Processing of personal data within SJ AB and its group companies ("SJ")

Your privacy is important to us and so we strive to ensure that the personal data collected about you is stored and handled in a safe and secure manner, and in accordance with the data protection legislation.

This informational text explains how SJ handles your personal data and what rights you have. The information is intended for persons who:

• are a customer of ours – when purchasing tickets, travelling with us, making purchases in the bistro, or visiting one of our lounges
• are a member of SJ Prio, linked to a company agreement (SJ Biz), have an SJ annual pass or a login account
• visit our website or our social media platforms, use our apps, or connect to SJ Wi-Fi
• participate in our marketing activities or customer surveys
• otherwise communicate with us, for example through our Customer Services

We encourage you to read through this information carefully. If you have any questions about how your personal data is handled, you are welcome to contact us. Our contact information may be found at the end of this informational text.

WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

SJ AB (reg. no. 556196-1599) or its group companies are the controller of personal data for the processing of personal data we carry out in accordance with the provisions set forth below.

WHAT IS PERSONAL DATA?

Personal data is any and all information which may be linked to you directly or indirectly (i.e. together with other data), for example name, email, personal ID number, and travel and purchasing history.

We will only process your personal ID number where clearly warranted for the purpose, necessary for secure identification, or where there is some other earnest reason. We always minimize the use of your personal ID number to the greatest extent possible.

ON WHAT LEGAL BASIS DOES SJ PROCESS YOUR PERSONAL DATA?

All processing of personal data by SJ is carried out based on a legal basis, for example that the processing is necessary to perform a contract with you or for SJ to be able to perform a legal obligation. You can read more further below in this informational text about the legal bases on which we rely under the heading “Which personal data do we process about you and why?”.
 

HOW LONG DO WE SAVE YOUR PERSONAL DATA?

Your personal data is only saved as long as needed to fulfil the purposes of the processing, or as long as we are obligated by law to save the data. After this, your data is erased or de-identified in a secure manner so that it can no longer be connected to you. You can read more further below in this informational text about how long we save your data under the heading “Which personal data do we process about you and why?”.

HOW WE PROTECT YOUR PERSONAL DATA?

Your privacy is important to us which is why we place security at the forefront. We take measures in order to protect your data in accordance with the General Data Protection Regulation and established information security guidelines. This means that we protect your data through technical solutions, for example encryption of information, as well as organizational routines and rules, for example authorization controls, adapted to the nature of the personal data processing.
 

WHAT ARE THE SOURCES OF YOUR PERSONAL DATA?

The personal data which SJ processes comes from:

• You yourself, when you book and pay for your travel with SJ, register for a marketing activity, communicate with SJ, or travel with us.
• Any third party who books and pays for your travel for you.
• Your employer, when your employer has signed a corporate agreement (SJ Biz) with SJ.
• The distributer (for example travel agency, train station café, tourist agency, newspaper stand or other operator) with whom your travel is booked and paid.
• Another travel operator through whom your travel with SJ and any needs for a passenger assistance escort are booked.
• The travel operator who arranges replacement travel with SJ due to traffic disruptions on your original trip.
• Payment brokers, fraud control services, and authentication services which verify your payment.
• SJ Prio cooperating partners, when you earn or use Prio points with, for example, cooperating hotel chains and issuers of bank cards.
• The National Population Register (information companies) when we update information regarding your address in our customer register, for example.
• Your computer, telephone or other unit when you use our digital channels and services (for example IP address, operating system, crash logs, or location services).
• SJ, when we create data linked to you, for example ticket number, SJ Prio number, points balance and campaign codes.

TO WHOM DO WE DISCLOSE YOUR PERSONAL DATA?

SJ never sells your personal data to a third party. We only share your information with the suppliers and partners we use to provide our services, i.e. the following categories of recipients.

• suppliers, both within and outside the EU/EEA, such as suppliers who provide services and functionality that SJ itself cannot offer. This includes, for example, suppliers who provide IT services, distribute tickets, provide marketing services, handle customer service matters, or perform payment services and related services, as well as credit information and collection services on behalf of SJ.
• distributors of travel within and outside of Sweden when you provide your SJ Prio, SJ Biz or SJ Annual Pass number.
• travel operators that perform a part of your booked travel when you purchased your travel from SJ.
• passenger assistance escort coordinators, station managers, and passenger assistance escort operators when you book a passenger assistance escort during your travel
• travel operators that are not a part of your original journey in order to be able to handle your onward journey in the event of transportation disruptions
• if you book, or travel, through a company agreement (SJ Biz), information about your purchasing and travel history may be disclosed to the company with which we have an agreement (often your employer)
• cooperation partners within the scope of SJ Prio.
• if you book through a discount offer from another company (most commonly the discount offer is tied to other types of membership and agreements you have entered into), information regarding the purchase will be disclosed to the company with which we have an agreement.
  
• your bank when you identify yourself using BankID, pay with a bank card, or use Swish.
• companies that provide anti-fraud services and companies that provide identity verification in connection with payment services and ticket inspection.

We may also disclose personal data to public authorities as required by law or SJ otherwise determines there is cause for such disclosure, e.g. to law enforcement authorities when they request data in order to prevent and investigate suspected criminal offenses, or to search for missing persons. Personal data may also be disclosed to other recipients when required by law, other regulations or decisions of public authorities, or where it is necessary in order for SJ to protect its rights, e.g. regarding insurance matters.

Recipients who process personal data on behalf of SJ must always enter into what is referred to as a data processor agreement with us to make it possible for us to ensure that your personal data is handled correctly and securely. The data processors are only entitled to process the personal data they receive from SJ on SJ’s behalf, in accordance with the instructions given by SJ in the data processor agreement.

When your personal data is shared with a recipient that is an independent controller of personal data, for example, other travel operators or a bank, the recipient’s privacy policy and information regarding the processing of personal data applies.

TRANSFER TO COUNTRIES OUTSIDE THE EU/EEA

Our goal is that your personal data will always be processed within the EU/EEA. However, our use of certain suppliers, e.g. cloud service providers, requires that in some cases personal data will be processed in countries outside the EU/EEA, known as third countries. This may mean that the supplier’s personnel have access to your personal data from such a country in connection with service or support being carried out for the service which, under the GDPR, constitutes a transfer of personal data to a third country. SJ’s main rule is that no personal data is stored in countries outside the EU/EEA. Where we use suppliers to process your personal data on our behalf outside of the EU/EEA, we use separate safeguards to protect your personal data, for example, we, or our data processor, enter into agreements which include the standardized model clauses for transfers of data as adopted by the EU Commission and which, among others, are available on the Swedish Authority for Privacy Protection’s website or verify that the EU Commission has decided that the recipient country has an adequate level of protection. When you contact us, we can provide more information about the security measures that have been taken. Information about which countries are deemed to have an "adequate level of protection" is available here on the EU Commission’s website.

COOKIES

When you visit our website, we may also collect information and data about you by using what is referred to as cookies. For more information about how we use cookies, please see https://www.sj.se/en/settings/cookies?about-cookies=

HOW TO OBJECT TO ELECTRONIC DIRECT MARKETING:

SJ may use your email address or your mobile telephone number for direct marketing purposes. If you do not wish for us to use your email address or mobile telephone number for direct marketing, you are welcome to contact us and we will set up what is referred to as an ‘advertising block’ for your data.

Please contact us as follows:

• Log into www.sj.se (through the tab in the upper right-hand corner of the start page) and click on “My page (which you will find when you click on your name in the upper right corner. Click then on my SJ Prio in the menu to the right. Click on the link “I wish to obtain offers by email” where you can choose to remove any offers and news you no longer wish to receive.
• You can register for advertising blocks for organizations which have signed corporate agreements (SJ Biz) by sending an email to foretag@sj.se. Don’t forget to include the company name, company registration number, and contract number (SJ Biz) and your name and title.
• You can register for advertising blocks for marketing by email by sending an email to stop@sj.se. Don’t forget to include your name.
• You can register for an advertising block on marketing via SMS by sending an SMS with the text “STOP” to 71671.
• By following the link at the end of the email from SJ, you can state what marketing you do not wish to receive, and an automatic advertising block will be set up.

YOUR RIGHTS

Under data protection legislation, you have a right to receive information directly from us regarding how your personal data is processed. We are giving you that information here. You also have certain other rights under data protection legislation, and you can read more about them below.

Right to access

You have the right to know whether and how we are processing your personal data and an extract of which data is being processed, known as an “extract from the register”. The extract from the register will contact a summary of the personal data we process about you and, together with the information here, helps you understand:

• what the personal data is used for
• how long the personal data will be saved
• what personal data has been shared and
• where the data comes from.

If you would like an extract from the register, please contact us as described below.

We reserve the right to charge an administrative fee if you request such an extract several times during the same year.

Right to correction

You have the right to request a correction if your data is incorrect and to supplement incomplete personal data.

If you have a login account at www.sj.se or in the SJ, you can edit your contact information yourself. Otherwise, please contact us as described below.

Right to data portability

You have the right to demand a copy, in a machine-readable format, of the data that SJ processes about you in order to perform an agreement with you. You also have a right to have such personal data moved from SJ to another company, a public authority, or an organization. This right is limited to data which you yourself have provided to us.

If you would like to move the data that SJ processes about you in this manner, please contact us as described below.

Right to erasure

You have the right to request that your personal data be erased. In certain cases, your request may be denied, for example if we require your data in order to perform our agreement with you or to perform our legal obligations, because SJ’s interest in continuing to process the data outweighs your interest in having it erased, or because it is still needed for the purpose for which we collected it.

Here are a few examples of when you cannot have your personal data with SJ erased:

• if you have booked a ticket and/or are a passenger on a journey which has not yet been completed (with a personal ticket)
• if you have been a passenger with, or booked a ticket for, a personal ticket over the past 12 months since SJ has a legal obligation to handle complaints during this time and requires your data in order to handle any complaints
• if you have an active SJ Prio membership, are covered by a corporate agreement (SJ Biz), have a valid SJ Annual Pass, or have a login account at sj.se/SJ App. In order to be erased, you must first close off your relationship with us
• if you have a pending matter with customer service
• if you have a debt to SJ
• if your personal data is a part of bookkeeping materials, for example in conjunction with payment transactions, complaints, or other economic claims or in an invoice relationship

If you would like to erase your personal data, please contact us as described below.

Right to object to processing

You have the right to request that we stop processing your personal data where the processing is supported by SJ’s legitimate interest. When you have submitted such a request, we will carry out a new weighing of interests. If your interest in having the processing stopped overrides SJ’s legitimate interest, SJ is obligated to stop the processing.

You are also entitled to object to processing for direct marketing purposes, whereupon SJ is obligated to stop the processing.

If you would like to object to any processing, please contact us as described below.

Right to restrict the processing

You have the right to require that SJ’s processing of your personal data (with the exception of storage) be restricted where any of the following alternatives apply.

• if you object that your personal data is not correct, the processing should be restricted during the period of time SJ requires to verify the correctness of the personal data
• SJ’s processing is illegal but you oppose the personal data being erased and instead request a restriction on its use
  SJ no longer requires the personal data for the purposes behind the processing but you need the data in order to establish, enforce, or defend against a legal claim
• you have objected to the processing in accordance with Article 21.1 (see the heading above) and are awaiting whether SJ’s reasons override your legitimate reason

If you would like to restrict the processing of your personal data, please contact us as described below.

AUTOMATED DECISION-MAKING WITH LEGAL EFFECTS

Automated decision-making with legal effects or automated decision-making which similarly significantly affects you, means that SJ makes a decision which can have a significant impact on you, using exclusively technical aids. This processing also involves profiling being carried out based on your personal data before a decision is made.

SJ carries out this type of automated decision-making when we:

• decide to approve or deny your application to use an invoicing service that includes credit. These automated credit decisions are based on the data that you have personally provided, data from external sources such as credit-rating agencies, and SJ’s own internal information
• decide whether your purchase poses a risk of fraud, if our processing shows that your behaviour indicates possible fraudulent behaviour. The automated decision means that we evaluate whether your purchase constitutes a risk of fraud, based on the information that you have personally provided.

We use automatic decision-making when it is necessary for us to enter into or perform the agreement with you. If you are not approved in connection with the automated decision-making described above, you will not have access to any of SJ’s means of payment.

You are always entitled to object to an automated decision with legal effects or a decision which similarly significantly affects you (together with the related profiling) by contacting SJ as described below.

CONTACT INFORMATION

Questions and more information?

If you would like to know more about data protection legislation and your rights, you can read more here https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

We have dedicated customer service personnel who can answer your questions regarding how SJ handles your personal data. You can contact them at dataskydd@sj.se.

Matters regarding your rights?

If you wish to exercise your rights as set forth above, please contact us via the form https://www.sj.se/en/rights-gdpr.html

In order to use the form, you need Mobile BankID. If you do not have Mobile BankID you can contact us by sending a written request, signed by you, to:

SJ Customer Services
Box 1028
831 29 Östersund

or by sending a scanned copy to dataskydd@sj.se

In the letter or email, we would like you to state, in addition to the matter involved, your name, address, email, telephone number, and personal ID number and to sign your request. Please also include a copy of your ID. SJ will send the reply to your address as recorded in the National Population Register or to your digital mailbox.

Comments?

SJ has appointed a Data Protection Officer (DPO) who ensures that SJ is handling your personal data lawfully, correctly, and transparency. If you have a matter you wish to address with our data protection officer, please contact them by email sent to dataskydd@sj.se and state “DPO” in the subject line of your email.

If you believe that our processing of your personal data is not being carried out in accordance with the data protection legislation, we request that you contact us at the address set forth above. You also have the right to file a complaint with the Swedish Authority for Privacy Protection.

WHAT PERSONAL DATA DO WE PROCESS ABOUT YOU AND WHY?

In this section, we explain how your personal data is used, among other things, in order for us to be able to provide you with relevant experiences, services and offers.

1. when you purchase tickets, travel with us, make purchases in the bistro, visit one of our lounges or in connection to lost property management
2. when you request compensation in the event of delay and in conjunction with other claims for compensation
3. when you are a member of SJ Prio, are covered by a corporate agreement (SJ Biz), or have an SJ Annual Pass or a log in account

– Are a member of SJ Prio

– Are covered by a corporate agreement (SJ Biz)

– Have an SJ Annual Pass

– Have a log in account

4. when you communicate with us
5. when you participate in market activities or costumer surveys
6. when you are connected to SJ Wi-Fi or use SJ's website and SJ apps
7. camera surveillance on board
   
8. when you have a legal obligation or otherwise have an interest in disclosing information to public authorities or other recipients

1. When you purchase tickets, travel with us, make purchases in the bistro, visit one of our lounges or in connection to lost property management

When you purchase tickets, travel with us, make purchases in the bistro, visit one of our lounges, or when SJ manage lost property, we handle the following information which you personally provide to us:

• Your name (and the names of any passengers travelling with you) and your contact information
• your personal ID number, for example when you purchase an SJ annual pass or when you visit one of our lounges
• your SJ Prio membership number, company agreement number (SJ Biz) and/or SJ annual pass number if you state these in conjunction with reservations/purchases
• information regarding your journey and travel and purchasing history, for example time of departure, destination, ticket type, seat, additional services, purchasing channel, method of payment, price, journey destination and basis for any additional fees
  
• information regarding the need for assistance or wheelchair space during the journey, where such information is required
  
• information regarding payment and payment history
• information regarding response history (if you click on an email or read messages).
  
• information regarding lost items

We handle your personal data in order to:

• handle and deliver what you have purchased in accordance with our purchasing and travel terms and conditions, for example by providing your journey or the product you have purchased
• charge for the journey, supplemental services, or goods in the bistro, including handling bank card payments, and to send digital receipts.
• in order to discover, and prevent, fraud in conjunction with bank card payments
• identify you as a traveller, for example in conjunction with ticket checks
• accommodate your needs for a passenger assistance escort or wheelchair space in conjunction with travel.
• notify you (through an SJ app, text message, email, or similar electronic communications) regarding changes in the journey, for example in the event of delays or changes in departure times
• market our services and products, for example by email and SMS and, through use of the response history review whether campaigns and messages are relevant
• send customer surveys via email or SMS
  
• accommodate your wishes regarding advertising blocks.
• compile statistics regarding business travel booked via a company agreement (SJ Biz) in order to report to the company (usually your employer)
• compile statistics regarding travel booked via a cooperation (most commonly the discount offer tied to other types of memberships/agreements) in order to report to the cooperation partner
  
• produce statistics regarding purchases of travel and goods, to improve our services
• manage lost property

If you choose to pay for a journey using SJ Private Invoicing (SJ Privatfaktura), with or without installment payments, we also handle personal data about you together with our payment service provider. For more information about how we use personal data in conjunction with payments using SJ Private Invoicing, please see: https://minafakturor.sj.se/Content/documents/legal/sj/sv_se/Personuppgiftsbehandling.pdf (in Swedish only).

Legal basis for the processing: We process your personal data based on: a legal obligation when we process your application for compensation in conjunction with delays and when we handle your matters regarding personal injury; performance of a contract when we handle other complaints regarding the journey and/or the product; and a weighing of interests when we have a legitimate interest in improving our services and discovering and preventing fraud.

Period of storage: We save data about you for up to 12 months after completion of the journey, to handle any complaints, for marketing, and to handle any request for advertising blocks. Information regarding your response history is saved for 12 months, and information regarding your card payments is saved for 24 months. Information connected to lost property management is not stored by SJ.

2. Compensation in conjunction with delays and other claims for compensation

When you submit a complaint about your journey by applying for compensation in conjunction with delays or when you contact us with other claims for compensation, we handle:

• data which you personally provide to us, for example your name (and the name of any passengers travelling with you) contact information, payment information, account information, travel history
• your personal ID number, for example when you apply for compensation for delays
• information regarding the basis for your claim for compensation
• documents which you append to your matter, for example receipts or doctors’ certificates

We process your personal data in order to:

• handle and assess your claims for compensation
• discover and prevent fraud in conjunction with claims for compensation
• produce statistics regarding your matters to improve our services

Legal basis for the processing: We process your personal data based on: a legal obligation when we process your application for compensation in conjunction with delays and when we handle your matters regarding personal injury; performance of a contract when we handle other complaints regarding the journey and/or the product; and based on a weighing of interests when we have a legitimate interest in improving our services and discovering and preventing fraud.

Period of storage: In order to secure traceability, we save your personal data for up to 12 months after the matter has been closed. Where compensation has been paid in a matter, we save the data for 7 years in accordance with the Swedish Bookkeeping Act. Personal injury matters are saved until the matter is barred by the statute of limitations and life annuity matters for your entire lifetime.

3. When you are a member of SJ Prio, covered by a company agreement (SJ Biz), have an SJ annual pass or a login account

When you choose to become a member of SJ Prio, be covered by a company agreement (SJ Biz), purchase an SJ annual pass and/or create a login account in our digital channels, we process:

• data which you personally, or your employer, provide to us such as your name, personal ID number and contact information, including telephone number and email address
• contact information and other information which we obtain from the State Personal Address Register (SPAR)
• a customer number which we create in order to identify you in our systems

We process your personal data in order to:

• identify you and administer your customer relationship with SJ

Legal basis for the processing: We process your personal data based on performance of a contract in order to administer your customer relationship with SJ.

Period of storage: We save your personal data during the customer relationship and for up to 3 months after it is concluded.

You can read more in the section below about how we handle your personal data depending on whether you are a member of SJ Prio, covered by a company agreement (SJ Biz), have an SJ annual pass, and/or have a login account.

Members of SJ Prio

When you are a member of SJ Prio, we also process:

• data about your membership account, for example membership number, membership level and security code
• data about your points balance, points-qualifying purchases, and withdrawals of points from us or our cooperating partners, and purchases in SJ’s Points Shop (SJ Poängshop)
• data about your travel and purchasing history (on the condition that you entered your membership number when booking or when you register retroactively) 
• data about response history (if you click on an email or read messages)

The personal data is processed in order to:

• administer your membership in SJ Prio and your points balance, for example registration of and payment using points
• contact you with information and general offers, for example by email and text message and, using the response history, review whether our campaigns and messages are relevant
• analyze and categorize you in relation to our other customers, including in customer profiles, based on information you have provided to us (for example age, place of residence, gender, and stated preferences) and based on how you use our services (travel and purchasing history). This may also include us identifying which of our cooperation partners you are also a customer of, in order to inform you about our services and offers.
• offer you and inform you of both general and personal/tailor-made offers, including campaigns, and benefits from us and our cooperating partners which are deemed to be relevant for you (the offers and marking that we decide to provide is based, among other things, on your customer profile), for example by email, text message, and via digital channels belonging to SJ or a third party
• produce aggregated statistics and carry out analyses in order to improve our services, goods, and offers, including long-term analyses in order to understand trends over time
• ensure the security of our services, and discover or prevent various types of unlawful use, or use which otherwise contravenes the terms and conditions.

Legal basis for the processing: We process your personal data based on performance of a contract when we fulfill our obligations towards you as a member (for example administering your membership and providing relevant offers, including when we analyze which offers and marketing you will receive) and based on a weighing of interests when we have a legitimate interest in using data about your travel and purchases to produce statistics needed to develop, improve, and ensure the security of our services.

Period of storage:
We save your personal data during the membership period and for up to 3 months after the end of the membership. In order to ensure traceability, we save data regarding our communications with you for 12 months. Information regarding your response history is saved for 18 months. Your travel and purchasing history is saved for up to 7 years for our legitimate interest in analysing trends over time. In the event you terminate your relationship with SJ, we anonymize travel and purchasing history.

Persons covered by a company agreement (SJ Biz)

When you are covered by a company agreement (SJ Biz), we also process:

• data about your coverage under a company agreement and your authority under the company agreement
• invoice information
• data about your travel and purchasing history

The personal data is also processed in order to:

• administer your coverage under a company agreement (SJ Biz)
• administer payment, for example issuing company invoices or travel account invoices
• make it easier for you, your employer, and your employer’s travel agency when booking your business trips
• compile statistics regarding reservations and travel in order to report to the corporate client (often your employer)
• analyse and categorise you in relation to our other customers based on the information you have provided to us, for example age, place of residence, gender and stated preferences) and based on how you use our services (travel and purchasing history)
• contact you with information regarding general offers as well as personal and tailor-made offers, campaigns, and benefits from us, for example by email and text message
• produce aggregated statistics and carry out analyses to improve our services, goods, and offers, including long-term analyses needed to understand trends over time
• ensure the security of our services in order to discover or prevent various types of unlawful use, or use which otherwise contravenes the terms and conditions

Legal basis for the processing: We process your personal data based on a weighing of interests for our legitimate interest as well as that of the connected company in administering and following up travel within the company, in order to make it easier for you when booking business trips, and to fulfill our obligation in relation to the contracting company to provide you with relevant offers. We also process your personal data based on a weighing of interests where we have a legitimate interest in using your data regarding your travel and purchases to produce statistics needed to develop, improve, and ensure the security of our services.

Period of storage: We save your connection data as long as you are covered by a company agreement (SJ Biz) and for up to 1 month after that. In order to ensure traceability, we save data regarding our communications with you for 12 months. Your travel and purchasing history is saved for up to 7 years for our legitimate interest in analysing trends over time. In the event you terminate your relationship with SJ, we anonymize travel and purchasing history.

If you have an SJ annual pass

When you have an SJ annual pass, we also process:

• data regarding your SJ annual pass, for example annual pass number, level, and term of validity
• data regarding your travel and purchasing history

The personal data is processed in order to:

• administer your SJ annual pass, for example the term of validity and booking of seats
• make possible subsequent registration of SJ Prio points for your annual pass purchases in the event you subsequently choose to become a member of SJ Prio
• contact you with information and general offers via, for example, email and SMS
  
• keep you notified and give you rewards if you are a recurring annual pass holder
  
• produce aggregated statistics and carry out analyses needed to improve our services, goods and offers, including long-term analyses in order to understand trends over time
• ensure the security of our services in order to discover or prevent various types of unlawful use, or use which otherwise contravenes the terms and conditions

Legal basis for the processing: We process your personal data based on performance of a contract when we provide the service and based on a weighing of interests when we have a legitimate interest in using your data regarding your travel and purchases to produce statistics needed to develop, improve and ensure the security of our services.

Period of storage: We save your annual pass data as long as you continue to have an active customer relationship with SJ and for a period of 3 months afterwards in order to make it easier if you wish to return as an annual pass customer shortly after closing your annual pass. In order to ensure traceability, we save data regarding our communications with you for 12 months. Your travel and purchasing history is saved for up to 7 years for our legitimate interest in analysing trends over time. In the event you terminate your relationship with SJ, we anonymize travel and purchasing history.

If you have a login account

When you have a login account, we also process:

• data about your login account, for example username and password
• data which you personally choose to save in your profile, for example credit card information and name, contact information, and the membership numbers of passengers travelling with you
• data regarding your travel and purchasing history, or how you otherwise use our services or our digital channels, for example information regarding your most recent logins

The personal data is processed in order to:

• administer your login account and make it easier for you in conjunction with future purchases of travel
• contact you with information and general offers, for example by email and text message
• produce aggregated statistics and carry out analyses to improve our services, goods, and offers, including long-term analyses needed to understand trends over time
• provide, maintain, test, improve and develop the digital services and the technical platform used to provide these
• ensure the security of our services in order to discover or prevent various types of unlawful use, or use which otherwise contravenes the terms and conditions

Legal basis for the processing: We process your personal data based on the performance of a contract when we provide the service and based on a weighing of interests when we and you have a legitimate interest in facilitating the booking of future journeys and in using your data regarding travel and purchases to produce statistics needed to develop, improve, and ensure the security of our services.

Period of storage: We save your login information as long as you actively use your login account (up to 12 months after the last use) or have an active account with us (membership in SJ Prio, connected to a company agreement (SJ Biz) or have an SJ annual pass). In order to ensure traceability, we save data regarding our communications with you for 12 months. Your travel and purchasing history is saved for up to 7 years for our legitimate interest in analysing trends over time. In the event you terminate your relationship with SJ, we anonymize travel and purchasing history.

4. When you communicate with us

You can choose to communicate with SJ in many different ways, for example via social media, in FAQ forums, opinion functions, or in chats, telephone conversations, and emails with our Customer Services.

When you communicate with us, we process data which you personally provide to us, for example:

• name and contact information
• information regarding your views, questions, or matters

We process your personal data in order to:

• answer questions and handle your matters, for example addressing defects, handling complaints, questions regarding bookings and lost property
• deliver information which you have ordered, for example annual reporting and sustainability reporting
• improve our services and the information we provide and publish on our website
• analyse telephone conversations in order to improve our service, educate our personnel and improve our reception of customers
• respond to your request to exercise your rights under data protection legislation and inform you in the event of any personal data breach.
  

Legal basis for the processing: We process your personal data for our, and your, legitimate interest in administering your matter (weighing of interests). When your questions relate to a future or completed journey, we process your personal data on performance of a contract. When we respond to your request to exercise your rights under personal data legislation or inform you of any personal data breach, we process your personal data on the basis of a legal obligation.

Period of storage: We save your personal data for up to 12 months after the matter is closed in order to ensure traceability in your communications with us. If calls are recorded when you call our customer service for quality and training purposes, these are saved for 30 days.

5. When you participate in market activities or customer surveys

In conjunction with marketing activities (for example, lectures, transport service meetings, competitions, campaigns, recordings of podcasts, newsletters, etc.) or in conjunction with customer surveys (questionnaires and interviews on trains, by telephone or SMS, by email or via panels, e.g. Student Advisory Board), we process the information which you or any of our cooperating partners provide to us, including name and contact information.

We process your personal data in order to:

• administer the marketing activities, newsletters, or customer surveys, including providing you with feedback
• create reports and other materials for broadcasting in our podcasts
• inform you about, and offer you, new marketing activities and customer surveys
• produce statistics from marketing activities and customer surveys in order to improve our services

Legal basis for the processing: We process your personal data for our, and your, legitimate interests as described above (weighing of interests) and based on performance of a contract in the administration of contests. Where our processing requires your consent, we will obtain your consent before beginning the processing.

Period of storage: As a basic premise, we save your personal data for 1 month after the conclusion of the activity and up to 6 months in connection with customer surveys and recurring marketing. If you unsubscribe from newsletters, etc. we will delete your data immediately. Otherwise, we save the data that you have provided to receive newsletters and the like for 12 months from the last contact with you.

6. When you connect to SJ Wi-Fi or use SJ’s website and SJ’s apps

When you connect to SJ Wi-Fi, we are the controller of personal data for any processing which takes place in order to connect you to the Internet, but not for the continued processing, or for the contents of your communications over Wi-Fi. When you connect to SJ Wi-Fi, we process your IP address, MAC address, timestamps and the train’s GPS position if you use Wi-Fi during your journey.

When you visit our website, we process:

• data about how you interact with, and use, our website, for example in conjunction with booking journeys
• information regarding your visits to our website, through cookies. For more information about how we use cookies, please see https://www.sj.se/en/settings/cookies?about-cookies=

When you use our apps, you can choose to send logs to us if you have encountered technical problems. In such cases, we process data regarding your use of the app.

We process your personal data in order to:

• provide digital tools and services, including providing you with correct information
• provide support when you encounter technical problems
• maintain, test, and improve our digital tools and services
• discover and prevent various IT -related attacks against technology and users, for example dissemination of harmful code and data infringement.

Legal basis for the processing: We process your personal data based on performance of a contract when we provide Wi-Fi and based on a weighing of interests for our legitimate interest in maintaining, testing, and improving our digital tools and services. If our processing requires your consent, we will obtain your consent before the processing starts.

Period of storage: We save your personal data for 1 month after you have used our digital channels and for 3 months from the time at which you connected to our Wi-Fi. When you use location services, position data may, in certain cases, be stored in your mobile device for up to 24 hours.

When you ask Google to talk to SJ, SJ's voice control application can interact with you. Google is responsible for the processing of personal data that takes place within the Google Assistant. However, SJ may, in exceptional cases, process personal data and, in such case, is a controller of personal data for such processing. You can read more here about how we process personal data within the framework of SJ's voice control application.

7. Camera surveillance

On all routes operated by SJ AB, our employees may be equipped with body-worn cameras. The body-worn cameras are worn on the uniform and record moving pictures and sound. Read more on sj.se/bodyworncamera

In the service that SJ operates on behalf of Västtrafik (www.vasttrafik.se), there is fixed camera surveillance on board the trains. Each procuring party is the controller of the processing of personal data that takes place due to the fixed camera surveillance. Read more about on the respective websites.

8. When we have a legal obligation or otherwise have an interest in disclosing data to public authorities or other recipients

In addition to the provisions described in the sections above, in certain cases we process your personal data when we have a legal obligation, for example due to our bookkeeping obligation, obligations which follow from transportation law legislation, or upon request from a public authority. In these cases, a legal obligation is most often the legal basis supporting the processing of the personal data however, in certain cases, we may disclose data to a public authority, for example, the police, or a court based on a weighing of interests. This may be the case in relation to, e.g. police reports or in connection with searches after missing persons by the police or for the purpose of protecting SJ’s rights in a matter before a court or other public authority. 

In addition, based on a weighing of interests, SJ may disclose information to parties other than public authorities where necessary to protect SJ’s rights. The forgoing may, e.g., be in relation to an insurance company or other party against which SJ has brought a claim or is defending a claim.