Travelling with your Debit Card or Credit Card

The nine Dutch public transport carriers ('Carriers') and Translink are jointly introducing a new option to travel by public transport by means of purchasing a Ticket by checking in and out using your Debit Card or Credit Card. We are doing this in conjunction with a number of payment services. With these payment services, your Debit Card or Credit Card has a public transport travel function in the Netherlands linked to it. You pay for your journeys through the Bank Account associated with your Debit Card or the spending limit on your Credit Card.

^{¹ Arriva, Connexxion, EBS, GVB, HTM, Keolis, NS, Qbuzz and RET. See ovpay.nl for the most up-to-date overview.
² Maestro, Mastercard, VPAY and VISA. See ovpay.nl for the most up-to-date overview.}

If you purchase a ticket by checking in and out with your Debit Card or Credit Card, you and NS enter into a transport agreement to which the Terms and Conditions for Urban and Regional Travel , Terms and Conditions of NS and the OVpay Terms and Conditions for Checking in/out with your Debit Card and Credit Card apply. If you travel with Intercity Direct, then the Intercity Direct Product Terms and Conditions will also apply. In order to travel and pay with your Debit Card or Credit Card on NS public transport, your Personal Data must be processed. Then you can travel and pay with NS using your Debit Card or Credit Card. NS and Translink can also provide you with services.

If you do now wish for NS or Translink to have the necessary personal data, then you cannot travel and pay using your Debit Card or Credit Card, and you will have to use another form of ticket.

The processes were set up on the basis of Privacy by Design. This means that Translink and the carriers have designed and established the system in order to protect your privacy as a traveller as effectively as possible.

The capitalised terms below have a fixed definition, as stated in the glossary at the end of our privacy statement.

Pseudonymisation, re-identification and token use

Immediately after you check in, the unique identification number ('PAN') of your Debit Card or Credit Card is Pseudonymised. This is done by giving each Debit Card or Credit Card its own unique number, called a token. These unique tokens are used for the various purposes such as travel, payments, services, inspections and summary reports.

The Generic Back Office ('GBO') assigns each Carrier its own unique identification numbers for the tokens. As a result, Carriers have no insight into the travel patterns of trips with other Carriers made by a traveller using a Debit or Credit Card. The GBO is the central Translink administration system in which Translink registers Tickets and other things on behalf of Carriers, and calculates the cost of a journey as well as the total cost of your travel for the whole day.

Without additional information, Pseudonymised data cannot be traced back to your Debit Card or Credit card data. This Pseudonymisation is a measure aimed at reducing the risks for you as a traveller in the Processing of your Personal Data. By combining Pseudonymised data with other data, an organisation may be able to identify which Debit Card or Credit Card belongs to the pseudonym. This may then make it possible to view the travel history associated with a Debit Card or Credit Card.

In designing the processes, the Carriers and Translink followed the principles of Privacy by Design and made agreements with each other to prevent this risk of re-identification.

What personal data do we use? How can I travel and pay with my Debit Card or Credit Card?

A. Travel

When you check in with your Debit Card or Credit Card, the card reader reads Technical Data from the card. We check whether the Debit Card or Credit Card can be used to travel and notify you via the card reader. We call presenting your Debit Card or Credit Card to a card reader a 'tap'.

If you are allowed to travel with your Debit Card or Credit Card, Personal Data is sent from the card readers of the Carrier you are travelling with to the Translink GBO when you check in or out. In addition to the Technical Debit Card or Credit Card Data, the data package also includes the date, time and stop or station where you checked in or out. This information is used to piece together your trip and calculate the fare.

Please make sure that upon checking in and out, you present your Debit Card or Credit card to the reader separately, rather than from inside your wallet. This will help ensure that you only check in and out with the intended card, so you do not inadvertently get charged too much for your trip.

First time travelling with your Debit Card or Credit Card

The first time you check in with your Debit Card or Credit Card, an automatic check is performed to determine whether your Debit Card or Credit Card is suitable for public transport travel in the Netherlands. This check is also performed if you have not used the Debit Card or Credit Card to travel for a period of 14 days, and then check in again.

The GBO also checks with the Bank or Credit Card Company to see whether your Debit Card or Credit Card is blocked. If so, then the public transport travel function on your Debit Card or Credit Card will be temporarily blocked so that you cannot use it for travelling. This decision is made by the Bank or the Credit Card company. The Carriers and Translink cannot do anything to change this.

Travelling with your Debit Card or Credit Card

Every time you check in with your Debit Card or Credit Card, Translink's alert list is checked to see whether the Debit Card or Credit Card in question has been temporarily or permanently blocked. This list is managed in the GBO and distributed to Carriers. Translink will add your Debit Card or Credit Card if

it appears that your Debit Card or Credit Card used on public transport is on an alert list of • it appears that your Debit or Credit Card used on public transport is on an alert list of the Bank or Credit Card Company, for example, because it is registered as stolen or missing;
the Debit Card or Credit Card was declined, for example because you had no balance or because you had exceeded your spending limit on your Bank account or Credit Card.

B. Payment

Your trip fares are calculated in the GBO based on when you check in and check out with your Debit Card or Credit Card. In the night following the Travel Day on which you travelled, the full amount due for all trips made on one Travel Day will be sent to the Bank or Credit Card Company at once.

In order to process the payment, Translink sends the Technical Debit Card or Credit Card Data and the Reference Number to the Bank or Credit Card Company.

If the payment is successful, an entry will appear on your digital or physical bank account statement and you will receive your unique Reference Number for each day that you travel. A Reference Number is preceded by the letters 'NLOV'. You can find your digital account statement by logging on to your secure banking environment.

Contrary to the above, your outstanding balance is settled during the Travel Day if it exceeds a certain capped amount to be determined by Carriers. The fare due will then be debited directly from your bank account or spending limit. After successful payment, any subsequent trips you make will be charged at the end of the Travel Day, unless you reach the cap amount before the end of the day. In addition, journey fees from virtual Mastercard Payment Cards (on your mobile phone and smartwatch) are also being temporarily charged per journey instead of at the end of the Travel Day.

Summary Reports

Translink records all check-ins and check-outs in the GBO, pieces together your trips and determines the fares. Translink works with EMS, a payment solutions provider, and your Bank or Credit Card company to handle payment for trips you make with your Payment Card or Credit Card. Translink also ensures that NS and the other Carriers receive payment for the trips you make every day.

Each Carrier receives daily summary reports from Translink to verify the accuracy of their own transactions and payments. These reports contain transactions (e.g. every check-in or check-out), journeys (paired check-ins and check-outs) and payments within the domain of the Carrier in question.

Unsuccessful payments

If a traveller is unable to pay, for example because their balance or spending limit is too low, Translink will temporarily block the travel feature on your Debit Card or Credit Card. You will then no longer be able to travel by public transport with your Debit Card or Credit Card until the outstanding amount is paid.

Over a period of 62 calendar days, repeated payment requests will be made by the GBO to debit the amount due from your account or spending limit. If the payment is successful, the temporary block will be lifted.

You, as traveller, can also pay the due amount during this period or after it. You can do so by tapping your Debit Card or Credit card on a card reader on the check-in/check-out device of any Carrier. A payment request will then be made via the GBO to your Bank or Credit Card company. If the payment is successful, you will be able to travel using your Debit Card or Credit Card around 15 minutes later.

Temporary travel block

You can check whether you have temporarily been blocked from travelling with your Debit Card or Credit Card by tapping it on a Carrier’s card reader and checking the message on the display or by contacting OVpay customer service.

If you are unable to travel with your Debit Card or Credit Card, you can always use another Ticket to travel by public transport.

C. Service

We understand completely that you may have questions about matters such as a journey, costs that have been charged, or a missed check-in or check-out. You may also want to view the journeys you have made over a recent period. You can check by requesting your travel history via the OVpay website, OVpay app and OVpay Customer Service. The OVpay app has its own privacy statement; you can find it in the OVpay app or OVpay website under 'Privacy'. It is also possible to link your Debit Card or Credit card to your MijnNS account in order to receive service and information for journeys made on NS. For any questions you may have about NS services, you can also contact NS Customer Service.

In order to help you, you will need the Reference Number and the amount debited from your account. We do not know your Bank Card or Credit Card number and we cannot search on the basis of your IBAN either.

A unique Reference Number is created for each payment made with your Debit Card or Credit Card. You can find the unique Reference Number for the trips covered by that single payment (usually linked to one Travel Day) on your digital account statement. If you share this Reference Number and the corresponding amount with another person or organisation, they can gain insight into the trips you have made.

App and website

You can link your debit or credit card to the OVpay App, which can be downloaded from www.ovpay.nl. First, you will have to create an account with your own password. Using a Reference Number and the corresponding amount, you will then be able to view your public transport trip history and payment history for the past 18 months. In your online account, you can see whether you've checked in or out, view the prices and payments for your journeys, the payment status, and any blocks on your Debit Card or Credit Card.

In a Carrier's account environment (web or app, if available), you will only be able to view trips made with that Carrier with your Debit Card or Credit Card, again for the past 18 months. You can also use the OVpay app to choose to receive notifications when you check in or out.

On the ovpay.nl website, entering a Reference Number and the corresponding amount will show you only those trips linked to that specific payment. You can also visit this website to correct a missed check-in or check-out with NS.

If your trip with NS was delayed and you used your Debit Card or Credit Card, and if you are eligible for compensation based on the ‘Delay Refund' scheme, then you can submit a refund request using the web form at ns.nl. Remember to include the Reference number and amount.

Customer Service

For questions about travelling with a Debit Card or Credit Card, please contact NS Customer Service or OVpay Customer Service. Customer Service employees do not have access to your Debit Card or Credit Card details or the details of your payment account.

An employee will always explicitly ask for your details if this is necessary in order to answer your questions. Depending on your question, we may ask you for your Reference Number and the corresponding amount.

D. Inspection

Everyone using public transportation is required to have a valid Ticket. If you check in with your Debit Card or Credit Card, your Ticket will be linked to that Debit Card or Credit Card through a digital record in the GBO. NS employees regularly perform ticket inspections in trains and at stops and stations. If an NS employee comes to check your Ticket, you must hold your Debit Card or Credit Card against the card reader. The Technical Data of your Debit Card or Credit Card will be read and used in accordance with PCI DSS.

In order for NS employees to be able to serve/help you, they will explicitly ask your permission. The NS employee can then view the last 10 actions performed with your Debit or Credit Card on their device (up to a maximum of 62 days ago). This data is displayed on the device for a maximum of five minutes and disappears the moment another Debit Card or Credit Card is held against the card reader.

Basis for Processing

If you check in and out using the Debit Card or Credit Card with NS, the basis for Processing Personal Data is performance of a contract. This concerns the transport agreement to which the Terms and Conditions of Urban and Regional Transport, the NS Terms and Conditions and the OVpay Terms Conditions for Checking In/out with your Debit Card and Credit Card apply.

The grounds for the notification settings for checking in and out are: your permission.

Automated decision-making

In two cases, decisions are made automatically; if a fare is due or if a Debit Card or Credit Card has been blocked by a Bank or Credit Card Company.

Fare due

Passengers must always pay the fare due. If your Bank or Credit Card Company cannot process your payment, the travel feature on your Debit Card or Credit Card will automatically be blocked temporarily. You will still be able to check out, but you will not be able to check in again.

If your Debit Card or Credit Card’s travel feature has been blocked because your balance or spending limit is too low, you will not be able to check in again with this Debit Card or Credit Card until your debt has been paid. Over a period of 62 calendar days, repeated payment requests will be made by the GBO to debit the amount due from your account or spending limit. You can also pay yourself by tapping your Debit Card or Credit Card on any Carrier's card reader. Although the check-in will be rejected (and you will see an error message on the display), another attempt will be made to debit the amount. If this attempt is successful, you will be able to check in again after about 15 minutes and continue your journey.

You can object to this automated decision in which your Debit Card or Credit Card is temporarily blocked. You can do so by contacting OVpay customer service. They will determine why your Debit Card or Credit Card has been blocked, and will remove the block if appropriate.

A Debit Card or Credit Card blocked by a Bank or Credit Card Company

If a Debit Card or Credit Card used on public transport has been flagged by a Bank or Credit Card Company as stolen or missing, or if the Card has been temporarily blocked by the Bank or Credit Card Company for any other reason, the Card’s travel feature will also be temporarily blocked automatically.

This is also part of the general terms and conditions for the use of your Debit Card or Credit Card as agreed with your Bank or Credit Card Company.

The Carriers and Translink cannot change this temporary block. For questions about this, please contact your Bank or Credit Card Company.

Who are the Data Controllers? What do we use your personal data for?

Your Personal Data is Processed by: NS and Translink. NS, the other Carriers and Translink are jointly responsible for processing Personal Data relating to travel using your Payment Card or Credit Card, for the following processes and associated Personal Data: