Terms and conditions and data protection
VR’s terms and conditions
On this page, you can find VR’s Conditions of Carriage and the car transport terms. Changes to your plans? Read more about making changes and cancelling your ticket on the Customer Service page.
Customer service
Your safety is important to us
We have compiled tips for ensuring your train travel is as safe as possible. You find the most current information concerning train travel as well as the most frequently asked questions here.
Travel terms and conditions
19 April 2022
These Travel Terms and Conditions of VR-Group Plc’s (hereinafter “VR”) Passenger Services apply to all train journeys and services organised by the Passenger Services in Finland. These Terms and Conditions determine the rights and obligations of VR and its customers.
Separate provisions govern passenger rail traffic between Finland and Russia. For additional information on Helsinki Region Transport (HSL) tickets, contact HSL or go to HSL’s website.
There are separate terms and conditions for travelling with Interrail and Eurail passes. Separate rules apply to different first and last mile partnerships, which must be checked from VR’s webpage. The terms and conditions enter into force on April 19 2022 and are valid until further notice. They will replace VR’s Conditions of Carriage that entered into force on 17 December 2021. Rules related to car transport can be checked from the car transport terms and conditions.
1 Ticket
A ticket is a contract of carriage, according to which VR shall transport the passenger from the departure station to the destination station. The passenger shall have a ticket that is valid throughout the train journey and approved by VR.
The train journey starts when the passenger has boarded the train or another means of transport arranged by VR. VR is responsible for transport other than rail transport only if it is arranged by VR. The journey ends when the passenger has exited the means of transport in question.
Train timetables and the rolling stock may change in the period between the ticket purchase and the passenger’s journey. Customers that have given their contact information are informed of any material changes.
Personal tickets may only be used by the person whose name is marked on the ticket. In this case, the passenger shall be prepared to show a proof of identity. The rules governing changes and cancellations of tickets are ticket-specific. VR charges a fee for changes and cancellations. Lost, damaged or partly used train tickets cannot be changed or cancelled.
A ticket is not valid if the journey for the multi-ticket has not been reserved or the ticket has been altered or forged.
In VR’s long-distance traffic, the ticket shall be purchased from onboard personnel on the train at the latest. In VR’s commuter traffic, the ticket shall be purchased before boarding the train.
Even if the passenger has a ticket, he or she may be removed from the train if he or she endangers the safety of the service or other passengers or disturbs other passengers.
1.1 Ticket in VR’s long-distance traffic
VR’s long-distance traffic encompasses journeys made on InterCity, Pendolino, express and regional trains in the entire railway network in Finland. The customer shall always book a seat or a sleeping berth for single tickets and multi-tickets, with the exception of regional trains and buses.
The ticket entitles the passenger to travel in the train, class and seat indicated on the ticket. Under exceptional circumstances, VR’s onboard personnel may show the passenger to a seat other than the one indicated on the ticket or chosen by the passenger.
VR reserves the right to resell a reserved place to another customer in case the reservation holder is not reached for ticket inspection within reasonable time.
If the ticket is unreadable or damaged, VR may refuse to accept the change or cancellation of the ticket.
1.2 Ticket in VR’s commuter traffic
VR Commuter traffic encompasses traffic operated with commuter trains with line IDs in areas from Helsinki to Lahti and Nokia. VR’s commuter traffic tickets are not valid on VR’s long-distance trains.
The ticket shall be purchased before boarding the train. During the validity of the ticket, the passenger may change trains. This change shall take place within the validity period of the ticket. The ticket entitles the passenger to travel to the destination station indicated on the ticket even if the validity of the ticket ends before the arrival.
Single and multi-tickets that have been printed on paper shall be validated with the validator onboard immediately after boarding the train. The journey on a digital multi-ticket shall be activated before boarding the train. A digital single ticket shall be valid when boarding the train. The passenger must have the original ticket. A screenshot, picture or other copy of the ticket is not valid.
1.3 Ticket inspection
VR train staff may inspect tickets onboard the train. Passengers must present their tickets when requested. When changing trains, the ticket must also be presented upon request after the change. You must keep your ticket until you arrive at your destination.
If the passenger does not have a valid ticket on their person, they will be considered a ticketless passenger. A ticketless passenger may be removed from the train.
VR train staff has the right to impose an inspection fee upon a passenger found to be travelling without an appropriate and valid ticket. A ticketless passenger must identify themselves to the train staff upon request. When travelling with VR, all passengers are committed to paying any inspection fee imposed by VR train staff.
The passenger who has received an inspection fee may continue their train trip by purchasing a ticket. In other cases, the conductor has the right to remove a passenger from the train. The conductor has the right to remove a passenger from the train also if the passenger purchases a ticket during the ticket inspection but refuses to provide their personal data for the inspection fee. In this case, the ticket can be used in other train services where the ticket is valid.
1.4 Discounts
The passenger shall have a valid certificate proving their right to a discount with them for the entire journey.
When travelling with a discount ticket, the entitlement to a discount shall be proven in ticket inspection in a manner determined by VR. Otherwise it is deemed that the ticket is not valid and the passenger shall purchase a full-price ticket. A discount cannot be obtained retroactively.
2 Luggage, pets and children travelling alone
2.1 Luggage
The passenger may carry two pieces of luggage and a handbag, a backpack or a comparable piece of luggage. The passenger shall look after his or her hand luggage and is responsible for it. VR delivers lost property to the lost property office.
Hand luggage shall not inconvenience other passengers or rail traffic or cause damage to, for example, other passengers or luggage. If the passenger fails to adhere to the above, train personnel is authorized to refuse such pieces of luggage.
The passenger is liable for damage caused by his or her hand luggage in accordance with general liability provisions. The liability applies also to cases in which the hand luggage is placed so that the passenger cannot directly monitor it. VR is not liable for any damage caused by loss of or damage to hand luggage, unless the loss or damage is caused by VR’s or its personnel’s negligence or a circumstance referred to in the Rail Traffic Liability Act (5.2.1999/113).
Prams used by families with children and assistance devices used by passengers with reduced mobility can be transported free of charge onboard trains.
The Act on the Transport of Dangerous Goods and the Government Decree on the Transport of Dangerous Goods by Rail govern the transport of dangerous goods. Small amounts of dangerous goods may be carried as hand luggage in trains if the goods are packaged for retail trade and are intended for personal use or for sports and leisure time use and do not cause inconvenience or risk to other passengers or VR.
Firearms may be carried as hand luggage in trains as specified in the Firearms Act, that is, unloaded in a container.
Bikes may be transported in designated spaces onboard trains with a luggage car or bike spaces. In InterCity trains, a space for the bike shall be reserved in advance. Bikes cannot be transported on Pendolino trains. Bike trailers are transported empty and a bicycle fee is charged. More detailed information on transporting a bicycle can be found here.
Goods that require a lot of space can be transported as luggage in a separate luggage space on night trains. In this case, a luggage charge is collected. Before the journey, customers shall make sure that the transport is possible. Passenger is responsible for the loading of the luggage into the train, its transfer when changing trains and its pick-up at the destination station. With regard to its size, weight and other properties, the luggage shall be of such type that it may be transported without causing danger, damage or unnecessary inconvenience.
2.2 Pets
Pets are allowed in designated seats or spaces. If a pet is transported in other than designated seat, the passenger shall protect the seat with a cover. Passenger may travel with pets (and guide, assistance and hearing dogs) in sleeping cabins only in a pet cabin booked entirely for the group. Pets other than dogs shall be transported in pet carriers.
On commuter trains, pets may be transported free of charge in pet cabins. In long-distance trains, a pet charge is collected for the transportation of pets.
Passenger shall take care of his or her pet during the entire journey. Pets cannot travel alone.
2.3 Children travelling alone
Children travelling alone by train are under the responsibility of their parents. The conductor does not have an obligation to look after children during the journey.
3 Disabled passengers
Before the journey, customers shall ensure the availability of the services for disabled passengers. VR offers assistance service on stations that have an assistance point. Information about these stations is available on accessible train travel webpage, in VR’s customer service and in station ticket offices. The assistance service shall be ordered no later than 36 hours before the train’s departure time indicated on the timetable. Assistance devices used by disabled passengers are transported free of charge onboard trains.
An assistant of a disabled passenger may travel free of charge with the disabled person. The assistant shall be capable of assisting the disabled passenger throughout the journey. The assistant shall be over 18 years old. Passenger in a wheelchair does not need any separate certificate for assistants. In other cases, the passenger shall be able to prove the right to an assistant travelling free of charge. In VR’s long-distance traffic, the tickets for the disabled passenger and the assistant shall be purchased at the same time. In VR’s commuter traffic, the person being assisted shall have a valid ticket for the journey.
For passengers travelling with a guide, assistant or hearing dog, VR recommends service carriages for travelling in long-distance trains. In VR’s commuter traffic, guide, assistant or hearing dogs can be taken in any passenger cabin. On night trains, this is possible only in pet cabins booked entirely for the passenger’s use and accessible sleeping cabins. A separate charge is not collected for guide, assistance or hearing dogs.
4 Delays
VR’s live train updates are recorded into a system maintained by the Finnish Transport Infrastructure Agency and compensations are based on information received from the system.
When a train is delayed, compensation may be requested from VR. Rules related to delay compensation have been specified separately for long-distance traffic and commuter traffic.
In addition, compensation for damage caused by delays not exceeding EUR 5,000 may be requested from VR under the Railway Transport Act.
4.1 VR’s long-distance traffic
4.1.1 Compensation or re-routing
If a train service is cancelled or it is anticipated that arrival at the destination station indicated in the ticket will be over 60 minutes late, the passenger may
1. demand reimbursement of the ticket price for the journey not made and/or for the part or parts already made if the journey is no longer serving any purpose as well as for the potential return journey
2. continue their journey or be re-routed, under comparable transport conditions, to the final destination at the earliest opportunity
3. continue their journey or be re-routed, under comparable transport conditions, to the final destination at a later date.
In items 2 and 3, the passenger is entitled to delay compensation defined under section 4.1.2 However, in item 3, the passenger is not entitled to delay compensation for the delay of the original train service.
In case of a delay of 60 minutes or more, VR shall take all reasonable action to assist the passenger. As far as possible and having regard to the waiting time, this action will include the provision of refreshments and meals during the train journey. If necessary, alternative means of transport shall be organised for them.
If the journey cannot be expected to continue during the same day, VR provides reasonable accommodation, including necessary transport.
VR may also offer alternative transport (bus, taxi, etc.).
4.1.2 Compensation amount
If the passenger arrives at the destination indicated on the train ticket with a delay of 60 minutes or more, the passenger is entitled to receive 25% of the ticket price as compensation from VR. For delays of 120 minutes or more, the passenger is entitled to receive 50% of the ticket price as compensation. The compensation amount does not include fees related to additional services (e.g. surcharges related to seats, pets or bikes).
Possible delays in vehicle loading/unloading are not compensated.
Amounts under EUR 4 will not be paid.
4.1.3 Delay certificate
Upon request, the onboard personnel of a delayed train will give the passenger a certificate regarding the delay to be attached to the compensation application.
4.2 Compensation to season ticket holders in case of delays in VR’s commuter traffic
VR’s commuter traffic’s punctuality and operations are monitored by calendar month.
If VR’s commuter train services are cancelled or delayed by more than 10 minutes during a calendar month so that the trains that are cancelled and delayed by more than 10 minutes together constitute more than 10% of the month’s entire service offering, VR grants VR commuter traffic season ticket holders compensation as follows:
1. 14–30-day tickets: if even one day of the season ticket’s validity falls on the calendar month in which more than 10% of the month’s entire service offering is cancelled or delayed by more than 10 minutes, passengers is entitled to a 20% compensation of the 14–30-day ticket price.
2. 31–365-day tickets: if even one day of the season ticket’s validity falls on the calendar month in which more than 10% of the month’s entire service offering is cancelled or delayed by more than 10 minutes, passenger is entitled to a 20% compensation of the 30-day ticket price (delays during one calendar month, i.e. compensation is not paid for longer periods and compensation for delays during a calendar month are compensated only once).
4.3 Compensation for damage caused by delays
VR is liable to compensate passenger for damage caused by a train’s delay, cancellation or not stopping at a traffic point stated in the timetable, at the maximum EUR 5,000 per passenger. However, there is no liability to compensate for a delay that the passenger can reasonably be expected to have anticipated because of the nature of the transport, weather conditions, the time required for transferring to another transport mode or other conditions related to the transport.
To be relieved from liability to compensate, VR is required to prove that it has taken all reasonable measures to prevent the damage.
5 General rules related to compensation, injuries and damage
5.1 Personal injuries
In personal injuries, VR makes statutory advance payments to passengers or their dependants to cover immediate economic needs. The advance payments shall be proportional to the damage caused. VR is liable to the full amount of personal injury.
An amount of EUR 21,000 per passenger will be paid in advance in the case of death. In the case of injury, relevant and reasonable costs up to EUR 21,000 per passenger will be paid in advance.
Advance payments do not constitute recognition of liability and will be offset against any subsequent compensation paid. A demand may be made for the advance payment to be returned if the loss or damage was caused by the negligence or fault of the passenger or where the person who received the advance payment was not the person entitled to compensation.
Upon request, VR shall provide reasonable support for pursuing claims for injury-related compensation against third parties. This support may not conflict with VR’s own interests.
Compensation for personal injuries shall be requested from VR within three years of the moment when the injured party became or should have become aware of the injury. However, compensation shall be requested at the latest within ten years of the injury.
5.2 Loss and damage to property
Under the Rail Traffic Liability Act, VR is liable to the full amount for passenger’s clothes, luggage carried and animals that are damaged.
If the passenger notices, when receiving luggage, any damage to or loss of luggage, the passenger shall inform VR of this when receiving the registered luggage. In other case, the customer shall submit the notification within a reasonable amount of time after receiving the luggage.
The right to compensation is lost if the claim for damages is not submitted in writing to VR within a year or, if the damage has been caused intentionally or due to gross negligence by VR or a party that VR is responsible for, within three years.
Within a month, VR shall provide a response or inform the passenger of the date by which the response can be expected.
5.3 Compensation applications and the processing time
A compensation application form can be found at the vr.fi website. A compensation request can also be submitted at a ticket office or by calling our customer service number, after which the customer will be sent a printed compensation application form.
Applications are processed as quickly as possible, as a rule at the latest within one (1) month of receiving the application.
VR pays compensation to a bank account or as vouchers. Vouchers may be used to purchase services sold by VR.
6 Applicable legislation
Rail passenger traffic is governed by the following legislation and regulations:
a. Regulation (EC) No 1371/2007 of the European Parliament and of the Council on rail passengers’ rights and obligations (Regulation on railways’ responsibilities)
b. CIV Convention – COTIF (Convention concerning International Carriage by Rail) Appendix A (CIV)
c. national legislation, when it can be applied or its application has been agreed on: for instance,
- Railway Transport Act (1119/2000)
- Rail Traffic Liability Act (113/1999)
- Act on Maintaining Order in Public Transport (472/1977)
- Public Transport Penalty Fare Act (469/1979)
- Act on the Transport of Dangerous Goods (719/1994)
- Government Decree on the Transport of Dangerous Goods by Rail (195/2002)
- Firearms Act (1/1998).
A consumer has the right to have a dispute concerning rail travel resolved by the Consumer Disputes Board. For further information, see kuluttajariita.fi.
VR Car transport terms and conditions
Valid from 10 November 2021.
What kind of vehicles can be transported in a car-carrier wagon?
Car-carrier wagons and ramps are designed for normal, factory-made cars.
The following can be transported in car-carrier wagons:
- Roadworthy cars, station wagons and vans. The customer is responsible for ensuring that the vehicle meets the requirements
- Trailers coupled to the abovementioned vehicles, which are dimensionally suitable to be transported in car-carrier wagons
- Motorcycles and other power-driven vehicles. The customer is responsible for ensuring that the vehicle meets the requirements.
What can be carried in the vehicle during the journey?
It is strictly forbidden for the driver of the vehicle and passengers or pets to be inside the car or otherwise in the car-carrier wagon during the journey. Only the driver is allowed to enter the car-carrier wagon and must leave the wagon immediately after loading
In addition to the fixed equipment in the vehicle, passenger baggage may be left inside the car, on the roof rack, transport rack behind the vehicle, and the trailer during transportation.
- The roof load of the transported car may only consists of skis or suitcases or bags properly secured to the carrier or roof rack and protected from the effects of weather, loss and damage, within the dimensional limits specified below.
- Bikes can be transported in the transport rack behind the car properly secured and in accordance with the dimensions below
- Canoes or other large objects are not permitted on the roof of the car
- In car-carriers, the carriage of dangerous goods contained in ordinary articles and packed in small quantities for consumer use is permitted within the limits of the law.
Loading and unloading of cars
Loading and unloading a vehicle may be carried out by:
1) Vehicle loader reported by the customer
2) VR (when purchased with VR selected as loader)
Special remarks concerning loading and unloading of vehicles:
The driver of the vehicle must load and unload the following vehicles:
- Lower ground clearance cars
- Motorcycles
- Other motor vehicles
- Car-trailer combinations
- Cars with an alcohol interlock
- The loading of a car whose width in relation to the ceiling height prevents normal entry and exit of the vehicle may be banned.
- Lower ground clearance cars
If it has been agreed that VR will load the car at the time of the car space booking:
- The car must be delivered to a designated parking space at the car-carrier station
- The car must be at the loading point at the separately specified time in advance before the actual loading time starts. Cars arriving after the specified time will not be loaded
- The car keys must be left at the departure station at the separately specified time and place in advance before the actual load time starts. Keys delivered after the specified time will not be picked up
- In this case, VR loads the vehicle onto the train and delivers the car keys to the destination station. The keys can be picked up from the location indicated on the ticket by proving that you have the right to pick up the car.
- The car must be delivered to a designated parking space at the car-carrier station
Vehicle dimensional limitations in car-carrier wagons
There are two types of car-carrier wagons:
1) Fully covered car-carrier wagons
2) Partly covered and partly open car-carrier wagons
1) Fully covered car-carrier wagon (Gd car-carrier wagon)
- Height (including roof rack and load): not more than 1.84 m on the lower deck and 2.04 m on the upper deck
- Length: the maximum length of the car is 5.00 m, 10.00 m or 15.00 m, including load and protrusions, and the dimensions given in the reservation must no be exceeded
- Width: not more than 2.20 m, including load. Please note: the roofline of a car higher than 1.84 m can be up to 1.64 m wide
- Weight: not more than 3,000 kg and the axle or axle-group weight not more than 2,000 kg
- Rolling resistance: rolling resistance is attached to the tires and the height requirement is 15 cm in the front and back of the tires.
2) Partly covered car-carrier wagon (Gfot car-carrierwagon)
- Height (including roof rack and load): not more than 1.65 m on the lower deck and 2.05 m, 2.30 m or 2.60 m on the upper deck
- Length: the maximum length of the car is 5.00 m, 10.00 m or 15.00 m, including load and protrusions, and the dimensions given in the reservation must not exceeded
- Width: not more than 2.20 m, including load
- Weight: not more than 2,500 kg and the axle or axle-group weight not more than 1,400 kg
- Rolling resistance: rolling resistance is attached to the tires and the height requirement is 15 cm in the front and back of the tires.
Caravans in partly covered car-carrier wagons:
- Caravan height: not more than 2.60 m (including antennas and other parts rising above the roof)
- Caravan length: maximum 7.50 m, including towbar
- Caravan width: not more than 2.20m
- Caravan weight: not more than 1,400 kg.
Freight-carrying trailers in partly covered car-carrier wagons:
- Trailer height: not more than 1.60 m (including antennas and other parts rising above the roof)
- Trailer length: maximum 5.00 m, including towbar
- Trailer width: not more than 2.20 m
- Trailer weight: not more than 1,400 kg.
Responsibilities
Liabilities of the railway undertaking (VR)
- VR is responsible for the transport of the car when the customer loads the car onto the car-carrier wagon
- VR is responsible for the transport of the car, and the car during loading and unloading when VR loads and unloads the car onto/from the car-carrier wagon
- VR is responsible for the safe storage of the driver’s keys during the journey
- VR's liability for the car ends when the car is unloaded at an appropriate storage location
- VR is responsible for ensuring that the car-carrier wagon has sufficient space needed for the car
- VR is not responsible if the car cannot be loaded due to a reason beyond VR's control (for example, if the car does not start or there is something else wrong with the car)
- VR is not responsible for the functionality of the power supply for the entire duration of the journey
- VR is responsible for the wagon ventilation during loading and unloading
- The motorcycle driver attaches the bike or other power-driven vehicle and VR confirms the mount.
Responsibilities of the driver of the vehicle
- The driver of the vehicle is responsible for providing the correct weight and dimension information when placing the order. If the weight and dimension details provided by the driver differ from the actual weight and dimensions of the vehicle, VR is not obligated to carry the vehicle.
- When making the reservation, the customer must report, in addition to the weight and dimensions of the car, any roof box or roof load as well as other baggage, trailer and technical accessories transported outside the car
- The driver of the vehicle is responsible for the storage of the car in the parking space at the station
- For safety reasons, VR has the right to inspect the cargo load of a transportable van or an enclosed trailer, if necessary
- The car must be at the loading point no later than the time specified by VR. Cars arriving after the loading time will not be loaded
- When the driver of the vehicle drives the car onto the car-carrier wagon and out of the wagon at the destination station, the driver of the vehicle is responsible for loading and unloading of the vehicle
- When VR drives the vehicle onto the wagon and out of the car-carrier wagon, VR is responsible for loading and unloading of the vehicle
- At the destination station of the vehicle, the driver must check whether there has been any damage to the vehicle being transported or to its external equipment during transport
- VR has the right to take pictures of possible damage, if necessary
- If the driver of the vehicle suspects damage during transport, VR personnel must be informed immediately before leaving the unloading site
- The driver of the vehicle is responsible for securing the boxes and goods on the roof racks and carriers and for any damage they may cause
- VR is not responsible for any loss or damage caused to goods or property of third parties due to poor fastening or packaging during transport
- The motorcycle driver attaches the bike or other power-driven vehicle and VR confirms the mount
- The use of Webasto in a car-carrier wagon is permitted
- The use of an engine heater in a car-carrier wagon is permitted
- Charging an electric car in a car-carrier wagon is not permitted
- The driver of the vehicle locks the vehicle and closes the fresh air fan during transport
- The driver of the vehicle is responsible for using the auxiliary power and for starting the vehicle with the auxiliary power
- At the destination station, the driver of the vehicle must proceed to the place of unloading without delay. If the driver of the vehicle does not arrive at the place of unloading without delay, they will bear the costs of moving the vehicle and any other costs incurred as a result of their delay
- If the car is loaded in the outdoor area of the car-carrier wagon during the winter, the customer must check that there is no snow or ice in the engine compartment before starting the engine. If the customer fails to act in accordance with the above, VR will not cover any damage caused by snow or ice to the vehicle's engine at start-up.
Terms and Conditions of Corporate Contracts
1 Scope
This document outlines the terms and conditions pertaining to the corporate customer account (“VR Corporate Customer Account”) of corporate customers (“Customer”) registered with VR-Group Plc (“VR”). The VR Corporate Customer Account also covers any subsidiaries of the Customer operating under a different business ID, in which the Customer’s ownership exceeds 50%. The Customer is responsible for the VR Corporate Customer Account and for complying with the applicable terms and conditions. The Customer shall inform VR of any changes in its contact information, contact persons and corporate structure without delay.
2 Service provider and contact information
VR-Group Plc Passenger Services P.O. Box 488 FI-00101 Helsinki
Business ID 1003521-5
3 Services and products included in the VR Corporate Customer Account
The Customer can purchase VR train tickets and other services using the Corporate Customer Account. The ticket products and other services offered to the Customer by VR based on the VR Corporate Customer Account are specified in the valid service price list. VR has the right to freely change the ticket products, services and prices. The VR Corporate Customer Account does not cover any leisure time train trips of the Customer’s staff members. The VR Corporate Customer Account does not entail the right to resell any products or services.
4 Customer identifier and contractual discount
The VR Corporate Customer Account is used with a customer ID provided by VR. The Customer is responsible for ensuring that the ID is distributed and used securely throughout its organisation. VR is entitled to charge the Customer for all purchases made using the customer ID. VR shall not separately verify the purchaser’s right to use the customer ID. VR grants contractual discounts based on its criteria valid at the given time. The contractual discount applicable and the ticket products covered by the discount are specified according to the valid service price list. Contractual discount is only applicable to the Customer’s purchases made using the customer ID in the separately defined transaction channels. The transaction channels covered by the VR Corporate Customer Account are listed on VR’s website at www.vr.fi. Contractual discount is calculated at the moment of making the transaction and the discount is applied to the product’s price. VR reserves the right to change the contractual discount as well as the products and transaction channels to which it can be applied.
5 Terms of payment
The primary payment method is credit card. When paying with a credit card, the terms of payment outlined in the contract between the Customer and its credit card company apply. The use of invoicing as the payment method is subject to VR’s approval according to its specified criteria. Invoicing customers receive a weekly invoice to the address specified by the Customer. The term of payment is fourteen (14) days of the invoice date, unless separately agreed otherwise. The notice period is eight (8) days of the invoice date. The interest on arrears is determined by current interest legislation. VR can change the payment method to credit card at any time if it deems this appropriate, for example if the Customer has overdue payments, its credit rating falls below the A category or it violates these terms and conditions.
6 Terms and conditions of product and service sales and carriage
Separately defined terms and conditions of reservation, payment, change and cancellation apply to products and services. These terms and conditions are provided on VR’s website at vr.fi. Travel is governed by the Regulation of the European Parliament and of the Council on rail passengers’ rights and obligations (Regulation on railways’ responsibilities), the Finnish Rail Traffic Liability Act, the Railway Transport Act as applicable, and VR Passenger Services’ conditions of carriage.
7 Refund and compensation for products
Any claims concerning refund or compensation are processed according to VR’s applicable terms and conditions of sales and carriage and other applicable, valid regulations as outlined on VR’s website. Refunds for tickets purchased via travel agencies are always paid through the travel agency.
8 Liability
Each party shall be held liable for any direct damage caused to the other party by action or negligence. The parties shall not, under any circumstances, be held liable for any indirect damage such as loss of income or profits, interruption of operations, salary costs or other such damages or costs, unless this is caused by gross negligence or an intentional action of a party. VR’s compensation liability pertaining to VR Corporate Customer Accounts shall, in any case, be limited to a maximum of 20% of the Customer’s purchases made using its customer ID during the past 12 months before the damage. VR strives to provide a high-quality online service, but it does not assume responsibility for the uninterrupted availability of its website, Internet connections, technical problems, disturbance-free operation of the service or other such issues, nor for any damage caused to the Customer by any defects in the online service. VR does not assume responsibility for any external links on its website, the sites to which those links lead or for any damage caused to the Customer by using such links.
9 Transfer of the VR Corporate Customer Account
The Customer is not entitled to transfer the VR Corporate Customer Account or the related rights or obligations to a third party.
10 Force Majeure
If it becomes impossible or materially difficult for either party to fulfil its obligations related to the VR Corporate Customer Account due to a force majeure, i.e. a compelling reason that is beyond the parties’ scope of influence (including but not limited to strike, other forms of industrial action, fire, natural disaster, authority regulation), the party is discharged from its contractual obligations for the duration of the force majeure situation.
11 Personal data
By accepting these terms and conditions, the Customer gives VR the right to process data regarding it. VR always complies with the valid data protection legislation and its data protection notices and policies in the processing of personal data. These policies are provided on VR’s website at www.vr.fi. With regard to the processing of the personal data of the Customer’s contact persons and data processing related to the customer ID use, which may be required in order to fulfil this contract, the Customer is responsible for informing the data subjects as stipulated in legislation and for making sure that it has the right to release this data. VR is entitled to use the data according to its valid data protection notices and policies for such purposes as customer relationship management, service development and marketing, also in electronic format, such as e-mail communication. VR is entitled to record customer service calls and other communications and to use the records for such purposes as verifying business transactions, training and quality monitoring.
12 Confidentiality
Both parties undertake to maintain the confidentiality of any trade secrets or other information deemed to be confidential, which is obtained from the other party in conjunction with the VR Corporate Customer Account, and to refrain from using such information for any purposes other than the performance of the VR Corporate Customer Account contract.
13 Applied legislation and dispute settlement
The VR Corporate Customer Account is governed by Finnish law. Any disputes shall be primarily resolved by means of negotiation between the parties. If no agreement can be reached in negotiations, the disputes shall be finally resolved by arbitration in Helsinki in accordance with the Arbitration Rules of the Finnish Chamber of Commerce.
14 Changes in the VR Corporate Customer Account
VR has the right to unilaterally change the terms and conditions of the VR Corporate Customer Account.
15 Validity and termination of the VR Corporate Customer Account
The VR Corporate Customer Account shall become effective once the Customer has accepted these terms and conditions and received the customer ID from VR. Acceptance of these terms and conditions shall replace any earlier contracts concerning VR Corporate Customer Accounts. The VR Corporate Customer Account shall remain valid until further notice. Both parties are entitled to terminate the VR Corporate Customer Account by giving a written notice (by e-mail) to the other party. The Corporate Customer Account shall be terminated once VR has finished processing any outstanding issues that require a valid Corporate Customer Account. In order for the VR Corporate Customer Account to remain valid, the Customer must make sure that its data is correct, updated and corrected without delay throughout the customer relationship.
VR’s data protection
In the data protection notice, we explain how we process our customers’ personal data and protect their privacy.
VR’s data protection notice
26 April 2021
How we process your personal data
As we want to protect your privacy as comprehensively as possible, we take data protection seriously. We use your personal data only for the purposes we have indicated in advance and only to the extent necessary for the purpose of the processing in question. Your data will only be processed by individuals authorised to process personal data due to their work tasks. The data protection notice covers the protection of your privacy and, for example, the following information:
-
what types of personal data we collect and for which purposes
- when and how we can share your personal data with partners
- what rights you have and how you can access your personal data.
1 Controller
- VR-Group Plc (hereinafter referred to as “VR”)
- Business ID: 1003521-5
- PO Box 488
- FI-00101 Helsinki, Finland
- Tel. +358 307 10
2 Data Protection Officer and contact information
VR Group’s data protection officer: tietosuojavastaava(a)vr.fi
In any questions related to the register, please contact us through the data request form.
3 VR's customer
You can use our services anonymously when you purchase a ticket from a ticket vending machine, station ticket offices and R-Kioskis. On the other hand, you can use our services without logging in. In this case, your information will be collected in our customer register when purchasing and using our services.
3.1 What customer information do we collect and process?
We collect and process the customer information listed below: Information relating to travel and services
-
Purchase-related service, sales, payment and travel transaction data, including the journey details, payment method and other payment information, email address and/or telephone number needed for train ticket delivery or other service.
- When you purchase a personal ticket, we also ask you to provide your name and date of birth.
- Travel document information required for border crossings, such as passport number.
- Vehicle information provided by you for car transport and any photographs taken by VR of your car for processing damage cases.
- Data required for ordering and carrying out assistance service, such as name and contact information and a description of the need of assistance.
Information relating to the use of electronic services and background processes, such as
- Service usage data in different transaction channels, such as the Internet, vending machine and mobile services, including log and service transaction data and cookies required for combining the page view count.
- You can read about the collection of cookies in our cookie policy.
Information relating to communications and studies
-
Customer service call recordings.
- Messages that you have sent to us, such as chat, email and social media messages.
- Information that you have submitted on feedback and claim application forms and payments and messages relating to their processing. We will only process your health data in conjunction with customer contacts requiring it.
- Information provided in surveys related to service events, such as purchases or feedback processing.
- In customer surveys, we request demographic information, such as gender, to assess how representative the respondents are of the Finnish population.
- Information provided in connection with games and draws.
3.2 How do we use your information?
The processing of your personal data can be based on the performance of a contract that you have entered into with VR or your consent. In addition, the basis for processing can be a legitimate interest or legal obligation. Based on a contract made with you We use your information for performing the services of your choice when you contact our customer service. In customer service, we use your information to find your previous purchase and message history and be able to assist you in questions and problems relating to your bookings. We process your ticket delivery details (telephone and/or email) in order to inform you of major changes and disruptions concerning the services you have purchased. If you submit feedback to us or claim for compensation, we will store your information to process your contact. We may also compile any of your future contacts. When you take part in games and draws, we create a contact person with your details to perform any drawing. The purpose of our surveys and questionnaires is to develop the quality and content of services. After processing your contact, we may send you a customer survey concerning the service you received. On our site, we offer questionnaires targeting different customer groups, and after you have used our services, we may ask you about your experience of them. On our site, we may also offer you surveys with which we test new services and products. Participating in surveys is completely optional. We process customer information to create diverse customer profiles and segments for the development and statistical aggregation of our services, for instance. Such profiling does not have material impacts on the subject of the profiling. Based on your consent Your health data may be occasionally required for processing your claims. In this case, we will separately request your consent. In order to improve your customer experience, we may offer customised content or other individual services in our digital channels. For additional information about the customisation of services, see our cookie practices. When you consent to marketing in conjunction with games and draws, we can send you general and targeted marketing messages. In these messages, we provide information about our topical campaigns, new products and services and benefits of creating a VR username, for instance. Based on legitimate interest VR uses a social media management tool that collects and aggregates data from social media services. VR’s service agents and marketing communications specialists use the tool for creating and reporting responses and social media posts. We may transfer your information within VR Group on the basis of a legitimate interest, if there is a particular reason to do so. Based on our legal obligations With regard to trips to Russia, we collect your information and transfer it to border and other authorities. In addition, we may process your personal data to fulfil our obligations as laid down by law and regulations given by authorities, not forgetting security and responsibility. We may also transfer your data based on the authorities’ right to obtain information.
4 Customers who have created a VR username
Anyone over the age of 13 can create an account in VR’s services. Once you have created an account, you are responsible for your account’s login information as well as its accuracy, timeliness and appropriate use. If you suspect that someone has gained unauthorised access to your login information, please change your password immediately. You can delete your account by requesting its deletion via the feedback form.
4.1 What customer information do we collect and process?
When you use our services and make purchases after authentication and submit feedback or a claim, we will connect the events mentioned in section 3 to your customer username. In addition to the information mentioned in section 3, we collect and process the customer information listed below. Basic information about you and your customer account, such as
-
Name
- Address details
- Phone number
- Email address
- Date of birth
- Language
- Start of customer relationship and registration channel
Additional information you have provided related to your customer account By logging in to our old online shop, you can also store vehicle details, an identifier of your choice to be connected to bookings and your preferred ticket delivery method and address. You can also store other information that makes the use of services easier in your personal details, such as your favourite route and seat on the train. We process personal identity numbers in certain services that require the customer to be specified or identified, such as identification with a personal identity card. In identification with a personal identity card, the personal identity number is not provided as clear text and the original data cannot be restored on the basis of the string created. Any consent and prohibitions related to direct marketing you have given
- Marketing
- Surveys and questionnaires
- Travel-related notifications
- Use of location data
Information relating to communications and studies
-
Data related to marketing and customer communications, such as what kind of messages you have been sent and which messages you have opened.
- Information collected in surveys and questionnaires aimed at registered customers.
4.2 How do we use your information and for what purposes will your information be processed
The processing of your personal data can be based on the performance of a contract that you have entered into with VR or your consent. In addition, the basis for processing can be a legitimate interest or legal obligation. Based on a contract made with you We use your information to provide you with the best possible service throughout your customer relationship, both in face-to-face customer service and through our digital channels. By identifying you and your travel history and purchase behaviour, we can better address your needs and experience. The purpose of our surveys and questionnaires is to develop the quality and content of services. We send questionnaires targeting different customer groups, and after you have used our services, we may ask you about your experience of them. In addition, we may contact you to test new products and services. Participating in the surveys we send is completely optional. You can refuse to be sent surveys by contacting our customer service though the feedback form. We process customer information to create diverse customer profiles and segments for marketing and targeting of benefits or for the development and statistical aggregation of our services, for instance. Such profiling does not have material impacts on the subject of the profiling. Based on your consent When you consent to marketing, we may send you general and targeted marketing messages. In these messages, we provide information about our topical campaigns, new products and services. In the VR Matkalla app, you can enable travel-related communications to get real-time information about the progress of your journey. By enabling location in the app, we can enrich your user experience of the app. When the processing of your personal data is based on your consent, you can change your consent whenever you like. To change your consent, log in to your personal details on our website or using the VR Matkalla app. Your health data may be occasionally required for processing your claims. In this case, we will separately request your consent. In order to improve your customer experience, we may offer customised content or other individual services in our digital channels. For additional information about the customisation of services, see our cookie practices.
5 Corporate customers and business travellers
Corporate customers refers to companies that have a contract with us. Each company a contact person(s) whose information is stored in our customer register. In addition, information about other corporate users, such as business travellers, is stored in our register. Business travellers are employees of a company with a contract who have been created a username.
5.1 Information collected about customers/What information do we process
We connect journeys made with the company’s username with the company’s information. For corporate customers, we collect the contact person’s address details, email address and telephone number. With regard to business travellers, we may collect the username, name and email address. Information relating to questionnaires and surveys
- Information provided in satisfaction surveys associated with service events
- Information collected in other surveys and questionnaires
- In customer surveys, we request demographic information, such as gender, to assess how representative the respondents are of the Finnish population.
- In some questionnaires/surveys, the survey results can be linked to an individual. However, the information is not reviewed at the individual level, but as groups, assessing satisfaction with on-board services among passengers on a specific route, for example.
5.2 How we use your information and for what purposes is your information processed
The grounds for processing your personal data can be performing a contract you have entered into with VR, legitimate interest or legal obligation. Based on legitimate interest Processing the company contact person’s data is required for the controller’s legitimate interest and performing the cooperation contract. We process the personal data of contact persons of VR’s external stakeholders for contacts necessary for the cooperation, such as communications, invoicing and to invite the contact person to diverse events. The data subject has been designated as the company’s contact person by the person who entered into the contract or by the data subject.
6 Sources of data
Customer-related data is collected primarily from the customer directly and when using our services and travelling. Customer-related data is accumulated in VR’s information systems, for instance,
-
at station ticket sales, trains, ticket vending machines, telephone service and electronic service channels and our partners’ sales channels in conjunction with orders, service purchases and use and other customer service events
- when travelling, such as when the ticket is scanned and when using the restaurant car services
- in conjunction with customer questionnaires and surveys
- in conjunction with games and draws
- at customer events, such as fairs
- in conjunction with marketing
- in our digital services, i.e. the website and when using the VR Matkalla app, for instance; read about cookies
- in our social media channels.
7 Processors of personal data
As the controller, we process the personal data ourselves, but we also use reliable service providers. The service providers can vary, but their duties include the maintenance and development of IT systems, service production and various research and development tasks. The service providers of our choice process personal data commissioned by us. The data processing follows the current legislation, and it has been agreed upon in contracts between the organisations.
8 Transfer or disclosure of data
We may disclose your personal data to our partners in the following situations:
-
When you purchase our partner’s services from us, we may disclose your personal data necessary for the implementation of the service to our partner.
- We may disclose your feedback and contact information to our partner if your feedback concerns services provided by said partner. However, we ask you to primarily contact our partner directly. If we decide to transfer feedback containing your personal data, we will inform you of the disclosure of the data.
- When we resell HSL tickets, we provide HSL with personal data relating to your purchase, such as phone number and your device identifier.
- When you submit feedback about HSL’s services, HSL is the controller. In this case, we will forward your feedback to HSL and inform you of the disclosure of your personal data.
- When we impose a penalty fare, we transfer your personal data to a service provider for sending the payment.
- If you start using a service and allow the disclosure of your data when taking it into use, data can be disclosed to the service provider in question (such as Mobile Pay).
- In cases referred to in section 156 of the Act on Transport Services, we can disclose data/access a partner’s data for performing the partner’s services.
- We may disclose your feedback and contact information within the VR Group, if your feedback concerns other Group companies.
- With regard to journeys to Russia, necessary information relating to travelling is handed over to the border guard and other authorities and the Russian Railways (RZD).
Personal data can be transferred outside the EU and EEA in conjunction with the provision of IT services if the personal data can be accessed from a country outside the EU and EEA. Transfer is possible when 1) a contract has been entered into with the service provider following the standard contractual clauses of the European Commission or 2) the receiving country has an adequate level of data protection as decided on by the European Commission or 3) the company that processes the data has Binding Corporate Rules or 4) there are other legal grounds for the transfer. You can see Commission decisions on standard contractual clauses here.
We will not disclose customer information to parties outside VR or parties other than those participating in the production of VR’s services without grounds based on the General Data Protection Regulation.
9 Data retention period
We store personal data only for as long as it is necessary for the purposes of use and in accordance with the legislation that is in force at each particular moment. After this, personal data will be either erased or anonymised. In storing personal data, we comply with legal obligations, taking into consideration the legislation on accounting and the EU regulation on rail passengers’ rights and obligations and the Rail Traffic Liability Act. We will store your personal data in our services as follows:
-
We will store your basic information and general customer relationship-related information, information relating to the management of the customer relationship, your consent and refusals and customer classification data throughout your customer relationship.
- The end of your customer relationship will have an impact on the retention period. We will terminate your customer relationship without any separate measures if no journeys or contacts have been associated with your customer account for seven years. In this case, your data will be erased from the system within six months.
- As a customer, you also always have the right to request your customer relationship to be terminated without delay. In this case, your data will be erased from the system within three months.
- We will store our accounting-related data (such as purchases and claims) for the current year and the next six years in line with the Accounting Act.
- We will store your feedback and other similar contacts for five years.
- Campaign and marketing data will be stored for two years.
- Survey and questionnaire data will be stored for five years.
- Customer service call recordings will be stored for seven months and call history (numbers) for 12 months.
- Information collected through competitions and games will be stored for five months.
- We will store your passport information relating to cross-border travel for one month after your journey.
- Ticket delivery data (email and/or phone number) will be kept for seven years.
- Our social media tool stores data for three years.
When the contractual relation ends, the data retention period is determined according to the purpose of use and existing legislation.
10 Our customers’ rights
As our customer, you have a right to access your personal data of which VR is the controller. You can exercise your rights by submitting a data protection request with the online form on the vr.fi website. Alternatively, you can submit the request by calling VR’s customer service. You will receive a response to your request no later than one month after sending the request. We ensure these rights as described here by taking the applicable legislation and restrictions set therein into account. If you buy tickets through another service provider, the provider in question will act as an independent controller. When exercising the rights of a data subject through VR’s services, the request will not be directed or transferred to the other controller. Please contact the service provider in question directly when wishing to exercise your rights under the General Data Protection Regulation. As our customer, you have the following rights related to data protection:
-
Right to access data: You have the right to receive a copy of your personal data from VR and a confirmation of whether we have processed your personal data. The primary method for delivering the copy is encrypted email or alternatively mailing the document. Some data, such as call recordings, can only be accessed by visiting a VR office.
- Right to rectification: You have the right to request us to rectify inaccurate or erroneous data about you. When you register in our digital services, you can edit your personal data directly through our website or application. Such data includes, for instance, your name, address and contact details.
- Right to erasure: You have the right to request us to erase your personal data. Requests are handled on a case-by-case basis. VR has a legislation-based obligation or right to store certain data; such data cannot be erased.
- Right to restriction of processing: You have a right in certain special situations stipulated by the regulation to request the restriction of the processing of your personal data.
- Right to object: You also have a right to object to the use of your data in direct marketing, for instance. On grounds relating to your particular situation, you can object to processing that is based on VR’s legitimate interest.
- Right to data portability: You have the right to receive your data from us in a structured and commonly used format, which will enable you to transfer your data to another controller. This right concerns data that is in electronic format and whose processing is based on consent or the performance of a contract. We will provide the data to you via encrypted email.
- Right to withdraw consent: You have the right to withdraw the consent you have given when it is the grounds for processing personal data. When the consent is withdrawn, the consent-based processing of personal data will be discontinued. Private customers who have registered in the service may withdraw their consent to electronic direct marketing by logging in to our website and editing their data.
- Right to lodge a complaint with an authority: We seek to resolve any disputes primarily with our customers. If you find that we have not processed your personal data as stipulated by law, you may lodge a complaint with a supervisory authority.
11 Principles of data protection
We ensure the data security of the processing of our customers’ personal data processing and personal data confidentiality, integrity and accessibility with appropriate technical and organisational measures in accordance with VR’s data security principles. Personal data is protected against unauthorised access and illegal or accidental processing. Personal data is processed only by persons specifically appointed by VR to such tasks. We provide data protection training and guidance to our employees who process customer data.
Joint register with Facebook
26 April 2021
This applies to VR’s Facebook pages, the tracking pixel, and messaging services. These situations arise when you like a VR Facebook page, join or follow a VR community on Facebook, or chat with VR in the messaging service.
Controller
Facebook Ireland (“Facebook”) and VR-Group Plc act as joint controllers with regard to the fan and community pages, tracking pixel and messaging services on Facebook, as applicable. Information on the joint controllership and the data required under Articles 13(1) (a) and (b) of the GDPR are available in the Facebook privacy notice:https://www.facebook.com/about/privacy.
Facebook processes data in accordance with its privacy policy: www.facebook.com/about/privacy, which specifies, among other things, Facebook’s legal basis for the processing of personal data and the rights of data subjects. Facebook has the primary responsibility for compliance with the data protection legislation and the implementation of data security and the rights of data subjects in the service. You can manage your Facebook-related data protection settings on Facebook. VR is responsible for processing the content of the messages.
Data that is processed and the purpose and legal basis of the processing
Regarding individual data subjects, VR receives from Facebook the name given on Facebook, public profile picture and other data that the data subject has specified as public on Facebook. The data subject can also give other personal data in the comments or messaging services of the community pages. VR processes personal data on Facebook based on its legitimate interest.
The customer service on Facebook is part of VR’s multi-channel customer service. The registered data is not used for automatic decision-making or profiling that would affect the legal rights of the customers as data subjects. VR collects anonymised data for its own data and analytics platform in order to gain an overview of the topics discussed on social media, allocate appropriate resources to customer service, and support service development. VR may organise competitions on Facebook, in which case the data is processed in accordance with VR’s data protection notice, as stated in the competition.
VR uses social media tools to manage activities on Facebook. VR does not transfer personal data outside of the European Union or the European Economic Area without a legal basis. Some of our service providers are located outside the EU/EEA, and we may transfer personal data to these service providers if it is necessary for the purposes specified in this data protection notice. We use the necessary contractual protection measures (e.g. the standard contractual clauses on data protection approved by the European Commission) when we transfer personal data to such service providers.
VR recommends using VR’s feedback from for personal contacting or for sending messages that contain your personal data (such as name, address, telephone number) in order to ensure the confidentiality and data security of the communication.
You can limit the processing of your personal data by unliking and/or unfollowing the community page. You can also request the removal of your data by using the data protection form.
Rights of data subjects
You can read about the rights of data subjects against Facebook Ireland in the privacy policy of Facebook Ireland at https://www.facebook.com/about/privacy.
In addition, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.
- VR Group’s data protection officer: tietosuojavastaava(a)vr.fi
- Questions concerning the register should be sent by e-mail to: palaute(a)vr.fi
Data Protection Notice for VR-Group Plc’s camera surveillance (CCTV)
25 May 2018
1 Controller
- VR-Group Plc (hereinafter referred to as “VR”)
- Business ID: 1003521-5
- PO Box 488
- FI-00101 Helsinki, Finland
- tel. +358 307 10
2 Contact person in matters related to the data file
- Pekka Ahola
- VR-Group Plc
- PO Box 488
- 00101 Helsinki, Finland
- Data protection officer: tietosuojavastaava(a)vr.fi
3 Purposes of the processing of personal data
Personal data is processed to ensure the maintenance of order and safety and to look into criminal offences, incidents or accidents in VR’s premises, properties, outdoor areas and part of its rolling stock.
The processing of personal data is based on the controller’s legitimate interest.
4 Sources of data
A camera surveillance system that consists of recording surveillance cameras in VR’s premises, properties, outdoor areas and rolling stock.
There are surveillance cameras also in some of VR-Group Plc’s road transport vehicles.
VR has recording camera surveillance in the public spaces of the following stations:
Helsinki Central Railway Station, Hyvinkää, Hämeenlinna, Iisalmi, Imatra, Joensuu, Järvenpää, Kajaani, Karjaa, Kemi, Kerava, Kirkkonummi, Kokkola, Kouvola, Kupittaa, Lahti, Lappeenranta, Mikkeli, Oulu, Pieksämäki, Pori, Riihimäki, Rovaniemi, Salo, Seinäjoki, Tampere, Turku, Vaasa, Ylivieska.
5 Data content of the data file
Time- and location-specific visual recordings from VR’s premises, properties, outdoor areas and rolling stock, recorded by the camera surveillance system.
6 Recipients of personal data
Personal data is disclosed, to the extent permitted by law, to the Finnish Transport Agency and, upon request, to other authorities. Data can be disclosed to companies belonging to the same group in order to present legal claims and to insurance companies for processing accident cases.
We use external parties to support the processing of personal data in the maintenance and development of IT systems and safety monitoring room duties, for instance. These service providers process personal data commissioned by us and on our behalf. The data processing follows current legislation and is always carried out in accordance with this data protection notice. This is ensured, among other things, through contracts between the organizations.
7 Transfer or disclosure of data outside the EU or the EEA
Data will not be disclosed outside the EU or the European Economic Area or outside countries which the European Commission considers to have an adequate level of data protection, unless the adequate level of data protection has been ensured with contracts or in another manner required by law.
8 Data retention period
Normally, camera recordings are stored for one month at the maximum. However, data may be stored for a longer time, if necessary (upon authorities’ request, for instance).
9 Our customers’ rights
Right to access data / right to review data
A person has the right to access the data that has been stored about them in VR’s camera surveillance data file. After submitting a sufficiently detailed and specific access request, the person has the right to access data about them included in the recordings, subject to the rights and restrictions that are defined in more detail in the General Data Protection Regulation. The access request must be made in writing, signed and sent to: VR-Group Plc, PO Box 488, FI-00101 Helsinki, Finland.
The response to the request will be mailed to the person who submitted the request. A reasonable fee will be charged for the access request if it is less than a year since the previous access time.
Please note that in the railway network, camera surveillance in platform areas and in some of the stations falls under the responsibility of the Finnish Transport Agency.
Right to lodge a complaint with an authority
We seek to resolve any disputes primarily directly with data subjects. If a customer finds that we have not processed personal data as stipulated by law, the customer may lodge a complaint with a data protection authority.
10 Principles of data file protection
VR’s premises where personal data is processed are protected with access control as defined in the facility security guidelines.
Paper documents/records are stored in locked premises where outsider access is completely prohibited. Only separately appointed persons can access these documents/records. Documents are disposed of according to data security guidelines.
As defined in VR’s data security policy, electronic documents and data are protected with usernames and passwords as well as with firewalls against external intrusion. Only persons who have been given access rights can access the data.