Use of personal data
We are committed to protecting your data. When collecting, processing and using your personal data, we always comply with all relevant legal provisions. This personal data policy applies to our processing of your personal data when we are the data controller.
Personal data is used to implement the service for which the data was collected. The data is also used to gain greater knowledge of you and other users of the website.
We will only retain your personal data either for as long as we are subject to a legal obligation to do so, or for as long as it is relevant to the purpose for which the data was collected.
When you use light rail trains, are on a light rail platform, or are in the areas immediately around the platforms and tracks, you may be recorded on video by one or more cameras. Aarhus light rail’s CCTV monitoring system consists of the following four systems:
- Passenger compartment monitoring
- Track monitoring from front-mounted cameras on trains
- Rear-view mirror monitoring mounted on trains
- Cameras on platforms
What personal data is involved?
Personal data includes any information about an identifiable natural person, including video recordings. Recordings from Aarhus light rail’s CCTV monitoring system may include recordings of you using light rail trains or being on a light rail platform or in the areas immediately around platforms and tracks. It is these recordings that we collect, process and use.
In addition, we collect the personal data you have provided to us when registering an account, participating in a survey, requesting information via e-mail, etc. The personal data we use in this context consists of:
Contact information – If you contact us about an enquiry, we will store your telephone number, name, e-mail address and other information that should be provided in order for us to respond to your enquiry.
Interaction with YouTube – If you are logged into your Google account, your interactions with YouTube will be associated with your Google account.
Data from safety reports – If you report a safety incident via the form on our website, we will process your information in order to improve the safety of the light rail system.
For what purposes do we process your personal data?
We collect and store the personal data that you have provided to us in order to:
Fulfil your request for products and services
Respond to other requests from you
Improve the safety of the light rail system
We collect and store recordings from CCTV cameras for crime prevention and safety purposes.
On what legal basis do we process your personal data?
We collect and process personal data based on the following legal bases:
When you provide us with your personal data, it is processed on the basis of article 6 (1) (b) of the General Data Protection Regulation. This states that the processing of personal data is lawful when the processing is necessary for the performance of a contract (or agreement) to which the data subject is party, or to take steps at the request of the data subject prior to entering into a contract (or agreement).
When you are a passenger of Aarhus light rail, your personal data is processed on the basis of Article 6 (1) (c) and Article 6 (1) (e) of the General Data Protection Regulation. These state that the processing of personal data is lawful if the processing is necessary for compliance with a legal obligation of the controller, or if the processing is carried out in the exercise of official authority vested in the controller.
When you, without being a passenger of Aarhus light rail, are in the area that is subject to CCTV monitoring by Aarhus light rail, the processing is carried out on the basis of Article 6 (1) (f) of the General Data Protection Regulation. This states that the processing is lawful if it is necessary to pursue our legitimate interest in combating crime and the interests of the data subject do not override this interest.
When your personal data is processed in connection with CCTV monitoring, this always takes place within the framework of the Danish TV Surveillance Act.
Who is the data controller?
The data controller for the collection, processing and use of your personal data is Aarhus Letbane I/S, Thomas Koppels Gade 311, 8000 Aarhus C, CVR no.: 34704724, info@aarhusletbane.dk
We check and update your personal data
We check that the personal data we process about you is not false or misleading. We also ensure that your personal data is updated regularly.
As parts of our service depend on your data being correct and up to date, we would ask you to use the above contact information and inform us of any relevant changes to your data.
Who do we disclose your personal data to?
We only disclose your personal data to external parties if necessary and if there is a legal basis for this. In certain circumstances, we disclose your personal data to our suppliers if they process data on our behalf (so-called data processors). Our data processors only process personal data on our instructions and in accordance with the legal requirements for data processors. We enter into processing agreements with our data processors, which is our guarantee that they comply with applicable rules on the protection of your personal data.
We also disclose your personal data if we are legally obliged to do so, e.g. as part of investigations into suspected crimes or safety incidents.
Within the company, only employees who have a work-related need to view your personal data have access to the data.
When do we erase your personal data?
We erase your personal data registered with us when it is no longer necessary to retain it in relation to the purpose for which we collected, processed and stored this personal data. When we no longer need your personal data to fulfil this specific purpose, it will be erased or anonymised.
CCTV recordings in trains are erased after 72 hours, while other CCTV recordings are erased after 30 days. However, recordings may be stored for a longer period of time if required by the police, the Accident Investigation Board Denmark or other authorities, or if this is necessary for our handling of a specific dispute.
What are my rights?
Under data protection rules, you have a number of rights in relation to our processing of your personal data. If you would like to exercise these rights, please contact us. You have the following rights:
- The right to view personal data (the right of access)
- You have the right to access data that we process about you, as well as a number of other types of data.
- The right to rectification (correction)
- You have the right to have inaccurate data about you corrected.
The right to erasure
In certain circumstances, you have the right to have data about you erased before the time of our general erasure.
The right to restrict processing
In certain circumstances, you have the right to have the processing of your personal data restricted.
The right to object
In certain circumstances, you have the right to object to our otherwise lawful processing of your personal data.
The right to data portability
In certain circumstances, you have the right to receive a copy of your personal data, or to have personal data transmitted directly from Aarhus Letbane I/S to another data controller.
The right to withdraw consent
If our processing of your personal data is based on your consent, you have the right to withdraw that consent at any time. You can do this by contacting us using the contact details provided below.
If you choose to withdraw your consent, this will not affect the lawfulness of our processing of your personal data on the basis of your previously given consent and before its withdrawal. Therefore, if you withdraw your consent, this will only take effect from that point in time.
You can read more about your rights in the Danish Data Protection Agency’s guide on the rights of data subjects, which you can find at www.datatilsynet.dk.
Contact us
You can contact us if you wish to exercise your rights as described above, if you wish to make a complaint, or if you have any other questions about our personal data policy. You can contact us in the following ways:
Aarhus Letbane I/S
Thomas Koppels Gade 311
8000 Aarhus C
Denmark
E-mail: info@aarhusletbane.dk
Telephone: +45 40 31 61 91
Complaints to the Danish Data Protection Agency
You can file a complaint with the Danish Data Protection Agency about our processing of your personal data. For more information, visit www.datatilsynet.dk.
Changes to our personal data policy
Our personal data policy is regularly updated. The personal data policy in force at any time can be found at www.letbanen.dk
