1. INTRODUCTION

2. DATA CONTROLLER AND CONTACT INFORMATION

3. CATEGORIES OF PERSONAL DATA WE COLLECT

Zapout processes different types of personal data depending on your interaction with our services.

Personal identification data

• Full name
• Date of birth
• Social security number (required for BankID authentication)
• Contact details (e-mail address, telephone number, home address)

Travel and reimbursement data

• Train and bus ticket details
• Travel history (routes, operators used, timestamps)
• Delay reports and compensation eligibility

Payment and financial data

• Bank account details for reimbursement payments
• Transaction records and refund details
• Payment method information (credit/debit cards, mobile payments)

Technical and usage data

• IP address and device identifier
• Browser type, operating system and app usage logs
• Cookies and analytics data

Customer service and communication data

• Support requests, complaints and feedback
• Social media information (when you interact with us on social platforms)

Sensitive data (only if required)

• Medical data (only if required for specific claims)

4. PURPOSES AND LEGAL BASIS FOR PROCESSING

Zapout processes your data for specific and legitimate purposes, as required by the GDPR

5. DATA SHARING AND THIRD PARTIES

Zapout only shares your personal data with trusted partners when it is necessary for service delivery and compliance.

5.1 Transport operators and compensation partners

We share ticket, travel and delay information with public transport operators to process claims efficiently.

5.2 Financial institutions and payment processors

Banking and transaction details are securely shared for claims payments and refunds.

5.3 IT service providers and cloud hosting

We use GDPR-compliant cloud storage, analytics and security providers to protect your personal data.

5.4 Legal and regulatory authorities

When required by law, we share data with regulatory bodies, law enforcement authorities and tax authorities.

5.5 Commercial partners and data insights

With your explicit consent, anonymized travel data may be shared with third-party partners to improve the Services.

All data sharing agreements comply with the GDPR (Article 28 - Data Processing Agreements & Article 46 - International Transfers).

6. DATA RETENTION POLICY

We retain personal data only for as long as necessary, in accordance with legal and business requirements:

• Claims and reimbursement data: Retained for 6 months after case closure
• Financial records: Retained for 10 years for tax compliance
• Support requests: Retained for 3 years after resolution
• Marketing Consent: Retained until you withdraw consent
• Account Data: Remains available for 30 days after account termination for retrieval
• Legal protection data: Personal data may be retained longer than the periods specified above when necessary to establish, exercise, or defend legal claims, or to comply with legal obligations. Such data will be retained only for as long as reasonably necessary for these purposes.

After the retention periods expire, data is permanently deleted or anonymized, except where longer retention is required for legal compliance or protection of legal rights.

7. RIGHTS OF DATA SUBJECTS

Under the GDPR, you have the following rights:

To exercise your rights, please send an email to support@Zapout.se

8. DATA SECURITY MEASURES

Zapout uses advanced security protocols, including:

• Encryption: Banking, ID and travel data are encrypted
• Access controls: Restricted to authorized personnel
• Secure storage: GDPR-compliant cloud security measures
• Fraud prevention: AI-powered monitoring against fraudulent claims

9. AUTOMATED DECISION-MAKING AND PROFILING

Automated travel delay analysis is used for faster claims processing. No automated decisions that significantly affect your rights are made without human review. You have the right to request human review of automated decisions and receive meaningful information about the logic used.

10. INTERNATIONAL DATA TRANSFERS

Personal data may be transferred and processed outside the European Economic Area (EEA). When this occurs, we use Standard Contractual Clauses (SCC) or other GDPR-approved safeguards to ensure your data remains protected.

11. COOKIES AND TRACKING

For details on our use of cookies, tracking technologies and analytics, please see our Cookie Policy.

12. CHANGES TO THIS POLICY

We may update this privacy policy from time to time as necessary to reflect changes in our services or legal requirements. When we make significant changes to this policy, we will notify you via email and publish the updated version on our website. This policy was last updated on September 5, 2025.

13. CONTACT AND COMPLAINTS

If you have questions in regards of this policy or privacy concerns, please contact support@Zapout.se.

If our response does not resolve your concerns, you have the right to file a complaint with the Swedish Authority for Privacy Protection (IMY) or seek alternative dispute resolution through the Swedish National Board for Consumer Disputes (ARN).