Personal data protection

Here you can find information on how we process your personal data, and how you gain access to information we have about you.

You are not required to provide personal data in order to travel with us. You may travel anonymously if you prefer.

What is personal data

Personal data is data and assessments that can be linked to you as an individual.

How we process personal data

All personal data that you provide to Ruter will be stored in a proper manner and treated as confidential information. Data is stored only for the length of time required to process your case or perform the service in question, and we store no more than necessary data. Details on how long we store the data is provided in the information for the various services below.

The processing of personal data is subject to the current Personal Data Act and the General Data Protection Regulation (GDPR). Our internal procedures for processing personal data are in compliance with the Personal Data Act. Here the requirements to information security and internal control are met.

The Personal Data Act at Lovdata.no (In Norwegian)

Your privacy in the Ruter app

More on how we treat your privacy

Data controller

Ruter, care of the CEO, is the data controller for your personal data when you travel with us and use our services.

Ruter processes your personal data in accordance with the Personal Data Act.
To process your personal data, Ruter uses data processors in the areas of IT operations and support, debt collection, IT development, security services in ticket inspections, etc., in addition to invoicing and collection services. Some of Ruter's data processors use cloud services, but processing will take place within the EU/EEA. All data that can be linked to you is encrypted, and the encryption key is unavailable to the data processor in question.

If you travel with or use the services of other companies we cooperate with, this company will be the controller of your personal data.

Your rights

Ruter has a Data protection officer to ensure that the customers' rights are upheld.

Pursuant to the Personal Data Act and GDPR article15-22, you are entitled to:

  • access your data.
  • demand that incorrect data is corrected.
  • demand that your data is deleted if you withdraw your consent for processing, or if Ruter does not have the legal basis for further processing. If you choose to have data related to you deleted, it may mean that we no longer can provide you with supplementary services, but you may continue to travel with us.
  • request restrictions in the processing of your personal data if you e.g. believe they are incorrect. You may do this up to the point the disputed data are verified as correct. You are also entitled to request that the personal data is stored until you have settled a legal claim.
  • have your data transferred in a machine-readable format to a new data controller, for example if you move from Oslo and Akershus.

Request access

If you want access to data concerning you, you must submit a request in writing, either by post or by using the contact form. You may also contact our customer centre. To protect your privacy, you will receive information that identifies you at your postal address.

In addition to the registered personal data you have the right to request access to the following:

  • The purposes of the processing.
  • What type of personal data is processed.
  • The recipients or categories of recipients the personal data has been or will be delivered to, especially recipients in third countries or international organisations.
  • If possible, how long it is expected that the personal data will be stored, or if this is not possible, the criteria used to determine this period.
  • The right to request that the data controller corrects or deletes the personal data or limits the processing of the personal data concerning the data subject, or to protest against the named processing.
  • The right of appeal to a supervisory authority.
  • If the personal data has not been collected from the data subject, all accessible information about where the personal data originates from.
  • The existence of automated decisions, including profiling and relevant information about the underlying logic as well as the significance and the expected consequences of such processing for the data subject.

You may request access using a contact form or by contacting us by telephone or post.

Privacy Contact Form

Address and phone number to the customer centre

Postal address if you wish to send a request for access by post:

Ruter As
P.O. Box 1030
N-0104 Oslo

Ask questions or complain

If you have any questions or wish to complain about the processing of personal data, contact Data protection Officer You are also entitled to appeal the processing of personal data to the Data Inspectorate.

Contact Ruter’s Data protection Officer  at personvernombud@ruter.no.

The consequences for your rights and freedoms

Processing has little impact on your privacy. As a customer you may always travel anonymously with us, and we process your data to provide the desired services and follow up our transport agreement with you. As a rule, no sensitive data is processed, except in cases concerning school transport.

The data is submitted and relayed via a secure line and is stored with restricted access. Procedures have been established for different processing of personal data to ensure that your rights are safeguarded. Data Privacy Impact Assessments (DPIA) have been carried out for electronic ticketing, with acceptable results.