Personal information we hold

The personal information we hold about you includes:

  • Name, address, email address, date of birth, photograph, telephone number
  • The name of your educational establishment or training provider, student enrolment ID number, course dates
  • Password and user name for your TfL web account
  • Your marketing preferences
  • Your journey history

We store the details of any payment cards used to pay for the administration fee, pay as you go credit, auto top up or season tickets. This information is encrypted and stored in line with payment card industry security standards.

The TfL ticketing system records the location, date and time an Oyster card is used to validate a journey.

If you telephone Customer Services, your call will be recorded for training and quality purposes.

If you sign in to your online account, TfL will collect the IP address used by your computer for the purpose of fraud prevention and detection.

How we use personal information

TfL and the companies that process personal information on our behalf use your information for customer services and to administer the 18+ Student Oyster photo card scheme.

For example, we will use your personal information to ensure that you are eligible for the particular scheme you have applied for, to issue your 18+ Student Oyster photo card and respond to queries if you contact us.

We will also contact you near the expiry date of the 18+ student Oyster photo card to tell you about your future ticketing options.

We will only send you information about TfL's offers and promotions if you have chosen to receive it and you can change your marketing preferences at any time. TfL will not pass your personal information to any other organisation for marketing purposes without your prior consent.

Length of time we keep information

We retain data about the individual journeys made using your 18+ Student Oyster photocard for eight weeks after the card is used. After eight weeks, the journey data in the ticketing system is disassociated from your card (ie anonymised). This eight-week period is considered reasonable to enable customers to verify or make enquiries concerning their journeys (for example, for refund purposes).

The information we collect as part of the application process is kept for one year after the expiry date of your photo card.

Details of debit or credit cards used to pay the administration fee, to add pay as you go credit or season tickets are retained for a maximum of 18 months.

IP addresses collected when you access your Oyster online account are retained for 13 months.

Keeping personal information secure

We take the privacy of our customers very seriously and a range of robust policies, processes and technical measures are in place to control and safeguard access to, and use of, personal information associated with Oyster cards.

Sharing personal information

TfL uses an external service provider to process your application, issue your photo card and operate the photo card scheme on a day to day basis, including contact centre support. TfL also uses external service providers to operate 'back office' technical services and customer database management.

Your named educational establishment is able to view the relevant parts of your application online and will authorise it by confirming to TfL that you are enrolled on an eligible course.

If you use your 18+ Student Oyster photocard on National Rail services, TfL may share your personal data with the relevant train operating companies for the purpose of fraud prevention and detection.

Where you have agreed to receive marketing messages from train operating companies, we will pass them your contact details.

If you appeal against a penalty fare notice issued on a national rail service and you state that you used your Oyster card for that journey, the independent appeals body may verify the information you provide against journey data held in our ticketing systems. This is strictly for the purpose of assessing your appeal, and any information sharing is managed in accordance with relevant privacy and data protection legislation.

In some circumstances, disclosures of personal data to the police (and other law enforcement agencies) are permitted by the Data Protection Act 1998 (DPA), if they relate to the prevention or detection of crime and/or the apprehension or prosecution of offenders. Before any such disclosure takes place, the police are required to demonstrate that the personal data concerned will assist them in this respect. Each police request to TfL is dealt with on a strictly case-by-case basis to ensure that any such disclosure is lawful and in accordance with the DPA.

Overseas processing

TfL and its service providers currently process personal information relating to Oyster within the United Kingdom and the USA. Any such processing is subject to appropriate contractual safeguards and carried out in accordance with the requirements of UK and EU privacy legislation.

Team London volunteering

When you apply for your 18+ Student Oyster card, we will give you information about the Team London volunteering scheme run by the Greater London Authority (GLA).

If you choose to receive further information about Team London, TfL will pass your name to the GLA so that they can send you newsletters about volunteering opportunities. You can opt out from receiving this information at the time you make your 18+ Student Oyster application. If you wish to unsubscribe from receiving the newsletters at a later date, you will need to do this via the GLA.

Further information about how the GLA will handle your personal data can be found on the Team London website.

Accessing your personal information

You can see your journey history by signing into your online account or you can request a copy by calling Customer Services.

For access to other personal information please see Subject Access requests in Access your data.

18+ Student Oyster Privacy Notice

Transport for London (TfL), its subsidiaries and service providers, will use your personal information for the purposes of customer services and administration, the provision of travel related information, customer research and fraud prevention. If you use your Oyster photocard in connection with National Rail products or services, you will also be authorising TfL to share your personal information with relevant Train Operating Companies (TOCs) so that they can use it for the same purposes. Your personal information will be properly safeguarded and processed in accordance with the requirements of the Data Protection Act 1998.

Where you choose to receive information about volunteering opportunities, TfL will pass your name and email address to the Greater London Authority so they can contact you directly about this.

Relevant police services, and Local Authority Anti Social Behaviour units may provide TfL with details of any criminal convictions, warnings, reprimands, or other sanctions issued in relation to offences that have been committed by the concession holder on, or in relation to, London's public transport network.

Such information may be used as the basis for the withdrawal of this travel concession, and TfL may inform the police of any decision to withdraw your concession.  In certain circumstances, TfL and relevant TOCs may also share your personal information with these and other law enforcement agencies for the purposes of the prevention or detection of crime.

TfL may contact you shortly before the expiry of this travel concession, to inform you of the ticketing options available to you from that date.