VRs Data Protection Notice
Updated 25.6.2026
This Data Protection Notice describes how VR Sverige AB processes personal data relating to individuals who interact with VR Sverige, including through enquiries, contractual relationships, subscriptions to information services, and the use of our website and related services.
1 Controller
VR Sverige AB (hereinafter VR)
Business ID: 556351-9437
Sicklastråket 4
131 54 Nacka, Sweden
2 Data Protection Officer
VR Sverige AB
Sicklastråket 4
131 54 Nacka, Sweden
Email: dpo@vrsverige.com
3 Data Subjects
This Data Protection Notice applies to individuals whose personal data is processed by VR Sverige in connection with enquiries, agreements, information services, and the use of our website. This may include individuals contacting VR Sverige, persons entering into agreements with VR Sverige, subscribers to information and news services, and users of our website.
4 Personal Data Categories and Sources of Personal Data
Depending on the nature of your interaction with VR Sverige, the personal data processed may include:
- Identification and contact information, such as your name, contact details, organisation and role
- Technical information, such as IP address, device information and browser information
- Information provided in enquiries, agreements, subscriptions and other communications
- Information or materials submitted through functions available on our website
VR Sverige primarily collects personal data directly from you through enquiries, agreements, subscriptions, communications, and your use of our website and related services. Certain information may also be generated through your use of our website, including information relating to website usage and search behaviour.
5 Purposes of Processing and Legal Bases
VR Sverige processes personal data in order to manage and respond to enquiries, administer agreements and related communications, provide requested information and services, manage subscriptions to news and information services, and maintain and develop its website and related IT systems.
Personal data may also be processed to analyse website usage and search behaviour, produce website statistics, and provide customised content.
We process your personal data when necessary to fulfil a contract with you or when we have a legitimate interest in processing your personal data, such as communicating about our services, improving our website, or developing our services.
Where processing requires consent under applicable law, we will obtain your consent before commencing such processing.
6 Disclosure of Personal Data
VR Sverige may engage external service providers to perform services on its behalf, such as IT services, press release administration services and analytical services. Where these services require access to personal data, the service providers process personal data on behalf of VR Sverige under contractual arrangements designed to ensure an appropriate level of protection for personal data.
VR Sverige may also disclose personal data to police authorities and other public authorities where required in connection with criminal investigations or where disclosure is otherwise required by law or by a decision of a competent authority.
VR Sverige does not disclose personal data beyond what is described in this Data Protection Notice.
7 Transfers of Personal Data outside the EU/EEA
Service providers and other recipients may be located both within and outside the EU/EEA.
Where personal data is transferred outside the EU/EEA, VR Sverige implements appropriate safeguards in accordance with applicable data protection legislation. Such safeguards may include agreements incorporating the European Commission’s Standard Contractual Clauses or other transfer mechanisms approved under applicable law.
8 Retention Period for Personal Data
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected and processed.
Personal data processed in accordance with this Data Protection Notice is deleted when the relevant processing purpose has been fulfilled, unless a longer retention period is required by applicable law or is otherwise necessary to establish, exercise or defend legal claims.
Retention periods may vary depending on the nature of the processing activity and the applicable legal or operational requirements.
9 Cookies
VR Sverige uses cookies and similar technologies on its website. Cookies are small text files that are stored on your device when you visit a website. They may be used to analyse website usage, understand user behaviour, improve website functionality and provide customised content.
Information collected through cookies and similar technologies may include IP addresses, website usage information, search behaviour and other technical information relating to the use of the website.
You may manage, restrict or disable cookies through your browser settings. However, restricting the use of cookies may affect the functionality and user experience of the website.
10 Protection of Personal Data
VR Sverige is committed to maintaining a high level of security for personal data. VR Sverige has implemented appropriate administrative, organisational and technical measures designed to ensure the confidentiality, integrity and availability of personal data and to protect it against unauthorised access, alteration, disclosure, loss and destruction.
Access to personal data is restricted to individuals whose duties require such access. Personal data is processed only to the extent necessary for the relevant purpose and in accordance with applicable data protection legislation.
Where personal data is processed by service providers on behalf of VR Sverige, contractual arrangements are implemented to ensure an appropriate level of protection for personal data.
11 Data Subject’s Rights
VR Sverige is committed to ensuring that you can exercise your rights under applicable data protection legislation.
If you wish to exercise your rights or have questions regarding the processing of your personal data, you may contact us at dpo@vrsverige.com. We will process your request as soon as possible and no later than one month from receiving it.
Subject to applicable data protection legislation, you have the following rights:
- Right of access – You may request information about whether we process your personal data and obtain access to the personal data we hold about you.
- Right to rectification – You may request that inaccurate or incomplete personal data be corrected.
- Right to erasure – You may request that your personal data be deleted where there is no legal basis for continued processing.
- Right to restriction of processing – In certain circumstances, you may request that we restrict the processing of your personal data.
- Right to object – You may object to the processing of your personal data where the processing is based on a legitimate interest.
- Right to withdraw consent – Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
- Right to data portability – Where applicable, you may receive personal data concerning you in a structured, commonly used and machine-readable format and transmit that data to another controller.
- Right to lodge a complaint – You may lodge a complaint with the competent supervisory authority if you believe that the processing of your personal data violates applicable data protection legislation.