KLAPP Data Protection Policy

Strætó bs., Hestháls 14, 110 Reykjavík, is the guarantor for the processing of personal data in connection with the use of KLAPPIÐ.

This Data Protection Policy applies to all services of KLAPP. More detailed information on the processing of personal data at Strætó is available here.

The KLAPP app (KLAPPIÐ) provides a solution where the customers of Strætó can sign in, purchase their fares and review and forward tickets to others.

“My Pages” in KLAPPIÐ enables the customers to use the services offered by Strætó to a greater extent. Access to “My Pages” allows the customers to purchase single fares and period passes, top up their smart cards, purchase and keep track of credit in the KLAPP wallet, utilise discounts if they are entitled to them, obtain payment receipts, review the status of their payment methods and review their usage and transaction history. Access to “My pages” also allows the customers to send an enquiry in the form of queries and comments which is processed by the service representatives of Strætó.

It is essential that Strætó gains access to your personal data relating to the use of KLAPPIÐ. We gather personal data which you provide directly, information on the ways in which you use our services and, as appropriate, information from a third party, relating to specific discount terms of fares.

When you begin using the app, you have a choice between anonymous log in or to setting up an account that is linked to a phone number. When logging into “My Pages”, you must always provide a phone number and an e-mail address.

You must register payment card number when purchasing goods and services. Then you are given a choice of saving your payment card details for future purchases. In this situation, your card number is replaced by a virtual number (token) so that no payment card numbers are saved in the Strætó system. In order for you to maintain an overview of what payment cards are registered at any given time, the first six and the last four digits of the payment card, together with the expiry date, are disclosed in KLAPP.

Strætó provides their various customer groups special discount offers. These groups include disability and rehabilitation pensioners, students and employees of companies that hold a transport agreement with Strætó. Should you be entitled to these discount offers, we will also process information necessary to provide you with the applicable discount. Such information is only available to Strætó if you have given your consent for its disclosure with the relevant partner of Strætó, such as your employer, your school or the Social Insurance Administration. The only information Strætó receives is whether or not you are entitled to a discount. Further, Strætó extracts data from the Registers Iceland on the legal residence municipalities of those who utilise student discounts, due to agreements with municipalities on granting those discounts. Other information from partners is not collected.

When purchasing fares, information on the date and time of transaction, type of fare and, as appropriate, any applicable discounts, payment amount and payment confirmation from acquirers is stored by Strætó. Through “My Pages”, you have access to a statement of your own transactions and the status of fares. In addition to having access to a statement of your own transactions, you may request that a payment receipt is sent to your e-mail address. In cases where you use that option, you must register your e-mail address which will then be stored with Strætó.

When you forward an inquiry, a comment, a complaint or any other queries to us through “My Pages”, an task is automatically initiated by you in the client system of KLAPP which will be processed by a service representative of Strætó.

In other respects outside of those stated above, Strætó processes general information on your use of their services. Thus, your actions, including purchasing, activating, scanning and forwarding of fares, are both registered and stored with date and time. When scanning fares and boarding passengers, information on the bus stops where the services are being used is also stored on the system.

In addition, we may process other information about you which you choose to provide in the app, on “My Pages” or in communications with Strætó, such as full name, ID number, phone number, address and e-mail address.

Strætó conducts monitoring of correct payment of fares and has, in accordance with legislation and rules, the authority to apply charges to fares and process personal data necessary to comply with these rules. For the benefit of the above, information on customers is processed, i.e. name, ID number, fare media identification and information on the reasons for applying charges to fares.

The purpose of the processing is primarily to provide access to goods and services based on the agreement between you and Strætó. The personal information is also processed for the purposes of improving product range and services to customers. Information is processed to ensure that the users can enjoy the discount offers they are entitled to and conduct monitoring of correct payment of fares.

Strætó reserves the right to compile statistical summaries that are non-personally identifiable regarding the use of the services.

Processing of personal information that is necessary for the use of KLAPPIÐ is based on the agreement with you as a user; however, we need certain information so that you can use KLAPPIÐ.

Information on your use of the services is also used to improve and develop the services provided by Strætó, and it is in their legitimate interests to be able to improve the services to you.

In cases where the users want to use specific discount offers, such as disability discounts or student discounts, we collect information from our partners on the condition that you have given your consent for such disclosure. The collection of information on the legal residence municipality of students who use discount offers due to agreements with municipalities on such discounts is based on the legitimate interests of Strætó and is a precondition for offering discounts to students.

The processing of personal information in connection with monitoring payments of fares and decisions made on applied charges to fares is based on authorisations laid down in the Act on Road Transport Passenger Services and derived rules.

Your personal data may be disclosed to external parties, such as:

• partners of Strætó, i.e. The Social Insurance Administration, educational institutions or companies that have made transport agreements with Strætó, should it be necessary so that you may use the discount terms on offer for the customers of Strætó,
• the Icelandic Transport Authority, if a complaint is lodged regarding a decision made by Strætó on charges to fares.
• companies working together with Strætó towards carrying out the collection. Under such circumstances, the parties must adhere to confidentiality due to the provision of personal data.

When developing and operating the system, appropriate measures have been taken to ensure that this data is not obtained by unauthorised third parties, altered, damaged or lost. Thus, all communications between solutions and databases are encrypted.

Strætó does not collect payment card information, and thus, security in card transactions is ensured. When registering payment cards, they are converted to a virtual number (token) which replaces the card number when a payment is processed. The actual card number is thus never used within KLAPPIÐ, which will increase likelihood of security.

All communications between KLAPPIÐ and databases are encrypted. Access to the database will be limited and traceable.

Strætó will continue to apply appropriate measures as it has done hitherto to protect data which is being processed in relation to KLAPPIÐ and its further development.

You are entitled to receive information on saved data relating to the use of KLAPPIÐ, together with receiving a copy thereof.

You have the right to request that incorrect personal data be rectified and wrong information destroyed, in accordance with Act No. 77/2014 on Public Archives. You may also submit an objection to the processing of your personal data and request that such processing be limited. You are also entitled to receive your personal data in digital form or to have it directly transferred to a third party.

A Data Protection Officer (DPO) can be contacted via e-mail at personuvernd@straeto.is should you wish to exercise some of your rights, receive further information on the processing of personal data or submit comments thereof.

Should you believe that the processing of personal data is not in accordance with the law applying to their operations, you can submit an enquiry to the Data Protection Authority.