Service-specific privacy notices

This page contains additional privacy information for different HSL services.

1. HSL Customer Feedback

Date of compilation: 24 May 2018

1.1. What data processed in the service and why?

The purposes of the use of customer data are described in general in the HSL Customer Register Privacy Statement.

When submitting feedback, you can give us your contact details (name, email address, street address or PO Box, postcode and phone number), if you wish. If you want a reply to your feedback, please fill in the fields marked with an asterisk, so that we can reply you or ask for further information. You can provide additional information in the free text field.

In case of refund requests, you are also asked to provide, for example, your HSL card number, mobile ticket phone number and bank account number. Refund request forms are filled in at a service point or by HSL’s telephone customer service. In case of a strike, a printable refund request form will be available online at hsl.fi.

Your data is processed on the basis of an agreement between you and HSL. Your use of HSL’s services constitutes your acceptance of this agreement. 

1.2. How long is my data stored?

Data included in feedback are stored for three years.

1.3. Who processes the data? 

The data is processed by persons who have access to the data to perform their work tasks. HSL uses contract partners for data-processing tasks, and can disclose personal data to them where necessary to perform the tasks. Processors of personal data are bound by professional secrecy and confidentiality. Feedback is passed on as relevant. For example, feedback on driver performance is passed on the the relevant bus operator. 

1.4. How can I access my data? 

For more information about the exercise of the rights of data subjects, see Privacy>Rights of data subjects.

2. HSL app

Date of compilation: 24 May 2018

2.1. What data is processed in the service and why?

The main purposes of the use of customer’s data are described in the HSL Customer Register Privacy Statement.

When you start using the app, you are asked to provide the following information:

•Are you over or under 15 years of age?

If you are over 15 years of age, we ask for the postal code or your residence or postcode district (or you can tick the option “I live abroad”) in order to be able to provide you with better, up-to-date information. The domicile information derived from the place of residence is also needed for the purposes of dividing public transport costs between HSL’s member municipalities.

•If you are under 15 years of age, we ask for your guardians’ consent to use the service.

•All customers are asked for location and notification permission. Location permission enables better user experience, for example, by facilitating the use of the Journey Planner. The notification permission allows us to send you reminders about the approaching expiry of your tickets and to provide you with information about extensive disruptions affecting your travel.

When buying a ticket, you are asked to provide the following information:

•Phone number. Your phone number is processed for ordering and delivering the ticket and for checking its validity.

•If you are over 15 years of age, we ask for your name and contact details (first name, last name, email address). The information is utilized, for example for communications.

•If you are over 15 years of age, you can give your consent to direct marketing.

•If you are buying a season ticket, you need to strongly authenticate for the purposes of establishing the price subsidy based on the municipality of residence.

•Payment method (card payment or mobile payment). If you choose card payment, the information stored in the payment service include the credit card number and expiry date. Your card information is transmitted over a secure encrypted connection and stored in a secure PCI DSS compliant environment. In case of mobile payment, the operator charges the tickets to your phone bill. You can remove the card data at any time in the application settings.

•The data stored for you includes data about the tickets you order and the application version.

Your data is processed on the basis of an agreement between you and HSL. Your use of HSL’s services constitutes your acceptance of this agreement. HSL also processes the data to perform its basic tasks. Direct marketing, use of location information and notifications are based on your consent.

2.2. How long is my data stored?

Purchase, sales, order, invoicing and payment data necessary for the purposes of accounting will be stored for at most 10 years.

Base account data will be stored for the duration of the customer relationship with HSL. You are deemed to have terminated the use of the app and your service-specific information will be removed if you have not updated your information for three years and you have not had a valid mobile ticket purchased on the app for three years.

Only the information you provide when starting to use the service shall be stored for as long as you have the app on your device.  Removing the app from your device will not remove the data stored in HSL’s background systems.

2.3. Who processes the data?

The data is processed by persons who have access to the data to perform their work tasks. HSL uses contract partners for data processing tasks, and can disclose personal data to them where necessary to perform the tasks. Processors of personal data are bound by professional secrecy and confidentiality.

Payment service partners, including phone operators, are responsible for ticket invoicing.

2.4. How can I access my data?

You can access and update your information in the HSL app settings. You can update your location and notification permissions in the application settings as well as on your device settings.

For more information about the exercise of the rights of data subjects, see Privacy>Rights of data subjects.

3. HSL account

Date of compilation 25 May 2018, updated 21 June 2018

3.1. What data is processed in the service and why?

The main purposes of the use of customer’s data are described in the HSL Customer Register Privacy Statement.

When creating an HSL account, you need to provide your email address and phone number and create a password. If you are under 15 years of age, we ask for your guardians’ consent to use the service.

If you want, you can give your name, contact details and other information (first name, last name, mobile phone number, address, postcode, town/city, date of birth, alias and Travel Card number). The data is used for managing customer relations and for various functions such as prize draws and commenting at HSL.fi. If you are over 15 years of age, you can give your consent to direct marketing by phone or email. You can prohibit the use of your data for polls. If you want, you can select public transport routes for which you want to receive e.g. disruption alerts.

Information about the services you use via your HSL account is connected to your data. These services include e.g. city bikes.

Your data is processed on the basis of an agreement between you and HSL. Your use of HSL’s services constitutes your acceptance of this agreement. Direct marketing is based on your consent.

3.2. How long is my data stored?

Base account data will be stored for the duration of the customer relationship with HSL. Your service-specific data will be kept for three years from the last time you access your account or other activity related to the service. This principle will apply after the Travel Cardd replacement, set to begin in 2018, has been completed, because in conjunction of the card replacement, customers are encouraged to register their cards under their HSL account.

If need be, you can remove your user account. The removal will deactivate your HSL account. The deactivated account will be stored for as long as necessary to fulfill the rights and obligations of the parties.

Purchase, sales, order, invoicing and payment data necessary for the purposes of accounting will be stored for at most 10 years.

3.3. Who processes the data?

The data is processed by persons who have access to the data to perform their work tasks. HSL uses contract partners for data processing tasks, and can disclose personal data to them where necessary to perform the tasks. Processors of personal data are bound by professional secrecy and confidentiality.

3.4. How can I access my data?

You can access and update your information via the service. If need be, you can remove your user account. The removal will deactivate your HSL account.

For more information about the exercise of the rights of data subjects, see Privacy>Rights of data subjects.

4. HSL card service

4.1. What data is processed in the service and why? 

In the HSL card service, the data processed include the card numbers and name data in the user profiles, added by the users. The data stored in the service include the user’s HSL account, season ticket or value reminders. In addition, in case of strongly authenticated users, the data stored include the card system ID, the user’s travel card numbers and information about the sending of reminders (when the reminder has been sent). Other data visible in the service is obtained from other systems such as the HSL account and HSL card system. Information about the data processed in the HSL account service is available on this page under ‘HSL account’. 
The data is processed on the basis of an agreement between the customer and HSL. Your use of HSL’s services constitutes your acceptance of this agreement.  

4.2. How long is my data stored? 

Your data will be stored for the duration of your customer relationship with HSL and for at most three years after the termination of the customer relationship.   

4.3. Who processes the data? 

The data is processed by persons who have access to the data to perform their work tasks. HSL uses contract partners for data-processing tasks, and can disclose personal data to them where necessary to perform the tasks. Processors of personal data are bound by professional secrecy and confidentiality. 

4.4. How can I access my data? 

You can access your data in the HSL card service. 

For more information about the exercise of the rights of data subjects, see Privacy>Rights of data subjects. 

5. HSL Mobile ticket app

Date of compilation: 24 May 2018

5.1. What data is processed in the service and why?

The main purposes of the use of customer’s data are described in the HSL Customer Register Privacy Statement.

When you start using the app, you are asked to provide the following information:

•Phone number and home municipality. Your phone number is processed for ordering and delivering tickets and for checking the validity of your ticket. The domicile information is needed for the purposes of dividing costs between HSL’s member municipalities.

•If you are under 15 years of age, we ask for your guardians’ consent to use the service.

•If you are over 15 years of age, we ask for your name and contact details (first name, last name, postcode and email address). The information is utilized, for example for communications.

•If you are over 15 years of age, you can give your consent to direct marketing.

•Payment method (card payment or mobile payment). If you choose card payment, the information stored in the payment service include the credit card number and expiry date. Your card information is transmitted over a secure encrypted connection and stored in a secure PCI DSS compliant environment. In case of mobile payment, the operator charges the tickets to your phone bill.

The data stored for you includes data about the tickets you order and the application version.

Your data is processed on the basis of an agreement between you and HSL. Your use of HSL’s services constitutes your acceptance of this agreement. HSL also processes the data to perform its basic tasks. Direct marketing is based on your consent.

5.2. How long is my data stored?

Purchase, sales, order, invoicing and payment data necessary for the purposes of accounting will be stored for at most 10 years.

Base account data will be stored for the duration of the customer relationship with HSL. You are deemed to have terminated the use of the mobile app and your service-specific information will be removed if you have not updated your information for three years and you have not had a valid mobile ticket purchased on the Mobile ticket app for three years.

Removing the app from your device will not remove the data stored in HSL’s background systems.

5.3. Who processes the data?

The data is processed by persons who have access to the data to perform their work tasks. HSL uses contract partners for data processing tasks, and can disclose personal data to them where necessary to perform the tasks. Processors of personal data are bound by professional secrecy and confidentiality.

Payment service partners, including phone operators, are responsible for ticket invoicing.

5.4. How can I access my data?

You can access and update your information via the “My information” menu of the Mobile ticket app.

For more information about the exercise of the rights of data subjects, see Privacy>Rights of data subjects.

6. HSL’s SMS ticket

Date of compilation: 24 May 2018

6.1. What data is processed in the service and why?

The main purposes of the use of customer’s data are described in the HSL Customer Register Privacy Statement.

Your phone number is processed for ordering and delivering tickets and for checking the validity of your ticket. Your phone operator is responsible for ticket invoicing.

Your data is processed on the basis of an agreement between you and HSL. Your use of HSL’s services constitutes your acceptance of this agreement.

6.2. How long is my data stored?

Purchase, sales, order, invoicing and payment data necessary for the purposes of accounting will be stored for at most 10 years.

6.3. Who processes the data?

The data is processed by persons who have access to the data to perform their work tasks. HSL uses contract partners for data processing tasks, and can disclose personal data to them where necessary to perform the tasks. Processors of personal data are bound by professional secrecy and confidentiality.

Your phone operator is responsible for ticket invoicing.

6.4. How can I access my data?

You get information about the SMS tickets invoiced from your phone operator.

7. Travel Card/HSL card

7.1. What data is processed in the service and why?

The main purposes of the use of customer’s data are described in the HSL Customer Register Privacy Statement.

Customer data is collected on individual customers and corporate customers to manage customer relations and to implement the service.

The data includes:

•ID number;

•first name, last name and address (street address, postcode, town/city, home municipality) obtained from the population information system

•date of death;

•potential non-disclosure order;

•customer’s other address information (street address, postcode, city/town, country);

•invoicing address (street address, postcode, city/town, country);

•phone number;

•email address;

•customer group;

•language;

•consent to direct marketing;

•authorization data item;

•“Entitled to a companion” data item, and

•refund information.

The data is automatically updated with data obtained from the population information system.

Identity number is used for the purposes of verifying the customer's right to purchase a personal Travel Card, for storing personal data on a multi-user Travel Card, and for verifying the customer’s identity. In case of corporate customers, business ID serves as identifying information.

Basic card data includes:

•Travel Card number;

•card type (personal or multi-user);

•issue time of the card;

•Travel Card pricing factors (customer group and home municipality);

•language;

•Travel Card status information, e.g. card cancellation information or information about a lost and found card; and

•Value and season ticket information

Card transaction data includes:

•value and season ticket purchases;

•loading transactions

•value transactions.

Card history data includes:

•validation data from onboard Travel Card readers (boarding data).

Travel Card history data is collected in the background system to ensure customer rights as well as for the purposes of reconciliation and reporting of sales data and for verifying the accuracy and integrity of transactions on the system level as well as for each individual Travel Card. In addition, the data is needed to determine the municipal contributions of HSL’s member municipalities and for transport planning.

The data is processed on the basis of an agreement between the customer and HSL. Your use of HSL’s services constitutes your acceptance of this agreement. HSL also processes the data to perform its basic tasks. Direct marketing is based on your consent.

7.2. How long is my data stored?

Base account data will be stored for the duration of the customer relationship with HSL.

After Travel Card replacement, the data related to the old (green) card is stored for as long as necessary to fulfill the right to refund.

The basic Travel Card data (new, blue HSL card) will be deleted and the right to refund will expire within three years from the moment your Travel Card is deactivated or closed. Your service-specific data will be removed and your right to refund will expire when three years has passed from the last value or loading transaction or the expiry of the latest season ticket.

The Travel Card number is stored in the history data for the time required to validate tickets and perform other functions essential to the public transport system. Boarding data will be stored in pseudonymized form without the card number for as long as necessary for the purposes of public transport cost allocation between municipalities, transport planning and research.

Purchase, sales, order, invoicing and payment data necessary for the purposes of accounting will be stored for at most 10 years.

7.3. Who processes the data?

The data is processed by persons who have access to the data to perform their work tasks. HSL uses contract partners for data processing tasks, and can disclose personal data to them where necessary to perform the tasks. Processors of the data are bound by professional secrecy and confidentiality.

HSL can disclose customer data to authorities as permitted and required by legislation.

7.4. How can I access my data?

You can check your Travel Card information via the My Travel Card app on and Android or Windows phone.

You can check the information of tickets on your Travel Card as well as your value balance on a Travel Card reader, at a ticket machine or at a Travel Card sales or service point.

Travel Card customer information and Travel Card information related to purchase and sales transactions are available as printouts from HSL service points. Please bring with you a valid ID document. You do not need to have your Travel Card with you.

We are planning to introduce a new HSL card service which will allow you to view your Travel Card data online (requires strons authentication). HSL will inform customers about the opening of the HSL Card service on its website.

For more information about the exercise of the rights of data subjects, see Privacy>Rights of data subjects.

 

8. Recording of customer calls

8.1. What data  is processed in the service and why?

The main purposes of the use of customer’s data are described in the HSL Customer Register Privacy Statement.

Your phone calls to out customer services will be automatically recorded. Your phone number is also automatically stored, unless it is ex-directory.

The recordings of customer calls are used for verifying service transactions, improving service quality, HSL’s internal training purposes as well as for ensuring your and HSL’s legal protection.

Your data is processed on the basis of an agreement between you and HSL. Your use of HSL’s services constitutes your acceptance of this agreement.

Only designated persons, whose task is to maintain the system used to manage customer calls, have access to the recordings of customer calls.

All your data is processed as confidential and your data is only disclosed to persons who need the data to perform their duties and who are bound by professional secrecy and confidentiality. We shall not disclose the recordings to customers.

8.2. How long is my data stored?

The recordings are stored for six months, after which they are automatically destroyed.

Back to top