Data protection declaration – School transport

Personal data is all information that can be used to identify you. Below, you will find more information about how Skyss processes personal data and about your rights in relation to Skyss.

Purpose

Skyss processes your personal data in order to be able to make and implement decisions regarding school transport pursuant to the Education Act.

Grounds for processing personal data

Skyss’s processing is necessary in order to be able to decide and implement measures pursuant to the Education Act, cf. the General Data Protection Regulation Article 6 (1) (e) and 9 (2) (g).

What personal data does Skyss process?

General

In connection with the processing of applications for and the provision of school transport, Skyss processes the following personal data collected by your school or municipality:

Name, personal ID number, date of birth, phone number (of the pupil or guardian), address, other address in the event of shared residency, stop, school, class, timetable, reason for application, type of transport, transport period, School Travelcard number, and, in some cases, information about pickup and delivery times.

Temporary school transport for medical reasons

In addition to the personal data mentioned under the ‘General’ section, Skyss also processes information and documentation/medical certificates concerning the reason for temporary school transport being granted, e.g. that the pupil has broken their leg.

Permanent school transport for medical reasons

In connection with school transport granted for permanent medical reasons, Skyss also processes medical certificates and information about required aids.

Respite decisions

If an administrative decision has been made regarding respite measures, Skyss processes personal data contained in the respite decision and the address of the respite care home.

Refund of transport costs for private school transport

In connection with the refund of transport costs for private school transport, Skyss processes your name, address, personal ID number, car registration number, account number and documentation of the transport provided and costs.  

Sources of personal data

All personal data processed in connection with school transport services are collected from your school or the municipality that applies for school transport on your behalf.

Data processors

Skyss uses data processors to collect, store or in other ways process personal data on its behalf. In such cases, Skyss will enter into agreements with the data processor to ensure that the information is processed in accordance with the data protection regulations. Examples of data processors are suppliers of IT systems used by schools to apply for school transport and transport companies that pick up and drop off pupils entitled to adapted school transport.

Disclosure to third parties

Skyss does not disclose personal data to third parties as long as the public authorities do not require us to do so. 

Access to personal data

Personal data processed about you will be available to authorised personnel with an official need at your school, in Skyss and in the transport companies that pick up and drop off pupils entitled to adapted school transport.

Personal data will be forwarded to the appeal body in connection with the appeal of an individual decision.

Storage and erasure

All data are stored in Norway. The servers are operated by personnel in Norway and Denmark. All data stored are stored in accordance with applicable legislation. Your personal data will not be stored for longer than necessary to achieve the purpose of the personal data processing. 

Personal data processed in connection with applications for and the provision of school transport are stored as long as the data subject is entitled to school transport. Personal data about you will be stored for up to one year after you are no longer entitled to school transport.  

All personal data processed in connection with the payment of refunds for transport costs for private transport are stored for five years after the end of the financial year, cf. the Bookkeeping Act Section 13 with pertaining regulations.

Personal data processed in connection with application rejections and appeals are stored in accordance with the Freedom of Information Act and the Archives Act.

Security

Skyss has implemented data security measures and internal procedures to verify that no personal data fall into the wrong hands or are used for other purposes than those described in this data protection declaration.

Your rights in relation to Skyss

Right of access

You may request access to the personal data Skyss has registered about you.

Right of correction

You may request that incorrect or incomplete personal data be corrected or supplemented.

Right of erasure

You may request that Skyss erase your personal data, for instance if Skyss has processed your personal data in an unlawful way or for longer than necessary.

Right to limited processing

You may request that the processing of your personal data be limited if you contest the accuracy of the personal data, the legality or necessity of the processing or if you have objected to the processing and Skyss has accepted your objection. 

The processing will be limited from the time the objection is submitted and during the period of time it takes Skyss to assess the objection. If the processing shall be limited, Skyss is only allowed to store the limited personal data, and any other processing can only take place with your consent. This applies unless Skyss is required to process the personal data in connection with judicial matters, to protect the rights of others, or if the processing is of public interest.

Right to object

You may object to the processing of your personal data if you believe Skyss does not have the right to process your personal data. In such cases, Skyss may only continue processing the data if Skyss can substantiate a legitimate interest that carries more weight than your interests, rights or freedoms. The personal data may in any case be processed if Skyss is legally obliged to do so or if processing is necessary in order to establish, assert or defend a legal claim. 

Right to complain to the Norwegian Data Protection Authority

You can complain to the Norwegian Data Protection Authority if you are dissatisfied with Skyss’s reply or believe that Skyss is processing your personal data in breach of the applicable data protection regulations. Information about the complaint procedure is available here.

Contact information

If you have any questions relating to Skyss’s processing of your personal data or you would like to access, correct, erase or request limited processing or data portability, please use the contact form Data protection form here