Privacy policy and Data Protection Notice
1. Introduction
17.6.2026
This data protection notice may be updated from time to time, for example due to changes in legislation, service development, or changes in our practices. Any significant changes will be communicated appropriately, and the latest version of the data protection notice will always be available in our service. We recommend reviewing the notice regularly to stay informed of any updates.
How we process your personal data
Protecting your privacy is important to us. We process your personal data carefully, lawfully and transparently. We use your personal data only for the purposes specified in advance and described in this notice, and only to the extent necessary for the purpose of the processing.
Your personal data will only be processed by those individuals whose job duties require them to do so.
In this data protection notice, we explain, among other things:
- what personal data we collect and for what purposes we use it
- when and on what grounds we may disclose or transfer your personal data
- what rights you have in relation to your personal data and how you can exercise these rights.
1. Data controller
- VR Group Plc (hereinafter VR)
- Business ID: 1003521-5
- PO Box 488, 00096 VR
- Tel. 0307 10
2. Contact person for matters relating to the register
- VR Group Data Protection Officer: tietosuojavastaava(a)vr.fi
- You can contact us regarding questions about the register via the form.
3 Data subjects and data sources
This data protection notice describes the processing of personal data relating to VR’s customer relationships, travel, the use of digital services and customer communications.
3.1 Categories of data subjects
This notice applies to the following groups of data subjects:
Customers who have created a VR account
Individuals who have registered for VR’s services and created a personal VR account. Anyone aged 13 or over can create an account. The VR account contains information relating to the customer relationship, transactions and travel, as well as the consents and choices provided by the customer.
Other customers
Other customers include people who interact with VR without a VR account, for example:
- when buying a ticket from a ticket office, ticket machine or retailer
- when travelling on a train
- when contacting customer service
- when taking part in surveys, campaigns or prize draws.
Corporate customer contacts and business travellers
A corporate customer refers to a company that has entered into an agreement with VR. These registered parties include:
- contact persons appointed by the company
- company administrators for VR’s services
- business travellers whose VR account is linked to a corporate profile
Journeys made via the corporate profile and related data can be linked to the client company’s contractual relationship.
Individuals using social media channels
Data subjects also include individuals who interact with VR on social media channels, for example:
- by following or commenting on VR’s pages
- sending messages
- taking part in campaigns or competitions
In these situations, the processing of personal data may also involve joint controllership with the social media service provider, which is described in more detail later in this notice.
3.2 Sources of personal data
We collect personal data primarily from the data subject themselves. Data is collected, for example:
- in connection with registration for services and customer relationship management
- in connection with ticket purchases, travel and other service transactions
- in connection with customer service contacts, feedback and claims for compensation
- in connection with surveys, research, campaigns and prize draws
- in connection with the use of digital services (e.g. log and usage data)
- in connection with interactions on social media channels
In addition, we may obtain personal data:
- from a client company when the relationship relates to a corporate contract
- from our partners in connection with the provision of the service
- from public authorities where required by law
When using digital services, personal data may also be collected through the use of cookies and other similar technologies. Further information on these can be found in our cookie policy.
4 Purposes of processing personal data, categories of data and legal bases
We process personal data for predefined purposes. The data categories processed for each purpose and the legal basis for processing are described below.
Processing may be based on a contract, consent, legitimate interest or a legal obligation, depending on the purpose of the processing.
Where the processing of your personal data is based on your consent, you may withdraw your consent at any time. You can withdraw your consent by logging into your account either on our website or in the VR app.
If the processing is based on a legitimate interest, we have assessed the necessity of the processing and carried out a balancing test, in which we have weighed the controller’s legitimate interest against the data subject’s rights and freedoms. Our legitimate interests may include, for example, providing and improving transport services; ensuring safety and preventing misuse; maintaining and managing customer relationships; and developing services and customer experience. Processing is carried out only when we assess that it does not override the data subject’s fundamental rights or freedoms. In this assessment, we take into account, in particular, the data subject’s reasonable expectations based on their relationship with us, as well as the nature of the data and the impact of the processing.
4.1 Provision of services and fulfilment of the contractual relationship
Purpose
Ticket sales, travel arrangements, establishing and managing customer relationships, fulfilling corporate contracts, payment processing, invoicing and reporting, providing additional and special services (such as assistance and car transport services), and service-related fault reporting and other service communications.
Categories of data processed
- identification data, such as name and date of birth
- contact details, such as address, email address and telephone number
- customer details, such as the start date of the customer relationship, the registration channel and the language
- travel, booking and service details
- location data when the data subject has enabled in-journey communication or another location-based service
- payment details and payment transaction details
- ticket delivery details
- passenger information relating to border crossings
- vehicle information relating to car transport and any photographs taken in the event of damage
- information relating to assistance services, which may include special categories of data, such as health-related information
For corporate contracts, we also process:
- the names, contact details and job titles of the contact persons designated by the company
- information on which company the VR account is linked to
- journeys made using the corporate profile and related invoicing and reporting details
Legal basis
- Contract with the data subject
- Legal obligation (e.g. accounting legislation, transport and safety regulations, obligations imposed by public authorities)
- Where special categories of personal data are processed, such processing is carried out only where necessary and based on applicable legal grounds under, such as explicit consent or compliance with obligations under applicable law
- In the case of corporate customers and stakeholder contacts, the data controller’s legitimate interest based on the management of contractual relationships and communication related to cooperation. The data subject has been designated as the company’s contact person at the request of the contracting party or the data subject themselves.
4.2 Customer service and communications
Purpose
Provision of customer service, responding to enquiries, processing feedback, handling complaints and claims for compensation, paying compensation, informing customers of changes to the service, ensuring and developing the quality of customer service, and consolidating any subsequent enquiries relating to the same matter in order to handle the case. Some stages of customer service processing may be supported by automated methods and artificial intelligence solutions (such as the creation of transcripts of call recordings).
Data categories processed
- contact details, such as email address and telephone number
- customer and travel details to the extent necessary for handling the matter
- recordings of customer service calls and the transcripts and summaries produced from them
- call history data (numbers)
- chat, email and social media messages
- information provided on feedback and claims forms
- any health information where necessary for the processing of an individual claims case
- information required for the payment of claims, as well as additional information relating to any international payment transactions
Legal basis
- Contract with the data subject, insofar as the processing relates to the service agreement
- The data controller’s legitimate interest, based on the organisation of customer service, the documentation of operations, the prevention of misconduct and the development of service quality
- Explicit consent when processing health data for the purpose of handling an individual claims case, or, where applicable, processing necessary for the establishment, exercise or defence of legal claims.
4.3 Marketing, campaigns and customer communications
Purpose
Sending general and targeted marketing messages, communicating about customer-related benefits and services, running campaigns and prize draws, target marketing and monitoring its effectiveness, promoting awareness of services, and communicating about the benefits of being a customer. Marketing and communications may also be planned and targeted using automated methods.
Data categories processed
- contact details, such as email address and telephone number
- customer and purchase history
- marketing consents and opt-outs
- communication channel preferences
- information on messages sent, as well as opening of messages and click activity
- information provided in connection with campaigns and prize draws
Legal basis
- Consent in the case of electronic direct marketing or other consent-based marketing
- The data controller’s legitimate interest where the processing relates to communications concerning an existing customer relationship and the marketing of services to customers.
4.4 Surveys, customer questionnaires and service development
Purpose Assessing customer satisfaction and service experience, conducting surveys and customer questionnaires, developing services, products and operating practices, and communication regarding the testing of new services and products.
Surveys may be sent, for example, after a service event or targeted at different customer groups. In addition, personal data may be used for the design, testing and impact assessment of new services and features. The analysis of surveys and questionnaires, as well as service development, may be supported by automated methods and artificial intelligence.
Data categories processed
- contact details for sending surveys
- customer, travel and service data insofar as they relate to the service event being evaluated
- responses to customer surveys and studies
- background information collected in surveys (e.g. postcode)
- data relating to the use of services for development purposes
Survey results are generally reviewed at group level. Individual responses are not used for automated decision-making that would have legal consequences or similar significant effects on the data subject.
Legal basis
- The data controller’s legitimate interest, based on the evaluation of the quality of the services, as well as development and the improvement of customer experience
- Consent where required by the research or survey.
4.5 Analytics, profiling and personalisation
Purpose
Analysis of operations, monitoring of service usage, formation of customer groups and segments, and personalisation of digital services and communications. Data may be statistically combined to form customer profiles and segments, for example, for the purposes of service design, developing the customer experience and targeting communications. Analytics and segmentation may also be carried out using automated methods and artificial intelligence.
Data groups to be processed
- service usage data across different service channels log and transaction data
- data collected using cookies and similar technologies
- customer and purchase history
- customer profiles and segmentation data
Profiling is used to form customer groups and to target services and communications. Profiling and other automated analytics, including the use of artificial intelligence, do not result in automated decision-making that would have legal effects on the data subject or similarly significant effects.
Legal basis
The data controller’s legitimate interest, based on the analysis of operations, the development of services and the improvement of the customer experience Consent where processing is based on optional cookies or other similar technologies.
4.6 Compliance with legal obligations and cooperation with authorities
Purpose
Fulfilment of obligations arising from legislation and official regulations, ensuring security, and responding to information requests from authorities. This includes, for example, fulfilling accounting obligations, disclosing information relating to border crossings to the competent authorities, and processing related to inspection fees and other statutory measures.
Data categories processed
- accounting records and payment details
- passenger data relating to border crossings
- customer and travel data to be disclosed to the authorities
- identification and contact details relating to inspection fees
Legal basis
- Legal obligation
4.7 Social media channels and joint data controllership
Purpose
Interaction with customers and other stakeholders, providing customer service, communication, organising campaigns and competitions, analysing and developing social media activities, and using social media management tools for managing posts, customer communication and reporting.
When you interact with social media channels maintained by VR, for example by following pages, commenting on posts or sending messages, we process personal data related to that interaction.
The processing of personal data on social media channels may involve joint controllership with the relevant service provider to the extent that VR and the service provider jointly determine the purposes and means of processing, such as in relation to page visitor statistics or other analytics.
Categories of data processed
- public profile information on the social media service messages and comments
- data provided in connection with campaigns and competitions
- analytics and statistical data produced by the service provider
Legal basis
- The data controller’s legitimate interest, based on communication, maintaining customer relationships and enhancing the visibility of operations
- Consent where processing relates to tracking technologies or targeted advertising.
5 Processors of personal data
VR processes personal data as the data controller. However, in providing our services and supporting our operations, we use external service providers who process personal data on behalf of VR.
Service providers may process personal data for purposes such as:
- maintenance and development of IT systems
- provision of customer service solutions and communication systems
- payment processing and invoicing
- analytics and reporting services
- marketing implementation
- social media management tools
- call recording and transcription, as well as other technical support services
Service providers process personal data solely in accordance with VR’s instructions and may not use the data for their own purposes. VR ensures, through contracts and other appropriate measures, that the processing of personal data complies with data protection legislation and that personal data is adequately protected.
6 Disclosure and transfer of personal data
We may disclose your personal data to our partners in the following situations
- When you purchase services from our partners through us, we may disclose your personal data necessary for the provision of the service to our partners.
- We may disclose your feedback and contact details to our partners if your feedback relates to a service provided by our partner. However, we ask you to primarily contact our partner directly. If we forward your feedback containing personal data, we will inform you of the disclosure of your personal data.
- When we charge a inspection fee, we will pass on your personal data to the service provider for the purpose of sending the invoice.
- During service disruptions, necessary customer and travel data may be shared with service providers supporting real‑time disruption communication (e.g. traffic or incident communication partners).
- If you start using a service for which you consent to the disclosure of data during the set-up process, data may be disclosed to the relevant service provider (e.g. MobilePay).
- If you are travelling on a corporate account, we may disclose journeys made via the corporate profile, along with related booking, travel, invoicing and reporting data, to authorised administrative users of the corporate account for the purpose of managing and coordinating journeys.
- We may disclose your feedback and contact details within the VR Group if your feedback concerns other companies within the Group.
- Necessary passenger data relating to international travel is disclosed to foreign authorities and transport operators when crossing borders, if required by legislation or official requirements.
Personal data may be transferred outside the EU and EEA in connection with the provision of IT services if the personal data can be accessed from a country outside the EU and EEA. A transfer is possible where 1) an agreement has been made with the service provider in accordance with the standard contractual clauses adopted by the European Commission, or 2) the recipient country has an adequate level of data protection as determined by a decision of the European Commission, or 3) the company processing the data has binding corporate rules (Binding Corporate Rules) or 4) there is another lawful basis for the transfer. Where required, we assess the level of data protection in the recipient country and carry out transfer impact assessments.
We do not disclose customer data to parties outside VR or those involved in the provision of VR’s services without a basis under the General Data Protection Regulation.
7 Retention period for personal data
We retain personal data only for as long as is necessary to fulfil the purposes described in this notice or to comply with legal obligations. After this, the data is deleted or anonymised.
Retention periods are determined based on the purpose of processing as follows:
- Basic customer data is retained for the duration of the customer relationship. Customer data may be deleted if it has not been used for several years, after which the data will be deleted within a reasonable period of time.
- Data relating to contracts and payments is retained in accordance with accounting legislation.
- Data relating to customer service, complaints and compensation matters is retained for as long as required for the handling of the matter and any monitoring of the liability period.
- Data relating to marketing is retained for as long as the customer relationship is active or until the data subject withdraws their consent or objects to the processing.
- Data collected for research and development purposes is generally retained in anonymised or statistical form.
- Passenger data relating to border crossings is retained only for the period required by law.
8 Rights of data subjects
As a data subject, you have rights regarding your personal data insofar as VR acts as the data controller. You can exercise your rights by submitting a data protection request via the online form on the vr.fi website or by contacting our customer service. We respond to your request without undue delay and no later than one month after receiving it. We implement these rights in accordance with applicable legislation and take into account any statutory limitations.
Requests are generally processed free of charge. However, we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive. We may request additional information to verify your identity before fulfilling your request.
If you purchase tickets or services through another service provider, that service provider acts as an independent data controller. A data protection request made via VR does not apply to or get passed on to another data controller. If you wish to exercise your rights in such a situation, please contact that service provider directly.
The data subject has the following rights:
Right of access to data You have the right to obtain confirmation as to whether we are processing your personal data, as well as the right to receive a copy of the personal data we process. The copy will primarily be provided electronically in a secure format or, if necessary, in writing.
Right to rectification You have the right to request the rectification of inaccurate or incorrect personal data, as well as the completion of incomplete data.
Right to erasure In certain circumstances, you have the right to request the erasure of your personal data. This right does not apply in situations where we have a legal obligation or other lawful grounds to retain the data.
Right to restriction of processing In certain situations, you have the right to request that the processing of your personal data be restricted.
Right to object to processing You have the right to object to the processing of your personal data based on the controller’s legitimate interests. You always have the right to object to the processing of your personal data for direct marketing purposes.
Right to data portability You have the right to receive the personal data you have provided in a structured, commonly used format, and the right to transfer that data to another controller, insofar as the processing is based on consent or a contract and is carried out by automated means.
Right to withdraw consent If the processing of personal data is based on consent, you have the right to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out prior to withdrawal.
Right to lodge a complaint with a supervisory authority If you consider that your personal data has been processed unlawfully, you have the right to lodge a complaint with the competent data protection authority.
9 Data protection principles
We ensure the security of personal data processing and safeguard the confidentiality, integrity and availability of data through appropriate technical and organisational measures in accordance with VR’s data security principles.
Personal data is protected against unauthorised access, unauthorised or unlawful processing, and accidental loss, alteration or destruction. Personal data may only be processed by those individuals who are authorised to do so by virtue of their job duties. We ensure our staff’s data protection competence through training and guidance.
Joint register with Facebook
26 April 2021
This applies to VR’s Facebook pages, the tracking pixel, and messaging services. These situations arise when you like a VR Facebook page, join or follow a VR community on Facebook, or chat with VR in the messaging service.
Controller
Facebook Ireland (“Facebook”) and VR-Group Plc act as joint controllers with regard to the fan and community pages, tracking pixel and messaging services on Facebook, as applicable. Information on the joint controllership and the data required under Articles 13(1) (a) and (b) of the GDPR are available in the Facebook privacy notice
Facebook processes data in accordance with its privacy policy , which specifies, among other things, Facebook’s legal basis for the processing of personal data and the rights of data subjects. Facebook has the primary responsibility for compliance with the data protection legislation and the implementation of data security and the rights of data subjects in the service. You can manage your Facebook-related data protection settings on Facebook. VR is responsible for processing the content of the messages.
Data that is processed and the purpose and legal basis of the processing
Regarding individual data subjects, VR receives from Facebook the name given on Facebook, public profile picture and other data that the data subject has specified as public on Facebook. The data subject can also give other personal data in the comments or messaging services of the community pages. VR processes personal data on Facebook based on its legitimate interest.
The customer service on Facebook is part of VR’s multi-channel customer service. The registered data is not used for automatic decision-making or profiling that would affect the legal rights of the customers as data subjects. VR collects anonymised data for its own data and analytics platform in order to gain an overview of the topics discussed on social media, allocate appropriate resources to customer service, and support service development. VR may organise competitions on Facebook, in which case the data is processed in accordance with VR’s data protection notice, as stated in the competition.
VR uses social media tools to manage activities on Facebook. VR does not transfer personal data outside of the European Union or the European Economic Area without a legal basis. Some of our service providers are located outside the EU/EEA, and we may transfer personal data to these service providers if it is necessary for the purposes specified in this data protection notice. We use the necessary contractual protection measures (e.g. the standard contractual clauses on data protection approved by the European Commission) when we transfer personal data to such service providers.
VR recommends using VR’s feedback from for personal contacting or for sending messages that contain your personal data (such as name, address, telephone number) in order to ensure the confidentiality and data security of the communication.
You can limit the processing of your personal data by unliking and/or unfollowing the community page. You can also request the removal of your data by using the data protection form.
Rights of data subjects
You can read about the rights of data subjects against Facebook Ireland in the privacy policy of Facebook Ireland In addition, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.
- VR Group’s data protection officer: tietosuojavastaava(a)vr.fi
- Questions concerning the register should be sent by e-mail to: palaute(a)vr.fi
Data Protection Notice for VR-Group Plc’s camera surveillance (CCTV)
17 June 2025
1 Controller
- VR-Group Plc (hereinafter referred to as “VR”)
- Business ID: 1003521-5
- PO Box 488
- FI-00096 VR, Finland
- tel. +358 307 10
2 Contact person in matters related to the data file
- Corporate Security Manager
- VR-Group Plc
- PO Box 488, 00096 VR
- 00101 Helsinki, Finland
Data protection officer:
- VR Group Plc
- Data Protection Officer
- PO Box 488, 00096 VR
- 00101 Helsinki, Finland
- tietosuojavastaava(a)vr.fi
3 Purposes of the processing of personal data
Personal data is processed to ensure the maintenance of order and safety, to protect property and to prevent and look into criminal offences, incidents or accidents in VR’s premises, properties, outdoor areas and part of its rolling stock.
In VR’s maintenance and rail logistics, camera surveillance is also used to ensure smooth production processes.
The processing of personal data is based on the controller’s legitimate interest.
4 Sources of data
A camera surveillance system that consists of recording surveillance cameras in VR’s premises, properties, outdoor areas and rolling stock and body-worn cameras. There are surveillance cameras also in some of VR-Group Plc’s road transport vehicles.
VR has recording camera surveillance:
- in the public spaces of the following stations: Helsinki Central Railway Station, Hyvinkää, Iisalmi, Järvenpää, Kajaani, Kuopio, Kouvola, Lahti, Oulu, Pieksämäki, Riihimäki, Rovaniemi, Tampere, Toijala ja Ylivieska.
- In VR’s maintenance and rail logistics: The Hyvinkää machine shop, Helsinki depot (Ilmala), Imatra railway yard, Kemi railway yard, Kouvola depot and wagon repair shop, Kuopio railway yard, Oulu depot and railway yard, Pieksämäki depot, railway yard, component workshop and machine shop, Riihimäki depot, Savonlinna's Pääskylahti side track, Tampere depot and wagon repair shop and the Äänekoski tracks.
Body-worn cameras are used in VR's commuter traffic on lines D, H, M, R, T, G and Z. The body-worn cameras do not continuously record images and sound. The conductor will activate the recording function when they encounter a situation that threatens occupational or passenger safety. The uniform of the conductor using a body-worn camera includes a notice about the possibility of images and sound being recorded, and, if possible, the conductor will also state that they have activated the recording function. The body-worn camera will show that it is recording with an indicator light and sound.
5 Data subjects
All persons moving in the camera surveillance area and recorded by the surveillance cameras are data subjects. These may include, for example, train passengers, VR employees and other persons moving in the area.
6 Data content of the data file
Time- and location-specific visual recordings from VR’s premises, properties, outdoor areas and rolling stock, recorded by the camera surveillance system.
Time- and location-related visual and voice recordings recorded by body-worn cameras.
7 Recipients of personal data
Personal data is disclosed, to the extent permitted by law, to the Finnish Transport Agency and, upon request, to other authorities. Data can be disclosed to companies belonging to the same group in order to present legal claims and to insurance companies for processing accident cases.
We use external parties to support the processing of personal data in the maintenance and development of IT systems and safety monitoring room duties, for instance. These service providers process personal data commissioned by us and on our behalf.
The data processing follows current legislation and is always carried out in accordance with this data protection notice. This is ensured, among other things, through contracts between the organizations.
8 Transfer or disclosure of data outside the EU or the EEA
Data will not be disclosed outside the EU or the European Economic Area or outside countries which the European Commission considers to have an adequate level of data protection, unless the adequate level of data protection has been ensured with contracts or in another manner required by law.
9 Data retention period
Normally, camera recordings are stored for one month at the maximum. However, data may be stored for a longer time, if necessary (upon authorities’ request, for instance).
10 Our customers’ rights
As our customer, you have a right to access your personal data of which VR is the controller. You can exercise your rights by submitting a data protection request for this register by email tietosuojavastaava@vr.fi. Alternatively, you can submit the request in writing by delivering it to the address VR-Group Plc, Corporate Security Manager, PO Box 488, 00096 VR.
You will receive a response to your request no later than one month after sending the request. We ensure these rights as described here by taking the applicable legislation and restrictions set therein into account. A reasonable fee will be charged for the access request if it is less than a year since the previous access time.
Please note that in the railway network, camera surveillance in platform areas and in some of the stations falls under the responsibility of the Finnish Transport Infrastructure Agency.
Right to access data / right to review data
You have the right to receive a copy of your personal data from VR and a confirmation of whether we have processed your personal data. In order to implement the request, you must provide a sufficiently precise and individualized description of the time and place where the video was recorded.
Right to rectification
You have the right to request us to rectify inaccurate or erroneous data about you.
Right to erasure
You have the right to request us to erase your personal data. Requests are handled on a case-by-case basis. VR has a legislation-based obligation or right to store certain data; such data cannot be erased.
Right to restriction of processing
You have a right in certain special situations stipulated by the regulation to request the restriction of the processing of your personal data.
Right to object
When the processing of personal data is based on a legitimate interest, you can object to the processing of your data on grounds related to your personal situation.
Right to lodge a complaint with an authority
We seek to resolve any disputes primarily directly with data subjects. If a customer finds that we have not processed personal data as stipulated by law, the customer may lodge a complaint with a data protection authority.
11 Principles of data file protection
VR’s premises where personal data is processed are protected with access control as defined in the facility security guidelines.
We ensure the data security of the processing of our customers’ personal data processing and personal data confidentiality, integrity and accessibility with appropriate technical and organisational measures in accordance with VR’s data security principles.
Personal data is protected against unauthorised access and illegal or accidental processing. Personal data is processed only by persons specifically appointed by VR to such tasks. We provide data protection training and guidance to our employees who process personal data.