Privacy policy.

Who is responsible for your data

1.1 The data controller, trading as Arlanda Airport Transfer. That means we decide what is collected and why, and we are the ones answerable for it.

1.2 This policy covers personal data we process about passengers, the people who book on their behalf, business contacts, applicants to our partner network, and visitors to this website.

1.3 It sits alongside our booking terms. Where the two overlap on personal data, this policy governs.

1.4 † We have not appointed a data protection officer, as we are not required to. Data protection questions go to info@arlandaairporttransfer.com and are handled .

What we collect

2.1 To carry you — name, telephone number, email address, pickup and destination addresses, date and time, number of passengers and bags, and where you arrive by air the flight number, because we track the aircraft rather than the clock.

2.2 Only if you tell us — a child seat requirement and the child's age and height, an accessibility need, a preferred language, an assistance or other animal, a company reference for an invoice, or any note you add to a booking.

2.3 Because a transaction happened — the amount, date, method and a payment reference. We do not hold your full card number; our payment provider does.

2.4 Because you contacted us — the content of emails, WhatsApp and SMS messages, and a note of a phone call where it matters to a booking.

2.5 If you apply to our partner network — the company and permit details listed on the partner application, including permit and insurance numbers and bank details. This is business data, but where you are a sole trader it is also personal data and this policy applies to it.

2.6 What we do not ask for — your date of birth, passport number or personnummer. A transfer does not need them, we do not want the liability of holding them, and you should be wary of any operator that asks.

Where we get it from

3.1 Almost always from you — through the booking form, by phone, by email or on WhatsApp.

3.2 Sometimes from whoever booked for you: an employer, a travel agent, a DMC, an event organiser, or a hotel concierge. If you are reading this because a car arrived and you did not book it yourself, that is where your details came from, and section 8 applies to you exactly as it would if you had.

3.3 A flight status feed tells us when your aircraft actually lands. That is information about the flight rather than about you, but we mention it because it is the reason we know you are late before you do.

3.4 We do not buy personal data and we do not enrich your booking from third-party sources.

Why we use it, and on what legal basis

4.1 Every use we make of personal data is in the table below, with the legal basis under Article 6 of the GDPR and how long it is kept. If a purpose is not on this table, we are not doing it.

4.2 Where we rely on legitimate interests, we have weighed our interest against your rights and concluded it does not override them. You can object at any time under section 8, and we will stop unless we can show compelling grounds to continue.

4.3 Where we rely on consent — cookies and marketing — you can withdraw it at any time, as easily as you gave it, and withdrawing it never affects your booking.

4.4 We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

4.5 We do not knowingly collect special category data. If you tell us about a medical or mobility need so that we can carry you properly, we use it only for that journey and delete it with the booking.

Who else sees it

5.1 The driver performing your journey — name, phone, addresses, time, flight, and any requirement you told us about. They cannot find you without it.

5.2 A partner operator, where one is performing your journey under clause 17 of the booking terms. They receive only what the journey requires, act on our written instructions as a processor, and may not use your details for their own marketing. We tell you when a partner is driving you.

5.3 † Our payment provider, which processes the transaction and holds the card details we never see.

5.4 † Our website host and booking system, and our email provider — all as processors under written agreements.

5.5 Our accountant and auditor, for the records Swedish bookkeeping law requires us to keep.

5.6 An authority, where the law requires it — the police, Skatteverket, Transportstyrelsen, a court.

5.7 That list is complete. We do not sell, rent or trade personal data, and we do not share it with advertisers, data brokers or anyone else not named above.

Transfers outside the EU and EEA

6.1 We keep personal data inside the EU and EEA wherever we can.

6.2 † Where a supplier processes data outside that area, we rely on an adequacy decision by the European Commission or on the Commission's Standard Contractual Clauses, with a transfer risk assessment.

6.3 You can ask us which suppliers are involved and on what basis, and we will tell you. It is a fair question and the answer should not be a secret.

How long we keep it

7.1 Booking records: three years after the journey. This matches the ordinary limitation period for a consumer claim under preskriptionslagen (1981:130), so that we can still answer a complaint or defend a dispute.

7.2 Accounting records: seven years. Swedish bookkeeping law — 7 kap. 2 § bokföringslagen (1999:1078) — requires räkenskapsinformation to be preserved until the end of the seventh year after the calendar year in which the financial year ended. This obligation overrides a deletion request: we cannot erase an invoice because you ask us to, and we will say so rather than pretend otherwise.

7.3 Correspondence: kept with the booking it relates to, and otherwise for two years.

7.4 Unsuccessful partner applications: twelve months, then deleted, as promised on the application form.

7.5 Marketing consent: until you unsubscribe, plus a minimal record that you unsubscribed so we do not contact you again by mistake.

7.6 At the end of a retention period data is deleted or anonymised. Anonymised journey counts, with nothing identifying in them, may be kept indefinitely for planning.

Your rights

8.1 Under the GDPR you have the right to:

1. Access — a copy of the personal data we hold about you, and an explanation of what we do with it.
2. Rectification — have anything inaccurate corrected or incomplete data completed.
3. Erasure — have it deleted where we no longer need it, subject to clause 7.2.
4. Restriction — have us pause using it while a dispute about it is resolved.
5. Objection — object to any use resting on legitimate interests, and absolutely to direct marketing.
6. Portability — receive the data you gave us in a common machine-readable format.
7. Withdraw consent — at any time, without affecting anything done before you withdrew it.

8.2 Write to info@arlandaairporttransfer.com. We answer within one month and, in a complex case, will tell you inside that month if we need up to two more. All of this is free.

8.3 We may ask you to confirm your identity — usually just by replying from the address that made the booking. We ask only what is needed to be sure, and identity checks are not a way of making a request difficult.

8.4 If a request is manifestly unfounded or excessive, particularly if repetitive, we may charge a reasonable fee or refuse it — and if we do, we will explain why and tell you how to complain.

Cookies and this website

9.1 A cookie is a small file stored on your device. Under Swedish law — the Electronic Communications Act (2022:482), implementing the ePrivacy rules and supervised by PTS, the Swedish Post and Telecom Authority — we must tell you what cookies we use and obtain your consent before storing any that are not strictly necessary.

9.2 That consent must be voluntary, specific, informed and actively given. Practically, that means on this site there are no pre-ticked boxes, the accept and decline options are equally prominent, there is no cookie wall, and continuing to browse is not treated as agreement.

9.3 Strictly necessary cookies need no consent and are the only ones set by default. They keep a booking form's contents while you fill it in, keep you logged in where that applies, and provide basic security. Without them the site does not work.

9.4 † Everything else — analytics, preferences, anything from a third party — is set only if you agree.

9.5 You can withdraw consent at any time through the cookie settings link in the footer, or by clearing cookies in your browser. Withdrawing has no effect on a booking.

9.6 Our server keeps ordinary access logs — IP address, time, page requested, browser — to keep the site running and secure. That is not a cookie and rests on legitimate interests rather than consent.

Cameras in vehicles

10.1 † Where a vehicle carries a camera, this section applies; where it does not, none of it does, and we would rather state that plainly than leave you guessing.

10.2 Camera surveillance in Sweden is governed by the Camera Surveillance Act (2018:1200) and the GDPR. A vehicle with a camera carries a visible notice saying so.

10.3 Where cameras are fitted, they exist for the safety of passengers and drivers and to establish what happened in an incident — not to monitor conversation. Footage is overwritten on a short cycle and kept beyond it only where it is needed for a specific incident, insurance claim or police matter.

10.4 You can ask whether your journey was recorded and request a copy of footage of yourself, subject to the rights of other people appearing in it.

Children's data

11.1 We collect data about children only where a booking requires it — a child's age and height, so that we send the correct restraint under clause 12 of the booking terms. It is used for that journey and deleted with the booking.

11.2 Bookings are made by adults, so we do not offer online services directly to children and do not knowingly collect their data other than as above.

11.3 A parent or guardian may exercise the rights in section 8 on a child's behalf.

Security, and what happens after a breach

12.1 We keep personal data on access-controlled systems, transmit it over encrypted connections, and give drivers only the details of the journey they are performing — not a list of everyone else's.

12.2 Everyone handling booking data is bound to confidentiality, and every processor works under a written data processing agreement.

12.3 If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to IMY within 72 hours of becoming aware of it, as the GDPR requires. Where the risk is high, we will tell you too — promptly, in plain language, and saying what we do not yet know as well as what we do.

12.4 No system is perfectly secure and we will not claim otherwise. What we will do is keep the amount of data small enough that a breach cannot be catastrophic — which is the real reason we do not ask for your passport number.

Changes to this policy

13.1 We may update this policy. The version in force is always the one published here, with its version number and date at the top.

13.2 Where a change materially affects how we use data we already hold, we will tell affected customers directly rather than quietly amend the page. Where a change requires consent, we will ask for it rather than assume it.

How to reach us, and how to complain

14.1 For anything about your personal data, including exercising a right in section 8:

1. Email: info@arlandaairporttransfer.com
2. Telephone and WhatsApp: +46 72 786 06 89

14.2 Please complain to us first — not because you must, but because we can usually fix it the same week, and a regulator cannot.

14.3 If you are not satisfied, you have the right to complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection:

1. Post: Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm
2. Email: imy@imy.se · Telephone: +46 8 657 61 00
3. Online: imy.se, using the complaint form for individuals

14.4 If you live in another EU or EEA state, you may complain to your own national supervisory authority instead.

14.5 Complaints about cookies specifically go to PTS, the Swedish Post and Telecom Authority, which supervises the Electronic Communications Act.