If Arriva intends to process your personal data further for a purpose other than that for which the personal data were collected as described above, Arriva will inform you about this and about all relevant further information prior to such further processing. Arriva offers other services in addition to the glimble app. The collection and processing of your personal details via these services is subject to Arriva's general privacy statement, which can be found on its website.

7. With whom do we share data?

If necessary, for the above purposes, we will share your personal data with the following parties:

• External transport service providers for the booking, payment and execution of your chosen trips, as well as for the settlement of damages and the charging of received traffic fines. In order to use the services of external transport service providers, you will have to agree to their applicable terms and conditions in advance. 

• Fairtiq, in the context of travel using GPS, your data is shared with Fairtiq because they enable the technology to travel using GPS.

• Payment service provider. This party ensures that your payments for rides are being processed.

• Veriff for carrying out a driving licence check.

• Parties who assist us in creating and providing e-tickets for the trips you book and pay for.

• Parties who make it possible to send out push notifications via the glimble app.

• Parties who make it possible to analyse the effectiveness of our campaigns in the glimble app and who help us, for example, to build audiences to target on external platforms.

• IT and software vendors, including the developer of the glimble app.

• Parties that help us with billing.

• Parties that help us with customer contact and complaint handling.

• External service providers. To the extent necessary in the context of fraud prevention, handling or prevention of security incidents and fraud.

• When using the glimble app for business purposes, employers are given access to business and home-work trips via the employer portal. Only the type of transport, carrier, costs and CO2 emissions of private journeys which are reimbursed by the employer are made visible, not the pick-up and drop-off location. Private journeys that are not reimbursed by the employer are not made available to employers.

• Transport service providers and other clients to whom Arriva provides reports with aggregated data.

• Other parties involved in our services in connection with the glimble app, including consultants, accountants, banks and marketing agencies.

• The police or other authorities, when threats are made during customer contact or in the case of a suspicion of a (serious) crime, if the disclosure of data can be requested from us by means of a court order (which we must comply with).

• Tax authorities, when we have to provide data for the implementation of tax legislation and in the context of administration obligations.

• Supervisory authorities, in the context of requests or investigations by supervisory authorities (such as the Tax and Customs Administration, the Dutch Data Protection Authority or the Dutch Consumer and Market Authority, or other supervisory authorities with enforcement powers.

• The Dutch Ministry of Infrastructure and Water Management and the Dutch Organisation for Applied Scientific Research (Nederlandse Organisatie voor toegepast-natuurwetenschappelijk onderzoek, TNO, address: Anna van Buerenplein 1, 2595DA 's-Gravenhage), for the MaaS study (for more information, see section 8).

In certain cases, your data will be processed by these parties on our behalf (this is the case, for example, with regards to IT and software suppliers). Where necessary, we have made arrangements for this in a data processing agreement, for example with regards to the security and the storage of data. We do not sell your data to third parties. Other parties, such as the transport service providers, payment service providers, supervisory parties and consultants, process your data as independent data controllers in the sense of the GDPR. For more information on how these parties handle your personal data, you can request their own privacy statement from them or consult their website. In some cases, we are (legally) obliged to share certain personal data with third parties. For example, if we are involved in a legal procedure, have to comply with a (legal) obligation, have to obey a court ruling or instructions from an insurance company or government agency (such as the Dutch Data Protection Authority, or other competent (government) authorities). Generally, we will not store your personal data as set out above at sites located in countries outside the European Economic Area (EEA). However, there may arise situations where we engage parties located in countries outside the EEA and where personal data may therefore be shared with or accessed by a party located in a country outside the EEA. In this case, it will be ensured that appropriate measures are taken to guarantee adequate protection of your personal data in accordance with applicable data protection legislation, such as the GDPR. In general, we will use the standard contractual clauses (as approved by the European Commission) as a ground when transferring data to the data recipient. You can contact us (see below) if you wish to receive a copy of the standard contractual clauses used or wish to understand other appropriate measures taken.

8. MaaS research project

Arriva is taking part in a large-scale study into Mobility as a Service (MaaS) services in the Netherlands. The study is being carried out by the Dutch Ministry of Infrastructure and Water Management and Dutch Organisation for Applied Scientific Research (Nederlandse Organisatie voor toegepast-natuurwetenschappelijk onderzoek, TNO, address: Anna van Buerenplein 1, 2595DA 's-Gravenhage), in the so-called 'MaaS Learning Environment'. The aim of the study is to find out how different types of transport (private car, public transport, private bicycle, shared bicycles and scooters, rental and shared cars, taxis, etc.) can be integrated better. The aim is also to examine the effects of a 'MaaS app' (such as the glimble app) on, for example, CO2 emissions, traffic congestion reduction and other policy goals and services. The results of the research will also be used to improve services to travellers (and therefore also the services provided to you via the glimble app). When you use the glimble app, data about relocations is generated, which is very valuable for the MaaS research. If you give us permission (and only then), we will share your Travel information in a pseudonymised manner with TNO and the Dutch Ministry of Infrastructure and Water Management for the purpose of this research. Pseudonymisation means that we will ensure that you cannot be directly identified on the basis of the data. Thus, we will never give out your name and contact details. Because of the pseudonymisation it will be more difficult to link the data to you. TNO will subsequently anonymize the data received, so that they can no longer be traced back to you at all and therefore no longer contain any personal data. We ask for your consent for this research project during the registration process of the glimble app. When asking your consent, we will provide you with more specific information about (the purpose and method of) the study and the Ministry's and TNO's role in it.

9. Withdraw consent MaaS Learning Environment

If you no longer wish us to use your Travel Information for the MaaS research project, you can indicate this by contacting the customer service via the contact details at the end of this privacy statement.

10. Other websites

You may find links to websites other than those of Arriva via the glimble app. Arriva is not responsible for the handling of your personal data by these external parties/websites. Please read the privacy statement of the website you are visiting.

11. How long does Arriva keep your data?

Arriva does not retain your data any longer than necessary for the purpose for which it was collected and never longer than is legally permitted. The period for which particular data is kept depends on the nature of the data and the purposes for which it is processed. In principle, the personal data that we collect will be kept for a period of 2 years after obtaining your personal data, unless a different retention period is explicitly mentioned in this privacy statement. This way we can monitor, improve and customize the experience of the glimble app. Also, this retention period helps us detect fraud and abuse of the glimble app. Furthermore, it helps us to make accurate (historical) reports and internal analyses. The data about your planned, completed and saved trips is only collected and saved on an aggregate level, meaning that it cannot be directly traced back to you, or any other specific person.  Also when you remove the glimble app from your device or delete your glimble account, your personal data will be kept by us for a period of 2 years after deletion of the glimble app or your account. After this period, we will remove or anonymize your personal data. Arriva never stores your data longer than necessary when you travel using GPS. Location details are retained for a maximum of 12 months. This way, customer service can help you if you have any questions about your journey. If you contact us with questions, comments or complaints via social media, we will not keep your data longer than necessary, and for a maximum of 6 months. If you contact us by telephone and the conversation was recorded, this conversation will be kept for a maximum of 6 months. We keep proof of the consent you have given us for as long as we continue to process the personal data to which your consent relates. At the moment we delete your personal data, we will also delete the proof of your consent, unless we still need it in order to fulfil our accountability obligations under the GDPR. In certain cases, we retain (certain) personal data longer, for example when this is necessary to defend our interests in court (for example in the event of a dispute or legal proceedings), or when we must comply with statutory retention periods. For example, the fiscal retention obligation of 7 years. For more information about the specific retention periods, please contact us using the contact details at the top of this privacy statement.

12. What are your rights?

You have the right to inspect your own personal data. If data is incorrect, you can have it corrected. You also have the right to transfer data. This means that you can have the personal data that Arriva processes transferred to another party. Would you like to have your data removed from Arriva? This is possible as soon as you no longer have any (financial) obligations with Arriva. You also have the right to (more) information about the processing of your personal data. If you do not agree with the way in which we process your personal data, you can invoke your right to object to and limit the processing of your personal data. You can exercise your rights by sending us an e-mail or contacting us using the contact details at the bottom of this privacy statement. You can do so free of charge, except if your requests are excessive (for example, if you submit an unnecessary number of requests to us). In that case, we may charge a small fee to cover our administrative costs.

13. Complaints

Do you disagree with the journey you have travelled with GPS according to our records? Or do you have any questions? Please contact customer service using the details at the top of this privacy statement. If you have any questions or comments about this privacy statement or about the way in which Arriva processes your data in the context of the glimble app, please feel free to contact us using the contact details below. You can also contact us with questions about the (possible) processing, rectification, restriction of processing, data portability, removal of or access to your data.

• 0800 – 444 6888

• klantenservice@glimble.nl

14. Changes

Arriva reserves the right to make changes to the privacy statement. We advise you to check this page regularly for changes. The most recent version of the privacy statement can always be consulted via the app. If Arriva makes a material change to this privacy statement, we will notify you of this via the glimble app (push notifications), our website(s) and newsletters.