Access denied {{userModel.firstName}}

You are not authorised to access this page

Handling of personal data at SJ 

Handling of personal data at SJ

Your privacy is important to us and so we strive to ensure that the personal data collected about you is stored and handled in a safe and secure manner, and in accordance with the data protection legislation.

This informational text explains how SJ handles your personal data and what rights you have. The information is intended for persons who:

  • are a customer of ours – when purchasing tickets, traveling with us, or making purchases in the bistro
  • are a member of SJ Prio, linked to a company agreement (SJ Biz), have an SJ annual pass or a login account
  • visit our website or our social media platforms, use our apps, or connect to SJ Wi-Fi
  • participate in our marketing activities or customer surveys
  • otherwise communicate with us, for example through our Customer Services

We encourage you to read through this information carefully. If you have any questions about how your personal data is handled, you are welcome to contact us. Our contact information may be found at the end of this informational text.

WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

SJ AB (org. nr. 556196-1599) is the controller of personal data for the processing of personal data we carry out.

WHAT IS PERSONAL DATA?

Personal data is any and all information which may be linked to you directly or indirectly (i.e. together with other data), for example name, email, personal ID number, and travel and purchasing history.
 

ON WHAT LEGAL BASIS DOES SJ PROCESS YOUR PERSONAL DATA?

All processing of personal data by SJ is carried out based on a legal basis, for example that the processing is necessary to perform a contract with you or for SJ to be able to perform a legal obligation. You can read more further below in this informational text about the legal bases on which we rely under the heading “Which personal data do we process about you and why?”.
 

HOW LONG DO WE SAVE YOUR PERSONAL DATA?

Your personal data is only saved as long as needed to fulfill the purposes of the processing, or as long as we are obligated by law to save the data. After this, your data is erased or de-identified in a secure manner so that it can no longer be connected to you. You can read more further below in this informational text about how long we save your data under the heading “Which personal data do we process about you and why?”.

HOW WE PROTECT YOUR PERSONAL DATA?

Your privacy is important to us which is why we place security at the forefront. We take measures in order to protect your data in accordance with the General Data Protection Regulation and established information security guidelines. This means that we protect your data through technical solutions, for example encryption of information, as well as organizational routines and rules, for example authorization controls, adapted to the nature of the personal data processing.
 

WHAT ARE THE SOURCES OF YOUR PERSONAL DATA?

The personal data which SJ processes comes from:

  • You yourself, when you book and pay for your travel with SJ.
  • Any third party who books and pays for your travel for you.
  • Your employer, when your employer has signed a corporate agreement (SJ Biz) with SJ.
  • The distributer (for example travel agency, train station café, tourist agency, newspaper stand or other operator) with whom your travel is booked and paid.
  • Another travel operator through whom your travel with SJ and any needs for a passenger assistance escort are booked.
  • The travel operator who arranges replacement travel with SJ due to traffic disruptions on your original trip.
  • Payment brokers, fraud control services, and authentication services which verify your payment.
  • SJ Prio cooperating partners, when you earn or use Prio points with, for example, cooperating hotel chains and issuers of bank cards.
  • The National Population Register (information companies) when we update information regarding your address in our customer register, for example.
  • Your computer, telephone or other unit when you use our digital channels and services (for example IP address, operating system, crash logs).
  • SJ, when we create data linked to you, for example ticket number, SJ Prio number, points balance and campaign codes.

TO WHOM DO WE DISCLOSE YOUR PERSONAL DATA?

SJ never sells your personal data to a third party. We only share your information with the suppliers and partners we use to provide our services, i.e. the following categories of recipients:

  • suppliers, both within and outside the EU/EEA, such as suppliers who provide IT services, distribute tickets, provide marketing services, handle customer service matters, or perform payment services and credit information on behalf of SJ
  • distributors of travel within and outside of Sweden when you provide your SJ Prio, SJ Biz or SJ Annual Pass number.
  • travel operators that perform a part of your booked travel when you purchased your travel from SJ
  • passenger assistance escort coordinators, station managers, and passenger assistance escort operators when you book a passenger assistance escort during your travel
  • travel operators that are on not a part of your original journey in order to be able to handle your onward journey in the event of transportation disruptions
  • if you book, or travel, through a company agreement (SJ Biz), information about your purchasing and travel history may be disclosed to the company with which we have an agreement (often your employer)
  • your bank when you identify yourself using Bank-ID, pay with a bank card, or use Swish
  • other recipients where required by law, other regulations, or decisions of public authorities

Recipients who process personal data on behalf of SJ must always enter into what is referred to as a data processor agreement with us to make it possible for us to ensure that your personal data is handled correctly and securely. Where we use suppliers to process your personal data on our behalf outside of the EU/EEA, we use separate safeguards, for example we enter into agreements which include the standardized model causes for transfers of data as adopted by the EU Commission and which are available on the EU Commission’s website.

When your personal data is shared with a recipient that is an independent controller of personal data, for example a public authority or a bank, the recipient’s privacy policy and information regarding the processing of personal data applies.

COOKIES

When you visit our website, we may also collect information and data about you by using what is referred to as cookies. For more information about how we use cookies, please see https://www.sj.se/en/lankar/about-website.html


HOW TO OBJECT TO ELECTRONIC DIRECT MARKETING:

SJ may use your email address or your mobile telephone number for direct marketing purposes. If you do not wish for us to use your email address or mobile telephone number for direct marketing, you are welcome to contact us and we will set up what is referred to as an ‘advertising block’ for your data.

Please contact us as follows:

  • Log into www.sj.se (through the tab in the upper right-hand corner of the start page) and click on “My page (which you will find when you click on your name in the upper right corner. Click then on my SJ Prio in the menu to the right. Click on the link “I wish to obtain offers by email” where you can choose to remove any offers and news you no longer wish to receive.
  • You can register for advertising blocks for organizations which have signed corporate agreements (SJ Biz) by sending an email to foretag@sj.se. Don’t forget to include the company name, company registration number, and contract number (SJ Biz) and your name and title.
  • You can register for advertising blocks for marketing by email by sending an email to stop@sj.se. Don’t forget to include your name.
  • You can register for an advertising block on marketing via SMS by sending an SMS with the text “STOP” to 71671.
  • By following the link at the end of the email from SJ, you can state what marketing you do not wish to receive, and an automatic advertising block will be set up.

YOUR RIGHTS

You have certain rights under the data protection legislation. You can read more about them here.  

Right to access

You have the right to receive a confirmation as to whether and how we are processing your personal data and an extract of which data is being processed.

We reserve the right to charge an administrative fee if you request such an extract several times during the same year.

Right to correction

You have the right to request a correction if your data is incorrect and to supplement incomplete personal data.

If you have a login account at www.sj.se or in the SJ, you can edit your contact information yourself.

Right to data portability

You have the right to require that personal data be moved from SJ to another company, a public authority, or organization. This right is limited to data which you yourself have provided to us.

Right to erasure

You have the right to request that your personal data be erased. In certain cases, your request may be denied, for example if we require your data in order to perform our agreement with you or to perform our legal obligations.

Here are a few examples of when you cannot have your personal data with SJ erased:

  • if you have booked a ticket and/or are a passenger on a journey which has not yet been completed (with a personal ticket)
  • if you have been a passenger with, or a booked ticket for, a personal ticket over the past 12 months since SJ has a legal obligation to handle complaints during this time and requires your data in order to handle any complaints
  • if you have an active SJ Prio membership, are covered by a corporate agreement (SJ Biz), have a valid SJ Annual Pass, or have a login account at sj.se/SJ App. In order to be erased, you must first close off your relationship with us
  • if you have an pending matter with customer service
  • if you have a debt to SJ
  • if your personal data is a part of bookkeeping materials, for example in conjunction with payment transactions, complaints, or other economic claims or in an invoice relationship

Right to object to processing

You have the right to request that we stop processing your personal data where the processing is supported by SJ’s legitimate interest. After you have submitted your request, we will carry out a new weighing of interests. If your interest in having the processing stopped overrides SJ’s legitimate interest, SJ is obligated to stop the processing.

You are also entitled to object to processing for direct marketing purposes, whereupon SJ is obligated to stop the processing.

Right to restrict the processing

You have the right to require that our processing of your personal data (with the exception of storage) be restricted where any of the following alternatives apply:

  • If you object that your personal data is not correct, the processing should be restricted during the period of time SJ requires to verify the correctness of the personal data
  • SJ’s processing is illegal but you oppose the personal data being erased and instead request a restriction on its use
  • SJ no longer requires the personal data for the purposes behind the processing but you need the data in order to establish, enforce, or defend against a legal claim
  • you have objected to the processing in accordance with Article 21.1(see the heading above) and are awaiting whether SJ’s reasons override your legitimate reason.

AUTOMATIC DECISION-MAKING

The processing of your personal data may, in certain cases, involve automatic decision-making. This means that the decisions we take are made with the aid of technical means and without human involvement (for example in conjunction with an assessment of compensation in the event of delay). We use automatic decision-making when it is necessary for us to enter into or perform the agreement with you. If you believe that the assessment incorrect, you can contact us using the information set forth below.

CONTACT INFORMATION

Questions and more information?

If you would like to know more about data protection legislation and your rights, you can read more here https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

We have dedicated customer service personnel who can answer your questions regarding how SJ handles your personal data. You can contact them at dataskydd@sj.se.

Matters regarding your rights?

If you wish to exercise your rights as set forth above, please contact us via the form https://www.sj.se/en/rights-gdpr.html

To use the form, you need Mobile BankID. If you do not have Mobile BankID you can contact us by sending a written request signed by you to:

SJ Customer Services
Box 1028
831 29 Östersund

Or by sending a scanned copy to dataskydd@sj.se

In the letter or email, we would like you to state, in addition to the matter involved, your name, address, email, telephone number, and personal ID number and to sign your request. Please also include a copy of your ID. SJ will send the reply to your address as recorded in the National Population Register or to your digital mailbox.

Comments?

SJ has appointed a Data Protection Officer (DPO) who ensures that SJ is handling your personal data lawfully, correctly, and transparency. If you have a matter you wish to address with our data protection officer, please contact them by email sent to dataskydd@sj.se and state “DPO” in the subject line of your email.

If you believe that our processing of your personal data is not being carried out in accordance with the data protection legislation, we would request that you contact us at the address set forth above. You also have the right to file a complaint with the Swedish Data Inspection Board.

1. When you purchase tickets, travel with us, or make purchases in the Bistro

When you purchase tickets, travel with us, or make purchases in the Bistro, we handle the following information which you personally provide to us:

  • Your name (and the names of any passengers traveling with you) and your contact information
  • your personal ID number, for example when you purchase an SJ annual pass
  • your SJ Prio membership number, company agreement number (SJ Biz) and/or SJ annual pass number if you state these in conjunction with reservations/purchases
  • information regarding your journey and travel and purchasing history, for example time of departure, purchasing channel, method of payment, ticket type, price, journey destination and category of goods
  • information regarding the need for assistance or wheelchair space during the journey, where such information is required
  • information regarding payment and payment history

We handle your personal data in order to:

  • handle and deliver what you have purchased in accordance with our purchasing and travel terms and conditions, for example by providing your journey or the product you have purchased
  • charge for the journey, supplemental services, or goods in the Bistro, including handling bank card payments
  • in order to discover, and prevent, fraud in conjunction with bank card payments
  • identify you as a traveler, for example in conjunction with ticket checks
  • accommodate your needs for a passenger assistance escort or wheelchair space in conjunction with travel.
  • notify you (through an SJ app, text message, email, or similar electronic communications) regarding changes in the journey, for example in the event of delays or changes in departure times
  • market our services and products, for example by email and text messages
  • accommodate your wishes regarding advertising blocks.
  • compile statistics regarding business travel booked via a company agreement (SJ Biz) in order to report to the company (often your employer)
  • produce statistics regarding purchases of travel and goods, to improve our services

If you choose to pay for a journey using SJ Private Invoicing (SJ Privatfaktura), with or without installment payments, we also handle personal data about you together with our payment service provider. For more information about how we use personal data in conjunction with payments using SJ Private Invoicing, please see: https://minafakturor.sj.se/Content/documents/legal/sj/sv_se/Personuppgiftsbehandling.pdf (in Swedish only).

Legal basis for the processing: We process your personal data based on: a performance of a contract when we provide and charge for the journey and/or the product; based upon a weighing of interests when we have a legitimate interest in using your data for statistical purposes and to market our services, and to prevent fraud; and based upon a legal obligation for handling opt-out settings, passenger assistance escorts and wheelchair places.

Period of storage: We save data about you for up to 12 months after completion of the journey, to handle any complaints, for marketing, and to handle requests for advertising blocks. Information regarding your card payments is saved for 24 months.

2. Compensation in conjunction with delays and other claims for compensation

When you submit a complaint about your journey by applying for compensation in conjunction with delays or where you contact us with other claims for compensation, we handle:

  • data which you personally provide to us, for example your name (and the name of any passengers traveling with you) contact information, payment information, account information, travel history
  • your personal ID number, for example when you apply for compensation for delays
  • information regarding the basis for your claim for compensation
  • documents which you append to your matter, for example receipts or doctors’ certificates

We process your personal data in order to:

  • handle and assess your claims for compensation
  • discover and prevent fraud in conjunction with claims for compensation
  • produce statistics regarding your matters to improve our services

Legal basis for the processing: We process your personal data based on: a legal obligation when we process your application for compensation in conjunction with delays and when we handle your matters regarding personal injury; performance of a contract when we handle other complaints regarding the journey and/or the product; and based on a weighing of interests when we have a legitimate interest in improving our services and discovering and preventing fraud.

Period of storage: In order to secure traceability, we save your personal data for up to 36 months after the matter has been closed. Where compensation has been paid in a matter, we save the data for 7 years in accordance with the Swedish Bookkeeping Act. Personal injury matters are saved until the matter is barred by the statute of limitations and life annuity matters for your entire lifetime.

3. When you are a member of SJ Prio, covered by a company agreement (SJ Biz), have an SJ annual pass or a login account

When you choose to become a member of SJ Prio, be covered by a company agreement (SJ Biz), purchase an SJ annual pass and/or create a login account in our digital channels, we process:

  • data which you personally, or your employer, provide to us such as your name, personal ID number and contact information, including telephone number and email address
  • contact information and other information which we obtain from the State Personal Address Register (SPAR)
  • a customer number which we create in order to identify you in our systems

We process your personal data in order to:

  • identify you and administer your customer relationship with SJ

Legal basis for the processing: We process your personal data based on performance of a contract in order to administer your customer relationship with SJ.

Period of storage: We save your personal data during the customer relationship and for up to 3 months after it is concluded.

You can read more in the section below about how we handle your personal data depending on whether you are a member of SJ Prio, covered by a company agreement (SJ Biz), have an SJ annual pass, and/or have a login account.

Members of SJ Prio

When you are a member of SJ Prio, we also process:

  • data about your membership account, for example membership number, membership level and security code
  • data about your points balance, points-qualifying purchases, and withdrawals of points from us or our cooperating partners, and purchases in SJ’s Points Shop (SJ Poängshop)
  • data about your travel and purchasing history

The personal data is processed in order to:

  • administer your membership in SJ Prio and your points balance, for example registration of and payment using points
  • contact you with information and general offers, for example by email and text message
  • analyze and categorize you in relation to our other customers based on information you have provided to us (for example age, place of residence, gender, and stated preferences) and based on how you use our services (travel and purchasing history)
  • inform you of personal and tailor-made offers, campaigns, and benefits from us and our cooperating partners, for example by email and text message
  • produce aggregated statistics and carry out analyses in order to improve our services, goods, and offers, including long-term analyses in order to understand trends over time
  • ensure the security of our services, and discover or prevent various types of unlawful use, or use which otherwise contravenes the terms and conditions


Legal basis for the processing: We process your personal data based on performance of a contract when we fulfill our obligations towards you as a member (for example administering your membership and providing relevant offers) and based on a weighing of interests when we have a legitimate interest in using data about your travel and purchases to produce statistics needed to develop, improve, and ensure the security of our services.

Period of storage:
We save your personal data during the membership period and for up to 3 months after the end of the membership. In order to ensure traceability, we save data regarding our communications with you for 12 months. Your travel and purchasing history is saved for up to 7 years for our legitimate interest in analyzing trends over time. In the event you terminate your relationship with SJ, we anonymize travel and purchasing history.

Persons covered by a company agreement (SJ Biz)

When you are covered by a company agreement (SJ Biz), we also process:

  • data about your coverage under a company agreement and your authority under the company agreement
  • invoice information
  • data about your travel and purchasing history

The personal data is also processed in order to:

  • administer your coverage under a company agreement (SJ Biz)
  • administer payment, for example issuing company invoices or travel account invoices
  • make it easier for you, your employer, and your employer’s travel agency when booking your business trips
  • compile statistics regarding reservations and travel in order to report to the corporate client (often your employer)
  • analyze and categorize you in relation to our other customers based on the information you have provided to us, for example age, place of residence, gender and stated preferences) and based on how you use our services (travel and purchasing history)
  • contact you with information regarding general offers as well as personal and tailor-made offers, campaigns, and benefits from us, for example by email and text message
  • produce aggregated statistics and carry out analyses to improve our services, goods, and offers, including long-term analyses needed to understand trends over time
  • ensure the security of our services in order to discover or prevent various types of unlawful use, or use which otherwise contravenes the terms and conditions

Legal basis for the processing: We process your personal data based on a weighing of interests for our, and that of the connected company, legitimate interest to administer and follow-up travel within the company, in order to make it easier for you when booking business trips, and to fulfill our obligation in relation to the contracting company to provide you with relevant offers. We also process your personal data based on a weighing of interests where we have a legitimate interest in using your data regarding your travel and purchases to produce statistics needed to develop, improve, and ensure the security of our services.

Period of storage: We save your connection data as long as you are covered by a company agreement (SJ Biz) and for up to 1 month after that. In order to ensure traceability, we save data regarding our communications with you for 12 months. Your travel and purchasing history is saved for up to 7 years for our legitimate interest in analyzing trends over time. In the event you terminate your relationship with SJ, we anonymize travel and purchasing history.

If you have an SJ annual pass

When you have an SJ annual pass, we also process:

  • data regarding your SJ annual pass, for example annual pass number, level, and term of validity
  • data regarding your travel and purchasing history

The personal data is processed in order to:

  • administer your SJ annual pass, for example the term of validity and booking of seats
  • make possible subsequent registration of SJ Prio points for your annual pass purchases in the event you subsequently choose to become a member of SJ Prio
  • produce aggregated statistics and carry out analyses needed to improve our services, goods and offers, including long-term analyses in order to understand trends over time
  • ensure the security of our services in order to discover or prevent various types of unlawful use, or use which otherwise contravenes the terms and conditions

Legal basis for the processing: We process your personal data based on performance of a contract when we provide the service and based on a weighing of interests when we have a legitimate interest in using your data regarding your travel and purchases to produce statistics needed to develop, improve and ensure the security of our services.

Period of storage: We save your annual pass data as long as you have an active annual pass and for a period of 3 months afterwards in order to make it easier if you wish to return as an annual pass customer shortly after closing your annual pass. In order to ensure traceability, we save data regarding our communications with you for 12 months. Your travel and purchasing history is saved for up to 7 years for our legitimate interest in analyzing trends over time. In the event you terminate your relationship with SJ, we anonymize travel and purchasing history.

If you have a login account

When you have a login account, we also process:

  • data about your login account, for example username and password
  • data which you personally choose to save in your profile, for example credit card information and name, contact information, and the membership numbers of passengers traveling with you
  • data regarding your travel and purchasing history, or how you otherwise use our services or our digital channels, for example information regarding your most recent logins

The personal data is processed in order to:

  • administer your login account and make it easier for you in conjunction with future purchases of travel
  • contact you with information and general offers, for example by email and text message
  • produce aggregated statistics and carry out analyses to improve our services, goods, and offers, including long-term analyses needed to understand trends over time
  • provide, maintain, test, improve and develop the digital services and the technical platform used to provide these
  • ensure the security of our services in order to discover or prevent various types of unlawful use, or use which otherwise contravenes the terms and conditions

Legal basis for the processing: We process your personal data based on the performance of a contract when we provide the service and based on a weighing of interests when we and you have a legitimate interest in facilitating the booking of future journeys and in using your data regarding travel and purchases to produce statistics needed to develop, improve, and ensure the security of our services.

Period of storage: We save your login information as long as you actively use your login account (up to 6 months after the last use) or have an active account with us (membership in SJ Prio, connected to a company agreement (SJ Biz) or have an SJ annual pass). In order to ensure traceability, we save data regarding our communications with you for 12 months. Your travel and purchasing history is saved for up to 7 years for our legitimate interest in analyzing trends over time. In the event you terminate your relationship with SJ, we anonymize travel and purchasing history.

4. When you communicate with us

You can choose to communicate with SJ in many different ways, for example via social media, in FAQ forums, opinion functions, or in chats, telephone conversations, and emails with our Customer Services.

When you communicate with us, we process data which you personally provide to us, for example:

  • name and contact information
  • information regarding your views, questions, or matters

We process your personal data in order to:

  • answer questions and handle your matters, for example addressing defects, handling complaints, questions about lost property
  • deliver information which you have ordered, for example annual reporting and sustainability reporting
  • improve our services and the information we provide and publish on our website
  • analyze telephone conversations in order to improve our service

Legal basis for the processing: We process your personal data for our, and your, legitimate interest in administering your matter (weighing of interests).

Period of storage: We save your personal data for up to 12 months after the matter is closed in order to ensure traceability in your communications with us.

5. When you participate in market activities or customer surveys

In conjunction with marketing activities (lectures, competitions, campaigns, recordings of podcasts, etc.) or in conjunction with customer surveys (questionnaires and interviews on trains, by telephone, or via panels or in the use of SJ Labs), we process the information which you provide to us, including name and contact information.

We process your personal data in order to:

  • administer the marketing activities or customer survey, including providing you with feedback
  • create reports and other materials for broadcasting in our podcasts
  • inform you about, and offer you, new marketing activities and customer surveys
  • produce statistics from marketing activities and customer surveys in order to improve our services

Legal basis for the processing: We process your personal data for our, and your, legitimate interests as described above (weighing of interests) and based on performance of a contract in the administration of contests. Where our processing requires your consent, we will obtain your consent before beginning the processing.

Period of storage: As a basic premise, we save your personal data for 1 month after the conclusion of the activity.

6. When you connect to SJ Wi-Fi or use SJ’s website and SJ’s apps

When you connect to SJ Wi-Fi, we are the controller of personal data for any processing which takes place in order to connect you to the Internet, but not for the continued processing, or for the contents of your communications over Wi-Fi. When you connect to SJ Wi-Fi, we process your IP address, MAC address, timestamps and the train’s GPS position if you use Wi-Fi during your journey.

When you visit our website, we process:

  • data about how you interact with, and use, our website, for example in conjunction with booking journeys
  • information regarding your visits to our website, through cookies. For more information about how we use cookies, please see https://www.sj.se/en/lankar/about-website.html

When you use our apps, you can choose to send logs to us if you have encountered technical problems. In such cases, we process data regarding your use of the app.

We process your personal data in order to:

  • provide digital tools and services
  • provide support when you encounter technical problems
  • maintain, test, and improve our digital tools and services
  • discover and prevent various IT -related attacks against technology and users, for example dissemination of harmful code and data infringement.

Legal basis for the processing: We process your personal data based on performance of a contract when we provide Wi-Fi and based on a weighing of interests for our legitimate interest in maintaining, testing, and improving our digital tools and services.

Period of storage: We save your personal data for 1 month after you have used our digital channels and for 3 months from the time at which you connected to our Wi-Fi.

7. When we have a legal obligation

In addition to the provisions described in the sections above, in certain cases we process your personal data when we have a legal obligation, for example due to our bookkeeping obligation, obligations which follow from transportation law legislation, or upon request from a public authority. In these cases, a legal obligation is the legal basis supporting the processing of the personal data.

UPDATES TO THE INFORMATIONAL TEXT

This information may be updated. The most recent version is always published here. If we make any significant changes in how we process your personal data, we will notify you via www.sj.se, the SJ App or by email.

Most recent update: 25 May 2018