National Transport Authority
Privacy Notice for Leap Card Customers
This Privacy Notice is issued by the National Transport Authority of Dún Scéine, Harcourt Lane, Dublin
(“NTA”, “we”, “us”, “our”).
We provide an integrated ticketing scheme called ‘Leap Card’ as a convenient way to pay for public transport services (“Leap Card”). The purpose of this notice is to inform you of the data relating to you that we may collect and use in connection with Leap Card and the uses (including disclosures to third parties) we may make of such data.
If you have any questions about our use of your personal data, please contact us at firstname.lastname@example.org
Personal Data that we Collect and Process
We will collect and process personal data relating to you in connection with your use of Leap Card and our relationship with you. This personal data may include:
• your name and contact details, including your address, phone number email address and post code.
• Your chosen Leap Card label name and your chosen Leap account user name
• Your chosen responses to security questions
• the unique identifier assigned to your Leap Card (Card Serial Number) and the times when you use your Leap Card to pay for public transport services
• your credit/debit card or bank account details, where you choose to make top up payments by credit/debit card or automatic direct debit;
• if you apply for a personalised Leap Card, the photograph that you provide to us;
• if you apply for a Student Leap Card, your date of birth and the school/college/institute that you attend;
• if you apply for a Child Leap Card 16-18, the date of birth of the child.
Purposes of Processing and Legal Basis
We will use personal data relating to you for the purposes of:
• processing your application for a Leap Card;
• providing you with a Leap Card and facilitating your use of Leap Card in accordance with our terms and conditions with ;
• enabling you to pay for public transport services with Leap Card, providing you with receipts when you purchase credit or tickets with the Leap Top-Up App, logging your transactions, calculating and deducting travel credits, facilitating pre-paid tickets to be loaded onto your Leap Card and processing top-ups;
• managing your Leap Card account;
• providing you with customer support;
• contacting you in order to provide you with updates in relation to Leap Card;
• carrying out research and customer satisfaction surveys;
• sending you promotional and marketing materials, subject to any preferences that you express when we collect your contact details or subsequently. You can opt out of receiving promotional and marketing materials from us at any time by using the ‘unsubscribe’ facility. .
• generating and analysing statistics regarding usage of Leap and public transport services. Where possible, personal data will be anonymised before being used for this purpose;
• fraud prevention, investigation and detection;
• establishing, exercising or defending legal claims;
• performing our functions as a public authority and complying with our legal obligations.
The legal bases on which we process your personal data are:
• that this is necessary for the performance of tasks that we carry out in the public interest or in the exercise of official authority vested in us by law;
• that this is necessary for compliance with a legal obligation that applies to us; or
• In the circumstances where we send you marketing and promotional communications, that you have given your consent to the processing
Recipients of Data
We may disclose your personal data to other organisations in connection with the above purposes, including:
• to public service transport operators;
• to third parties who we engage to provide services to us in connection with Leap , such as outsourced service providers, IT services providers, professional advisers and auditors;
• to other public authorities and bodies where required or permitted by law, such as the Gardaí or other law enforcement authorities for the purposes of the prevention, investigation or detection of crime.
We will not hold your personal data for longer than is necessary. We retain your personal data for as long as we need it for the purposes described in this Notice, or to comply with our obligations under applicable law and, if relevant, to deal with any claim or dispute that might arise between you and us.
• Leap Card Transaction data (for registered and personalised customers only) is retained for 13 months.
• Personal data you provide in relation to your application for a Leap Card, or in order to register a Leap Card is retained for:
• As long as you choose to remain as Registered, (i.e. until you unregister) or;
• Until you return or refund your Leap card (i.e. close your account); or
• Until the expiry of your Leap Card (assuming that you do not opt to request a replacement)
• The email address that you provide in order to opt in to receiving marketing communications is retained until you unsubscribe to these communications.
The information you provide to the Authority may occasionally be passed to third parties located outside the European Economic Area, including to a jurisdiction which is not recognised by the European Commission as providing for an equivalent level of protection for personal data as is provided for in the European Union. This is solely for the purposes of the operation of the integrated ticketing scheme (and not for direct marketing purposes).
If and to the extent that we do so, we will ensure that appropriate measures are in place to comply with our obligations under applicable law governing such transfers. These may include entering into a contract governing the transfer that contains the ‘standard contractual clauses’ approved for this purpose by the European Commission or, in respect of transfers to the United States of America, ensuring that the transfer is covered by the EU-US Privacy Shield framework. If you would like to receive further details of the measures that we have taken in this regard, please contact us at email@example.com.
You have the following rights, in certain circumstances and subject to certain restrictions, in relation to your personal data:
• the right to access your personal data
• the right to request the rectification and/or erasure of your personal data;
• the right to restrict the use of your personal data;
• the right to object to the processing of your personal data;
• where you have given your consent to receive marketing communications, the right to withdraw your consent to the processing at any time.
If you wish to exercise any of the rights set out above, please contact us at firstname.lastname@example.org.
We may occasionally update this policy. We encourage you to periodically review this policy for the latest information on our privacy practices.
If you are not happy with the way we are using your personal data or how we facilitate your rights or comply with our obligations under applicable data protection law, you have the right to make a complaint to the Data Protection Commissioner by emailing email@example.com.