Privacy Statement for Digital Travel Services

Privacy Statement: Digital Transport Services

Statement updated on 20 April 2026

Oy Matkahuolto Ab

Business identity code 0111393-9

(Hereinafter “Matkahuolto” or “We”)

This privacy statement describes how Matkahuolto processes its customers’ personal data, which Matkahuolto collects in order to provide its digital transport services and related customer service and communications. Matkahuolto offers customers a variety of ticket products and related services through its sales channels.

Matkahuolto is the controller of the personal data processed by it in connection with the provision of digital transport services. As data protection is all about trust, the protection of your privacy and personal data is of great importance to Matkahuolto. This is why Matkahuolto collects your personal data only to the extent necessary to provide its services.

A more detailed description of the ways in which your personal data is processed and the purposes of such processing is provided in this privacy statement. When we process your personal data for the purposes described below, you are the data subject referred to in the privacy statement and have the rights laid out in section 9.

What is described in this privacy statement only applies to the ways in which Matkahuolto or the parties acting on its behalf process data. Matkahuolto’s electronic services may contain links to third-party websites or services. Matkahuolto is not responsible for the privacy policies of these services, so we recommend that you review them separately.

1. Contact details related to the processing of personal data

Oy Matkahuolto Ab

Customer Service Centre

P.O. Box 100

00101 Helsinki

tietosuoja@matkahuolto.fi

2. What data do we process?

In connection with its digital transport services, Matkahuolto processes personal data concerning customers who have purchased tickets and travel rights, those who have registered as users of Matkahuolto’s electronic channels (such as the Matkat app) and those who have booked demand responsive transport services (data subjects), for the purpose of providing services to them and developing its services.

In connection with the provision of digital transport services, Matkahuolto may process the following personal data:

• identification and contact details of the data subject, such as full name, date of birth, nationality, phone number, email address and postal address;

• registration information required for any electronic customer account, such as username, password, or other unique identifier;

• demographic information, such as age, gender, title, occupation and native language;

• customer relationship information, such as your contacts with Matkahuolto customer service, including recorded customer service calls and customer feedback you provide;

• billing and collection information;

• basic ticket information: travel card or ID number;

• other information about the ticket: payment and billing information, date and place of purchase, ticket product, validity of the right to travel and information on any refunds;

• information on the use of the ticket: date and time of use (reading) of the travel card or mobile ID, the means of transport on which the ticket is used, ID no. of the reader device, the operator and service, and information on the boarding stop or location; and

• other information received from the data subject, such as complaints, messages and replies to Matkahuolto’s inquiries and surveys.

When you use Matkahuolto’s electronic services, such as the Matkat app, we may collect metadata related to your use of the services, such as where you accessed the services, the duration of your visit, the amount of data transferred, the type of web browser, IP address, operating system and user interface, as well as the browser version and language. If you visit the electronic services without registering or logging in, Matkahuolto will only process the above metadata. Based on this data, individual users cannot be identified unless you register or log in to the service, or provide your information when making a purchase. This data may be collected using cookies or other similar technologies; for more information, please see our Cookie Policy.

Matkahuolto’s Matkat app uses Meta’s services to collect data on app usage and events related to conversion paths, such as app installation, launch, registration, login and purchase transactions. This data is used to measure, optimise and target advertising, as well as to improve the app experience. Meta may combine this data with other information it has collected about you in accordance with its privacy policy.

The Matkat app also uses Google’s Firebase services for technical troubleshooting and usage analysis. Google processes this data in accordance with its own privacy policy.

In addition, other personal data, as described in more detail below, is collected on users of subsidised school trip tickets, personal tickets subsidised by the municipality or city, and employee ticket products, in order to provide these services.

a. Subsidised school trip tickets for upper secondary students

The subsidised school trip ticket for upper secondary students is a ticket product offered by Matkahuolto and subsidised by the Social Insurance Institution of Finland (Kela) for upper secondary students whose studies meet the criteria specified in the Subsidised School Trips Act (48/1997).

Matkahuolto processes the following personal data of holders of subsidised school trip tickets:

• name, phone number and email address (information collected in the Matkat app);

• more precise identification data of the data subject (personal identity code);

• information on the granting of the right to purchase subsidised school trip tickets; and

• other ticket information such as ticket product, ticket validity period and ticket purchase details.

This information is collected in order to identify the customer and to verify their right to a subsidised school trip ticket.

b. Personal tickets subsidised by municipalities or cities

Personal tickets subsidised by municipalities or cities are tickets downloaded to the Matkat app or a personal travel card, tickets for school children, and service voucher products, the granting of which is based on the data subject’s place of residence within a specific municipality or city. A further criterion for the issuance of the tickets for school children is the data subject’s status as a comprehensive school pupil.

Matkahuolto processes the following personal data of holders of personal tickets subsidised by municipalities or cities:

• name, phone number and email address (information collected in the Matkat app);

• for school children, information regarding their right to purchase tickets, including their month and year of birth; and

• other ticket information such as ticket product, ticket validity period and ticket purchase details.

This information is collected in order to identify the customer and verify their right to use the subsidised ticket.

c. Employee ticket products

An employee ticket means a subsidised ticket (season or series ticket) offered by an employer based on the data subject’s employment with the company involved.

Matkahuolto processes the following personal data of holders of employee ticket products:

• name, phone number and email address (information collected in the Matkat app);

• more precise identification data of the data subject (personal identity code);

• employer; and

• other ticket information such as ticket product, ticket validity period and ticket purchase details.

This information is collected in order to identify the customer and verify their right to use the employee ticket.

3. Purposes and legal bases for the processing of personal data

Matkahuolto processes the personal data of customers using its digital transport services for the purposes described below. Personal data is processed only on legal bases according to data protection legislation.

The purpose of processing based on consent is always clearly stated when consent is sought. Failure to provide the required information may prevent the creation of a customer account or the provision of services.

How do we combine customers’ personal data?

Matkahuolto may combine personal data collected through the use of various services to provide a better customer experience. To combine your data, you must be registered as a user of our electronic services and deal with Matkahuolto through your electronic customer account.

If you do not use an electronic customer account, Matkahuolto will process your data only in connection with individual services and will not combine data from different services.

Matkahuolto may use combined data to personalise its services and marketing, as well as to target its advertising. For this purpose, Matkahuolto may create a profile of you based on your transaction history and how you use our services. Profiling does not result in automated decision-making that would have legal or other significant effects on you.

4. Electronic direct marketing

Matkahuolto will not use your personal data for direct electronic marketing without your prior consent. You may withdraw your consent at any time by contacting Matkahuolto’s customer service.

Matkahuolto has the right to send electronic direct marketing without separate consent if the data subject’s contact information was obtained in connection with a previous purchase, the marketing relates to products or services belonging to the same product group, and the data subject has not objected to the marketing. You have the right to object to the use of your personal data for direct marketing purposes at any time by contacting Matkahuolto’s customer service.

5. Regular sources of data

Matkahuolto regularly collects personal data from the following sources:

• The data subject

  : data is collected when tickets are sold and handed over, as well as at other times when the data subject interacts with Matkahuolto through its channels and when the data subject participates in marketing campaigns or customer feedback surveys. Information related to single tickets or demand responsive transport services is also collected directly from the data subject.

• Operators

  : data on ticket usage is collected according to use. Matkahuolto collects, through a technical interface, information on the use of tickets from the carriers on whose means of transport the data subject travels with tickets purchased from Matkahuolto.

• Kela

  : The right to buy a subsidised school trip ticket can be obtained from the Social Insurance Institution of Finland (Kela) through strong authentication.

• Educational institutions

  : for school children’s tickets, the pupil’s information is obtained from the educational institution.

• Employer

  : The employer of the person entitled to an employee ticket notifies Matkahuolto of the qualifying information.

6. Disclosures and transfers of personal data

Matkahuolto discloses the personal data of data subjects to the following recipient groups:

• Payment service providers

  : In our digital sales channels, we use third parties as payment service providers. In addition to the personal data disclosed by Matkahuolto (name and email address), payment service providers may request additional information depending on the payment method chosen. This additional information will not be processed or stored by Matkahuolto. Instead, it will be handled by the payment service provider in accordance with its own privacy statement.

• Operators:

  Matkahuolto discloses personal data to a limited extent to operators for the purpose of providing digital transport services. The data disclosed varies by ticket type and operator, but may include information such as: travel card or mobile ID number, ticket product, validity period of the right to travel, the name or self-selected identifier provided by the passenger when purchasing the ticket, and phone number.

• Information system suppliers and other service providers

  : Matkahuolto may transfer personal data to information system suppliers and other service providers for the purpose of providing services or completing tasks they have been assigned to carry out, such as IT system maintenance, customer service or other data processing tasks. Matkahuolto’s Matkat mobile app uses Meta’s services for measuring, optimising and targeting advertising, as well as for improving the app’s user experience, and Google’s services for technical troubleshooting and usage analysis. Meta and Google process this data in accordance with their privacy policies.

In addition, Matkahuolto will disclose the personal data of the holders of its subsidised tickets to the recipients specified below. The purpose of the disclosures is to enable the invoicing of subsidised tickets and to verify Matkahuolto’s invoicing basis and the appropriateness of invoicing.

• Subsidised school trip tickets for upper secondary students

  : Matkahuolto discloses information to the Social Insurance Institution of Finland (Kela) as needed for it to grant school trip subsidies and credit the amount to Matkahuolto on a monthly basis. Provisions on the disclosure of information are set out in section 1 of the Decree on School Trip Subsidies for General Upper Secondary and Vocational School Students (425/2004).

• Personal tickets subsidised by municipalities or cities

  : Matkahuolto discloses information to the municipality or city as needed for it to grant the subsidy and credit the amount to Matkahuolto on a monthly basis or pays for the travel.

• Employee ticket products

  : Matkahuolto provides employers with information on tickets purchased by employees and subsidised by the employer.

When disclosing personal data to service providers acting as processors, Matkahuolto has ensured, for example, through contractual arrangements, that the processor acting on its behalf processes such data only in accordance with the written instructions issued by Matkahuolto for the performance of the processor’s tasks and exclusively for the purposes indicated in this privacy statement. Also, Matkahuolto has ensured that access to personal data is limited to persons who need to access it for work-related reasons.

In addition to the above, Matkahuolto discloses personal data to third parties in the following cases:

• Matkahuolto may disclose your personal data to third parties if you have given your consent;

• Matkahuolto may disclose your personal data as required by the competent authorities or other competent parties or as required by applicable law, in accordance with current legislation;

• If Matkahuolto sells, buys, merges, or otherwise reorganises its business, Matkahuolto or a party acting on its behalf may disclose your personal data to the buyers and their advisors;

• When Matkahuolto resells mobile tickets on behalf of other parties (such as HSL, Waltti, Onnibus.com, VR, and FlixBus or Viking Line, Tallink Silja and Eckerö Line), personal data related to the purchase is forwarded to the relevant party, which is responsible for processing the disclosed data in accordance with its own privacy policy.

The personal data is primarily stored in the territory of the Member States of the European Union or the European Economic Area, but processors outside the EU or EEA may have access to personal data when providing their services to Matkahuolto. If personal data is transferred outside the EU or EEA, Matkahuolto ensures that (i) the European Commission has determined that there is an adequate level of protection of personal data in the country in question; (ii) the transfers are carried out using standard contractual clauses or other equivalent arrangements approved by the European Commission; or (iii) the transfer complies with other appropriate safeguards for the transfer of personal data outside the EU or EEA. More detailed information on the applicable safeguards is available on request from Matkahuolto.

7. Personal data protection policy

Personal data is stored in a database that may only be accessed by specifically designated staff members of the controller or a party acting on its behalf, who need to access such data for work-related reasons, have received adequate training and are bound by a statutory or contract-based non-disclosure obligation.

The machine-readable service is located in a protected and locked computer room accessible only by technical personnel with access badges. The servers are protected through technical means.

All the data communications between the browser and the server environment are encrypted.

Access to servers and applications is restricted through role-based access control management.

8. Storage period and erasure of personal data

The retention period of the data is determined by the type of data involved and its intended purpose. Matkahuolto retains the personal data of data subjects in accordance with applicable legislation for only as long as the retention of data is necessary to achieve the purpose of the processing of personal data.

Matkahuolto determines the storage periods of personal data according to the following criteria:

• Your personal data will be retained for the duration of your active customer relationship. The activity of your customer relationship is determined on the basis of your use of Matkahuolto electronic services or your communication with Matkahuolto. If you have not had an active customer relationship with Matkahuolto for two years, your data will be deleted in the next quarterly data deletion process.

• Information about your direct marketing consent will be deleted if you withdraw your marketing consent or object to the processing of your personal data for direct marketing purposes.

• Your data will be deleted if you have requested the deletion of your data and Matkahuolto has no other basis for processing your personal data.

The communication sections of some of Matkahuolto services, such as your public feedback, will still display your pseudonym and related content even after your customer relationship has ended.

Matkahuolto is required to retain some of your personal details contained in your purchase, delivery and payment data in order to comply with accounting or other mandatory legislation even after the end of your customer relationship or other basis for processing personal information. Personal data forming part of accounting information is retained for the period of time required under accounting legislation (up to 10 years).

In some cases, the retention period of personal data is also determined by the terms and conditions of the agreement made with the subsidising party or other legislation binding on Matkahuolto.

For single tickets, any name information of the data subject is retained in the system and in the acknowledgements stored in the system for the period specified by the Accounting Act. The data subject’s email address is retained until the end of the financial year following the one in which the purchase was made, i.e. for a maximum of two years from the date of purchase.

When Matkahuolto no longer needs the personal data for the original purposes, the data is erased from Matkahuolto’s IT systems and other files, or the data is irrevocably anonymised.

9. Rights of the data subject

The EU General Data Protection Regulation guarantees data subjects a number of rights that you can exercise to control the processing of your personal data. You may exercise the following rights in respect of Matkahuolto insofar as Matkahuolto serves as the controller of your personal data.

• Right of access to data:

  You have the right to receive confirmation from Matkahuolto as to whether it is processing your personal data, as well as the right to check such data. Matkahuolto may request you to formulate your request in more detail regarding the procedure for the delivery of the data, etc.

• Right to rectification:

  You have the right to request that inaccurate or incorrect information be rectified or that the incomplete information be supplemented. When requesting a rectification, you need to be aware that all information cannot be changed retroactively by such a request. For example, the contents of the decisions concerning the data subject’s benefits cannot be amended. Specific appeal procedures exist for such decisions as explained in each individual decision.

• Right to be forgotten:

  In certain circumstances, you have the right to have Matkahuolto erase your personal data.

• Right to restriction of processing:

  In certain cases stipulated by law, you may have the right to demand that Matkahuolto limit the processing of your personal data.

• Right to withdraw consent:

  • Right to data portability:

    Subject to certain statutory provisions, you may have the right to receive from Matkahuolto the personal data it processes about you in a commonly used and machine-readable format, and the right to transmit that data to another data controller without Matkahuolto’s interference.

  • Right to object the processing of personal data:

    In certain situations, you may have the right to object to the processing of your personal data. In particular, the right to object to the processing of personal data applies to situations in which processing is based on Matkahuolto’s legitimate interest, unless there is a compelling legitimate reason for the processing that overrides the data subject’s interests, rights and freedoms, or if the processing is necessary for the establishment, exercise or defence of legal claims.

  • Right not to be subject to automated decision-making:

    You have the right not to be subject to a decision based solely on automated processing, such as profiling, that produces legal effects concerning you or otherwise significantly affects you.

  If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

If you have registered as a user of Matkahuolto’s electronic services, you can check and correct your information in the electronic services provided by Matkahuolto. If you have not registered as a user of the electronic services, or if you do not want to use the electronic services to check or correct your information, you can check and correct your information by contacting Matkahuolto Customer Service Centre referred to in section 1 of this privacy statement. Any requests for the erasure or transfer of the data or any objection to direct marketing must always be submitted to the Matkahuolto Customer Service Centre.

Matkahuolto will take action in response to the data subject’s request without undue delay and, as a rule, will provide the data subject with information regarding the measures taken with regard to their rights within one month of receiving the request.

The data subject has the right to lodge a complaint concerning the processing of personal data by Matkahuolto with the data protection authority. The complaint must be filed with the competent supervisory authority – in Finland, the Data Protection Ombudsman – in accordance with the instructions provided by the authority.

10. In conclusion

Matkahuolto reserves the right to update and revise this privacy statement. Matkahuolto will notify data subjects of any significant changes on its website or by other appropriate means.

Matkahuolto is not generally obliged to individually notify data subjects of changes, such as when the provision of such information proves impossible or would require unreasonable effort (for example, when there are no up-to-date contact details for the data subject), so the data subjects are encouraged to periodically review this statement for any changes.