Skip to main content

Main navigation

Pilot - Travelling with your debit card or credit card

The nine Dutch public transport operators¹ ("Transport Operators") and Translink are jointly introducing a new option for travelling on public transport: purchasing a Ticket by checking in and out with your Debit Card or Credit Card. This new service is offered in collaboration with several payment services,² and will allow you to use your Debit Card or Credit Card to travel by public transport. You pay for your travel through the Bank account linked to your Debit Card or through the spending limit of your Credit Card. NS will start this trial in the summer of 2022 with a limited group of passengers. More information about this will follow on NS.nl.


¹ Arriva, Connexxion, EBS, GVB, HTM, Keolis, NS, Qbuzz and RET. See ovpay.nl for the most up-to-date overview.
² Maestro, Mastercard, VPAY and VISA. See ovpay.nl for the most up-to-date overview.

If you purchase a Ticket by checking in and out with your Debit Card or Credit Card, you and NS enter into a transport agreement to which the Terms and Conditions for Urban and Regional Travel, Terms and Conditions of NS and the OVpay Terms and Conditions for Checking in/out with your Debit Card and Credit Card apply. In order to travel and pay with your Debit Card or Credit Card on NS public transport, your Personal Data have to be processed. NS and Translink can also provide you with services.

If you do not want NS and Translink to have access to the Personal Data needed for this service, you cannot travel and pay with your Debit or Credit Card and will have to use another Ticket.
All processes are designed based on the principles of Privacy by Design. This means that Translink and the Carriers have designed and set up the system in such a way as to protect your privacy as a traveller as much as possible. 

The capitalised terms below have a fixed definition, as stated in the glossary at the end of our privacy statement.

Pseudonymisation, re-identification and token use

Immediately after you check in, the unique identification number ("PAN") of your Debit Card or Credit Card is Pseudonymised. This is done by giving each Debit Card or Credit Card its own unique number, called a token. These unique tokens are used for the various purposes such as travel, payments, services, inspections and summary reports. 

The Generic Back Office ("GBO") assigns each Carrier its own unique token identification numbers. As a result, Carriers have no insight into trips made by a traveller with a Debit or Credit Card with any of the other Carriers. The GBO is Translink's central administration system. It is used to register Tickets for Carriers, calculate fares and keep track of each user’s total daily travel expenses, among other things.
Without additional information, pseudonymised data cannot be traced back to your Debit Card or Credit Card details. Pseudonymisation is a measure that reduces the risks for travellers when their Personal Data are Processed. By combining Pseudonymised data with other data, organisations may be able to find out which Debit Card or Credit Card belongs to the pseudonym. This may also enable them to piece together the travel history linked to a Debit Card or Credit Card. 

In designing the processes, the Carriers and Translink followed the principles of Privacy by Design and made agreements with each other to prevent this risk of re-identification.

Which personal data do we use? How can I travel and pay with my Debit Card or Credit Card?

A. Travel

When you check in with your Debit Card or Credit Card, the card reader reads Technical Data from the card. We check whether the Debit Card or Credit Card can be used to travel and notify you via the card reader. We call presenting your Debit Card or Credit Card to a card reader a "tap".

If you are allowed to travel with your Debit Card or Credit Card, Personal Data are sent from the card readers of the Carrier you are traveling with to the Translink GBO when you check in or out. In addition to the Technical Debit Card or Credit Card Data, the data package also includes the date, time and stop or station where you checked in or out. This information is used to piece together your trip and calculate the fare. 

First time traveling with your Debit Card or Credit Card

The first time you check in with your Debit Card or Credit Card, an automatic check is performed to determine whether your Debit Card or Credit Card is suitable for public transport travel in the Netherlands. This check is also performed if you have not used the Debit Card or Credit Card to travel for a period of 14 days and check in again. 

The GBO also checks whether your card has been blocked with your Bank or Credit Card Company. If your card has been blocked, you will (temporarily) be unable to travel with your Debit Card or Credit Card. This is a decision made by the Bank or Credit Card Company and it cannot be changed by the Carriers or Translink cannot change this.

Travelling with your Debit Card or Credit Card

Every time you check in with your Debit Card or Credit Card, Translink's alert list is checked to see whether the Debit Card or Credit Card in question has been (temporarily) blocked. This list is managed in the GBO and distributed to Carriers. Translink will add your Debit Card or Credit Card if 

  • the Debit Card or Credit Card you use for public transport is on an alert list published by a Bank or Credit Card Company, for example because it has been registered as stolen or missing;
  • the Debit Card or Credit Card was declined, for example because you had no balance or because you had exceeded your spending limit on your Bank account or Credit Card.

B. Payment

Your trip fares are calculated in the GBO based on when you check in and check out with your Debit Card or Credit Card. In the night following the Travel Day on which you traveled, the full amount due for all trips made on one Travel Day will be sent to the Bank or Credit Card Company at once.

In order to process the payment, Translink sends the Technical Debit Card or Credit Card Data and the Reference Number to the Bank or Credit Card Company.

If the payment is successful, an entry will appear on your (digital) account statement and you will receive your unique Reference Number for each day that you travel. A Reference Number is preceded by the letters "NLOV". You can find your digital account statement by logging on to your secure banking environment. 

Contrary to the above, your outstanding balance is settled during the Travel Day if it exceeds a certain capped amount to be determined by Carriers. The fare due will then be debited directly from your bank account or spending limit. After successful payment, any subsequent trips you make will be charged at the end of the Travel Day, unless you reach the cap amount before the end of the day.

Summary Reports

Translink records all check-ins and check-outs in the GBO, pieces together your trips and determines the fares. Translink works with EMS, a payment solutions provider, and your Bank or Credit Card company to handle payment for trips you make with your Payment Card or Credit Card. Translink also ensures that NS and the other Carriers receive payment for the trips you make every day.

All Carriers each receive daily summary reports from Translink to check the accuracy of their own payment records. These reports contain transactions (e.g. every check-in or check-out), trips (paired check-ins and check-outs) and payments within the domain of the Carrier in question. 

Unsuccessful payments

If a traveller is unable to pay, for example because their balance or spending limit is too low, Translink will temporarily block the travel feature on your Debit Card or Credit Card. You will then no longer be able to travel by public transport with your Debit Card or Credit Card until the outstanding amount is paid.

Over a period of 62 calendar days, repeated payment requests will be made by the GBO to debit the amount due from your account or spending limit. If the payment is successful, the (temporary) block will be lifted. 

Travellers are also free to pay the outstanding amount themselves both within this period and afterwards by tapping their Debit Card or Credit Card on a card reader on any carrier's check-in/check-out equipment. The GBO will then submit a payment request to your Bank or Credit Card Company. If the payment is successful, you will be able to travel with your Debit Card or Credit Card after about 15 minutes.

(Temporary) travel block

You can check whether you have (temporarily) been blocked from travelling with your Debit Card or Credit Card by tapping it on a Carrier’s card reader and checking the message on the display or by contacting OVpay customer service.
If you are unable to travel with your Debit Card or Credit Card, you can always use another Ticket to travel by public transport.

C. Service

We understand that you may have questions about a trip or charges, that you might have forgotten to check in or out or that you would like to see your trip history. You can request (a part of) your trip history on the OVpay website or OVpay App or from OVpay customer service. You will soon be able to link your Debit Card or Credit Card to your MijnNS account for service and information.  For specific questions about NS services, you can also contact NS Customer Service. 

In order to help you, you will need the Reference Number and the amount debited from your account. We do not know your Bank Card or Credit Card number and we cannot search your IBAN either.

A unique Reference Number is created for each payment made with your Debit Card or Credit Card. You can find the unique Reference Number for the trips covered by that single payment (usually linked to one Travel Day) on your digital account statement. If you share this Reference Number and the corresponding amount with another person or organization, they can gain insight into the trips you have made.

App and website

You can link your debit or credit card to the OVpay App, which can be downloaded from www.ovpay.nl. First, you will have to create an account with your own password. Using a Reference Number and the corresponding amount, you will then be able to view your public transport trip history and payment history for the past 18 months. 

In a Carrier's account environment (web or app, if available), you will only be able to view trips made with that Carrier with your Debit Card or Credit Card, again for the past 18 months.
On the ovpay.nl website, entering a Reference Number and the corresponding amount will only show you the trips linked to that specific payment. You can also visit this website to correct a missed check-in or check-out with NS. 

If your trip with NS was delayed a, you used your Debit Card or Credit Card and are you eligible for compensation based on the ‘Delay Refund' scheme, you can submit a refund request via the web form on ns.nl, stating the Reference Number and the corresponding amount.

Customer Service

For questions about travelling with a Debit Card or Credit Card, please contact NS Customer Service or OVpay Customer Service. Customer Service employees do not have access to your Debit Card or Credit Card details or the details of your payment account. 

An employee will always explicitly ask for your details if this is necessary in order to answer your questions. Depending on your question, we may ask you for your Reference Number and the corresponding amount.

D. Inspection

Everyone using public transportation is required to have a valid Ticket. If you check in with your Debit Card or Credit Card, your Ticket will be linked to that Debit Card or Credit Card through a digital record in the GBO. NS employees regularly perform ticket inspections in trains and at stops and stations. If an NS employee checks your Ticket, you must hold your Debit Card or Credit Card against the card reader. The Technical Data of your Debit Card or Credit Card will be read and used in accordance with PCI DSS. 

In order for NS employees to be able to serve/help you, they will explicitly ask your permission. The NS employee can then view the last 10 actions performed with your Debit or Credit Card on their device (up to a maximum of 62 days ago). These data are displayed on the device for a maximum of five minutes and disappear the moment another Debit Card or Credit Card is held against the card reader. 

Basis for Processing

If you check in and out using the Debit Card or Credit Card with NS, the basis for Processing Personal Data is performance of a contract. This concerns the transport agreement to which the Terms and Conditions of Urban and Regional Transport, the NS Terms and Conditions and the OVpay Terms Conditions for Checking In/out with your Debit Card and Credit Card.

Automated decision-making

In two cases, decisions are made automatically; if a fare is due or if a Debit Card or Credit Card has been blocked by a Bank or Credit Card Company. 

Fare due

Passengers must always pay the fare due. If your Bank or Credit Card Company cannot process your payment, the travel feature on your Debit Card or Credit Card will automatically be blocked (temporarily). You will still be able to check out, but you will not be able to check in again.

If your Debit Card or Credit Card’s travel feature has been blocked because your balance or spending limit is too low, you will not be able to check in again with this Debit Card or Credit Card until your debt has been paid. Over a period of 62 calendar days, repeated payment requests will be made by the GBO to debit the amount due from your account or spending limit. You can also pay yourself by tapping your Debit Card or Credit Card on a card reader on any carrier's card reader. Although the check-in will be rejected (and you will see an error message on the display), another attempt will be made to debit the amount. If this attempt is successful, you will be able to check in again after about 15 minutes and continue your journey.

You may object to this automated decision to (temporarily) block your Debit Card or Credit Card by contacting OVpay Customer Service. They will assess why your Debit Card or Credit Card has been blocked and unblock it if there is reason to do so.

A Debit Card or Credit Card blocked by a Bank or Credit Card Company

If a Debit Card or Credit Card used on public transport has been flagged by a Bank or Credit Card Company as stolen or missing, or if the Card has been (temporarily) blocked by the Bank or Credit Card Company for any other reason, the Card’s travel feature will also be (temporarily) blocked automatically. 

This is also part of the general terms and conditions for the use of your Debit Card or Credit Card as agreed with your Bank or Credit Card Company.

The Carriers and Translink cannot change this (temporary) block. For questions about this, please contact your Bank or Credit Card Company.

Who are the Data Controllers? Why do we use your personal data?

Your Personal Data are Processed by: NS and Translink. NS, the other Carriers and Translink are jointly responsible for processing Personal Data relating to travel using your Payment Card or Credit Card, for the following processes and associated Personal Data:

Tapping (checking in and out)

Legal basis: performance of a contract

  • Purpose: Checking Debit Card status and tap validation.
  • Personal Data: Technical Debit Card data (PAN, PAN serial number and expiration date); Tap data.
  • Retention periods: 24 hours max.

Processing taps (transaction processing)

Legal basis: performance of a contract.

  • Purpose:
    • Processing taps.
    • Qualifying taps: tap in/ tap out/ tap for settling outstanding debt.
    • Compiling trips based on check-ins/check-outs (trip transaction data); determining fares; preparing trip transaction data/tap for settling outstanding debt.
  • Personal data: Technical Payment Card data (PAN, PAN serial number and expiration date); Pseudonymisation tokens derived from technical Card data; trip transaction data.
  • Retention periods: 18 months.

Central traveller support (self service) without service account

Legal basis: performance of a contract

  • Purpose:
    • To provide insight into trip transactions, payment transactions and outstanding debt to travellers via the OVpay website.
    • Facilitating missed check-outs via website.
  • Personal data: Reference number; Payment transaction data; Outstanding debt; Trip transaction data (e.g. check-in/check-out; date/time; location; means of transportation; trips and fare per trip).
  • Retention periods: Until service has been provided. No data will be kept on the website.

Central traveller support (self service) with service account

Legal basis: performance of a contract

  • Purpose: Providing insight into trip transactions, payment transactions and outstanding debt to data subjects via the OVpay app
  • Personal data: Username and password (2FA); Reference number; Payment transaction details; Outstanding debt; Trip transaction details.
  • Retention periods: Until service has been provided. No data will be kept in the app

Decentralised passenger support (self service) with service account at public transport company

Legal basis: performance of a contract

  • Purpose: To provide data subjects with insight into the following via the website/app of the public transport company in question:
    • trip transactions and payment transactions with the public transport company in question (from the past 18 months);
    • outstanding debt and the underlying transactions (if any) with other public transport companies.
  • Personal data: Reference number; Payment transaction data; Outstanding debt; Trip transaction data.
  • Retention periods: Until service has been provided. No data will be kept on the website/in the app.

Ticket inspection

Legal basis: performance of a contract

  • Purpose:
    • Checking whether a traveller has a valid electronic ticket while using public transport;
    • If there no valid check-in or check-out records are found, checking the last ten public transport transactions with the same card to determine follow-up action for public transport company (still under development as of July 2022))
  • Personal data: Technical Debit Card data (PAN, PAN serial number and expiration date); pseudonymisation tokens; trip transaction data.
  • Retention periods: Data will be automatically deleted as soon as the inspection device has received the response that the Debit Card was/was not tapped in/out and 5 minutes have passed or when a subsequent Debit Card is presented for inspection or when the inspection (app) is closed.

Mobile service for travellers

Legal basis: consent

  • Purpose: Ticket inspector can scan a Debit Card at a traveller’s request to provide information about their last ten public transport transactions with the same Card (still under development as of July 2022)
  • Personal data: Technical Debit Card data (PAN, PAN serial number and expiration date); pseudonymisation tokens; trip transaction data.
  • Retention periods: Data will be automatically deleted as soon as the inspection device has received the response that the Debit Card was/was not tapped in/out and 5 minutes have passed or when a subsequent Debit Card is presented for inspection or when the inspection (app) is closed.

With whom do we share this data?

NS, the other Carriers and Translink use services provided by Processors. We always enter into written agreements with third parties (such as IT suppliers) that Process Personal Data on our behalf. We do this by entering into a so-called “processing agreement", in which we lay down agreements about the security of your Personal Data and about the use of the Personal Data, among other things.

Translink uses the services of EMS to process the payment with your Bank or Credit Card Company. In doing so, Translink provides the Technical Debit Card or Credit Card details and the Reference Number. EMS processes this data in the capacity of a Processor.

In addition, the carriers and Translink are in some cases required by law to provide your data to third parties, e.g. in the event of a court order.

Helpdesk for queries about travelling with a Debit Card or Credit Card or requests with regard to exercising your rights

If you have any questions about the Processing of your Personal Data in connection with travel using a Debit Card or Credit Card, please get in touch with NS’s and Translink’s points of contact. 

In principle, NS and Translink can only answer specific questions if they have access to your Debit Card or Credit Card details. If you have created an account in the OVpay App, linked your Debit Card or Credit Card to this account, and provided your details, Translink can also use this information to help you. Before you can view your trip history, you must provide the Reference Number and the corresponding amount.

For general questions about travelling with a Debit Card or Credit Card, please contact OVpay customer service via telephone number 0900-1433 (standard call charges apply) or the OVpay contact form.

For specific questions about services provided by NS, please contact NS Customer Service. We ask that you contact NS Customer Service via the chat if possible, as this will allow you to send screenshots and will make it easier to assist you.
If you would like more information about how NS or Translink handles your Personal Data, please contact the data protection officer of either organisation:

Exercising your rights

If you wish to exercise your rights, please notify NS, Translink's Customer Service or Translink's Data Protection Officer, see contact details above.

Glossary

Because traveling with your Debit or Credit Card is new, we may use terms that you are not (yet) familiar with. To help you out, we have listed these terms and what they mean here.

  • Terms and Conditions of Urban and Regional Transport: the Terms and Conditions for the Use of Public Urban and Regional Transport by Bus, Tram, Light Rail, Metro and Regional Public Transport by Train.
  • App: a mobile application developed and offered by an individual Carrier or by Carriers and Translink together (under the name OVpay) that enables Passengers with a Debit Card or Credit Card to access their online account, link their Debit Card or Credit Card to their account and thus easily view their trip and payment history, and submit service requests, among other things. The use of an App is subject to the terms of use of the App in question.
  • AVR-NS: Nederlandse Spoorwegen's Terms & Conditions for the transport of Passengers and Hand Luggage.
  • Bank: a financial institution offering payment services and the institution holding the Bank Account to which the Passenger's Debit Card used for public transport is linked.
  • Debit Card: a contactless card issued by the Bank for payment (physical or virtual on a smart device) that allows the user to use and pay for public transport by checking in and out at the designated card reader at the station, at the stop or in the vehicle.
  • Credit Card: a contactless credit card issued by the Credit Card Company that allows the traveller to use and pay for public transport.
  • Credit Card Company: a financial institution that offers payment services and that issued the Credit Card to you.
  • Generic Back Office ("GBO"): the digital back office of Translink. This is where Tickets are registered, fare prices are calculated, and each user’s daily trips are tracked.
  • Joint Processor: If two or more Processors jointly determine the purposes and means of the Processing, they are considered Joint Processors under the GDPR.
  • Payment Card Industry Data Security Standard ("PCI DSS"): an information security standard for organisations dealing with Debit Cards or Credit Cards.
  • Personal Data: any information about an identified or identifiable natural person as referred to in the GDPR.
  • Pseudonymisation: the Processing of Personal Data in such a way that the Personal Data can no longer be linked to a traveller without the use of additional data, provided that these additional data are stored separately and that technical and organisational measures have been taken to ensure that the Personal Data are not linked to an identified or identifiable traveller as referred to in the GDPR.
  • Travel day: a period starting at 00.00 and ending at 03.05 the next day.
  • Reference number: a code consisting of a combination of fourteen letters and numbers. A unique reference number is assigned to each payment. This code is linked to the amount debited from your bank account or spending limit.
  • Technical Debit Card or Credit Card Data: these technical data consists of the numbers of the Debit Card or Credit Card, namely the PAN, the PAN sequence number and the expiration date of the Debit Card or Credit Card. The PAN is a unique Debit Card or Credit Card identification number. The PAN sequence number is stored in the chip of the Debit Card or Credit Card and is not visible.
  • Translink: Trans Link Systems B.V., having its registered office and principal place of business in Amersfoort. 
  • Ticket: the ticket that provides valid access to trains, buses, trams and metros and is purchased by the Traveller by checking in with NS for each journey using the Debit Card or Credit Card that they use for public transport. A Ticket is only valid if all the requirements stated in the Terms and Conditions of Urban and Regional Transport (when travelling with urban or regional carriers) or the AVR-NS (when travelling with NS) are met.
  • Carrier(s): the Dutch public transport companies mentioned on the website OVpay.nl.
  • Processing: an operation or set of operations relating to Personal Data or a set of Personal Data, whether or not carried out through automated processes as referred to in the GDPR.
  • Processor: a natural or legal person, government agency, department or other body that processes Personal Data on behalf of the Controller as referred to in the GDPR.
  • Controller: a natural or legal person, government agency, department or other body which/which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data as referred to in the GDPR.