Data protection declaration

1. Objective

The objective of processing personal data in the Farte ticketing app is as follows:

Telemark County Council (hereafter referred to as the "data controller") is responsible for the personal data processed in the Farte ticketing app.

The Farte ticketing app is delivered by WTW AS (hereafter referred to as the "data processor"), which processes your personal data on behalf of the data controller in accordance with a separate data processing agreement, cf. Item 5.

2. Legal basis

The Farte ticketing app is an optional service. If you choose not to use it, you may purchase tickets via alternative channels such as travel cards or paying for your ticket with cash or card on board the bus or ferry.

We need to process your personal data in order for you to use the app and fulfil the service level agreement you enter into with the data processor once you open the app and accept the terms and conditions. Before registering in the app you will be informed that your personal data will be processed in accordance with this privacy policy.

3. Personal data

The app processes the following general personal information about you:

Mobile number and password: This information must be registered to your user profile to enable us to offer a service with secure and verified log-in. Your mobile number is required to ensure that you can access your active season tickets or receipts for past purchases in case you lose your mobile. Your mobile number serves as your unique user ID when using the app and is the only personal information required for your user profile.

Name and email address: Adding your name and email address to your user profile is optional. We only need your email address if you want to have your receipts emailed to you. You can delete or amend this information at any time under "Settings" in the app.

Sales documents: All sales documents are stored in accordance with the Norwegian Bookkeeping Act. The travel information associated with your ticket purchase is only retrieved when initiated by the registrant, e.g. when submitting a complaint or other query that requires us to look more closely at all the details of your purchase.

Credit and debit cards: When you pay with a credit or debit card, a connection with the payment service provider is created to allow you to register your card in the Farte ticketing app without storing your full card details in the app. If you choose to save one or more cards to your profile, only the payment service provider has access to your full card details. The app will only store the first six and last four digits of the card number along with the expiry date. This information is essential in order to allow you to recognise your card, to enable us to generate the information that should be included on your receipt, and to allow us to respond efficiently to any refund entitlements.

Technical information: When you use the Farte ticketing app your IP address, the time of your query, info about your mobile phone, the version number and mobile platform for the app, including your chosen language, will be stored in the application log. This information is required in order for the app to work on your particular platform/mobile and is stored to ensure that the service works as intended. It also provides us with necessary information to help resolve any faults. We do not use analytical tools (e.g. Google Analytics) that identify and log the behaviours of identifiable users. The only analytical function is crash reporting using the HockeyApp, which provides completely anonymous crash reports and helps us swiftly rectify the problem if the app were to crash.

Travel information: When you grant the app access to your phone’s GPS, the positioning data will only be used locally on your handset. No positioning data logged in the app is shared with the back-end system. The only travel information to be processed is the information about the departure point/zone and destination point/zone required to document the purchase and work out the correct price. The travel information associated with your purchase is stored and anonymised together with the other transaction data.

4. Statistics

Information used for statistical purposes is de-identified and therefore cannot be linked to you personally. Telemark County Council is required to report passenger figures to central and local government pursuant to Section 2-2 of the Statistics Act and Section 49 of the Local Government Act. Statistics are also used to improve and develop new services for our customers. Examples of what the statistics can tell us include how many people travel between different zones, the number of ticket purchases in each category, and how many people purchase tickets via the mobile platform (Android or iOS). Telemark County Council collects information about the ticket purchases made in the Farte ticketing app. The travel information associated with your ticket purchase will not be used in conjunction with personal data in order to generate statistics.

5. Data processor

WTW AS, the supplier of the Farte ticketing app, acts as data processor on behalf of Telemark County Council. A data processing agreement has been entered into by WTW AS and Telemark County Council. The data processing agreement ensures that WTW processes all personal data in accordance with the provisions given by Telemark County Council in this privacy statement.

Telemark County Council and WTW AS process personal data in accordance with Norwegian law, including the Personal Data Act, relevant accounting legislation and the industry standard for e-ticketing.

6. Other data processors associated with the Farte ticketing app

The personal data collected or generated in the Farte ticketing app will not be processed by systems belonging to sub-contractors other than WTW and the payment service provider(s) you choose to use.

7. Personal data sources

All personal data processed by the Farte ticketing app is uploaded or generated by you. No information is obtained from external registers or services.

8. Access to personal data

The processed personal data is only accessible on a need-to-know basis to authorised personnel at Telemark County Council and its sub-contractors, including ticket inspection providers, payment service providers, WTW AS and the server operator.

No information will be disclosed to any third parties either in Norway or abroad not mentioned in this privacy policy.

9. Rights and requests for information

We must tell you how your personal data is processed. This privacy policy can therefore be accessed from the app’s menu at any time. As a user of the Farte ticketing app, you have the right to:

• access the personal data being processed,
• demand that incorrect personal data be corrected or removed,
• receive a copy of the personal data that you have disclosed and transfer it to another data controller (data portability),
• contact the data controller if you wish to provide feedback or ask questions about the processing of your personal data,
• complain directly to the Norwegian Data Protection Authority if you feel that the processing of your personal data is in breach of prevailing legislation.
• Please note that your mobile number is linked to your user profile. To change your mobile number, simply reset the app and create a new user.
• Any other personal data that you have provided can be amended or deleted at any time under "Settings" in the app.

10. Storage and deletion

All data is stored in WTW’s server centre in Norway. The servers are operated by personnel in Norway. All data stored in the back end system is kept in accordance with prevailing legislation. Your personal data will not be stored for longer than is necessary to fulfil the communications purposes for which the app is intended. Both the data controller and the app developer, WTW AS, have put in place information security measures and internal procedures to ensure that no personal data goes astray or is used for purposes other than those described in this privacy policy.

Both the data controller, Telemark County Council, and its data processors observe the principles of privacy by design and privacy by default. This implies that your personal data should not be stored for longer than is necessary in order to fulfil the purpose of the service.

Profile information: Your profile information will be stored for as long as you remain an active customer. You may request your user profile to be deleted from the Farte ticketing app at any time. You must then register again if you wish to use the service at a later date. Your mobile number will be verified when logging in for the first time on a new device. If you have entered other personal data in the app, you may edit this data in your profile at any time under "Settings".

Transaction history and sales documents: All sales documents are stored for 5 years from the end of the financial year in line with prevailing accounting legislation, including the Bookkeeping Act and associated regulations. Receipts for your most recent purchases can always be accessed through the app. As required by the payment service providers, Telemark County Council is obliged to grant you access to the sales documents for all service purchases for a period of 20 months. After 20 months the sales documents will be archived and anonymised so that it is no longer possible for you or anyone with authorised access to the Farte ticketing app to retrieve information linked to the user.

Technical information and application log: Parts of the application log are stored for an appropriate period of time to ensure that the service works as intended and that customers receive the service they are entitled to. In the event of a complaint about a fault with service, for instance, the relevant application log may be kept for longer to enable it to monitor the time period in question and complete the processing of the complaint.

11. Security

All communication between the solution and the applications on the end user’s handsets is encrypted. All access to the online system is encrypted. All internal data transfers between the various components in the system are encrypted. Data may only be retrieved via APIs that have been encrypted and made secure with access keys. Access to the data via Telemark County Council’s interface is role-based and personal with incident logging to ensure traceability. The administration interface for the solution has been designed with different access levels so that individuals who require access through Telemark County Council or WTW will be able to access only the amount of information they need.

12. Contact information

If you require further information about how your personal data is processed, please contact Telemark County Council on farte@t-fk.no.

Please note that this privacy policy will be updated as and when changes are made to the system. The latest version of the privacy policy is always available in the Farte ticketing app, allowing you to keep up-to-date with how your personal data is processed.