The privacy policy

APCOA Sverige AB org.nr: 556439-7478 ("APCOA", "we" or "us") is the data controller for the processing of personal data carried out by us and our data processors or in cases where APCOA determines the purpose and means of the processing.

At APCOA Sverige AB, our customers' trust is our greatest asset. This trust forms the basis of our business operations. This trust is based on respect and protection of our customers' personal integrity.

We maintain this protection by complying with the GDPR Regulation (EU), 2016/679 and treat the information that our customers entrust to us in a careful and responsible manner. Therefore, in all contexts where personal data or other important information may be processed by APCOA Sverige AB or by anyone else on behalf of APCOA Sverige AB, all reasonable and appropriate measures are taken to protect customer data from unauthorised access, disclosure, alteration and destruction.

Our IT security procedures and policies aim to ensure that the information we hold about our customers remains inaccessible to unauthorised persons. APCOA Sverige AB protects information in accordance with established security standards and procedures according to the ISO 27001 standard.

With APCOA Sverige AB's privacy policy, we want to inform you in more detail about how we safeguard your legitimate interest in privacy protection in various ways. Here you can find out more about how we process your personal data and about your rights to, for example, have personal data corrected and how you can obtain extracts of the personal data we process.

GDPR: GDPR stands for "General Data Protection Regulation" and is a data protection regulation that governs how personal data is handled and protected within the European Union (EU). The GDPR aims to give individuals control over their personal data and strengthen their data protection rights, while imposing strict rules and requirements on organisations and businesses that process personal data. 

Personal data: any information that can be directly or indirectly linked to a living individual. This may include name, registration number, address and social security number. 

Services: All services provided or administered by APCOA Sverige AB. This includes, for example, short-term parking, camera parking, contract parking, APCOA FLOW, 

Processing: any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. 

Customer: You who use APCOA's products or services. 

Data subject: The owner of the personal data processed by APCOA. Most often the data subject and the customer are the same person, but in some circumstances the customer may be a third party, for example if the customer is acting as an agent or if the data is not considered to be personal data. 

Other terms follow the definitions in Article 4 of the GDPR.

We only process your personal data when it is necessary to provide our Services, when we have a legitimate interest, when required by law or otherwise when you have given us your explicit voluntary and unconditional consent.

In order to provide our services, APCOA may share personal data with third parties such as consultants, suppliers or other members of the APCOA group. We will not share your personal data unless authorised to do so by law. 

Our service providers provide, among others, the following services: information services, telephony services, support services and IT services, such as support, operation, improvement, development, mailing and invoice management services, reminder, collection and payment services. 

These service providers may only process your personal data according to APCOA's explicit instructions and may not use your data for their own purposes. They are also legally and contractually obliged to protect your personal data. 

For the development of customer management systems and the manual correction of registration numbers, APCOA uses service providers located in third countries. In this regard, APCOA has ensured adequate protection of the privacy and fundamental rights and freedoms of individuals in relation to access to APCOA customer data through the EU Commission Decision on standard contractual clauses between controllers and processors pursuant to Article 28(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council and Article 29(7) of Regulation (EU) 2018/1725 of the European Parliament and of the Council. You have the right to obtain, upon request, information about the countries outside the EU/EEA to which your personal data is transferred and a copy of the safeguards that APCOA has put in place to protect your personal data. 

Our suppliers may transfer personal data to countries outside the EU/EEA if the country has a so-called adequate level of protection, or if the supplier has put in place sufficient safeguards to ensure that your rights are respected and your privacy is protected. 

For billing and collection purposes, we may share your personal data with our suppliers to fulfil our right to claim payment. We may also share the data with the vehicle owner who is also jointly and severally liable for inspection fees. 

In case of unpaid fees and inspection fees, we or our suppliers may process your personal data or obtain additional information from public sources to fulfil our right to claim payment. This right is based partly on the Contracts Act and partly on the Act on Control Fees for Illegal Parking. 

APCOA may also, in exceptional cases, share personal data with property owners/building societies in order to fulfil our part of our contracts. In these cases, we have based sharing on a balance of interests. 

We will also send data to government institutions and authorities that are entitled to access this information within the framework of our statutory duty of disclosure or if we are obliged to disclose this data through them. The processing is necessary for the fulfilment of legal obligations. 

In the context of a legal dispute, we may transfer data to other parties. The processing is necessary for the purposes of our legitimate interest in establishing, exercising and defending legal claims. 

We may share personal data with law enforcement authorities, such as the police, if we are required by law to disclose your data or to assist in an ongoing criminal investigation. The processing is necessary to comply with legal obligations or to fulfil our legitimate interest in contributing to an ongoing criminal investigation upon request. 

We may share information with potential buyers and sellers if we were to sell all or part of the business or in the event of a merger. The processing is necessary to fulfil our legitimate interest in carrying out the sale or merger. 

We may also share information internally within the Group. The processing is necessary to fulfil our legitimate interest to administer and manage APCOA Sweden in an efficient way or to use certain products and services provided internally. 

We may share personal data with consultants. These consultants act in their capacity as employees and may not process personal data outside of their work. They are also bound by professional secrecy even after the consultancy service has ended. 

We take data protection within our company very seriously. Our staff and contracted service providers are bound by a duty of confidentiality and comply with legal provisions on data protection. 
For more information on how we handle personal data in individual cases, see below or contact us.

Personal data is provided and collected before and in connection with the initiation of a customer relationship, the conclusion of a contract and/or the submission of an assignment, or otherwise in connection with a customer relationship. The data is processed by APCOA Sverige AB for incoming and outgoing administration and fulfilment of agreements entered into, and for APCOA Sverige AB to be able to fulfil its obligations under the law. 

When initiating a customer relationship and for certain payments, APCOA Sverige AB may check personal data in accordance with the law and/or official decisions in order to be able to apply and ensure that the customer relationship can be initiated and payment can be made. The personal data may also form the basis for APCOA Sverige AB's market and customer analyses, business and method development, as well as statistics and risk management. 

APCOA needs to fulfil a legal requirement to collect and process personal data. The legal basis for APCOA Parkering Sverige AB to have the right to collect personal data is regulated in the GDPR Regulation (EU) 2016/679, Article 6, paragraph 1 a-f and varies depending on the situation. Below you can find more info. 
 

Article 6 GDPR, paragraph 1 a-f

a) The data subject has given consent to the processing of his/her personal data for one or more specific purposes. 
b) The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. 
c) The processing is necessary for compliance with a legal obligation to which the controller is subject. 
d) The processing is necessary to protect the vital interests of the data subject or of another natural person. 
e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 
f) Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. 

See below on the processing of personal data in specific cases.

Account management

Newsletters, data collection and cookies

Providing services - Short-term parking

Providing services - Long-term parking/contract parking/subscription parking

Providing services - Urban Hubs

Providing services - Other services

*Parakey or Accessy can be used instead of physical keys when you rent a garage or car park.

** Broklubben is a new collaboration with Öresundsbron that means lower costs for those who often use some of our parking facilities and travel through the Öresund Bridge. If you choose to become a member of Broklubben, you agree to enter into an agreement with Apcoa Parking. In order to fulfil our part of the agreement, we need to process your personal data such as registration number and information about the time and place of parking. More info can be found below in "Park & Go"

Providing services - Customer service

Fulfilling legal obligations

Establish, exercise and defend legal claims

Payment and debiting

Camera surveillance

More info can be found below in "Camera surveillance"

Camera parking

More info below in "Park & Go"

Static

We may use personal data to produce statistics. We transform the data so that it can no longer be linked to you or be considered personal data. We will never share the statistics with unauthorised parties.

Erasure of data

We will delete your personal data in accordance with the information set out above. We may also delete your personal data before when you contact us and use your right to be forgotten. Please note that the request does not mean that all your personal data will be deleted, but that a case-by-case analysis will be made.

Customer records

APCOA may retain information about past customers or past interactions with customers for the purpose of ensuring that APCOA's associates and employees have access to a respectful work environment. Such records may include information about harassment, threats, verbal or physical attacks, and any other interactions that contribute to an inappropriate work environment. APCOA may also retain information about payment history, fraud attempts or rogue behaviour to ensure respectful and professional delivery of our services. 

APCOA has balanced its interests and our right to choose reputable customers outweighs the customers' right to rent parking. 

Customers are given access to customer records when an extract from the register is requested or if we receive a request for disclosure of records from the customer. 

APCOA keeps customer records for a maximum of 8 years for serious offences or offences related to rental agreements, and a maximum of 2 years for less serious offences.

When we or you delete your personal data, including your account in hyra.apcoa.se or APCOA FLOW, it may take up to 72 hours before the data disappears from our systems. After 72 hours, it is no longer possible to recover the data.

Camera parking - Park & Go.

Camera parking Park & Go means that you can park with us and pay in our app, on the website or on site without having to enter your registration number or parking time yourself. 
We have chosen to give all our customers a payment deadline of 72 hours. This means that you don't have to worry about parking when you visit a popular tourist destination over the weekend, for example. You can pay at your leisure when you get home.

GDPR assessment

Based on the above measures, Apcoa has applied appropriate technical and organisational measures to ensure that the processing is secure and has a level of security appropriate to the risk represented by the processing. The measures are in accordance with ISO27001 and have been implemented in consultation with Apcoa's Data Protection Officer

Park & Go aims to facilitate our customers by offering a simplified payment solution (read more about Park & Go in https://www.apcoa.se/fastighetsaegare/vaara-tjaenster/park-go/Data on vehicles that have outstanding payments 72 hours after leaving APCOA's car park is sent to Svea Ekonomi AB, which handles all invoicing.

In cases where the camera cannot read the licence plate number, images are sent to countries outside EU/EEA areas for manual correction. We have taken appropriate security measures to ensure your privacy through standard contractual clauses (EU) 2021/914. You have the right to receive, upon request, information about the countries outside the EU/EEA area to which your personal data is transferred and a copy of the safeguards that APCOA has taken to protect your personal data.

Legal basis

Registration

Payment via pay.apcoa.se

Payment via the bridge club

Hotel and reception services and advance booking

Automatic image correction

Our Park & Go facilities

Our car parks with ANPR technology include:

• Stockholm Central
• Stockholm - Kista One
• Stockholm - Millenium
• Stockholm - Torsplan 1
• Gothenburg Central
• Gothenburg - Frölunda Torg
• Gothenburg - Kallebäcks Terrasser
• Gothenburg - P-hus City
• Gothenburg - Platinan
• Gothenburg - Citygate
• Malmö Central
• Malmö - Triangeln
• Malmö - Turning Torso
• Malmö - Emporia
• Mölnlycke - Mölnlycke Fabriker
• Karlstad - Centralsjukhuset
• Karlstad - Mitt i City
• Karlstad - Pinassen
• Kristianstad - Boulevard
• Kolmårdens Zoo
• Norrköping - Ankaret
• Norrköping - Lyckan
• Norrköping - Spiralen
• Norrköping - Spiran
• Skånes zoo
• Skara Summerland
• Örebro - Eyra garget
• Tosselilla Summerland - Tomelilla
• Uddevalla - Gyldenlöwe car park
• Järfälla - Väpnaren
• Partille - Allum

Partille - Allum slotskullen

Apcoa Parking Sverige AB monitors certain areas with cameras. Legal basis for Apcoa to carry out camera surveillance according to GDPR Regulation (EU) 2016/679, Article 6, paragraph 1 f. We carry out camera surveillance to prevent theft and vandalism. This is a so-called legitimate interest. Such camera surveillance constitutes a so-called personal surveillance. 

Data processed in camera surveillance are images that can be attributed to a natural person and registration number. 

When collecting personal data by both types of camera surveillance, we have based on a balance of interests. When balancing the interests, we have made an overall assessment where we have considered, among other things, the nature of the data, how much data is processed and how it is processed. 

For each area where we have a camera, we have summarised the purpose of the camera surveillance and how long your information is stored with us

Areas with camera surveillance:

• Stockholm - Torsplan 1
• Stockholm - Torsplan 2
• Södertälje - Malinsbogaraget, Bangatan 8
• Gothenburg - Kungsgaraget
• Gothenburg - P-hus Avenyn

Cookies are used

We use so-called "cookies" to enhance the usability of our website and make its use more convenient for you. "Cookies" mean that data may be stored on your computer when you visit our website. You have the option to prevent cookies from being stored on your computer by changing your browser settings, but this will limit your use of our website.

You can read our Cookie Policy and how to change your settings here

Data collection using Google Analytics

Our website uses Google Analytics 4, a web analytics service. Both Google and Google Analytics use so-called "cookies". Google Analytics collects information about your operating system, browser, the previously visited website (referring URL) and the date and time you visited our website. Google analytics 4 decided to no longer save IP address. Information about your use of our website is saved and stored in the EU. Google uses this information to analyse your use of our website, to compile reports on website activity for website operators and to provide other services relating to website activity and internet usage. Google will transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. This use is anonymous or uses pseudonyms. You can find more information about this at Google:www.google.com/intl/se/privacypolicy.html

Data protection regulations for the implementation and use of Google AdSense

The controller has integrated Google AdSense on this website. Google AdSense is an online service that enables the placement of adverts on third-party websites. Google AdSense is based on an algorithm that selects adverts displayed on third-party websites that match the content of the respective third-party website. Google AdSense enables interest-based targeted marketing of internet users, which is carried out by generating individual user profiles. 

The operating company of Google AdSense is Alphabet Inc, 1600 Amphitheater Pkwy, Mountain View, CA 94043-1351, USA. 

The purpose of the Google AdSense component is to integrate adverts on our website. Google AdSense places a cookie on the information and communication technology system of the person concerned. What cookies are has already been explained above. Setting the cookie enables Alphabet Inc. to analyse the use of our website. Each time one of the individual pages of this website, which is operated by the data controller and on which a Google AdSense component has been integrated, is called up, the Internet browser of the information and communication technology system of the person concerned is automatically activated by the respective Google AdSense component to transmit data to Alphabet Inc. for the purpose of carrying out online marketing and calculating commissions. 

The person concerned may at any time, as already described above, prevent the setting of cookies by our website by making a corresponding setting in the Internet browser used and thus permanently object to the setting of cookies. Such a setting of the internet browser used would also prevent Alphabet Inc. from setting a cookie on the information and communication technology system of the person concerned. In addition, a cookie that has already been set by Alphabet Inc. can be deleted at any time via the internet browser or other software programs. 

Google AdSense also uses so-called tracking pixels. A tracking pixel is a miniature graphic that is embedded on websites to enable log file recording and log file analysis, which allows a statistical evaluation. Based on the embedded tracking pixel, Alphabet Inc. can see if and when a website was accessed by a data subject and which links were clicked by data subjects. Tracking pixels are used, among other things, to evaluate the flow of visitors to a website. 

Personal data and information, including the IP address, necessary for the collection and billing of the advertisements displayed, are transmitted to Alphabet Inc. in the USA via Google AdSense. This personal data is stored and processed in the USA. Alphabet Inc. may pass on this personal data collected via the technical process to third parties. Google AdSense is explained in more detail at the following link www.google.se/intl/sv/adsense/start/.

Data protection regulations for the implementation and use of Google Analytics (with anonymisation function)

The controller has integrated the Google Analytics component (with anonymisation function) on this website. Google Analytics is a web analytics service. Web analytics is the collection, collation and evaluation of data about the behaviour of visitors to websites. A web analytics service collects, among other things, data about the website from which a person came to a website (so-called referrer), which subpages of the website were visited or how often and for how long a subpage was viewed. Web analytics is mainly used to optimise a website and for cost-benefit analysis of internet advertising. 

The operator of the Google Analytics component is Google Inc, 1600 Amphitheater Pkwy, Mountain View, CA 94043-1351, USA. 

The controller uses the extension "_gat._anonymizeIp" for the web analysis via Google Analytics. With this extension, the IP address of the internet connection of the person concerned is shortened and anonymised by Google if our website is visited from a member state of the European Union or from another state party to the European Economic Area. 

The purpose of the Google Analytics component is to analyse visitor flows on our website. Google uses the data and information obtained to, among other things, evaluate the use of our website, compile online reports for us showing the activities on our website and provide other services related to the use of our website. 

Google Analytics places a cookie on the information technology system of the person concerned. What cookies are has already been explained above. By setting the cookie, Google can analyse the use of our website. Each time one of the individual pages of this website, which is operated by the controller and on which a Google Analytics component has been integrated, is called up, the Internet browser on the information technology system of the person concerned is automatically activated by the respective Google Analytics component to transmit data to Google for online analysis. As part of this technical process, Google becomes aware of personal data, such as the IP address of the person concerned, which Google uses, among other things, 

The cookie is used to store personal information, such as the access time, the location from which the access was made and the frequency of visits to our website by the person concerned. Each time you visit our website, this personal data, including the IP address of the internet connection used by the person concerned, is transmitted to Google in the USA. This personal data is stored by Google in the USA. Google may pass on this personal data collected through the technical process to third parties. 

The data subject may at any time, by making a corresponding setting in the browser used, prevent our website from placing cookies and thus permanently oppose the setting of cookies, as already described above. Such a setting of the browser used would also prevent Google from placing a cookie on the information technology system of the data subject. Furthermore, a cookie already placed by Google Analytics can be deleted at any time via the browser or other software. 

Furthermore, the data subject has the possibility to object to and prevent the collection of data generated by Google Analytics in connection with the use of this website and the processing of this data by Google. To do this, the data subject must download and install a browser add-on via the link tools.google.com/dlpage/gaoptoutdownload. This browser add-on informs Google Analytics via JavaScript that no data and information about website visits may be transmitted to Google Analytics. The installation of the browser extension is considered by Google as a contradiction. If the data subject's information technology system is subsequently deleted, formatted or reinstalled, the data subject must reinstall the browser add-on to disable Google Analytics. If the browser add-on is uninstalled or deactivated by the data subject or another person who can be attributed to their sphere of influence, the option to reinstall or activate the browser add-on is available. 

Further information and Google's current data protection policy can be found at www.google.se/intl/sv/policies/privacy/ and at www.google.com/analytics/terms/se.html. Google Analytics is explained in more detail at this link www.google.se/intl/sv_se/analytics/.

Data protection regulations for the implementation and use of Google Remarketing

The controller has integrated Google Remarketing services on this website. Google Remarketing is a feature of Google AdWords that allows a company to show adverts to internet users who have previously visited its website. The integration of Google Remarketing allows a company to create ads that are tailored to the interests of the user and thereby show interest-based ads to the internet user. 

The operator of the Google Remarketing services is Google Inc, 1600 Amphitheater Pkwy, Mountain View, CA 94043-1351, USA. 

The purpose of Google Remarketing is to show interest-based advertising. Google Remarketing enables us to display adverts via the Google advertising network or have them displayed on other websites, tailored to the individual needs and interests of internet users. 

Google Remarketing places a cookie on the information technology system of the data subject. What cookies are has already been explained above. By placing the cookie, Google can recognise the visitor to our website if he or she subsequently visits websites that are also members of the Google advertising network. Each time a website is visited on which the Google Remarketing service has been integrated, the internet browser of the data subject automatically recognises itself to Google. As part of this technical process, Google becomes aware of personal data, such as the IP address or the user's browsing behaviour, which Google uses, among other things, to display interest-based advertising. 

The cookie is used to store personal information, such as the web pages visited by the data subject. Therefore, personal data, including the IP address of the data subject's internet connection, is transmitted to Google in the USA each time our website is visited. This personal data is stored by Google in the USA. Google may pass on this personal data collected via the technical process to third parties. 

The data subject may at any time, by making a corresponding setting in the browser used, prevent our website from placing cookies and thus permanently oppose the setting of cookies, as already described above. Such a setting of the browser used would also prevent Google from placing a cookie on the information technology system of the data subject. Furthermore, a cookie already placed by Google Remarketing can be deleted at any time via the browser or other software. 

Furthermore, the data subject has the possibility to object to interest-based advertising by Google. To do this, the data subject must open the link www.google.se/settings/adsfrom each of the browsers used and make the desired settings there. 

Further information and the applicable Google data protection regulations can be found at www.google.se/intl/sv/policies/privacy/.

Data protection regulations for the implementation and use of Google AdWords

The controller has integrated Google AdWords on this website. Google AdWords is an internet advertising service that allows advertisers to place adverts both in Google search results and in the Google advertising network. Google AdWords allows an advertiser to predefine certain keywords that will be used to display an advert in Google search results only when the user uses the search engine to retrieve a search result related to the keyword. In the Google ad network, the adverts are distributed to websites relevant to the topic using an automatic algorithm and taking into account the previously defined keywords. 

The operator of the Google AdWords services is Google Inc, 1600 Amphitheater Pkwy, Mountain View, CA 94043-1351, USA. 

The purpose of Google AdWords is to promote our website by displaying interest-based advertising on the websites of third-party companies and in the search results of the Google search engine, as well as to display third-party adverts on our website. 

If a person accesses our website via a Google advert, a so-called conversion cookie is stored on the IT system of the person concerned by Google. What cookies are has already been explained above. A conversion cookie expires after thirty days and is not used to identify the person concerned. If the cookie has not expired, the conversion cookie is used to determine whether certain underlying pages, such as the shopping basket of an online shopping system, were visited on our website. The conversion cookie enables both us and Google to understand whether a person who came to our website via an AdWords advert generated revenue, i.e. completed or cancelled a purchase. The data and information collected through the use of the conversion cookie is used by Google to create visitor statistics for our website. In turn, we use these visitor statistics to determine the total number of users who were referred to us via AdWords ads, i.e. to determine the success or failure of the AdWords ad in question and to optimise our AdWords ads in the future. Neither our company nor other Google AdWords advertisers receive information from Google that could be used to identify the person concerned. 

The conversion cookie is used to store personal information, such as the website visited by the person concerned. Therefore, every time you visit our website, personal data, including the IP address of the internet connection used by the person concerned, is transmitted to Google in the USA. This personal data is stored by Google in the USA. Google may pass on this personal data collected via the technical process to third parties. 

The person concerned may at any time prevent the setting of cookies by our website, as already described above, by making a corresponding setting in the browser used and thus permanently object to the setting of cookies. Such a setting of the browser used would also prevent Google from setting a conversion cookie on the IT system of the person concerned. In addition, a cookie already set by Google AdWords can be deleted at any time via the browser or other software. 

In addition, the data subject has the possibility to object to interest-based advertising by Google. To do this, the person concerned must open the link www.google.se/settings/adsfrom each of the browsers used and make the desired settings there. 

Further information and the applicable Google data protection regulations can be found at www.google.se/intl/se/policies/privacy/.

Data protection regulations for the implementation and application of Instagram

The controller has integrated components of the Instagram service on this website. Instagram is a service that qualifies as an audiovisual platform and enables users to share photos and videos as well as to forward such data to other social networks. 

The operating company for the Instagram services is Instagram LLC, 1 Hacker Way, Building 14 First Floor, Menlo Park, CA, USA. 

Each time one of the individual pages of this website, which is operated by the controller and on which an Instagram component (Insta button) has been integrated, is called up, the Internet browser of the information technology system of the person concerned is automatically activated by the respective Instagram component, causing a representation of the corresponding component to be downloaded from Instagram. As part of this technical process, Instagram is informed which specific sub-page of our website is visited by the person concerned. 

If the person concerned is logged into Instagram at the same time, Instagram recognises which specific sub-page the person concerned visits each time the person concerned calls up our website and throughout the stay on our website. This information is collected by the Instagram component and assigned by Instagram to the respective Instagram account of the person concerned. If the data subject clicks on any of the Instagram buttons integrated on our website, the data and information thus transmitted are assigned to the personal Instagram user account of the data subject and stored and processed by Instagram. 

Instagram always receives information via the Instagram component that the data subject has visited our website if the data subject is logged into Instagram at the same time as they access our website; this happens regardless of whether the data subject clicks on the Instagram component or not. If the data subject does not want this information to be transferred to Instagram, they can prevent the transfer by logging out of their Instagram account before accessing our website. 

Further information and the applicable data protection regulations for Instagram can be found at help.instagram.com/155833707900388 and www.instagram.com/about/legal/privacy/.

Data protection regulations for the implementation and use of LinkedIn

The controller has integrated components from LinkedIn Corporation on this website. LinkedIn is an internet-based social network that enables users to connect with existing business contacts and create new business contacts. Over 400 million registered people use LinkedIn in over 200 countries. LinkedIn is currently the largest platform for business connections and one of the most visited websites in the world.LinkedIn is operated by LinkedIn Corporation, 2029 Stierlin Court Mountain View, CA 94043, USA.LinkedIn Ireland, Privacy Policy Issues, Wilton Plaza, Wilton Place, Dublin 2, Ireland, is responsible for data protection issues outside the United States. Each time our website, which is equipped with a LinkedIn component (LinkedIn plug-in), is called up, this component causes the browser used by the person concerned to download a corresponding representation of the LinkedIn component. More information about LinkedIn plug-ins can be found at developer.linkedin.com/plugins. As part of this technical process, LinkedIn is informed which specific subpage of our website is visited by the data subject. 

If the data subject is logged in to LinkedIn at the same time, LinkedIn recognises which specific subpage of our website is visited by the data subject each time the data subject calls up our website and throughout the data subject's stay on our website. This information is collected by the LinkedIn component and assigned to the respective LinkedIn account of the person concerned by LinkedIn. If the data subject clicks on a LinkedIn button integrated on our website, LinkedIn assigns this information to the data subject's personal LinkedIn user account and saves this personal data. 

LinkedIn always receives information via the LinkedIn component that the data subject has visited our website if the data subject is logged into LinkedIn at the same time as they access our website; this happens regardless of whether the data subject clicks on the LinkedIn component or not. If the data subject does not want this information to be transmitted to LinkedIn, they can prevent the transmission by logging out of their LinkedIn account before accessing our website. 

LinkedIn offers at www.linkedin.com/psettings/guest-controls the possibility to unsubscribe from emails, SMS messages and targeted ads as well as manage ad preferences. LinkedIn also uses partners such as Quantcast, Google Analytics, BlueKai, DoubleClick, Nielsen, Comscore, Eloqua and Lotame who may set cookies. Such cookies can be rejected at www.linkedin.com/legal/cookie-policy. LinkedIn applicable data protection regulations are available at www.linkedin.com/legal/privacy-policy.LinkedIn Cookie Policy is available at. www.linkedin.com/legal/cookie-policy.

Normally, we do not process so-called sensitive personal data. APCOA's processing of "sensitive data" is exceptional and complies with the GDPR Regulation 2016/679, Article 9, paragraph 1. We will always inform you before processing your sensitive personal data. 

Article 9, paragraph 1. 

Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited. 
The starting point is that the processing of sensitive personal data is prohibited, but there are a number of exceptions. APCOA will never process your sensitive personal data without first complying with the requirements of the GDPR. Some examples of when it is permitted to process sensitive personal data:

Where the data subject has given explicit consent

To protect someone's vital interest

When the data subject himself has made the sensitive data public

If it is necessary for legal claims or in the judgement of the courts.

We will never process your personal data for any purpose other than what we have informed you via this policy or other relevant information. If you suspect that our processing is in breach of the GDPR, please read more about what you can do in "Your rights".

You as a data subject, i.e. the person whose personal data is being processed, have a number of rights under the GDPR. As data controllers, APCOA has a responsibility to have procedures in place to deal with requests to exercise these rights when someone requests it.

Right to information

You have the right to be informed when your personal data is being processed. Information about the processing of personal data shall be provided by us as data controllers both when the data is collected and when you otherwise request it.

In addition, there are certain occasions when specific information must be provided to you, for example if there is a data breach or similar (a personal data incident) with us as data controllers and there is a risk of, for example, identity theft or fraud.

The information must be provided to you free of charge, in an easily accessible written form (which may be in electronic form) and in clear and plain language.

Among other things, you have the right to know

the purposes for which personal data will be processed

the legal basis for the processing

how long personal data will be stored

who will have access to the personal data

data subjects' rights under the GDPR

whether personal data will be transferred to a so-called third country (country outside the EU/EEA)

that you can lodge a complaint with IMY

that you can withdraw consent, if you have given it

the contact details of us and of our Data Protection Officer.

Right of access

You have the right to contact us as data controllers to find out whether or not your personal data is being processed. If your personal data is being processed, we must provide you with a copy of the data and provide information on, among other things

the categories of personal data being processed

what the personal data is used for

how long the data will be kept

who the personal data has been shared with

where the data comes from.

The right to receive a copy of your personal data does not mean that we always have to disclose the document containing the personal data. Often it may be sufficient to provide you with an intelligible summary of all the personal data contained in the document or otherwise being processed. The summary should be designed to enable you to check the accuracy and lawfulness of the data.

There may be circumstances in which information should not be disclosed, for example because of the provisions of other legislation or because disclosure of the information would be detrimental to others.

In some cases, as data controllers, we may also refuse to provide a copy of the data, for example if you make so-called unfounded or unreasonable requests, such as requesting access several times in a short period of time.

Right to rectification

You have the right to contact us as data controllers and ask for incorrect data to be rectified. This also means that you have the right to supplement with missing personal data that is relevant to the purpose of the personal data processing. The fact that we, as data controllers, must also ensure that the data is accurate and up to date is already clear from the basic principles of the GDPR.

If data is rectified at your request, we as controllers must inform those to whom they have disclosed data of the rectification. However, this does not apply if it would prove impossible or involve excessive effort. You also have the right to request information on to whom data has been disclosed.

Right to erasure

You have the right to contact us as data controllers and ask for your data to be deleted.

The data must be deleted in the following cases

if the data is no longer needed for the purposes for which it was collected

if the processing is based on your consent and you withdraw that consent

if the processing is for direct marketing purposes and you object to the processing

if you object to personal data processing that is carried out in the exercise of official authority or following a balancing of interests and there are no legitimate grounds that override your interest

if the personal data has been processed unlawfully

erasure is necessary to comply with a legal obligation

if the personal data relates to a child and has been collected in the context of the child creating a profile on a social network.

If data is deleted at your request, we must also inform those to whom it has been disclosed of the deletion. However, this does not apply if it would prove impossible or involve excessive effort.

When personal data has been published or otherwise made public (in a social network, an internet forum or on a website), it is not always sufficient to delete it there. In these situations, the publisher must also take reasonable steps to inform other data processors of the data subject's request so that copies or links to the data are also removed.

There are exceptions to the right to erasure and the obligation to inform others if it is necessary to fulfil other important rights such as the right to freedom of expression and information, to comply with a legal obligation, to perform a task carried out in the public interest or in the exercise of official authority.

Right to restriction of processing

In certain cases, you have the right to request that the processing of your personal data be restricted. Restriction means that the data is marked so that it can only be processed for certain limited purposes in the future.

The right to restriction applies, among other things, when you consider the data to be inaccurate and have requested rectification. In such cases, you can also request that the processing of the data be restricted while the accuracy of the data is being investigated.

When the restriction ends, we as data controllers will inform you of this.

Right to object

You have the right to object to our processing of your personal data.

The right to object applies when personal data is processed for the performance of a task carried out in the public interest, in the exercise of official authority or following a balancing of interests.

If you object to the processing in such cases, we as data controllers may only continue to process the data if it can be demonstrated that there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing is carried out for the establishment, exercise or defence of legal claims.

You always have the right to object to the use of your personal data for direct marketing purposes. Such an objection can be made at any time. If you object to direct marketing, your personal data may no longer be processed for such purposes.

Specific rules apply to personal data processed for scientific and historical research purposes or statistical purposes.

Right to data portability

In certain cases, you have the right to obtain and use your personal data elsewhere. As data controllers, we are obliged to facilitate such a transfer of personal data. A prerequisite is that we as data controllers process the personal data on the basis of the data subject's consent or to fulfil a contract.

This only applies to personal data that you as a data subject have provided yourself.

Automated decisions

You have the right not to be subject to a decision based solely on any form of automated decision-making, including profiling, where that decision is likely to produce legal effects or similarly significantly affect you.

Automated decision-making can be, for example, an automated rejection of an online credit application or a rejection of an online recruitment without personal contact.

Automated decision-making may be allowed if it is necessary for the conclusion or performance of a contract between the data subject and the controller or if the data subject has given his or her explicit consent. It may also be authorised by specific legislation.

The controller must inform the data subjects that automated decision-making is used in accordance with the general information obligation of the Regulation.

Automated decisions can be taken with or without profiling. Conversely, profiling can be used without leading to an automated decision. Profiling means any form of automated processing of personal data whereby the data are used to evaluate certain personal aspects relating to an individual, in particular to analyse or predict that individual's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Profiling is a processing of personal data that must comply with all the provisions of the GDPR

Facilitating the data subject

As a data controller, we have an obligation to facilitate data subjects in exercising their rights under the GDPR. This can be done, for example, through clear information on our website and otherwise by providing user-friendly communication channels through which a data subject can make a request in an efficient manner. Identification

We need to be able to identify that it is actually you making the request to ensure compliance with security measures and to minimise the risk of unauthorised disclosure of personal data.

If there are reasonable grounds to doubt your identity when you submit a request to exercise a right, we may request additional information necessary to enable identification. However, we may not collect more information than is necessary.

Time limits

As data controllers, we will deal with a request as quickly as possible, but we must act on the request within one month of receiving it.

The deadline may be extended by two months if necessary. In this case, we as controllers must inform you of the extension and the reason for the delay within one month of receiving the request. This means that the information you have requested must be provided no later than three months from receipt of the request.

Events that may justify an extension are, for example, if the request is complex or if we, as controllers, have received many requests at the same time.

What does one month mean?

The time limit starts on the day we as controllers receive the request. The deadline ends on the same date the following month.

If the end date is a Saturday, Sunday or public holiday, the deadline is extended to the next working day.

If the end date does not exist because the next month has fewer days, the end date will be the last day of the next month.

Compensation for damages

An individual who has suffered damage because his or her personal data has been processed in breach of the GDPR may be entitled to compensation from the controller or controllers involved in the processing.

A processor may also be liable for damages if the processor has breached the provisions specifically aimed at processors or has processed data contrary to the controller's instructions.

As a data subject, you can claim damages from us as data controllers or our processors or bring an action for damages in court.

Anyone who has suffered damage is in principle entitled to receive compensation for the entire damage from either the controller or the processor. They may then in turn settle this between themselves. However, a controller or processor is not obliged to pay compensation if they can prove that they are not in any way responsible for the damage.

Can we claim by regular mail?

To make it easier for you to make a rights request, it is also important to consider how we can collect additional information. For example, if we already use digital channels where your identity can be verified, data subjects should be able to use the same channel to make a rights request. If in such a situation you are instead directed to more cumbersome means of making a request, for example by regular mail for rights requests but not for other customer matters, it is questionable whether we have fulfilled the requirement to facilitate the exercise of the data subject's rights. Such an exception could be, for example, that it is necessary for security reasons. However, the starting point should be that we should offer alternative ways to submit the data.

Provisions on confidentiality of customer data exist to protect customer confidence and rights. Confidentiality applies to all data relating to individual customers, which means that such data may be used and disclosed only if it is not unauthorised and does not contravene the GDPR Regulation (EU) 2016/679. The confidentiality applies both between units and executives and applies to all employees regardless of position or form of employment within the company as well as in relation to other companies within and outside the group. In some cases, customer data is disclosed to authorities pursuant to law or other regulations. 
In other respects, the handling of customer data within APCOA Parking Sverige AB is based on the Group's need to be able to control, manage and monitor its risks and to be able to provide the services that customers demand.

If you wish to receive information about what personal data about you APCOA Sverige AB is processing, you can submit or send a written request - signed by you - to: 

APCOA Sverige AB 
Box 470 24 
100 74 Stockholm. 
Mark the envelope "GDPR"

To the same address you can notify requests for rectification of inaccurate or incomplete personal data, extracts of existing personal data as well as the right to have your personal data deleted and the right to be forgotten. 
You can send an e-mail to gdpr@apcoa.se or call 08-556 306 70 with the same request. You can also reach our Data Protection Officer through this address. You also have the right under Art. 77 of the GDPR, if you consider the processing of personal data concerning you to be contrary to the GDPR, to lodge a complaint with a supervisory authority (Phone: 08-657 61 00; Email:imy@imy.se Privacy Protection Authority).

APCOA may, from time to time, amend the Privacy Policy. If such changes are made to the APCOA Privacy Policy that change the way APCOA processes your Personal Data, such as collecting additional Personal Data for specified purposes or processing data for new purposes, APCOA will notify you of such changes via, for example, the Website, the APCOA Flow application or email. APCOA recommends that you regularly read the APCOA Privacy Policy for the latest information on how APCOA processes your personal data

Apcoa is committed to making parking as easy as possible for everyone who parks with us. We have two types of parking.

Camera parking.

Camera parking means that you can park with us and pay in our app, on the website or on site. APCOA does not offer the possibility to search all our car parks at the same time, but you as a customer must choose the garage you have visited. Receipts are only available for the car parks that you have paid for yourself, regardless of whether you have chosen to pay via pay.apcoa.se or in one of our apps. Your parking is only available until you have paid for it and for a maximum of 72 hours. If you pay on site in a machine before you leave the car park, no one can find your parking online. 
We have chosen to give all our customers a payment deadline of 72 hours. This means that you don't have to worry about parking when you visit a popular tourist destination over the weekend, for example. You can pay at your leisure when you get home. 
APCOA has additional measures to strengthen your privacy, such as preventing anyone from bulk searching one or more licence plate numbers from the same device, a division of the garages that makes it difficult to find a vehicle without knowledge of the vehicle's parking, notification of licence plate activation and signage informing the user of our privacy policy before entering the car park.

Regular parking with surveillance.

This means that you pay on the spot in a machine or one of our apps and no other user can see your parking as they are never available online.

GDPR assessment

Based on the above measures, Apcoa has applied appropriate technical and organisational measures to ensure that the processing is secure and has a level of security appropriate to the risk represented by the processing. The measures are in accordance with ISO27001 and have been implemented in consultation with APCOA's Data Protection Officer.