesses about you, and what you need to do if you want us to rectify or delete these data.
2. GENERAL INFORMATION ABOUT PROCESSING PERSONAL DATA AT BRAKAR AS
2.1 Data controller
Brakar, in the person of its CEO, holds ultimate responsibility for processing customers’ personal data, and is the “Controller” in relation to the Norwegian Personal Data Act. As the Controller, Brakar will ensure that its customers’ personal data are at all times processed in accordance with the provisions of the Norwegian Personal Data Act and other applicable regulations.
2.2 The personal data that Brakar processes about travellers
In principle, you do not need to reveal personal data to travel with Brakar. Brakar provides an anonymous ticket system for those people who require such; for example, tickets can be purchased through the Brakar App solution or as unregistered travel cards.
Brakar also provides the opportunity to register travel cards. If you choose to do so, we will need to process some personal data about you. The same applies if you wish to claim discounted prices (youth/student tickets) or to use the school transport scheme. This applies to the following data:
- name
- address, town/city, post code
- date of birth
- email address
- mobile phone number
Additional information about the processing of personal data in connection with the school transport scheme is presented in Section 4 below.
The personal data mentioned above are provided voluntarily by you and stored by Brakar for as long as necessary to execute the service in question, or for as long as the customer relationship with you continues, cf. Section 8, letter a of the Norwegian Personal Data Act.
Brakar only stores the data to which you, as our customer, have given your consent. You are entitled to withdraw your consent at any time. To do so, simply go to brakar.no, log onto “My pages” and delete your account. Brakar will subsequently delete all the personal data about you that are stored in our IT systems, in accordance with our deletion procedures.
In addition to the contact details stated above, Brakar registers information about the separate journeys our customers make. This includes data about:
- start of journey
- embarkation zones for the journey
- time travel card was read
- ticket type used
- travel card number
In principle, these data are anonymised, but it may be possible to link them to the individual customer if they are associated with a travel card number and the card is registered. From this perspective, travel data may constitute “personal data” in relation to the Norwegian Personal Data Act.
If you purchase tickets via the Brakar app solution, you are required to enter your phone number the first time you log on. You must also provide information about your payment card. The information about your payment card may be entered in connection with a single purchase, or it may be stored in the app to allow you to use the same payment card for subsequent purchases.
In addition, you can choose to enter your email address if you wish to receive receipts for purchases by email. If your email address contains your full name or another type of unambiguous identification, please note that we cannot guarantee that you can travel anonymously.
2.3 The purpose of the processing
Brakar’s overarching purpose in processing personal data is to be able to provide good, efficient services for travellers. This applies to those who travel with a registered travel card or the Brakar app solution, and to those who use the school transport scheme.
The purposes of the processing of personal data as described in section 2.2 above are:
- to determine the extent to which the customer may be entitled to discounted tickets (youth/student tickets), and whether the traveller’s right to discounted tickets is to terminate on account of age, for example,
- to be able to contact travellers to inform them that their tickers will soon expire,
- to issue travel cards in response to enquiries (e.g. customers who have lost their travel card and requested a new one),
- to pass on traffic reports, with the express consent of the customer,
- to communicate other relevant information to the customer, with his/her consent.
The travel data registered are also used for statistical purposes, including assessing budgets, capacity and future transport needs on different routes, and in connection with the submission of reports to Buskerud County, which is the company’s owner (owner reports).
2.4 Basis for Processing
Brakar bases its processing of personal data on consent from the customer/user/school pupil, cf. Section 8, first paragraph of the Norwegian Personal Data Act. As described in Section 2.2 above, consent is voluntary and may be withdrawn at any time, resulting in cessation of the processing. The processing of the information is also founded on Section 8, letter a of the Norwegian Personal Data Act, which permits processing that is necessary to fulfil obligations under an agreement with the data subject.
2.5 Data security and responsible storage of the personal data
Brakar processes all personal data in a secure, confidential manner. We make sure that the data are stored responsibly and processed confidentially, so as to comply with requirements for data security and internal control.
2.6 Deletion of personal data
If the customer uses a registered travel card, information about his/her name, address, email address, phone number and date of birth can be deleted by the customer himself/herself, by accessing the “My pages” tab on the Brakar website (brakar.no).
In other cases, these data will be deleted when the travel card is blocked on reaching its expiry date. For example: personal data linked to youth cards are deleted when the card is blocked on account of the customer having exceeded the age limit of 20 years.
In line with the “sector standard for privacy and data security in electronic ticketing”, which has been approved by the Norwegian Data Protection Authority, travel data are anonymised or deleted within 104 days.
2.7 Procedure for requesting access, rectification or deletion
If you wish to request access to the personal data Brakar processes about you, you need to submit your request in writing by filling out our contact form and sending it by standard mail or email to personvern@brakar.no.
If you choose to send the form to us by standard mail, address it to:
Brakar AS, Privacy Consultant
Strømsø torg 4
3044 Drammen
If you think there are errors in the personal data Brakar is processing about you, you can simply correct any errors via the “My pages” tab on brakar.no. Brakar will also ask you every six months to check that the data are correct in connection with your logon procedure. If you wish to terminate your customer relationship and delete the associated data, you can also do this via the “My pages” tab on our website. If you need assistance in this regard, contact our customer service centre at:
Customer Service, Brakar AS, tel. +47 32 20 30 90
If you have specific questions about Brakar’s processing of your personal data to which you cannot find the answers elsewhere, contact the Privacy Consultant at Brakar AS by email to personvern@brakar.no.
2.8 Use by Processors
Brakar will be able to share your personal data with what are known as “Processors”, who include subcontractors that process personal data on behalf of Brakar, cf. Section 2, subsection 5 of the Norwegian Personal Data Act. These will typically be system developers and IT suppliers we work with in connection with the operation and maintenance of our website, our app solution and our payment solutions.
Such Processors are not to use the personal data for any purpose other than supplying the service agreed with Brakar. We always enter into specific Data Processor Agreements with operators who process personal data on behalf of Brakar, so as to make sure that the Processor acts in compliance with the terms of the Data Processor Agreement, the present privacy policy and Norwegian privacy legislation in general.
Brakar only works with Processors based in Norway, EU/EEA countries, or other countries with satisfactory privacy legislation.
2.9 Disclosure of personal data to third parties
In certain cases, Brakar may disclose personal data to the police or to other public authorities. However, this requires either a separate legal basis or an order from the courts.
Brakar neither sells nor otherwise forwards personal information about you to third parties in any circumstances other than those stated in the present policy.
3. AUTOMATIC REGISTRATION OF USER INFORMATION ON VISITING OUR WEBSITE
In the same way as many other companies, we at Brakar use what are known as “cookies” and corresponding technology on our website if you have approved this choice in your browser. Cookies are small text files stored by the browser on your computer. These files are used to register certain types of information about you as a user and store them automatically when you visit our website. The information stored typically has to do with which browser and operative system you are using, and which domain or which IP address you are linked to. These data are only used to register and analyse the traffic pattern on our website, and to provide us with an overview of our customers’ consumption patterns. We use this information to analyse and develop our services.
4. BRAKAR’S PROCESSING OF PERSONAL DATA FOR SCHOOL TRANSPORT
4.1 The personal data we process in connection with the school transport scheme
On behalf of Buskerud County, Brakar provides transport to and from school for children at primary and lower secondary schools, and for children at upper secondary schools who are entitled to such transport under Section 7 of the Norwegian Education Act.
To allow Brakar to administrate and organise school transport in a satisfactory manner, Brakar needs to register some personal data about the schoolchildren covered by the scheme.
The personal data about the pupils are transferred to Brakar from the local school offices, or directly from the individual pupils or their guardians. The personal data we process in connection with the school transport scheme are:
- name
- national identity number
- address
- post code
- town/city
- phone number
- school affiliation
- contact information for guardians (only if it is necessary to contact the guardians to administrate the school transport for the pupil in question)
- health data about the pupil (only for special transport)
In the case of special transport (specially adapted transport in a taxi on account of lack of public transport, or right to school transport for reasons of health) Brakar may, as mentioned above, need to register information about the health status of the pupil. The information in question has to so with documenting the pupil’s need for special transport and the duration of this need, and it will typically concern the pupil’s diagnosis and/or need for special resources. The information is drawn from doctor’s notes submitted by the pupil/guardians to Brakar, or which Brakar receives from the school office.
In addition to the above, Brakar registers travel information in connection with the school transport scheme. This is, for example, information about:
- the zone and stop where the pupil starts the trip (for bus transport)
- when the travel card was read (for bus transport)
- travel card number (for bus transport)
- if appropriate, time and place of collection (only for taxi transport)
4.2 Controller and legal basis for the processing
Personal data processed in connection with school transport for primary and secondary school pupils are transferred to Brakar from the local school offices in Buskerud. The authority to make decisions regarding school transport under the Norwegian Education Act has been delegated to Brakar AS by Buskerud County. In accordance with the sector standard for e-ticketing, the county authorities and the administration company enter into a Data Processor Agreement that regulates how Brakar is to process personal data in this context.
The processing of personal data in connection with school transport is necessary to enable the county authorities to fulfil a legal obligation, cf. Section 8, letter b of the Norwegian Personal Data Act. Information about health status is considered sensitive personal data under Section 2, subsection 8 of the Norwegian Personal Data Act. The legal basis for processing such data is Section 7-3 of the Norwegian Education Act, cf. Section 9, letter b of the Norwegian Personal Data Act.
4.3 The purpose of the processing
The overarching purpose of processing personal data in connection with school transport is performance of public authority ordered under the Norwegian Education Act. Brakar uses the pupil’s personal data:
- to make decisions concerning the right to school transport, including an assessment of the distance between home and school, the extent to which the pupil has a dangerous route to school and whether the pupil needs school transport for reasons of health
- to define the practical transport requirements for each individual pupil (adaptation for wheelchair use, etc.)
- to contact the pupil or the pupil’s guardians where necessary in connection with the planning and administration of the specific transport.
It is necessary to collect sensitive personal data about health status to allow Brakar to assess whether the pupil is entitled to school transport for medical reasons, and whether the pupil has special needs in connection with the transport (adaptation for wheelchair use, etc.), cf. Section 7-3 of the Norwegian Education Act.
4.4 Use of Processors in connection with school transport
In order to ensure that the school transport scheme can be run efficiently and appropriately, we at Brakar occasionally need to share personal data about school pupils with our partners. These partners are considered “Processors” as defined in Section 2, subsection 5 of the Norwegian Personal Data Act. They are primarily transport operators who, on behalf of Brakar, handle the actual execution of the school transport, as well as suppliers of the school administration IT systems used in connection with school transport.
It may be necessary to provide the transport operators with the pupil’s name, address, school class and any specific information about special needs that are relevant to performance of the transport service –information about wheelchair use, for example. Information about diagnoses derived from doctor’s notes received by Brakar is never disclosed to the transport operators.
Brakar have entered into Data Processor Agreements with the transport operators we commission. This means that Brakar has ensured that the transport operators utilised under the school transport scheme only process personal data as agreed with Brakar, and that the data are processed responsibly.
4.5 Brakar’s administration of personal data in connection with school transport
All personal data that Brakar handles in connection with school transport are stored and administrated confidentially. Access to the personal data is limited, and they are only processed in connection with decisions regarding school transport and the administration of same. The personal data are stored in separate, secure systems, and only a limited number of staff at Brakar have access to these data.
The personal data are not disclosed to others unless Brakar is ordered to do so by public authorities. Some anonymised data may, however, be reported to Buskerud County, which has overarching responsibility for the school transport scheme under the Norwegian Education Act.
The personal data are stored for as long as the school pupil is registered in our systems and is entitled to school transport. On account of the afore-mentioned obligation to report to the county authorities, the data are stored for up to one year after the right to school transport expires.
