Personal data processing

The Nobina Group comprises several companies in the Nordic countries of Sweden, Finland, Norway and Denmark. The company you are in contact with or provides the journey or service you use is, as a general rule, the company that is responsible for processing your data.

In order to perform certain services, we must sometimes share personal data with other companies in the Group. When we share personal data within the Group, we have entered into an internal arrangement to regulate the processing.

Inside the bus and on depot
We use camera surveillance to ensure that our employees are safe at their workplace and our passengers are safe during their journey. Photographs and moving images taken during camera surveillance on buses or from other cameras at our depots may therefore contain, either directly or indirectly, information about you.

Camera surveillance is used to prevent and suppress crime and/or assist the police in the event of a crime; prevent, minimise and/or detect accidents or the disruption of public order.

We store material from camera surveillance for a maximum of 14 days.

We may share material from camera surveillance with the police, other competent authorities and our clients.

We rely on the legal basis of legitimate interest.

For autonomous vehicles
We use camera surveillance directed out from the vehicles to ensure that the operator can see autonomous vehicles surroundings. The cameras are necessary for the operation of autonomous vehicles without an operator in the vehicle. Photographs and moving images taken during this camera surveillance may therefore contain, either directly or indirectly, information about you.
Camera surveillance is used to prevent, minimise and/or detect accidents.
We do not store any material from the cameras directed outwards.
We may share material from camera surveillance with the police, other competent authorities and our clients.
We rely on the legal basis of legitimate interest.

Passenger information

We may process information about you, such as name, contact details, payment information or location services, depending on the wording of our agreement with our clients. We require this information in order to identify you as a customer/passenger and to charge for the services you use.

We only retain the information for as long as we need it to fulfil the purpose.

We may share the material with the client that has contracted the relevant traffic.

We rely on the legal basis of the performance of a contract.

Onboard services

When Nobina offers onboard internet, we process information about you in the form of device information (your device’s unique code) from your mobile device or computer if you choose to connect to Nobina’s Wi-Fi. We require this information if you are to use onboard internet.

We only retain the information for as long as we need it to fulfil the purpose.

We rely on the legal basis of legitimate interest.

When you travel with us in commercial traffic we may process your personal data through:

Passenger information

When you book, purchase and/or travel with us in commercial traffic, through coach hire or on LandvetterExpressen, we process your data in order to administrate a customer relationship with you. We process data such as name, contact details and in specific cases your personal identity number.

We only store this information as long as we need it to fulfil our contractual relationship with you. When you purchase a ticket on LandvetterExpressen we store your data for two years.

We rely on the legal basis of the agreement to manage our customer relationship with you and legitimate interest since we also store your data in order to manage our contractual relationship.

Onboard services

When Nobina offers onboard internet, we process information about you in the form of device information (your device’s unique code) from your mobile device or computer if you choose to connect to Nobina’s Wi-Fi. We use this information to enable you avail of onboard internet.

We only retain the information for as long as we need it to fulfil the purpose.

We rely on the legal basis of legitimate interest.

Account information

To use certain services within our app Travis you need to register an account. We will the process information about you according to below.

Taxi

When you use taxi services we will process your phone number.

Electrical scooters

When you use electrical scooters we will process your email address.

We only retain the information for as long as necessary to fulfil the purpose.
We rely on the legal basis of legitimate interest.

If you use Travis’ partners services, we may share your account information with the partner who provides the service you use. Nobina and the partner are both controllers for the processing of personal data.

Cookies and pixels

When you use Travis, you can decide whether you wish to place cookies/pixels on your device and thereby agree to the use of your data for analysis, conversion tracking, remarketing, A/B testing, personalisation and marketing automation.

We only retain the information for as long as we need it to fulfil the purpose and you can delete cookies/pixels at any time on your device.

We rely on the legal basis of consent and you can withdraw your consent at any time by updating your preferences in Travis.

Crashlytics

When you use Travis, we need to process personal data in the form of your device’s unique device information in order to trace and manage crash data. The data is necessary to allow us to develop and manage Travis’ functionality and to help users in the event of complaints or other defects.

We only retain the information for as long as necessary to fulfil the purpose.

When you apply to work with us, we will process the data about you submitted by you in connection with your application, such as name, contact details and experience. We obtain the data either directly from you or from the recruitment company we use. We need the information to employ the correct person for each work role, which means we may conduct checks, tests and other suitability assessments.

We save your data for two years in order to address any legal requirements linked to the recruitment.

We rely on the legal basis of legitimate interest.

If you wish us to retain your data for subsequent recruitments, we rely on the legal basis of consent and you can withdraw your consent at any time.

When you take part in campaigns or other marketing, we may process data in the form of name, contact details, images or other information you submit to us. We need the information to administer campaigns and market ourselves.

We only retain the information for as long as we need it to fulfil the purpose.

We rely on the legal basis of legitimate interest.

For some campaigns or other marketing, we rely on the legal basis of consent and you will then be asked to provide active consent that you may withdraw at any time.

Lost property

Typically, our clients are considered data controller for the contact with you when you travel by public transport and, in connection with this, lose property. In other cases, we process your contact details in order to contact you to return your property.

We only retain the information for as long as we need it to fulfil the purpose.

We rely on the legal basis of legitimate interest.

Social media

When you visit our platforms on social media, we will process the information you provide to us, such as name and contact details. We process the data in order to respond to you on the relevant platform in our marketing.

We only retain the information for as long as we need it to fulfil the purpose. Often, you can delete content and comments yourself.

We rely on the legal basis of legitimate interest.

E-mail subscription and newsletters

When you subscribe to newsletters (such as press releases and reports) or other e-mail subscriptions (such as job vacancies) we process your name and contact details in order to send the desired e-mail or newsletter.

We only retain the information for as long as we need it to fulfil the purpose.

We rely on the legal basis of consent and you can update your preferences or withdraw your consent at any time.

When you visit us

When you visit us, we may need to process information, such as name and contact details (for example telephone number or e-mail). We need the data to identify you and to know which people are present on our premises.

We only retain the information for as long as we need it to fulfil the purpose.

We rely on the legal basis of legitimate interest.

Claims, customer complaints and other contacts

When you contact us regarding claims, customer complaints or other customer contacts, we may process name, contact details, travel information and other information you submit or that is necessary in processing your case.

We only retain the information for as long as we need it to fulfil the purpose.

We rely on the legal basis of legitimate interest.

Contact list

We may process data about you when you are a current or potential customer, supplier, or a business or authority. We process data in order to manage our relationship or provide you with offers. The information we process about you includes name, contact details and/or other information that is relevant to the reason we have contact with you.

We only retain the information for as long as we need it to fulfil the purpose.

We rely on the legal basis of legitimate interest.

When you are a shareholder, we process your data to manage the obligations to which we are subject as a listed company, such as addressing general meetings and shareholding. This entails handling information about you including name, contact details, personal identity number and shareholding. We obtain the information either from you or from Euroclear Sweden AB .

We store this information as long as necessary to fulfil the purpose or as long as necessary pursuant to law.

We rely on the legal basis of legal obligation.

In certain cases we process your personal data when we are obliged by law, for example due to accounting obligations, in the event of a traffic accident or claim. We may then need to process information about you, such as name, contact details, or other  relevant information.

We rely on the legal basis of legal obligation.

Information under the Swedish Accounting Act will be stored for seven years. Otherwise, we store this information as long as necessary to fulfil the purpose or as long as necessary pursuant to law.

In certain cases, we process your personal data in order to manage and respond to legal requirements, such as a dispute or legal process. The data we process is dependent on the matter but may include name, contact details and other identifiers. This may  also mean we process sensitive data. When we process sensitive data we always take the necessary technical and organisational security measures.

We store this information as long as necessary to fulfil the purpose or as long as necessary pursuant to law.

We rely on the legal basis of legitimate interest.

We use cookies on our websites. A cookie is a small text file that is saved on your computer and facilitates certain functions, such as navigating the website. We also use cookies to collect statistics about the number of visitors to our website, to analyse visitor behaviour and to improve the website’s functionality and the user’s experience of the websites. This information enables us to develop and optimise the websites.

The information collected by Nobina through cookies on our websites is only used for Nobina’s purposes, and not for third party purposes. Cookies are sometime used to collect information that is considered personal data, such as IP addresses and information linked to the IP address, but no personal data that is otherwise   directly associated with you as an individual.

Cookies may either be automatically erased when you close your browser (session cookies) or alternatively stored on your computer to facilitate future visits to the website (persistent cookies). Persistent cookies must also be automatically erased after a specified time. You can always erase cookies from your browser. The first-party cookies used on our website are described below.

If you do not accept the use of cookies, you can change the settings in your browser to automatically deny the storage of cookies or to inform you when a website asks to store a cookie. The browser can also be used to erase existing cookies and block third-party cookies. If you browser blocks cookies it may limit some functionality on the website.

We may share some personal data within the Nobina Group, with our clients, trade union organisations and employer organisations, external partners and advisors within and outside the EU/EEA, and with authorities or other recipients if so required by law, other regulations or official decisions.

If we use partners and suppliers outside the EU/EEA, we provide special safeguards, such as signed agreements that include the standard clauses for data transfer as adopted by the European Commission.

We always protect our personal data by using appropriate technical and organisational safeguards.

Nobina has established processes, procedures and technical measures to proactively and reactively improve the level of security. All of these measures are designed to ensure that your personal data is managed securely and is not accessible to unauthorised individuals.

You can read more about how Nobina works with information security, and how we protect personal data, here.

According to applicable data protection laws, you have the right to request register extracts, rectification and erasure of personal data. You also have the right to request restriction of our processing, request the right to data portability (when you have contributed information yourself), object to our processing and lodge a complaint with supervisory authorities. Certain rights are only applicable in some situations, for example if we are obliged by law to store certain information then we cannot erase such information. If you wish to exercise any of these rights or find out more about how we process your personal data, please contact us using the contact details above. In order to respond to your request, we must receive a personally signed request where you prove your identity. If you are of the opinion that our processing of your personal data is not in accordance with data protection laws, you have the right to complain to the Swedish Authority for Privacy Protection (former Swedish Data Protection Authority), which is the supervisory authority.