Personal data refers to any information which can be used to identify an individual. Mälardalstrafik processes personal data in different ways and at different times, for example, when you purchase a ticket and travel with us, visit our websites, connect to the wireless network on our trains or contact us.

When we compile statistics or carry out market and customer analyses, your personal data is anonymized. We need to perform the personal data processing which we carry out in order to be able to provide and administer your trip, handle matters, develop and improve our business operation and to inform you about any traffic disruptions.

You have the right to receive information about your personal data and how it is processed.

Mälardalstrafik's processing of personal data is an integral part of our terms and conditions of purchase and travel. Fundamental to our processing of personal data is that:

• We only collect the personal data which we need for the purposes for which we operate and provide our services.
• We protect the personal data we collect.
• We use the personal data only for the purposes for which they are collected.
• We delete personal data whose purpose of processing has been fulfilled and which is no longer needed.
• We inform the persons concerned about what data are collected, when and how it is done and for what purpose.

Mälardalstrafik limited liability Company (organisation No. 556425–0610) is the data controller for the processing of your personal data. In some cases, your personal data is processed by our suppliers. To ensure correct handling of the data processed by our suppliers, we have signed a personal data processing assistant agreement which regulates how they may use the data.

Content 

Content

1. What are personal data? 
2. How we protect your personal data 
3. Legal ground for processing and how long we store your personal data 
4. When do we process your personal data? 
5. When does Mälardalstrafik process your personal data?
   5.1. When you purchase a ticket and travel with us
    - 5.1.1 When you connect to wireless networks on Mälartåg
    - 5.1.2 Ticket inspection and surcharge
    - 5.1.3 Camera surveillance on Mälartåg
   5.2. When you contact us with matters in different channels 
   5.3. When you apply for compensation in the event of delay and other claims of compensation 
   5.4. When you visit our websites and use our mobile apps 
   5.5. When you participate in marketing activities or customer surveys
   5.6. When we have a legal obligation, or otherwise have a legitimate interest, to disclose information
6. Where do we get your personal data from? 
7. To whom do we share your personal data with? 
8. Your rights 
    - Withdraw consent
    - Request access to (so-called register extract) 
    - Request deletion and request correction
    - Right to object to processing
    - Request restriction of processing
    - Data portability 
9. Automated decision-making 
10. Complaint 
11. Contact 
12. Data protection officer

1. What are personal data?

Personal data is any information which can be directly or indirectly linked to an individual (for example, name, e-mail address, national registration number, and purchase and travel history).

In accordance with Swedish regulations, national registration number may only be processed when it is warranted with regard to the purposes, when it is necessary for secure identification or if there is another noteworthy reason. We work to minimize the use of national registration number as much as possible.

2. How we protect your personal data

The protection of your personal data is very important to us at Mälardalstrafik. We take appropriate measures to ensure that your data is protected and that the processing is carried out in accordance with applicable data protection regulations. This means that we protect your data with technical measures (e.g. encryption of information) and various organisational measures, such as routines and rules (e.g. access control).

3. Legal basis for processing and how long we store your personal data

All processing of personal data that Mälardalstrafik carries out is supported by a legal basis, for example that the processing is necessary to perform a contract with you, to earn one for Mälardalstrafik legitimate interest or for Mälardalstrafik to be able to fulfil a legal obligation.

Your personal data is stored only for as long as is necessary to fulfil the purposes of the processing, alternatively as long as we have an obligation to store it according to the law. After that, your data will be deleted or de-identified so that they no longer can be linked to you.

The points below depict situations in which we process your personal data, based on legal support for which we do so and the length of time we store your data.

4. When do we process your personal data?

We process your personal data in a number of different situations, for example to administer your trips and to improve our services and digital channels:

1. When you purchase a ticket and travel with us
2. When you contact us with errands in different channels
3. When you apply for compensation in the event of delay and other claims of compensation
4. When you visit our websites or use our mobile apps
5. When you participate in marketing activities or customer surveys
6. When we have a legal obligation, or otherwise have a legitimate interest, to disclose information

5. When does Mälardalstrafik process your personal data?

Below you can peruse more about the different situations in which we process your personal data.

5.1. When you purchase a ticket and travel with us

When you purchase tickets, the following data is processed:

• First and last name, address, e-mail address, telephone number, national registration number.
• Information about your purchase and travel history, e.g. time of departure, destination, type of ticket, purchase channel, method of payment, card number, travel card number, booking number and price.
• Information about the need of assistance and wheelchair space during the trip.
• Payment details and payment history.

Your personal data is processed in order to:

• Payment for the ticket, process your payment and deliver the purchased ticket.
• Detect and prevent fraud, e.g. at the time of booking and in connection with payment.
• Manage your need for an escort or wheelchair space in connection with travel.
• Compile anonymized statistics on purchased tickets and journeys for the purpose of carrying out, developing and improving our services.
• Handle complaints and rebookings, assist in case of traffic disruptions, carry out troubleshooting, track lost travel cards, and provide support.

Processing your personal data with the support of performance of contracts when delivering and paying for the ticket, balancing of interest when we have a legitimate interest in using your data for statistics and preventing fraud, and legal obligation for management of escort needs and wheelchair space.

Your data is stored for as long as they are up to date or necessary for the purpose for which they were collected.

In some exceptional cases, Mälardalstrafik is not the data controller for the processing of personal data which takes place in connection with our services. In cases where you choose to pay by credit card, Bambora is the data controller for the information you provide when you register your card for payment. When you choose to pay with Swish, it is your bank which is the data controller for the information you provide when you register for Swish.

For more information on how Bambora processes personal data, see bambora.com.

The Movingo app and movingobiljett.se

Region Sörmland sells Movingo tickets on behalf of Mälardalstrafik. On Region Sörmland's website more information can be had on how Region Sörmland processes personal data.

5.1.1 When you connect to wireless networks on Mälartåg

When you connect to wireless networks on Mälartåg, we process data necessary to enable your connection to the Internet via wireless network, such as:

• MAC-address
• Device Name
• Local IP number
• Time
• Use data volume
• Vehicle identity
• Date

We process your personal data in order to be able to connect you to the Internet through a wireless network, in order to be able to continuously improve these services and to produce statistics.

When you are connected to a wireless network on board Mälartåg, we are the data controllers for the processing which takes place to connect you to the Internet, but not for the continued processing or content of your communication via the wireless network.

We process your personal data with the support of performance of contracts when we provide wireless network on board Mälartåg and with the support of balancing of interest when we have a legitimate interest in using your data for statistics and improving our services.

We store the data for up to one year from the time you connected to our wireless network.

5.1.2 Ticket control and surcharge

If you are not in possession of a valid ticket at a ticket inspection, you will have to pay a surcharge. In connection with this, we need to process the following personal data:

• Name (and names of any fellow travellers), national registration number, address.
• Payment/non-payment details.
• Details of any objections.

The information is primarily collected directly from you during ticket inspection. If you do not provide us with the information at that time, we will retrieve it from the public register SPAR (the Swedish state personal address register).

We process your personal data to:

• Identify yourself as a traveller and detect and prevent fraud.
• Check your ticket's validity and administer, issue and manage surcharges.

Your personal data is processed with the support of performance of contracts at ticket inspection and when the surcharge is administered, issued and managed and balancing of interest to prevent fraud.

Your personal data is stored for as long as they are up-to-date or necessary for the purpose for which they have been collected.

5.1.3 Camera surveillance on Mälartåg

Transdev runs Mälartåg on behalf of Mälardalstrafik. At Mälartåg, camera surveillance takes place with fixed vehicle cameras recording moving images. Images are only stored for 72 hours. Click the link here for more information regarding camera surveillance. 

5.2. When you contact us with errands in different channels

When you contact us, your personal data are processed in order to be able to process your application. This may include matters to handle requests from you about us and our services, booking of assistance or wheelchair space, or to be able to make payments to you in the event of repurchases or complaints.

You can choose to communicate with us via social media (Facebook, Messenger, Instagram and LinkedIn), chat (Mälar-Märta), web forms, phone calls and emails. When communicating with us, information that you provide is processed, such as:

• Name and contact details, address, e-mail address, purchase history, national registration number, reference number on additional notice.
• Personal data provided in connection with your particular comments, questions or matters.
• Booking of, and information about accompaniment or wheelchair space during the trip.

Your personal data is processed in order to:

• Answer questions and handle your case, such as remedying errors, handling complaints and questions about bookings, rebookings and lost property.
• Manage your need for an escort or wheelchair space in connection with travel.
• To handle requests from you about us and our services and able to make payments to you in the event of repurchases or complaints.
• Develop and improve our services and the information we provide and publish via websites, mobile apps or social media.
• Analyse calls for the purpose of improving our service, train our employees and improve our customer reception.

Your personal data is processed with the support of balancing of interest for our legitimate interest in handling your case and in developing and improving our services. When your questions relate to an upcoming or completed trip, your personal data is processed with the support of performance of contracts and legal obligation for handling escort needs and wheelchair space.

We store customer case data for up to a period of 12 months after the case has been closed to ensure traceability in communication. If calls are recorded when you make a call to Mälardalstrafik's customer service for quality and training purposes, it is stored for 30 days.

5.3. When you apply for compensation in the event of delay and other claims of compensation

Mälardalstrafik Customer Service handles cases of compensation in the event of delay and other claims of compensation on behalf of Mälardalstrafik. When you make a reclamation about your trip by applying for Compensation for Delay (EVF) or contact us with other claims of compensation, the following data is processed:

• Information that you provide yourself, such as names (and names of any fellow travellers), contact details, payment information and account details.
• Your national registration number or coordination number.
• Details of the basis for your claim of compensation.
• Information in documents which you attach to your case, such as receipts and medical certificates.

Your personal data is processed in order to:

• Manage and assess your claims for compensation.
• Detect and prevent fraud in connection with claims for compensation.
• Produce statistics on cases in order to develop and improve our services.

Your personal data are processed with the support of legal obligation when processing your EVF application or personal injury case, performance of contracts when other complaints regarding the trip are processed, and with the support of balancing of interest when we have a legitimate interest in developing and improving our services and detecting and preventing fraud.

We store customer case data for up to a period of 12 months after the case has been closed to ensure traceability in communication. If compensation has been paid in the matter, data will be stored pursuant to the Accounting Act (1999:1078), (”Bokföringslagen”) och Archives Act(1990:782) (”Arkivlagen”).

5.4. When visiting our websites and using our mobile apps

When visiting our websites and mobile apps we process:

• Data about user behaviour and how users interact on our website.
• Information about your visits to our websites through cookies. Here you will find more information about how we use cookies.

We process the data in order to:

• Provide digital tools and services, providing you with accurate information.
• Provide support when you have technical issues.
• Maintaining, testing and improving our digital channels and services.
• Detect and prevent various IT-related attacks against technology and users, such as the distribution of malware and data breaches.
• Compile anonymized statistics on the use of our services.

We process data with the support of performance of contracts to administer your customer relationship with us and provide you with support when you have technical issues. With the support of balancing of interest when we have a legitimate interest to compile statistics and to develop, improve and ensure the security of our digital tools and services.

We store case data for up to a period of 12 months after the case has been closed to ensure traceability in communication.

My account

When you create or have a login account "My Account" in our digital channels, we also process the following personal data:

• Information that you provide such as name, telephone number, e-mail address, national registration number, bank card reference number.
• A customer number which we create to identify you in our systems.

We process your personal data to:

• Identify you, administer your customer relationship and login account to facilitate for you to rebook and purchase trips, among other things.
• Contact you with information in case of traffic disruptions.
• Produce anonymized statistics and carry out analyses for the purpose of improving our services.
• Providing, testing, maintaining and further developing the digital services and the technical platform used to provide them.
• Ensure the security of our services, to detect or prevent various types of illegal use or use which otherwise violates the Terms.

We process data on the basis of the fulfilment of agreements when we provide the service, to administer your customer relationship with us and provide you with support when you have technical issues. We process the data on the basis of a balancing of interest when we have a legitimate interest in simplifying booking and rebooking trips, compiling anonymized statistics and to develop, improve and ensure the security of our digital tools and services.

We save your personal data for as long as you are actively using your login account and thereafter for a period of up to two years. You can delete your account at any time, and if your account has been inactive for two years, it will be automatically deleted.

The Movingo app and movingobiljett.se

On behalf of Mälardalstrafik, Region Sörmland provides the Movingo app and Movingobiljett.se. On Region Sörmland's website more information can be had on how Region Sörmland processes personal data.

5.5. When you participate in marketing activities or customer surveys

In connection with marketing activities (such as competitions, promotions and events) or in connection with customer surveys (such as surveys and interviews on trains or by telephone), we process the data that you provide to us, such as:

• Name and contact details.

We process your personal data to:

• Administer the marketing activity or customer survey, including providing feedback to you.
• Create reports and other material.
• Inform about marketing activities and customer surveys.
• Produce statistics from marketing activities and customer surveys, in order to improve our services.

We process your personal data with support of balancing of interest for our legitimate interest as mentioned above. If our processing requires your consent, we will obtain your consent before the processing begins.

As a starting point, we store your data for one month after the end of the activity.

5.6. When we have a legal obligation, or otherwise have a legitimate interest, to disclose information

In addition to what is depicted in sections 5.1–5.5 above, we process your personal data in some cases when we are obliged by law, e.g., due to our accounting obligation, or when requesting disclosure of public documents. In these cases, legal obligation is usually the legal basis that supports the processing of personal data, but in some cases data may be disclosed to an authority, such as the police or a court, on the basis of balancing of interest. This may be in connection with a criminal report or in the police's search for missing persons or in order to safeguard our rights in a case in court or other authority.

In addition, Mälardalstrafik, with the support of balancing interest, disclose information to parties other than authorities when it is necessary to safeguard Mälardalstrafik's rights. For example, it may be an insurance company or other party against whom we have claims or received such from.

6. From whom do we get your personal data?

We collect personal data which providers of data have provided to us. The personal data that Mälardalstrafik processes comes from:

• Yourself, for example when you book and pay for your trip, when you travel with us, when you communicate with us.
• Another person/party who booked and paid for the trip for you.
• The retailer with whom your trip is booked and paid.
• Other stakeholder, through whom your trip with us or your possible need for assistance is booked.
• Traffic operator who arranges a replacement journey with Mälartåg due to a traffic disruption in your original journey.
• Payment processors, fraud control services, and authentication services which verify your payment.
• Population register (credit checking company), SPAR, for the purpose of being used for e.g. surcharges.
• Your computer, phone or other device when you use our digital channels and services (e.g., IP address).
• Mälardalstrafik, when we create information that can be linked to you (e.g., ticket number).

7. Who do we share your personal data with?

Only authorised employees of Mälardalstrafik and of our suppliers and agents can and may access your personal data. Your data is only shared with the suppliers and agents we use to provide our services. We do not disclose your personal data to other recipients unless we are required to do so due to legal requirements, other statutes or decisions by public authorities. Mälardalstrafik never sells your information to third parties.

Our suppliers only process personal data on our behalf in accordance with our documented instructions. To ensure a high level of security and to ensure that your personal data is handled in a lawful manner, the suppliers must sign an agreement of data processing. Mälardalstrafik has no intention to make use of any suppliers outside the EU/EEA for the processing of your personal data, but in the event that this should become relevant, special protective measures will be taken.

When your personal data is shared with a recipient who is an independent data controller, such as other transport operators or a bank, the recipient's integrity policy and information on personal data processing apply.

8. Your rights

As a data controller, you have the right to request information about how we process your personal data. The request must be in written from and signed in person, and contain information about name and national registration number. Also attach a copy of your ID. We need this to ensure that we disclose the data to the right person. Below are the rights you have in relation to our processing of your personal data. For more information, see https://www.imy.se/verksamhet/dataskydd/det-har-galler-enligt-gdpr/de-registrerades-rattigheter/. Please note that the rights under the GDPR are not absolute and therefore invoking a right does not necessarily lead to an action.

Withdraw consent

As a data controller, you have the right to withdraw your consent to certain personal data processing. If you withdraw your consent, we will cease the processing for which you gave your consent to and delete personal data which was processed solely on the basis of the consent.

To the extent that we process your personal data on the basis of your consent, you have the right to withdraw your consent to the processing with future effect. This implies that if you withdraw your consent, we have the right to continue processing already collected personal data if there is legal basis for this.

Request access to (so-called register extract)

You have the right to request confirmation from us on what personal data concerning you we process and what processing we carry out on your personal data, as well as the right to request access to a so-called register extract of the personal data processing we carry out on your data.

Request deletion and correction

In some cases, you have the right to have your personal data deleted, for example if it is no longer necessary for the purpose for which it was collected. We cannot delete such data as we need to fulfil our contractual obligation to the customer.

Furthermore, if you believe that information about you is incorrect or incomplete, you have the right to request that it be corrected.

Right to object to adjudication

You have the right to object to the processing of your personal data based on the legal basis legitimate interest. In the event of such a request, we will carry out a renewed balancing of interest to assess whether we may continue processing the personal data. If your interest in the cessation of the processing outweighs our legitimate interest, we are obliged to cease the processing. However, we may continue to process your data, even if you have objected to the processing, if we have compelling legitimate grounds for the processing which outweigh your integrity interest.

Restriction of processing

You have the right, under certain circumstances, to request that the processing of your personal data be restricted. If the processing has been restricted, we may only process it on the basis of your consent in addition to storing the data, in order for us to establish, exercise or defend legal claims or to protect the rights of others.

If you contest the accuracy of your personal data, you have the right to request restriction of processing. Processing should be restricted for the time we need to verify the accuracy of the personal data.

If our processing is not in accordance with applicable law, but you oppose the deletion of the personal data and instead request a restriction of its use, you have the right to request restriction of processing.

If we no longer need the personal data for the purposes of the processing, but you need it to be able to establish, exercise or defend legal claims, you have the right to request restriction of processing.

Data portability

You have the right to extract a copy of the personal data concerning you in a structured format (data portability). The right to data portability, as opposed to the right to a register extract, only applies to data which you have provided and that we process on the basis of certain legal grounds, such as your consent.

9. Automated decision-making

The processing of your personal data may in some cases involve automated decision-making. This would imply that the decisions we make are made using technical means and without human intervention (e.g., in the case of an EVF trial). We use automated decision-making when it is necessary for us to enter into or perform a contract with you. If you believe that the assessment is incorrect, you can contact us as below.

10. Complaint

If you believe that our processing of your personal data is in violation of applicable data protection legislation, you can contact us so that we can rectify the error. You also have the right to lodge a complaint with the Swedish Data Protection Authority, which is the supervisory authority for the processing of personal data.

11. Contact

If you have any questions about the camera surveillance, the processing of your personal data or wish to exercise your rights, you can contact Mälardalstrafik.

Contact details:
Mälardalstrafik Aktiebolag
Kollektivtrafikens hus
Centralplan 3, 111 20 Stockholm

Email: malardalstrafik@malardalstrafik.se

The request to exercise your rights must be made in written form and signed in your own hand and, in addition to your case, contain information about your name and national registration number. Also attach a copy of your ID. Mälardalstrafik will send replies to your registered address or your digital mailbox.

12. Data protection officer

Mälardalstrafik has appointed a Data Protection Officer (DPO) to ensure that Mälardalstrafik processes your personal data in a lawful, correct and transparent manner. If you have a matter you would like to address to our Data Protection Officer, please contact us by email malardalstrafik@malardalstrafik.se and write "DPO" in the subject line.

We may update this information

We may update this information text, for example, if we would process data for new purposes, collect additional data or share data with other recipients. In such case, we will notify you in an appropriate way. The latest version of the information is always published on this page.