Privacy policy: GDPR & personal data

Fordania AB (Reg. no: 559490-9417), hereinafter referred to as "Fordania", "we" or "us", acts as a data processor and is responsible for storing personal data in accordance with instructions from the data controller, who is the user that collected the information. In this privacy policy we explain what type of personal data we store and how we process it. This privacy policy applies to: fordania.se | app.fordania.se

For further information about our business and its purposes, please visit fordania.se. When we use expressions such as 'when you, as a customer of one of our customers' or similar, we mean that 'you' are a customer of, or have personal data stored with, a company that uses our web-based system to run parts of its operations.

The policy covers the following:

Background and purpose
Your rights
Processing of personal data
How do we obtain information about you?
Sharing of information
Contact details

1. Background and purpose

Under applicable data protection legislation, specifically the GDPR, personal data may only be collected for specific, explicitly stated and legitimate purposes. Data that has been collected may not subsequently be processed in a manner incompatible with these original purposes. Furthermore, the processing of personal data must rest on a lawful basis, a so-called legal basis. Our processing of your personal data is based on one or more of the following legal bases:

The processing is necessary to perform a contract with you ("contract")
The processing is necessary to fulfil a legal obligation ("legal obligation")
The processing is necessary to serve our legitimate interests, provided that these interests are not overridden by your rights and freedoms ("legitimate interests assessment"), or
In certain cases, the processing is based on your explicit consent ("consent")

In most cases, our processing of your personal data is based on contract, legal obligation or a legitimate interests assessment. In specific situations where consent is required, we will obtain it before processing begins.

For questions regarding privacy and data protection matters, you can contact us by email at isak@fordania.se

Below we set out the legitimate purposes for which we process your personal data, as well as the legal basis underlying each purpose.

2. Your rights

Under applicable data protection legislation, specifically the GDPR, you have the right to be informed about when and how we process your personal data. In addition, in certain cases you have the right to access your personal data, as well as to have it transferred, rectified or erased. Here is an overview of your rights:

Right to information

You have the right to obtain, free of charge, information about which personal data we process about you through a so-called data subject access request. To request such an extract, you must submit a written request signed by you. We only disclose data that we can reliably verify belongs to you, and we may not disclose information that would infringe the rights of others. To request a data subject access request, please send a written and signed request by email either directly to us at isak@fordania.se or to the contact details you have received from the company responsible for the actual collection of your data.

Right to rectification

If you discover that inaccurate, incomplete or misleading personal data is being processed about you, you have the right to request that these errors be rectified or completed without undue delay. After correcting the data, we are obliged to inform the recipients with whom we have shared your data of the rectification, unless this is impossible or requires a disproportionate effort on our part. Your right to information also means that you have the right to know which recipients we have shared your information with.

Right to erasure (“the right to be forgotten”)

We retain your personal data in our system for as long as it is deemed necessary by the companies that collected the data, in accordance with their business purposes. When the customer relationship ends, either at the request of the company responsible for the data or when it is determined that the data is no longer needed for the purposes of the business, we will erase your personal data within 12 months. Exceptions apply if we are legally required to retain it for a longer period (e.g. under the Accounting Act). As a customer of one of our customers, you always have the right to contact us and request that your personal data be erased. We are obliged to erase the data in the following situations:

If the data is no longer needed for the purposes for which it was collected
If the processing is based on your consent and you withdraw that consent
If the processing is carried out for direct marketing and you object to the data being processed
If you object to personal data processing carried out following a legitimate interests assessment and there are no overriding legitimate grounds that outweigh your interest
If the personal data has been processed unlawfully
If erasure is required to fulfil a legal obligation

Right to restriction of processing

When data is erased following your request, we are obliged to inform the recipients with whom we have shared your data of the erasure, provided that this is not impossible or does not involve an unreasonable effort on our part. You also have the right to request information about which recipients have received your data. In certain cases you have the right to request that the processing of your personal data be restricted. This means that the data is marked in our systems so that in the future it may only be processed for specific purposes. The right to restriction applies, among other things, when you consider the data to be inaccurate and have requested rectification. In such circumstances, you may also request that the processing of the data be restricted while its accuracy is being investigated. You must be informed when the restriction is lifted.

Right to data portability

You have the right to have your personal data transferred to yourself or to another data controller in a structured, commonly used and machine-readable format. Data portability means that you can request and use your personal data elsewhere. The data controller that has received your data is obliged to facilitate such a transfer of personal data. To benefit from data portability, the recipient must process the personal data with your consent or to perform a contract with you, and it applies only to the personal data that you yourself have provided.

Right to object

You have the right to request restriction of the processing of your personal data.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority if you consider that we are processing your personal data in breach of data protection legislation.

Right to compensation

You have the right to claim compensation if you have suffered damage as a result of a breach of data protection legislation.

3. Processing of personal data

We process your personal data in our capacity as a service provider to companies that use our web-based administration system. When these companies collect your personal data to manage their customer relationships, bookings or other administrative purposes, the data is stored in our system at their request and instruction. Our role is limited to providing a technical platform for the storage and processing of this data, with the aim of enabling companies to streamline the management of their customer records and related services. This helps them to improve their service and maintain strong customer relationships.

We are not responsible for the companies' purposes or methods for collecting and processing personal data, but act in accordance with our agreements and applicable data protection legislation. Fordania undertakes never to use your personal data for its own purposes, such as marketing or other activities not directly related to the services we provide. Our role is limited to storing personal data on behalf of the companies that use our systems, with the aim of enabling and facilitating their use of our services.

We do not request access to, review, or use the stored information for any purpose other than what is required to fulfil our obligations as a service provider, in accordance with agreements and applicable data protection legislation. There may, however, be situations where Fordania, in its capacity as a service provider, is legally obliged to disclose stored personal data to competent authorities. Such measures may be taken only upon a formal request from a governmental or judicial authority, for example in the event of suspicion of criminal activity believed to be linked to services you have purchased from the companies to which you have provided your personal data. Disclosure takes place only to the extent required by applicable legislation and is intended to facilitate the investigation of any offences and to ensure compliance with legal obligations.

4. How do we obtain information about you?

Fordania AB only processes the personal data that you have voluntarily provided to the company that uses our system. It is important to emphasize that we do not collect or seek out personal data directly from you. By providing your personal data to the company, you consent to them, as data controllers, using our system to manage that data. Where necessary and when reasonable for the company's business purposes, the company may, within the framework of applicable laws, also use our system to obtain supplementary data, such as address information or credit checks, in accordance with the information and purpose to which you have consented. Such processing takes place solely under the responsibility of the specific company, and Fordania is only responsible for providing the technical infrastructure for storage and processing.

Companies use our administration system to facilitate and streamline their operations. They are themselves responsible for entering information about their customers into the system, and we store this information for them so that they can have an overview of their customer records and booking history. We only process personal data that companies voluntarily provide to us in order to use our system in accordance with their business purposes. The data we may process about you includes the following:

First name and surname
Date of birth
Address
Email address
Personal identity number
Company registration number for businesses
Phone number
Photo of driving licence
Credit check & address retrieval
Other driving permits (e.g. learner driving permit)
Transaction information, means of payment
Previous bookings and information about your bookings: when you booked, when you returned the car

We strictly limit our handling of personal data to the information you voluntarily provide to the company whose services you use. We neither request nor collect additional information. Our sole purpose is to store the information that the company has shared with us on your initiative.

As a provider, we do not offer the ability to collect sensitive personal data, such as race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or data concerning health or sex life. As for personal identity numbers, these do not constitute sensitive personal data under applicable legislation. However, we treat them as particularly worthy of protection if they are stored by us. When handling images of driving licences and other data classified as sensitive personal data under Swedish legislation, we take strict security measures to ensure that this data is processed in accordance with applicable data protection legislation, including the GDPR. Since a driving licence constitutes an official identity document containing information that can identify an individual, we process such data with the highest degree of security and care, in full compliance with statutory requirements to protect the individual's privacy and rights. We take these measures to ensure that the sensitive personal data we store is not misused or processed in a manner that could infringe the privacy of the data subject.

5. Sharing of information

To safeguard your rights when your information is stored, we want to clarify that the specific company to which you have provided your data stores the information with us. We do not share this information with our corporate customers. Only the company to which you have provided your data is authorized to use it for its business purposes. We undertake not to share or forward your personal data to any third party, except in the cases expressly prescribed by law or in accordance with the purposes for which the data was collected. Under no circumstances will we sell your personal data to third parties, nor will we transfer this data to third parties for marketing purposes. We take all necessary measures to ensure that your personal data is processed in accordance with applicable data protection legislation.

Sensitive information that you share with us will only be accessible to specific, authenticated key personnel within the company. This means that employees who do not have a business need to access the information are automatically prevented from accessing it. The owner of the company can also control and restrict access to the sensitive information by choosing which employees are authorized to access the information in our web system. The purpose of these measures is to ensure responsible handling of the information, solely for business purposes, and that none of the data you provide will be misused in any way.

6. Contact details

Fordania AB ("Fordania") is registered with the Swedish Companies Registration Office (Bolagsverket) under registration number 559490-9417. Fordania AB is a data processor and is responsible for storing personal data as described above and complies with Swedish data protection legislation.

You can always ask your questions about our processing of your personal data at isak@fordania.se

Changes

Fordania AB reserves the right to update this policy when necessary.

Last revised: 2025-11-03