Privacy Policy

1. Purpose

The purpose of processing personal data for the Mobillett application:

Troms fylkestrafikk (henceforth known as the "Data Controller") is responsible for the personal data being processed via Mobilletten. Troms fylkestrafikk is the country traffic department for the Troms County Municipality.

The Mobillett app is provided by WTW AS (henceforth the "Data Processor"). The Data Processor will process your personal information on behalf of the Data Controller based on a separate data processing agreement; ref. section 6.

2. Legal basis

The use of Mobilletten is voluntary. If you decide not to make use of the solution, you can choose to buy a ticket using our anonymous travel card, Tromskortet, or by making a cash payment.

Your personal data is needed to use the app, and you need to sign a service agreement with the Data Controller by accepting the terms of the agreement before you can use the app. Before you register in the app, you will be informed that your personal data is being processed in accordance with this Data Protection Declaration.

3. Personal data

The following personal information is needed before you can use the solution:

Cell phone number and a password: This information needs to be registered in your user profile so we can offer the service via secure and verified login. Your cell phone number is needed as a means to access your active period tickets or receipts from previous purchases, in case you lose your cell phone. Your cell phone number becomes your unique user identification in the app. This is the only personal information required in the user profile.

Name and secondary users: You can add other users to the app if you like. This offer is available to people who want to create secondary users on their Mobillett account. Secondary users can pay for tickets using the money you deposited in your Mobillett account. You only need to enter you cell phone number to assign a secondary user to your Mobillett account. If you wish, you can also add a name or a nickname for this user so it is easier for you to distinguish between various secondary users. The name of the secondary users will also appear in Mobillett Web where you can log in and get a complete overview for all purchases that are paid with your Mobillett account in the last 20 months.

E-mail address: You can add your e-mail address to your profile if you like. Your e-mail is only required if you want to take advantage of the opportunity to receive receipts from your purchases, which are sent to your current e-mail address.

Sales documentation: All sales documents are stored in accordance with the Norwegian Bookkeeping Act. Travel information about your ticket purchases is only acquired as personal data when initiated by the registered party, for the purpose of registering complaints or making other enquiries where it is necessary to look at the details of a specific purchase.

Bank cards – The app accesses an interface from a payment service to carry out payments using a bank card. Registering a payment card in Mobillett app allows you to buy tickets without relinquishing all the details of your bank card. Even if you choose to store information on one or more payment cards in your profile, only the payment service company will see all the details from your card. Only the first six digits and the last four digits of your card number are stored in the app, along with the card's expiration date. This is essential for allowing the customer to recognise his or her card in the app and to generate the details required on the payment confirmation/receipt, as well as to effectively enforce the customer's right to a refund.

Phone Number – Your phone number is sent to Strex, which is the payment company used by mobile phone operators, if you intend to pay for tickets in your cell phone bill.

Details for Mobillett account – You or your secondary users can deposit money in your Mobillett account that you then use to pay tickets. The system processes information about account balance and transactions relative to your Mobillett account, including transaction history for refills, purchases, refunds and account credits.

Technical information: Your IP address will be registered when you use the Mobillett app or Mobillett Web, along with the time of the enquiry, information about the web browser or cell phone being used, as well as the version number and cellular operating system for the app, including the language options which are logged in the application log. These details are required for the solution to work on your platform/cell phone, and they are only logged to ensure that your service works the way it should. It also provides us with the information that is necessary to solve problems if an error should occur. No form of analysis tool is used (such as Google Analytics) to monitor and log purchasing patterns of identifiable users. The only related functionality is a crash report via HockeyApp, which provides fully anonymised crash reports as an aid to ensure fast error correction should the app crash.

Travel information: By allowing the app to access the GPS on your cell phone, only the local positioning data is used on your phone. No position data is logged in the app which is passed on to backend. The only travel information processed is departure place/zone and stopping place/zone info, which is needed to document a purchase and to calculate the correct price. The travel information related to your purchase is stored a while, but it is anonymised together with the other data in the sales documentation.

4. Cookies

To be able to use Mobillett Web, you need to have cookies enabled in your web browser. Cookies are small text files placed on your computer when you download a website. Cookies are needed for login, navigation and to implement features that allow a site to function smoothly. Note that none of the information in the cookies can identify you personally. It is possible to change the settings in your browser to prevent the site from using cookies. If you choose to turn off the cookies, you will experience problems and be logged out. This is because cookies are used to keep you logged in until you actively log out again, or you have been inactive for a long time.

5. Statistics

Information is used for statistics, but the information is anonymised and can thus not be linked to your person. Troms fylkestrafikk is required by law to provide the state and municipal authorities with traffic statistics; ref. § 2-2 of the Statistics Act and § 49 of the Local Government Act. Furthermore, statistics are used to improve and develop our services and what we offer our customers. Examples of what the statistics provide tell us: how many people travel between zones, the number of purchases per ticket category and how many people buy tickets using their cell phone platform (Android or iOS). The public transport company gathers information from ticket purchases via the Mobillett app. The travel information from your ticket purchase will not be used together with personal data to produce statistics.

6. Data processor

WTW AS is the supplier of Mobillett app. WTW functions as the Data Processor on behalf of Troms fylkestrafikk. A data processing agreement has been drawn up between WTW AS and Troms fylkestrafikk. The Data Protection Declaration ensures that WTW handles all personal data according to the terms specified by Troms fylkestrafikk in this Data Protection Declaration.

Troms fylkestrafikk and WTW AS process personal data in accordance with Norwegian law, including the Personal Data Act, accounting legislation and current norms and standards for the e-ticketing trade.

7. Other data processors associated with the Mobillett solution

The personal data collected or generated in the Mobillett solution is not processed in systems belonging to other sub-suppliers than WTW and the payment service(s) you have chosen to use.

8. Sources of personal data

All the personal data being processed by and for Mobilletten is added or generated by you alone. No information is collected by remote registries or other services.

9. Access to personal data

The personal data being processed is only accessible by authorised personnel who need the information to provide services at Troms fylkestrafikk and their sub-suppliers or subcontractors, including ticket checking companies, payment providers, WTW AS and the operating company.

No information will be disclosed to external third parties, neither in Norway nor abroad, who are not named in this Data Protection Declaration.

10. Rights and requirements for information security

You will be informed about how and why your personal data is being processed. This declaration is therefore available from the menu in the app at any given time.

When using Mobillett app, you have the right to:

• gain access to the personal data that is being processed,
• to request that incorrect information be corrected or removed,
• to receive personal information which you gave about yourself, and transfer the information to a different Data Controller (data portability),
• to contact the Data Controller if you have suggestions or questions related to the processing of your personal data.
• to complain to the Norwegian Data Protection Authority directly if you think your personal information is being handled or processed in violation of applicable law.
• Note that your cell phone number is linked to your user ID. To change the cell phone number, simply reset the app and create a new user.
• The rest of the personal information that you provided can always be corrected or deleted via the settings in the app.

11. Storage and deletion

All data is stored in Norway at WTW's server center. Servers are operated by personnel in Norway. All the data stored in the back-end system is stored in accordance with applicable law. Your personal data will not be stored longer than necessary to achieve the communication objectives the app is used for. The Data Controller and the application developer (WTW AS) have implemented information security measures and internal control routines to make certain no personal data goes astray or is being used for any other purpose than that described in this Data Protection Declaration.

Troms fylkestrafikk (as the Data Controller) and its data processors work according to the principles for built-in protections and personal data protection as default settings. This implies, among other things, that your personal information is not kept longer than is necessary to fulfil the purpose of the service.

Profile information: Your profile information is kept as long as your customer agreement is active. You have the right to request the deletion of your user identification from the Mobillett service at any time. You will then have to register for the service again if you want to use it at a later date. Your cell phone number is verified the first time you log in using a new device. If you have entered other personal information in the app, you have the opportunity to edit this information in your profile at any time via Settings in the menu.

Transaction history and sales documentation: All sales documentation is kept for 5 years after the end of the financial year in accordance with Norwegian accounting legislation, including the Bookkeeping Act and associated regulations. Receipts from your most recent purchases will be available in the app at any time. According to requirements set by the payment services, Troms fylkestrafikk is obligated to grant you access to sales documents for all the services you paid for these past 20 months which were carried out by your user ID or related to your Mobillett account. You can retrieve this information yourself by logging in to Mobillett Web. The sales documentation will be archived anonymously after 20 months have passed in a manner that makes it impossible for you or people with service access to the Mobillett service to acquire any information about the user.

Technical information and application logs: Different parts of the application logs are kept for a sufficient period of time to ensure that your service functions as intended and so customers receive the service they are entitled to. For example, complaints based on errors in the service can be stored for a longer period for relevant application logs until the complaint process is finished.

12. Security

All communication between the solution and the applications running on the end-users' phones are encrypted. All access to the system via internet is encrypted. All data transferred internally between the various components in the system is encrypted. Access to extract data is only possible via API, which is encrypted and secured using access keys. Access to data via Troms fylkestrafikk's interface is governed by roles and identifiable persons and recorded in incident logs to ensure traceability. The administration interface for the solution is designed with a different level of access so only WTW or employees at Troms fylkestrafikk who need access can view information that is relevant to their work tasks.

13. Contact info

If you need more information about personal data processing, you can contact the data protection officer at the Troms County Municipality: personvernombud@tromsfylke.no.

Please note that the Data Protection Declaration will be updated if changes are made to the system. The most recent Data Protection Declaration will always be available via the Mobillett app to keep you informed about how and why personal data is processed at any given time.