Privacy Policy for the Company Portal
What is the company portal?
The Business Portal is an administration solution where companies can easily purchase and manage both corporate tickets and regular tickets for their employees. As an employee of a company that has an agreement with Ruter for access to corporate tickets, you can easily register as a user.
In the portal you get a complete overview of order history, and you can set up a dedicated access that allows employees to order corporate tickets themselves. For Oslo schools, the Corporate Portal is also used to purchase and manage annual school passes for students who are entitled to school transport by public transit.
Ruter is responsible for processing your personal data in the corporate portal.
Purpose
The purposes of processing personal data about you as a user of the service are:
- to be able to offer the corporate portal for managing the purchase, distribution and administration of tickets, and access to other services offered by Ruter
- to gather insights by analyzing information about your use of the website in order to improve the site.
Legal basis
The legal basis for processing personal data is Ruter’s and your employer’s legitimate interest in fulfilling the agreement on corporate ticket purchases.
To collect insights and statistics about your use of the website, the legal basis is your consent to the processing.
What personal data do we process?
In order to offer the corporate ticket, it is necessary to process the following information:
- Information such as name, email and phone number about you as a user of the service for the company, your role, and a parameter to identify the end user that the company itself specifies, e.g. employee number or similar.
- The user's actions in the system and completed order
- We use the analytics tool Amplitude, where we typically process information about how you use the website and which buttons you click.
- When analyzing in Amplitude, we replace your IP address with a shared IP address.
- When a purchase is made in the app, or if you as a user of the website log in to your Ruter profile, it is possible to link the time of purchase, the specific amount, or the login with information generated about purchases or logins in other internal systems. There is therefore a theoretical possibility of identifying you as a user of the service, but we will not do this in practice.
How are the data stored and deleted?
Personal data is anonymised/deleted in the following way:
Information about you as a user of the company portal for as long as you are registered as a user.
Your IP address is processed only for a few seconds, then replaced with a shared IP address and therefore not stored further. Analytical data about the use of the website is stored for 3 years.
In Amplitude, such data cannot be linked to you/the user. For analytical purposes, Ruter will also not link data about your use of the website to information such as name and contact details.
For IT-utvikling og drift av tjenesten, benytter Ruter selskapet Tet digital som databehandler.
Se ellers beskrivelsen under RuterProfil for informasjon om tilganger og
bruk av skytjenester.
Dersom det legges inn opplysninger om sluttbruker som f.eks. ansattnummer så kan sluttbrukere lese mer om behandling av personopplysninger i personvernerklæring for Ruters bedriftsbillett.
Klage til Datatilsynet
Du har rett til å klage på det du mener er ulovlig behandling av personopplysninger til Datatilsynet, men ta gjerne kontakt med oss først via vårt personvernombud på, personvernombud@ruter.no