Privacy

Reisbalans respects your privacy.

To be able to serve you to the best of our ability, we need your personal data. As we highly value your privacy, we will handle your personal data with care. Below, you will find our privacy statement.

 

Reisbalans B.V. Privacy Statement

Personal Data Processing

Your privacy is important to us. This statement forms the basis for the processing by Reisbalans B.V. (hereinafter: “Reisbalans”, “we”, “us” or “our”) of all the personal data that we collect from you or that you provide to us. Please read the following statement carefully to learn how Reisbalans handles your personal data.

The term ‘Personal Data’ refers to any information about you personally (name, vehicle registration number, telephone number, email, etc.). Please remember that our privacy policy is subject to change due to both amendments to the law and the ever-changing nature of technology. Whenever any changes occur, we will update our Privacy Statement without notice to you. The most recent version of our Privacy Statement will apply. Therefore, we recommend that you review this statement on a regular basis.

We process personal data with the utmost care in accordance with the GDPR (General Data Protection Regulation). The basic principle for processing is that any data being processed must be adequate, relevant and not excessive.

Who is responsible for the data?

Reisbalans, having its registered office in Amersfoort, the Netherlands, is the Controller for the Processing of your data. This statement will apply to the collection and, more in general, the processing of personal data by Reisbalans, the key purposes of which are the processing of payments and the provision of Reisbalans mobility services.

Retention period

We will not retain the personal data collected by us any longer than is necessary for the purposes for which such personal data were collected, and for a maximum period of 18 months following expiry thereof, unless provided otherwise in this Privacy Statement. After expiry of the retention period referred to above, all your personal data will be deleted, unless the data must be retained for a longer period of time in connection with legal obligations. Deletion implies anonymising, destructing or redacting personal data so that they are no longer personally identifiable.

What data are collected and for what purpose?

You may provide information to us by completing forms on our website(s) or through your employer, by using our website or our app, by contacting us by telephone or by email, by using third-party services, or otherwise. Such information includes information that you provide when you register on our websites, use third-party mobility services, send us a request, contact our customer service, enter into an agreement for the provision of services, participate in promotions or surveys, and when you report a problem with our website. The personal information that you provide and that is necessary to enable us to provide you with our services and/or our reply, may include your name, address, email address, telephone number, trip data (location, time, provider, customer number), and bank details. We will not use your personal data for any purposes other than those described in this Privacy Statement. In no event will we sell your personal data.

More specifically, we will need to collect information from you in the following situations in order to comply with, change or update your request for the provision of one or more mobility or other services.

Inviting you as Data Subjects for our services

To enable you to enter into an agreement with Reisbalans, we will, on the instructions of a third party (usually your employer), send you an invitation by email containing a unique registration link. You can use such link to register.

This data will be used on the basis of a legitimate interest. We will retain such data for a maximum period of 3 months following receipt from your employer.

Entering into an agreement

Before you can use the Reisbalans services, you will enter into an agreement with Reisbalans. You will enter into such agreement during the registration process at mijn.reisbalans.nl or *company name*.reisbalans.nl. To enable us to prepare and administer such agreement, we will process your contact details, personal information, and login credentials.

This data will be used on the legal basis of performance of the agreement. We will retain your data on our website for a maximum period of 18 months following termination of the agreement.

Entering into a billing relationship

If we enter into a billing relationship with you, Reisbalans will need your account details, such as personal information, name and address details, and bank account number.

This data will be used on the legal basis of performance of our administrative duties. We will retain this data for a maximum period of 10 years following the date of the invoice.

Creation of a personal user account in the secure environment of our website

In some situations, where you wish to use the Reisbalans services, you may need a personal account in the secure environment of mijn.reisbalans.nl or *company name*.reisbalans.nl. For purposes of such account, we will need certain information from you, such as your contact details, date of birth, passport photo, residence, password, work location, travel history, and email address.
If you have been provided with the Reisbalans service by a third party (such as your employer), we will, where possible, use your business contact details.

The basis for the processing of this data is the performance of an agreement. We will retain your account data on our website for a maximum period of 18 months following termination of the user account.

Activation and use of third-party transport services

Your personal account allows you to activate and administer third-party services. Such third parties may include Greenwheels (car sharing), OV-Fiets (bike sharing), RC-BKA (public transport), Transvision (taxi), and Yellowbrick (parking). For the proper performance of such third-party services within Reisbalans, we will need to share your data with such third parties. If you use third-party services through mijn.reisbalans.nl or *company name*.reisbalans.nl or our app, we will share data with the relevant third party or parties.

We implement safeguards to avoid any infringement of your privacy. For example, we only share data with third parties that such third parties need to provide their services. In some cases, this may only be your customer number; in other situations, your name and contact details will be shared. We receive travel information and trip data from third parties, such as location, data, provider, and price of a travel transaction. A list of third parties can be found on the Reisbalans website.

These third parties will act vis-à-vis you as independent Controllers. By using any such third-party services through Reisbalans, you agree to the terms and conditions and the privacy statement of the relevant third party or parties. We only do business with parties strictly selected by us, which meet stringent privacy requirements. Nevertheless, upon receipt of your data, the relevant party is the Controller. We will not be responsible for their content, privacy and security practices, and the policy of such third parties with which we share data. We recommend that you review the privacy and security practices and policy of the relevant third parties before providing data to them. You will find those on the website of the relevant third party, or they may be available on request from such third party.

The basis for sharing data with third parties is the performance of the agreement. We will process your data from external parties for a maximum period of 18 months following termination of your user account. The retention period applicable to the third parties can be found in the relevant third party’s privacy policy.

App use and trip registration

Our apps can be linked to your mijn.reisbalans.nl or *company name*.reisbalans.nl. If you choose to do so, we will use your contact details, travel history, card details, travelling credit, transaction data, location data, device data and OS data in the app.

After you install and log onto the app, we will exchange data between the app and mijn.reisbalans.nl or *company name*.reisbalans.nl. The app allows us to provide you with travel advice and send you push notifications on validation of trips, and allows you to register your trips and contact the Reisbalans customer service. In addition, the app allows you to view your travelling credit and travel history, and to register your trips. Trips are registered based on location determination (telephone signal, WiFi and/or GPS) of your mobile device. You will be asked for approval before location determination is switched on. You may at any time switch your location determination on or off.

Automatic trip registration will automatically register your trips, so that you need not enter your trips manually. These records will be used to prepare new expense claims. You will find them in the cost overview as soon as they have been processed. Automatic trip registration uses your location in the background when the app is not in use.

The basis for the processing of this data is the performance of an agreement. We will retain App data for a maximum period of 18 months following termination of the user account.

Private use

If permitted by your employer, the mobility services offered through Reisbalans may be used for private purposes as well. Transactions for private purposes will be confirmed by you in the Reisbalans portal or app under purpose of travel ‘Private’.
In terms of settlement of these transactions, two forms are used here: settlement through payroll or direct settlement between yourself and Reisbalans. In the event of direct settlement between yourself and Reisbalans, a payment agreement will be concluded between yourself and Reisbalans.

Private use through a direct billing relationship between yourself and Reisbalans will be made available by your employer, but can only be activated by you. If you wish to use this service, you will grant Reisbalans B.V. a direct debit mandate through the payment provider Twikey B.V. To that end, Twikey will process personal data, namely: name, address, residence, IBAN and signature.

By using this service, you accept the Twikey Privacy terms and conditions.

If you fail to pay your invoice, Reisbalans may shift the payment obligation to your employer. In such event, we will need to share your email address in combination with the total amount outstanding with your employer.

You may at any time adjust the bank details provided by you in connection with the direct debit mandate.

The basis for the processing of this data is the performance of an agreement. We will retain the billing data for a maximum of 2 financial years of data history. The retention periods for the data that you share with Twikey can be found in the Twikey Privacy terms and conditions.

Missed check-out

You may forget to check out or your check-out may not be properly registered by the transport provider with which you have travelled. If your employer has instructed us to do so, we will automatically try to correct your trip. To that end, we will share your public transport chip card (“OV chip card”) number, the end date of your card, the date of the incomplete trip, the check-in and the check-out stop as calculated by us, the transport provider, and the amount of the claim using uitcheckgemist.nl, a service offered by the joint public transport providers in the Netherlands. For such purpose, we use software that is developed by TMP. Thus, TMP will receive the aforesaid personal data as well.

The basis for the processing of this data is the performance of an agreement. We will retain travel data for a maximum of 2 financial years of data history. TMP will delete your data as soon as the result of the request has been fed back to us. For the way in which uitcheckgemist.nl handles your data, please refer to the uitcheckgemist.nl privacy conditions.

Customer contact and (electronic) messages

To enable us to answer your questions or provide you with assistance, we may, at times, need to use your data. This data have been provided to us by you. They may include your contact details, your trip data or your device data. In some situations, for example in the event of remote assistance, we may also need to view your personal mijn.reisbalans.nl or *company name*.reisbalans.nl environment together with you. For purposes of handling complaints or requests, we may need to use your bank details.

We may send you messages without your consent of a non-advertising nature, such as messages about purchases, administration, changes to, or termination of, services, or about the use of third-party services, for example in the event of changes or emergencies.

The basis for the processing of this data is the performance of an agreement. We will retain your customer contact data and electronic messages for a maximum period of 18 months following termination of your user account.

Reports

For purposes of preparing reports and conducting statistical research, we will use aggregated data, for example travel data, where possible. For reports to Reisbalans management, we will not use any names, email addresses or other directly identifiable information. Names and contact details will, however, be used for reports to your employer.

The basis for the processing of this data is the performance of an agreement and the protection of Reisbalans’ legitimate interests. We will retain reports for a maximum period of 18 months following termination of the agreement.

Improvement of Reisbalans

Reisbalans is continuously improving its services and your user experience. To improve our services, your data is analysed. This may include travel data, website and app visits, systems and account data.

The basis for the processing of this data is the protection of Reisbalans’ legitimate interests. We will retain this data for a maximum period of 18 months following termination of your user account.

Keeping Reisbalans safe

With a view to fraud prevention and detection, we may use your contact details and travel data. Furthermore, for security purposes, we may use your account and systems data as well as your IP addresses.

The basis for the processing is the protection of Reisbalans’ legitimate interests. We will retain your data for a maximum period of 18 months following creation of the data. In the event of fraud or unauthorised access, we will retain the data for a maximum period of 10 years following the time of the incident.

To whom do we disclose personal data?

We may provide you with the personal data relating to you. We will share your data with the following category of recipients:

  1. We will disclose personal data to (the representatives of) the organisation (often your employer) which, or the private individual who, has granted you the right to use Reisbalans. Please note that the use of our services will result in a file containing personal data based on which decisions may be made on the use of Reisbalans by such organisation or private individual. For example, the relevant organisation or private individual may view your travel history containing location, time and means of transport.
  2. We are under the obligation to disclose your personal data if required to do so by law for any reason whatsoever.
  3. We will share data with third parties acting as Controllers. See ‘Activation and use of third-party transport services’.
  4. We may disclose your personal data to Processors within the meaning of the GDPR. These are service providers performing work on our instructions. Personal data will not be shared with partners unless we deem a partnership with the relevant partner necessary for purposes of our business operations, the proper and safe provision of our services, or the development of future services. When we work together with partners, we, as the Controller, ensure that personal data are properly and carefully processed by such service providers in accordance with the GDPR. The following types of Processors may be involved:
    1. Hosting parties
    2. Customer service software
    3. Analysis software
    4. Security software to keep our services safe
    5. File sharing
    6. Research software and services

As indicated earlier in this document, we will not use your personal data for any purposes other than those described in this Privacy Statement. In no event will we sell your personal data.

Data storage

We will store your personal data within the European Economic Area.

Links to third-party websites

Our service may contain links or refer you to other websites, apps and advertisements from third parties, which may keep information about you. We do not control any such websites or their activities. All data, including personal data, that you provide to any such third parties will be provided directly to, and will be subject to the privacy policy of, the relevant third party. We will not be responsible for its content, privacy and security practices, and policy of any third parties to which we link or refer. We recommend that you review the privacy and security practices and policy of the relevant third parties before providing data to them. You will find those on the website of the relevant third party, or they may be available on request from such third party.

Security

For purposes of protection of your personal data, we have implemented physical, technical and organisational measures. We will use our best efforts to maintain full reliability, accuracy and completeness of all personal data in our databases and to protect the privacy and security of our applications and databases. We have in any event implemented the following measures:

  1. We have implemented physical and technical measures and management procedures designed to prevent unauthorised access, loss or abuse of personal data to the extent possible;
  2. Sensitive information or personal data, such as account passwords and other payment-related identifiable information, are transmitted in encrypted form;
  3. Sensitive information (including your password) is stored in encrypted and/or hashed form where possible; we limit internal access to personal data to employees who need such information in the performance of their duties;
  4. Our employees are bound by a confidentiality clause;
  5. Our information management systems are set up so as to prevent employees who are not authorised to view certain information or personal data, in principle, from accessing such information;
  6. Our servers are set up in a secure environment in data centres. You will only have access to the front-end of our servers, and only by logging on with a user name and password. You are responsible for safekeeping of your login credentials;
  7. Personal data is backed up on a regular basis.
Seven rights

Of course, personal data that we use is, and will remain, your property. Therefore, you have the right to view, adjust, erase or restrict the data that we keep about you or transfer same to someone else. In some situations, you may do so through mijn.reisbalans.nl or *company name*.reisbalans.nl, or you may use the application form on the service page. You may submit the following requests to us:

  1. a request for data portability based on the right that you have to transfer personal data to another party;
  2. a request for erasure, exercising your right to be ‘forgotten’;
  3. a request for access, based on your right to view the personal data that we process about you;
  4. a request for rectification and supplementation, giving you the right to correct personal data processed by us;
  5. a request for restriction of processing, exercising your right to have fewer personal data processed about you; and
  6. an objection, exercising your right to object to data processing.

Upon receipt by us of your written request, we will ask you to further identify yourself, so that we can be certain that we do not disclose your personal data to others. Subsequently, we will provide you with a summary of all personal data that we keep about you and/or correct, change, export or delete personal data. Your request will be handled within 30 days. Please note that your request may have consequences for your use of our services.

Questions or complaints

Anyone has the right to submit a question or complaint to us about the processing of their personal data by contacting us in accordance with the following procedure. If you wish to correct your data, if you have a question, or if you object to our processing of your data, you may send us a message. We, Reisbalans, have our registered office and principal place of business at Utrechtseweg 15 in 3811 NA Amersfoort. Our service desk can be reached by telephone at +31 (0)88 – 934 3456 or by sending an email to info@reisbalans.nl.

For complaints about processing of personal data or for handling complaints regarding processing of personal data by Reisbalans, you may directly contact the Dutch Data Protection Authority, by telephone at +31 (0)88 18 52 50, or via: https://autoriteitpersoonsgegevens.nl/nl/zelf-doen/privacyrechten/klacht-indienen-bij-de-ap.

The mobility card is provided by RC-BKA. RC-BKA is a division of the Mobility Invest Group, of which Reisbalans is a division as well. Click here to view the RC-BKA privacy statement.