About your personal information

How we protect your personal information

This privacy policy describes, among other things, how and why Öresundståg AB (“Öresundståg”, “we”, “us”) processes your personal data, what rights you have and where you can contact us with questions.

It is important that you feel safe with us, also when it comes to your privacy. We are concerned that the processing of your personal data takes place in a secure manner that meets the legal requirements of the General Data Protection Regulation (GDPR) and other applicable legislation, case law and general advice regarding personal data at any time.

Öresundståg is responsible for the processing of your personal data

Öresundståg AB, 556794-3492, is the data controller for the processing of your personal data and is responsible for the processing of your personal data in accordance with this policy when you use the services provided by Öresundståg or are in contact with us in any other way.

Responsibility of others for the processing of your personal data

When you buy a ticket from, or are otherwise in contact with, public transport operators such as Skånetrafiken, Länstrafiken Kronoberg, Hallandstrafiken, Kalmar länstrafiken, Blekingetrafiken and Västtrafik or the transport company VR Sverige AB, each of these is the data controller for their processing of your personal data.

How Öresundståg receives your personal data

We process personal data that you provide yourself when you use the services provided by Öresundståg, such as when you buy a ticket on our website, participate in competitions and campaigns or register your right to delay compensation.

In some cases, Öresundståg may also obtain personal data from sources other than yourself. This may, for example, involve personal data from your municipality, SPAR or other public sources.

Examples of personal data that may be processed

Examples of personal data that may be processed include name, email address, telephone number, postal address, date of birth, purchase and travel history, payment information and other information that you have provided to us, or that is necessary for us to be able to fulfill our obligations to you.

When is Öresundståg entitled to process your personal data

Öresundståg only processes your personal data when there is a legal basis for the processing. This is the case when the processing is necessary to fulfill an existing agreement or an agreement you want to enter into, when we have a legitimate interest in the processing or when the processing is due to the fulfillment of a legal obligation such as a requirement in law or regulation.

In some cases, Öresundståg may need your consent to process your personal data. In these cases, we obtain your consent separately and you will always receive clear and unambiguous information about what you consent to. You also have the right to withdraw your consent at any time, see more below under “Your rights” and “Right to withdraw consent”.

Why Öresundståg processes your personal data

We may process your personal data for the following purposes, among others:

To provide you with good service

• Administer and complete your purchase of a ticket from us.

• Handle and administer your questions to Öresundståg's booking support.

• Handle lost property.

This privacy policy describes, among other things, how and why Öresundståg AB (“Öresundståg”, “we”, “us”) processes your personal data, what rights you have and where you can contact us with questions.

Öresundståg is responsible for the processing of your personal data

Responsibility of others for the processing of your personal data

How Öresundståg receives your personal data

In some cases, Öresundståg may also obtain personal data from sources other than yourself. This may, for example, involve personal data from your municipality, SPAR or other public sources.

Examples of personal data that may be processed

When is Öresundståg entitled to process your personal data

Why Öresundståg processes your personal data

We may process your personal data for the following purposes, among others:

To provide you with good service

• Administer and complete your purchase of a ticket from us.

• Handle and administer your questions to Öresundståg's booking support.

• Handle lost property.

To provide you with relevant information and offers

• Administer participation in competitions and campaigns.

• Conduct analyses to provide relevant marketing offers and information.

• Provide traffic information including disruption information.

To develop public transport using Öresundståg

• Keep statistics for the purpose of developing Öresundståg's services.

• Carry out voluntary market research and surveys.

To carry out checks

• Prevent abuse and inappropriate use of our services.

• Check the validity of tickets.

These have access to your data

Those people within Öresundståg who are directly affected by the personal data in order to achieve the purposes for which the personal data are intended are given access and authorization to your personal data. Your personal data is also processed by our hired personal data processors.

We do not disclose personal data to other companies or authorities unless we are obliged to do so due to an agreement, law, regulation or official decision or to protect our rights or the rights of third parties or if disclosure to third parties follows from our commitments to you. However, personal data may be disclosed to relevant public transport authorities or transport companies if this is necessary to perform the service.

Öresundståg is subject to the principle of public access. This means that certain documents containing personal data constitute so-called public documents that Öresundståg must disclose if someone requests it. Before disclosure, a confidentiality assessment is carried out in accordance with the Public Access and Secrecy Act.

How long will we save your data

We do not save your personal data for longer than is necessary to fulfill the purposes of processing your personal data. When these purposes no longer exist, for example if an agreement is no longer valid or the case has been processed, your personal data will be handled and disposed of in accordance with the legal regulations that apply to archiving and disposal.

Transfer to third countries

Your personal data will not be transferred to countries outside the EU/EEA.

Your rights

We are keen to ensure that you are aware of your rights regarding your personal data and that you can contact us at any time to exercise the rights listed below. Under the heading “Contact information” below, you will find information on where you can turn.

These are your legal rights:

Right to withdraw consent

You have the right to withdraw your consent at any time. If you wish to withdraw your consent, please contact us as soon as possible. Withdrawal of consent does not affect the lawfulness of processing that has been carried out before the withdrawal.

Right to request access to personal data

We always want to be transparent about how your personal data is processed. If you want to receive confirmation of whether personal data concerning you is being processed or to gain insight into which personal data we process about you, you have the right to request access to your data, a so-called register extract. We will take the necessary measures to ensure that we provide the register extract to the right person. You will then also be informed about the purposes of the processing, the personal data to which the processing applies, the recipients or categories of recipients to whom the personal data have been or will be disclosed and, if possible, the envisaged period for which your personal data will be stored or the criteria used to determine the period. If the personal data have not been collected from you, you will be provided with all available information about the source of these data. Information on additional rights will be provided at the same time and you will be provided with a copy of the personal data that is being processed.

Right to rectification of personal data

You have the right to request that your inaccurate personal data be corrected without undue delay. You also have the right to complete incomplete personal data.

Right to erasure of personal data

You have the right to have your personal data erased where possible. We will erase the personal data at your request without undue delay to the extent permitted by applicable law. This right applies, for example, when the personal data is no longer necessary for the purposes for which it was collected or otherwise processed, if you withdraw your consent, object to the processing, the personal data has been processed unlawfully or if the personal data must be erased for compliance with a legal obligation, as long as there is no reason under applicable law that makes the processing necessary. For example, processing may be necessary to exercise the right to freedom of expression and information, to comply with a legal obligation or to establish, assert or defend legal claims. For example, we cannot erase data that is a public document or where there is a statutory requirement to retain it, such as for accounting purposes. We also cannot erase data where there are legitimate reasons for the data to be retained, such as unpaid debts.

Right to restriction of processing

You also have the right to restrict our processing of your personal data where possible. You can do this, for example, if you contest the accuracy of the personal data, if the processing is unlawful, if the personal data are no longer necessary for the purposes of the processing but you need them to establish, exercise or defend legal claims or pending a possible check as to whether our legitimate grounds override your legitimate grounds. Please note that the implementation of restrictions needs to be consistent with what is possible to implement under the rules on public documents.

Right to object to processing

You also have the right to object at any time to our processing of your personal data for reasons relating to your specific situation, for example when the processing is based on a legitimate interest. Please note that the implementation of objections needs to be consistent with what is possible to implement under the rules on public documents.

Right to data portability

Under certain conditions, you have the right to have your personal data transferred to another data controller in a structured, commonly used and machine-readable format when this is technically feasible, so-called right to data portability. This applies when the processing of your personal data is based on consent or on a contract and the processing is automated.

Right to lodge a complaint

If you believe that we have handled your personal data incorrectly, you have the right to lodge a complaint with the relevant supervisory authority (in Sweden, the Swedish Data Protection Authority and in Denmark, the Data Protection Authority).

Cookies

Öresundståg's website uses small text files, so-called cookies, to facilitate your browsing on the site. They are mainly used to collect statistics about users' visits and improve the experience. This may, for example, involve certain types of marketing. See more information about our use of cookies on our website under the heading "About the website".

Cameras - for a safer journey

Body-worn camera

On Öresundstågen, staff may use body-worn cameras. The data controller for the processing of personal data that occurs when using body-worn cameras is the respective company responsible for the personnel involved.

If you would like to know more about the processing of personal data within the framework of body-worn cameras, you can find information at VR Sverige AB, which is the data controller for this processing, www.vrsverige.com/kameror.

Fixed cameras on Öresundstågen

Fixed cameras are installed on the Öresund trains. Recorded material is stored for up to 14 days and may be disclosed to, for example, the relevant police authority when investigating incidents. The legal basis for the processing is that there is a legitimate interest.

The data controller for the processing of personal data that occurs when using the fixed cameras is the public transport authority concerned.

The purpose of the processing of personal data that occurs within the framework of the fixed cameras is to increase the safety of passengers and staff, detect and secure evidence in the event of vandalism, assist the police with visual material in their investigations of crimes at their request, and contribute visual material to safety and accident investigations.

For those who want to know more

If you have general questions about how personal data is processed, please contact the public transport authority from which you purchased your ticket in the first instance.

You can also visit www.imy.se for general information about your rights regarding personal data.

For specific questions about Öresundståg and our handling of personal data, please write to us.

Contact information

Öresundståg AB

Attn: Data Protection Officer

Norra Stationsgatan 1C

281 48 Hässleholm

dpo@oresundstag.se

Data Protection Officer: Attorney Lars Melin

Changes to Privacy Policy

This privacy policy is available on our website www.oresundstag.se. We may, from time to time, need to update the policy. Our latest version of the privacy policy is always published on our website.

This privacy policy is established on March 27, 2026.