Your rights
The General Data Protection Regulation (GDPR) provides rules for the processing of personal data. NS treats its travellers' and current and former employees' data with care. The personal data we use is, and remains, your property. This means you also have the right to view, change, delete, limit or transfer to someone else any of your data that is in our possession. In some cases, you can do that via Mijn NS or the request form. These rights are not absolute. When you complete the form, NS uses the data that you provide to verify your identity and to prevent your personal data being disclosed to the wrong person. Your request will only be processed after we have verified your identity. In some cases, you may be asked to provide additional information to verify your identity.
Right of inspection
Want to know which data we process? You can always request an overview from us. We will then tell you, among other things, what we use the data for, how long we store it and what you can do if the data is inaccurate. You can view some of your personal data via Mijn NS. If you do not yet have a Mijn NS account (or a Mijn NSI or Mijn NS Zakelijk account), you can create one now.
If you would like to view more data than is available in Mijn NS, then you can submit a request to inspect your personal data using the request form. Naturally, we have to be certain that we are providing the right person with the personal data. Therefore, please include your data that is known to NS.
Correcting or supplementing your data (rectification)
If the data we are using is no longer correct or is incomplete, you can easily correct some of your personal data yourself through Mijn NS. If you do not yet have a Mijn NS account (or Mijn NS Zakelijk), you can create one now. If you would like to correct data that is not available in Mijn NS, then you can submit a request for rectification using the request form.
Deleting your personal data (erasure)
Under certain circumstances, you may request that we delete your data from our system by filling in the request form. As a consequence of this, we will no longer be able to provide you with our products and services.
Objecting to the processing of your data
In certain situations, you may object to the processing or further processing of your data, for example, on the grounds of your personal circumstances. You can indicate this using the request form. We will evaluate your request and then inform you of how we can accommodate it.
Temporarily pausing the processing of your personal data (restriction)
To temporarily pause the processing of your personal data, please submit the request form.
Transferring your data (data portability)
If you wish, you can receive a copy of your data that is in our possession. You can transfer this data yourself, or request that we do so. Please use the request form to ask for this, and to let us know your preference.
Opting out of the use of travel data for analytical purposes
We are keen to maintain our relationship with you. If we do this for the purpose of marketing related to monitoring passenger growth and passenger distribution, we have a commercial interest in using certain derived travel data. We call this travel data 'Maandtellers'. 'Maandtellers' are data relating to travel frequency, time since most recent journey, travel during peak/off-peak hours, preferred routes, preferred stations, OV-fiets, storage on account, and travel yield. We use this data for analyses aimed at identifying trends, so we can adjust our products accordingly. By linking this information with individual travel information, we can achieve better business results and improve customer satisfaction. We use aggregated or anonymous data for the analyses wherever possible. The data we use only tells us something about your travel behaviour. We can't use this data to 'track' you. If you do not wish your pseudonymised travel data to be part of these analyses, you can let us know by means of the request form. You will only receive offers based on your travel data after you have given NS consent for this.
We will consider your request in accordance with the General Data Protection Regulation. We will inform you of any actions undertaken regarding your request as quickly as possible, and within one month of the receipt of your request and all required data. We may extend this period by two months due to the complexity of your request or the number of requests received. In that case, we will inform you of the need for an extension within one month of the receipt of your request.
Submitting a complaint
You retain the right to submit a complaint to the Dutch Data Protection Authority at any time. If a DDMA (Data-driven Marketing Association) Code of Conduct applies, you can lodge a complaint with the DDMA Privacy Authority.