Privacy Policy
1. Introduction
A-Train AB (“A-Train”, “we” or “us”) conducts business under the brand name “Arlanda Express”. It is important to us that we process your personal data responsibly and securely, in accordance with applicable laws. This privacy policy describes how we process your personal data and what rights you have in connection with it.
We process personal data about persons who:
are our customers (e.g. by purchasing a ticket via app or internet);
are contact persons/employees at a company that is a customer of ours or who collaborates with us;
travel with us (regardless of whether you have bought your ticket yourself or if someone else, such as your employer or a travel agency, has bought your ticket);
have a registered account with us;
otherwise come into contact with us, for example contacts our customer services or visits our website; and
visit our premises, stations or stay nearby the track area.
You can also read about how we use cookies and what choices you can make in our Cookie Policy.
2. What is personal data and personal data processing?
Personal data
Personal data means any information which can be linked directly, or indirectly when combined with other data, to a living person. This means that widely differing data constitute personal data, e.g. name and contact details, purchasing and travel history and case details.
Personal data processing
Personal data processing means all measures taken with the personal data, e.g. collection, storage, processing, use for various purposes, alteration or destruction of personal data.
3. Legal ground for our personal data processing and storage period
Legal ground
There must be a legal ground for all personal data processing. Our legal ground for processing your personal data may be that we need to use your data to fulfil an agreement with you or to comply with an obligation that we have by law, or that a legitimate interest in processing your data otherwise exists. Information on the legal ground we rely on for any given processing is set out in Section 10.
You have the opportunity to oppose certain unnecessary personal data processing, such as e-mail marketing; further information about this is available in Section 7 (Offers and information via e-mail). Your rights are described in more detail in Section 8 (Your rights).
Data retention
We only retain your personal data for as long as necessary for us to fulfil the purposes of the processing, or for as long as we are required to retain the data by law. Your data are then erased or anonymised so that it can no longer be linked to you. Information on how long we retain your personal data for is set out in Section 10.
4. How can we gain access to your personal data
In many cases, you give us the personal data we process about you in connection with buying a trip via the app or our website or by registering an account with us. Personal data may also be sent to us by other parties or created by us.
When you have not given us your personal data yourself, we could have received the personal data in the following ways:
From another person/party, who booked or paid for your ticket (e.g. your employer);
From retailers or distributors of our tickets (e.g. a travel agency) if your ticket has been purchased from such retailer/distributor;
From your computer, phone or other device when you buy a ticket or register an account (e.g. IP address);
From operators who handle our payment solutions, analyse suspected fraud and authenticate logins or payments; or
Through camera surveillance of our premises, stations or nearby the track area.
We may also generate our own personal data, e.g. an identification number for your ticket.
5. Recipients of your personal data
We will never sell your personal data to a third party, but in some cases it is necessary for us to share personal data with other parties, both within and outside the EU/EEA. We do this to fulfil our obligations towards you and/or the person who bought your ticket. We may also disclose your personal data to a public authority during an investigation into suspected crime or if we are obliged to disclose data by law, other statute or public authority decision.
If, in connection with purchasing a ticket or registering an account with us, you choose to register your membership number in another company’s loyalty programme (e.g. Norwegian Rewards), that company will be informed of the value of your purchase in order for the points to be added to your loyalty programme. If you do not want this data to be disclosed to the company responsible for the loyalty programme, do not enter your membership number when buying a ticket from us or registering your account.
Our IT suppliers and other partners who manage personal data on our behalf, so-called data processors, must always sign an agreement with us so that we can ensure a high level of protection of your personal data with them as well. Specific safeguards are implemented with regard to partners outside the EU/EEA, such as entering into agreements that include the standard model clauses for data transfer adopted by the EU Commission and which are available on the EU Commission’s website.
The following operators may need access to your personal data:
External partners who perform tasks on our behalf, e.g. to supply IT services or assist with customer services, marketing, analytics or statistics;
The person/party who booked your ticket (e.g. your employer);
Our partners regarding earning points in loyalty programmes, if you decide to enter your membership number for such loyalty programme(s) when purchasing your journey;
Retailers/distributors of our tickets (e.g. a travel agency) if your ticket has been purchased from such an operator; and
Our payment solution provider (Adyen), your bank or card issuer when you pay for a ticket or identify yourself with a Bank ID.
If we share your personal data with a recipient who is an independent data controller for their processing of your personal data, e.g. a public authority, the recipient is responsible for the lawfulness of the processing in question.
6. Security for the protection of personal data
We safeguard your personal data with a high level of security and to this end have implemented appropriate technical and organisational security measures to protect your personal data from unauthorised access, change, dissemination or destruction. Examples of security measures we take are data encryption and access control.
7. Offers and information via e-mail
When you buy a ticket to travel with us (e.g. via app or internet), we need your e-mail address so we can provide you with your ticket and receipt. We may contact you by e-mail with important information about your ticket or journey. If you have chosen to receive our newsletter, you will receive it to your e-mail address until you unsubscribe for it.
We may also send you offers and other marketing of our services up to 12 months after your ticket or travel pass has been used. If you do not want to receive offers and other marketing via e-mail, you can deregister at any time by contacting us via one of the channels specified in Section 9 (Contact details for the data controller). You can also deregister from receiving further mailings via a link included in each e-mail. Note that even if you have opted out of e-mail marketing, we may (in accordance with the first paragraph above) need to send you important information about your ticket or journey.
8. Your rights
You have certain rights in relation to us. These are set out in general below. If you want to claim any of these rights, or get more information, please contact us via the contact details listed in Section 9 below:
Right of access (register transcript) – a right to information about our processing of your personal data and access to it.
Right to rectification – a right to have erroneous data rectified and partial data completed.
Right to object – a right to object to our personal data processing about you if it takes place based on a legitimate interest or for direct marketing. With regard to direct marketing via e-mail, you can object to this by using the deregister link contained in each e-mail or by contacting us via the contact details below.
Right to erasure – a right to have your personal data erased under certain circumstances unless the data is necessary for a particular purpose or there is another legal ground for the processing.
Right to restriction of processing – a right to request that personal data processing is restricted, e.g. if you contest the accuracy of the data. Our access to the data is restricted while the accuracy of the data is investigated.
Right to data portability – a right to request that personal data are transferred from one data controller to another. This right is restricted to data that you have supplied to us yourself.
If you have any complaints about how we process your personal data, or would like further information, please contact us via the contact details below. You also always have the right to file a complaint about how we process your personal data to the relevant supervisory authority. The Swedish Authority for Privacy Protection (IMY) is the supervisory authority in Sweden: www.imy.se.
9. Contact details for the data controller
A-Train AB
Postal address: PO Box 130, SE-101 22 Stockholm, Sweden
Visiting address: Klarabergsviadukten 70, Floor 5, World Trade Center, Stockholm, Sweden
E-mail: gdpr@atrain.se
Telephone: +46 (0) 771-720 200
10. Details about what personal data we process about you and for what purpose
10.1 Processing in connection with purchasing tickets or services
We process personal data about persons who purchase tickets (as a private individual or as contact person or employee of a corporate client or travel agency). We process different types of personal data about you depending on the purchasing channel and payment method selected. Note that if you buy your ticket from one of our ticket vending machines, you only need to choose the type of ticket and then pay for it. We do not process any personal data about you when making a purchase from a ticket vending machine (although our payment provider processes your card details).
The purposes of our processing are:
Managing your order/purchase and carrying out the travel service.
Delivering any other services you order and administering our agreement with you or your company/employer.
Notifying you of important information, e.g. ticket, receipt, information about the journey and traffic situation.
Charging for the services you or your company have purchased.
Detecting and preventing fraud e.g. when booking and in connection with payment.
Categories of personal data:
Contact details: Name, personal identification number (only for purchases from sole traders as the personal identification number is then the same as the company registration number for the business), telephone number and e-mail address.
Order details: The ticket’s period of validity, type of ticket, choice of additional services, purchasing channel, price and payment method, IP address, payment card details in truncated form or other payment details, language preferences, order reference, badge number (if you are employed at Arlanda Airport).
Loyalty programme: Your loyalty programme membership number (such as Norwegian Rewards).
Legal ground:
Fulfilment of contract: To fulfil our contractual obligations with you and otherwise to administer obligations that follow from the agreement (e.g. dealing with complaints).
Legal obligation: To comply with legal obligations, e.g. accounting legislation.
Legitimate interest: When personal data is processed regarding a person other than the one we have the customer relationship with (such as close relatives or contact persons/agents/passengers of corporate customers), this is done on the basis of a legitimate interest.
Storage period:
We retain your data for up to twelve months after your ticket or travel pass has been used up. If data needs to be retained for a longer period of time by law (e.g. in accordance with the Accounting Act) the data is retained in accordance with the legal requirement.
10.2 Processing in connection with the journey
In addition to personal data collected in connection with your ticket purchase under Section 10.1, we also process certain personal data about you in connection with your journey with us.
The purposes of our processing are:
Provide services that you or someone else has ordered.
Maintain the safety of our passengers, staff and the general public through camera surveillance at the stations/platforms (no camera surveillance occurs on our trains). Camera surveillance takes place for the purpose of crime prevention, to prevent or detect public order disturbances, to maintain safety and to prevent accidents.
Check the validity of tickets.
Offer Wi-Fi to our passengers.
Categories of personal data:
Order details: The period of validity of the ticket, type of ticket, any additional services.
Details about the journey: The train number on which the ticket is used is recorded in connection with the ticket being checked on board the train (recording the train number gives us information about the approximate time and direction of travel (Stockholm Central/Arlanda Airport) when the ticket is used. As our tickets are not personalised, we usually do not know who is travelling on a particular ticket.
Camera surveillance: Camera surveillance (images without sound) from the stations/platforms. Signs indicate which areas are monitored.
Device details: MAC address, session ID, IP address, train GPS position and time stamp if you use our Wi-Fi.
Legal ground:
Fulfilment of contract: To fulfil our contractual obligations with you and otherwise to administer obligations that follow from the agreement (e.g. dealing with complaints) as well as to check your ticket.
Legitimate interest: We have a legitimate and justifiable interest in processing your personal data in order to complete the journey, e.g. checking tickets and using camera surveillance to maintain security for passengers, our staff and others present at the stations/platforms. Camera surveillance takes place in particular for the purpose of crime prevention, to prevent or detect public order disturbances, to maintain safety and to prevent accidents.
Fulfilment of public interest (camera surveillance): In some cases, our camera surveillance of stations/platforms may also be based on the fulfilment of a public interest in maintaining safety and preventing accidents.
Storage period:
The personal data processing takes place during the journey and the data may then be saved for up to twelve months after your journey, e.g. to deal with complaints.
Camera surveillance recordings are saved for up to three weeks. If there is a suspicion of crime, camera surveillance recordings may be handed over to the police and other law enforcement agencies.
10.3 Processing in connection with a registered account
If you register an account with us (either as a private customer, corporate customer or travel agency), we process the following personal data.
The purposes of our processing are:
Offer you special features, products (e.g. the travel pass), discounts and terms.
Provide you with good service.
Present your booking and travel history for you.
Categories of personal data:
Contact details: Name, telephone number and e-mail address of the person who registered the account. If you register an account as the representative of a corporate client or travel agency, we also process data about your position (job title) and employer/travel agency.
Account details: E-mail address (username), telephone number, password, profile picture, default payment method (e.g. saved card details), whether or not you are employed at Arlanda, preferences regarding receipt of newsletters and offers, language preferences. To some extent, you can decide which date you choose to register in your account.
Booking and travel history: Valid tickets, used tickets, purchasing and booking history as well as travel history. The history you can view when logged in includes all purchases (up to 12 months back) where your ticket was delivered to the e-mail address associated with your account. This means that the history is presented in your account regardless of whether you bought your ticket in logged-in mode or not, and also when you bought the ticket through any of our resellers, provided that the e-mail address to which you receive the ticket is the same as the e-mail address registered for your account.
Loyalty programme: Your loyalty programme membership number (such as Norwegian Rewards).
Legal ground:
Fulfilment of contract: To fulfil our obligations to you according to the terms and conditions of the account that apply.
Storage period:
The details are retained until you delete your account. Your account will be automatically deleted if you have not used it for three years unless you actively choose to renew the account.
10.4 Processing for analysis and marketing
In order to develop our services, we analyse aggregated personal data/other data about journeys as regards how the services are used and produce aggregated statistics on our customers’ travel habits. We also send you newsletters (if you have subscribed for it and as long as you have not unsubscribed), offers and information about our services via e-mail if you have not objected to marketing (see Section 7).
The purposes of our processing are:
At an aggregate level, to analyse how our services are used and compile statistics.
Send you newsletters, offers and marketing regarding our services via electronic messaging (e.g. e-mail).
Depending on your choices regarding cookies, processing of IP address may, for example, take place in order:
to analyse choices, priorities and preferences, which means that a so-called profiling takes place, for the purpose of providing you with relevant and customised information, recommendations, adverts and offers and to develop our services; and
to create customised target groups to be able to direct customized offers and adverts to you on our website or for re-targeting (i.e. our advertising may also appear when you visit other websites). However, such processing only takes place if you have consented to it through your choice of cookies. See our Cookie Policy for more information.
Categories of personal data:
Contact details: Name, telephone number, e-mail address.
Order details and travel history: Type of ticket and its period of validity, travel pass balance, purchasing channel.
Customer segment: Corporate client, travel agency or private individual.
Preferences regarding receipt of newsletters and offers.
Information about use of our website: We use cookies to collect certain information about how visitors use our website. The information does not identify you directly, although the IP address of your device (e.g. computer) is registered. See our Cookie Policy for more information.
Legal ground:
Legitimate interest: We have a legitimate and justifiable interest in processing your personal data in order to compile statistics on the use of our services and to communicate with you even when it is not a direct consequence of our contractual relationship. We have a legitimate and justifiable interest in processing your personal data when you are an existing customer in order to send you offers and market our services.
Fulfillment of contract: To fulfil our contractual obligations towards you to deliver our newsletters, if you have chosen to subscribe for it.
Storage period:
The data is retained for up to twelve months after your ticket or travel pass has been consumed.
See our Cookie Policy for details on how long different cookies are retained.
10.5 Processing in connection with a case being handled by customer service, visits on our website or other contact with us
When you contact us, e.g. with questions for our customer service or when otherwise getting in contact with us, e.g. communicating with us through social media or, visiting our website, personal data that you give us or that we collect about you is processed, e.g. in connection with administering your case. We also process data that you give us in connection with administering, changing or converting your ticket via our website.
The purposes of our processing are:
Communicating with you and administering your case during contact with customer service, e-mail forms and social media accounts.
Analysing conversations and chats for the purpose of improving our communication.
Ensure that the website works as intended, optimize its features, and provide a better user experience.
Detect and prevent fraud and other abuse e.g. in connection with booking, paying for, administering or converting your ticket.
Categories of personal data:
Contact details: The contact details you give us or that are needed to deal with your question (e.g. name, address, telephone number and e-mail address).
Case information: Customer number, complaint, request, dealing with lost property, information about your journey, order details, purchasing and transaction history, payment details and other data you give us during your contact with us or that you provided in connection with your purchase of a ticket in accordance with Section 10.1.
Information about use of our website: We use cookies to collect certain information about how visitors use our website. The information does not identify you directly, although the IP adress of your device (e.g. computer) is registered. See our Cookie Policy for more information.
Legal ground:
Fulfilment of agreement: Fulfil our agreement with you and otherwise administer obligations that follow from the agreement.
Legitimate interest: We have a legitimate and justifiable interest in processing your personal data in order to communicate with you, give you information, analyse calls and use of our communication functions, detect and prevent fraud and other abuse and to develop, test and improve our services and technical platforms.
Legal obligation: In some cases, we have a legal obligation to process data you submit to us (e.g. under consumer law or for accounting purposes).
Storage period:
The data will be erased when it is no longer needed to fulfil your request. We may retain certain data for up to one year when we have a legitimate interest to do so for the purpose of evaluating and improving our procedures.
10.6 Processing in connection with visits to our premises, stations or track area
The purposes of our processing are:
Maintaining the safety of our passengers, staff, partners and the general public through camera surveillance at the stations, platforms, in our depots and premises and of the track area (no camera surveillance occurs on our trains). Camera surveillance takes place for the purpose of crime prevention, to prevent or detect public order disturbances, to maintain safety and to prevent accidents.
Categories of personal data:
Camera surveillance: Camera surveillance (images without sound) from the stations, platforms, in our depots and premises and of the track area. Signs indicate which areas are monitored.
Legal ground:
Legitimate interest: We have a legitimate and justifiable interest in processing your personal data in order to use cameras to monitor the stations, platforms, our depots, premises and the track area. Camera surveillance enables us to maintain safety for passengers, staff, partners and the general public. Camera surveillance takes place in particular for the purpose of crime prevention, to prevent or detect public order disturbances, to maintain safety and to prevent accidents.
Fulfilment of public interest (camera surveillance): In some cases, our camera surveillance of stations/platforms, in our depots and premises and the track area may also be based on the fulfilment of a public interest in maintaining safety and preventing accidents.
Legal obligation: In some cases, we may have a legal obligation to disclose camera surveillance recordings to the police and other law enforcement agencies.
Legitimate interest: If we have been the victim of crime or for the purpose of solving crimes or security incidents, we may have a legitimate interest in disclosing recordings from our camera surveillance to the authorities in charge or in analysing the recordings in order to identify measures to improve security, even if we do not have a legal duty to carry out such processing.
Storage period:
Camera surveillance recordings are saved for up to three weeks. If, for example, there is a suspicion of crime, camera surveillance recordings may be handed over to the police and other law enforcement agencies.
__________________
This Privacy Policy was last updated on 15/10/2021.