Privacy policy for Vygruppen AS
The privacy policy applies to anyone purchasing travel services from us or using vy.no, vy.se or the Vy app. Here you can read about our data protection principles and your rights.
When you use our services, the data controller is:
The Vy Group is a mobility group with a number of companies supplying various travel services, including rail and coach services. The companies in the Vy Group have a shared group customer register for best administration of customer relationships and coordination of service offerings from group companies. The companies in Vygruppen share responsibility for the processing of the information in the register.
Our privacy principles
- We process personal data lawfully, fairly and in a transparent manner.
- We only collect personal data that are relevant for our customer’s travel and relationship with us.
- We do not collect more personal data than necessary.
- The personal data we collect is up-to-date and accurate.
- The personal data we collect is erased when we no longer need it.
- The personal data we collect is treated confidentially.
- We never sell personal data to third parties.
- Our customers have a right of access to personal data linked to their customer relationship. Customers must be able to receive a copy of this data, and they can opt to have it erased from our systems if we do not need it for compliance with legal requirements, for example.
When do we process personal data?
Vygruppen AS sells and provides mobility services through our channels (including vy.no, vy.se and the Vy app), while also acting as a carrier for rail services on individual routes.
The Vy Group is otherwise made up of a number of other companies supplying various travel services, including rail and coach services, which are also sold via the Vygruppen AS channels.
We also provide services from other stakeholders and partners, including rail, coach and taxi companies, on vy.no, vy.se and in the Vy app.
We may also receive data when a third party sell tickets where Vy is the carrier, such as travel agencies or other carriers. In that case, we may process the data we receive as part of the partnership and that is necessary so that we can provide the service or communicate with regard to any discrepancies.
What are my rights?
You have the right to know if we process your personal data. If we process your data, you have the right to view information about what personal data we process and how we process it. You also have a right to receive a copy of the data that we process.
If we process personal data based on consent that you have provided or in order to fulfil an agreement that we have made with you, you have the right to take the data that you yourself have given to us: this is known as data portability.
Many people who travel with us choose not to create a Vy profile. If you travel with us but do not create a Vy profile, you cannot use the Vy app or My account on vy.no to request access, changes or erase, or to download your personal data.
You can demand that we correct information about you if it is defective or incorrect. You can also demand your Vy profile be erased.
You have the right to request that the processing of your personal data be restricted, for example if you believe the processing does not comply with applicable laws and regulations, or that the information is wrong.
You always have the right to object to our processing of your data for direct marketing purposes.
You can demand that we stop processing personal data about you based on your legitimate interests, unless our legitimate interests outweigh your interests with respect to the processing.
You can also refuse to allow your personal data to be used for direct marketing by withdrawing your consent.
How do we use your personal data?
Your personal data is mainly used to offer you mobility services from Vy and other partners, provide you with good customer service, or refunds/compensation when you are entitled to these. We also use your information to improve and personalise our services and marketing to ensure you have the best possible customer experience. Below you will find a list of our various processing activities and the information we may process during each activity.
When you buy a ticket or other travel services from us, we enter into an agreement with you. To be able to fulfil our part of the agreement, we have to have information about you and whatever you have purchased. We process data about your active and planned trips so that you yourself can amend any trip you have purchased.
We may use data such as your name, contact details, customer number, payment information and sales and travel history in this respect.
If a purchase is made without a customer profile:
You can also buy tickets and other travel services at vy.no without being logged in with a customer profile. You can opt to have your ticket delivered to you email as a PDF or you can download it to the Vy app. In this case, we initially process only data relating to your email address and payment information in connection with the purchase. This data will not be linked to a customer profile or be used for marketing or profiling activities.
If you buy tickets and travel services without a customer profile, however, this may mean that we will be unable to alert you if there are any problems with your transport.
In some cases, our suppliers and partners will require information to be provided about the names, ages and date of birth of passengers in order to prevent misuse of tickets. If our suppliers and partners require this, we will also ask for this so that we can implement the agreement between you and the supplier/carrier.
You can easily create a customer profile with us. We use data such as your name, contact details and customer number when creating a profile.
We also want to make it easy for you to adapt and administer your customer profile on My account. You can therefore also add information on payment methods, your favourite route and ‘My tickets and trips’ in your customer profile.
We also process information on your active and completed trips so that you can easily administer your purchases in My account.
When creating and administering your customer profile, we may use data such as your name, contact details, customer number, payment information, ‘My tickets and trips’, favourite routes and sales and travel history and how you use our products and services. This is necessary so that we can fulfil our agreement with you concerning the creation, administration and use of your customer profile.
The Vy Group is a mobility group with a number of companies sharing a group customer register.
The Vy Group consists of:
- Vygruppen AS
- Vy Tog AS
- Vy Buss AS
- Vy Gjøvikbanen AS
- Vy Mobility AS
- Vy Tåg AB
- Vy Buss AB
The purpose of the group customer register is to manage customer relationships and coordinate the provision of services from the different companies in the group.
The group customer register contains general profile data about you such as your name, contact details, customer number, payment information, search, sales and travel history and how you use our products and services.
Vy has a legitimate interest in managing customer relationships and coordinating the provision of services from the various companies in the group.
The companies in the Vy Group share responsibility for the processing of the information in the register.
As a customer, you can exercise your rights in respect of any of the Vy Group companies at any time.
Vy wishes to make its services, marketing and information more user-friendly and targeted. We want your experience with us to fit in with your personal preferences and needs. To do this, we use data about how you use our website and app. We link this together with other data we have received in connection with the customer relationship in order to create models and perform analyses that make it possible to understand your preferences, and through this to communicate targeted content to you.
When we do this, we may create new data about you, and at the same time we will place you in a group with other people who are in a similar situation or who we think have preferences similar to yours. We may also use partners to perform such analyses and create such models.
The results of these analyses and the data are used primarily for marketing purposes: see below. When you later view a website displaying our ads, for example, we may adapt our ad so that you see an ad that is relevant for you. We may also send out marketing campaigns by email that are based on your grouping.
We may also use different partners to monitor how you interact with us, which ads appear to be of more interest to you and whether any of these leads to purchases. This will allow us to develop what we know about the groups we create and learn more about which ads and products are relevant to you.
Here, we may use data such as your name, contact details, customer number, payment information, search, sales and travel history and how you use our products and services.
Vy has a legitimate interest in using profiling to enable it to provide more relevant products and services.
You have the right to object to profiling. This will stop our profiling/personal adaptation of data and we will remove personal data that is necessary for this processing.
We use different forms of marketing to tell you about trips we think you may be interested in and to highlight the benefits of travelling with us. Such personalised marketing uses your customer profile data, search, purchase and travel history and how you use our products and services. This is because we want our marketing and the information you receive from us to be better and more relevant to you.
Our marketing is carried out in accordance with the requirements of the Norwegian Marketing Control Act. We will only send you marketing if you have consented to receive marketing, or in connection with an order that you have placed with us.
For this purpose, we may use data such as your name, contact details, customer number, payment information, search, sales and travel history and how you use our products and services.
We send out necessary information linked with your trips, such as your ticket, acknowledgement of your purchase, information on route changes and deviations. For this, we may use notifications by email or text messages, or notifications directly in the Vy app (push notifications). You can choose for yourself what kind of notifications you want to receive in the Vy app.
We may use data such as your name, contact details, customer number, payment information and sales and travel history in this respect. We do this in order to fulfil the agreement we have with you, and also to fulfil our obligations in accordance with applicable regulations relating to passenger rights.
We must process your personal data so that we can respond to enquiries from you as a customer by email, online form, letter, chat, telephone or social media, e.g. enquiries about orders, amendments, complaints, feedback and refunds. This is necessary so that we can fulfil our agreement with you concerning the purchase of our services.
We also process your personal data so that we can automatically handle your refund and/or compensation cases. This is done so that we can offer faster handling of such cases as part of our fulfilment of the agreement that we have with you as a customer and our obligations in accordance with applicable regulations relating to passenger rights. As a customer, you will always have the right to request that any such cases are processed again or processed manually.
We also need to check what you have done on vy.no, vy.se and in the Vy app in order to be able to respond to enquiries about these services, for example as part of troubleshooting.
For this purpose, we use data such as your name, contact details, customer number, account number (for payment), payment information, case information and sales and travel history and how you use our products and services.
Your feedback and input on our services is important to us. That is why we conduct market surveys, produce customers surveys that we send out when your journey ends, and contact customers directly to hear what they think about our services. Participation in our surveys is voluntary.
To conduct high-quality surveys, we use personal data to select those who will be contacted as part of a survey. We have a legitimate interest in conducting such surveys in order to provide you with new and improved services.
For this purpose, we use data such as your name, contact details, customer number, date of birth, case information, search, sales and travel history and how you use our products and services.
We are constantly working to improve our solutions. This includes troubleshooting and error correction. If you contact us to report a bug or to suggest improvements, we may collect your contact information and information about how you use our products and services. This processing is necessary for us to fulfil our agreement with you.
For this purpose, we use data such as your name, contact details, customer number, payment information, search, sales and travel history and how you use our products and services.
We only ask about access that is necessary so as to ensure that it works and to offer you a good user experience. The app must be given access to location data from your mobile so that we can show you the newest station, stop or recommended route, for example.
When you install the app and use it later, you decide whether the app is to be given access to your location. You can also withdraw this access in the settings for the app.
We process personal data in order to identify demand for new products and services and improve existing products and services.
We have a legitimate interest in developing the companies’ products and services.
To give you a better customer experience, we have created simple add-on services that we hope will make travelling with us easier and more pleasant. For example, we offer Internet access aboard our trains and coaches and entertainment via our rewards programme, Green Journey.
Separate terms and conditions are applicable to the use of these services. We do not process personal data beyond what is necessary to offer these services to our customers.
Vy works to protect you against unwanted or harmful use, cyber attacks, malware and the like in our services. This is done, for example, through server and system logs, access control and firewalls.
We have a legitimate interest in ensuring information and network security and in preventing fraud.
For this purpose, we use information about your equipment such as:
- Browser type as well as browser version and settings
- Internet connection information such as IP addresses
- Overview of when, where and how you use our products and services
A number of our trains and coaches are fitted with CCTV. The purpose of this monitoring is to protect life, health and property, as well as to prevent crime.
Videos are only played back if there are concrete suspicions that a criminal offence has occurred or if the police ask for access.
Recordings are deleted in accordance with automated deletion routines and are not retained beyond what is necessary for the purposes at all times, and not for more than seven days. Video recordings may be retained for longer if there is specific suspicion that the law has been broken.
Our trains and coaches fitted with CCTV are labelled as such.
Vy Group companies have a legitimate interest in processing data in this way.
We only share your personal data in the following cases:
- With third parties, when part of the order includes services supplied by a third party, such as other carriers and/or suppliers of mobility services sold or supplied via Vy channels.
- With third party suppliers performing tasks or working on behalf of or at the instruction of Vy, and for the purposes specified in this privacy policy such as system suppliers and providers of payment services.
- With public authorities where so required in accordance with the law or enforceable decisions from authorities.
We may also share aggregated data with our business partners and group companies to improve our services and analyse such data.
Your data may in some cases be transferred to partners or other parties located outside the EU/EEA. In this case, we take necessary precautions to ensure that your data is protected in line with applicable personal data regulations.
We do not store your personal data for longer than necessary. We will retain your profile information for as long as you have an active customer relationship with us. Your profile will be deleted automatically if it is not used for three years.
Purchase and travel history is normally deleted after 410 days. Storage of purchase and travel history data in this period is necessary so that we can protect our interests in the event of any complaints.
In some cases, we may retain data beyond this where necessary in order to protect their interests in the event of any complaints or if we are required to do so in accordance with accounting and bookkeeping legislation.
Green Journey marketing
As a member of Green Journey, you will receive news, offers, travel tips and other customised information from Vy.
We may use data such as your name, contact details, customer number, payment information, search, purchase and travel history and how you use our products and services for marketing purposes.
Environmental footprint calculation
Green Journey provides you with an overview of how much CO2 you have used and saved by travelling with Vy this year. We use your customer number, order numbers, and the start and end stations for your completed journeys, as well as your mode of transport, to calculate your environmental footprint. The basis for the calculation is retained internally by Vy.
Entertainment
Members of Green Journey have access to entertainment content via the Vy app, including daily newspapers and selected audiobooks and podcasts. We share anonymised data about the number of downloads with our suppliers and other members of our corporate group to enable us to further develop our services and carry out analyses on the data.
Opting out
Do you have questions about privacy?
- Wondering what personal data we collect about you as a customer, or want us to erase something about you? Log in to My account.
- Please contact Customer Service for enquiries about our processing of personal information.
- Please get in touch with our Data Protection OfficerExternal link if you are unhappy with our processing of personal data. The Data Protection Officer is tasked with ensuring we comply with the Norwegian Personal Data Act.
- You also have the right to complain about our processing of personal data to the Norwegian Data Protection Authority. More information is available from The Norwegian Data Protection AuthorityExternal link, or you can send an email to postkasse@datatilsynet.noExternal link
- You can also contact us at:
Vygruppen AS
Company registry number 984 661 177
Schweigaards gate 23
0191 Oslo
We need to update our privacy policy as we develop new products and services. If we make major changes to our privacy policy, we may also contact you by email or other channels, for example, to notify you of the change.