Privacy policy
Version 2.0 · Effective 5 August 2026 · Replaces the version dated 29 December 2025
Who is responsible for your data
Förare is a business name of Jamshaid Amjad, an enskild näringsidkare (sole trader) registered in Sweden. Contact: support@forare.eu · +46 76 205 15 61.
We are the controller of the personal data described here. We have not appointed a Data Protection Officer — we are not required to, because we are not a public authority and our core activities are neither large-scale monitoring nor large-scale processing of sensitive data. Privacy questions go to support@forare.eu and reach a person, not a queue.
Which part applies to you
Part A if you book or travel with us — a passenger. Part B if you drive for us, or run a taxi company (åkeri) connected to us. Part C applies to everyone.
Part A — Passengers
A1. What we collect
You do not need an account to book with us. That is deliberate: the less we hold, the less there is to protect.
| What | Where it comes from |
|---|---|
| Name, email address, mobile number | You, when booking |
| Pickup and drop-off address, date and time | You, when booking |
| Flight number | You, when booking |
| Passengers, vehicle class, luggage, notes you write | You, when booking |
| Booking reference, price, VAT, payment status | Generated by us and by Stripe |
| Your flight's scheduled and actual times | Swedavia's flight information service |
| Messages you send us | You |
| Any review you leave | You |
| Technical logs: IP address, browser, timestamps | Automatically, when you use the site |
We never see or store your card number. Card details go directly to Stripe. We receive a payment reference, an amount, and whether it succeeded.
A2. Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Taking your booking, arranging the car and driver, carrying out the trip | Art. 6(1)(b) — performing our contract with you |
| Confirmation and the reminder messages before pickup, including your driver's name, phone and plate | Art. 6(1)(b) |
| Watching your flight and moving your pickup when it moves | Art. 6(1)(b) — it is part of what you bought |
| Giving your name, phone, pickup and drop-off to the driver carrying you | Art. 6(1)(b) |
| Payment, receipts, refunds | Art. 6(1)(b) and 6(1)(c) |
| Bookkeeping and VAT reporting | Art. 6(1)(c) — bokföringslagen, mervärdesskattelagen |
| Complaints, disputes, insurance claims | Art. 6(1)(f) — legitimate interest |
| Fraud prevention and site security | Art. 6(1)(f) |
| Asking you, once, to review your trip — always with an unsubscribe | Art. 6(1)(f) |
| Publishing a review you chose to leave | Art. 6(1)(a) — consent, withdrawable at any time |
We do not sell your data. We do not profile you for advertising. We do not make automated decisions about you with legal or similarly significant effects.
A3. How long we keep it
| Data | Retention |
|---|---|
| Accounting records — reference, date, amount, VAT | 7 years after the end of the financial year (bokföringslagen) |
| Booking details — addresses, flight number, driver assigned | 3 years after the trip — the consumer-claim limitation period |
| Free-text notes on a booking | 12 months |
| Support correspondence | 24 months |
| Reviews you chose to publish | Until you withdraw consent |
| Server and security logs | 90 days |
| Contact-form messages that do not become bookings | 12 months |
Part B — Drivers and fleet owners
If you enrol as a driver or register an åkeri with us, we hold considerably more about you than about a passenger. This section says exactly what and why.
B1. What we collect
| What | Why we need it |
|---|---|
| Name, phone, email, home area, languages | Contact, and matching you to trips |
| Personnummer | Secure identification — see B2 |
| Profile photograph | The passenger is told who is collecting them |
| Scan of your körkort, with expiry date | Legal check: you may not carry a passenger without it |
| Scan of your taxiförarlegitimation, with expiry date | Legal check: same |
| Your company, or the åkeri you drive for | Who we settle with |
| Availability, preferred zones, vehicle classes | Dispatch |
| Trip history: offered, accepted, declined, completed, no-shows | Settlement, quality, disputes |
| Payout records | Settlement and accounting |
| Vehicle data: plate, model, photos, insurance, besiktning, taximeter | Legal and airport requirements |
| Portal login and session records | Access control |
| Push notification registrations | Sending you a ride offer |
For åkerier we additionally hold organisationsnummer, taxitrafiktillstånd, F-skatt confirmation, insurance and bank details for payouts.
B2. Personnummer — the specific rule
Swedish law does not let anyone collect a personnummer just because it is convenient. Under 3 kap. 10 § lagen (2018:218), a personnummer may be processed without consent only where clearly justified by the purpose or the importance of secure identification. We rely on secure identification: verifying that the person holding a taxiförarlegitimation is the person we send to a passenger, and reporting settlements against the right individual. Your personnummer is visible only to our administrators — never to passengers, never to another driver or åkeri.
B3. What we deliberately do not collect
We do not ask for, accept, or store a belastningsutdrag (criminal record extract) — data about convictions is restricted under GDPR Art. 10 and Swedish law, and a private company generally may not register it. If you send one unasked, we delete it and tell you we have. We do not track your location outside a job you have accepted. We do not record audio or video.
B4. Legal bases
| Purpose | Legal basis |
|---|---|
| Enrolment, portal account, offering and settling trips | Art. 6(1)(b) — contract |
| Verifying körkort and taxiförarlegitimation | Art. 6(1)(c) — taxitrafiklagen makes them a precondition |
| Settlement and accounting records | Art. 6(1)(c) |
| Personnummer | Art. 6(1)(b)/(c), permitted by 3 kap. 10 § dataskyddslagen |
| Passenger safety, fraud prevention, disputes | Art. 6(1)(f) |
| Showing your name, photo and vehicle to the passenger who booked | Art. 6(1)(b) |
| Demonstrating verified supply to partners — in aggregate: counts and compliance status, never your identity documents | Art. 6(1)(f) |
B5. Automated decisions
Two things happen without a person pressing a button, and you are entitled to know: ride offers are routed automatically based on your zones, availability and vehicle class; and a temporary suspension from receiving offers is applied automatically after a third late cancellation within 90 days. You can ask for either to be reviewed by a person, put your side of it, and contest the outcome — write to support@forare.eu and a human, not the system, will look at it.
B6. How long we keep it
| Data | Retention |
|---|---|
| Profile, personnummer, document scans, photograph | While you are connected to Förare, plus 12 months |
| Trip, job and payout history | 7 years — accounting records |
| Vehicle and compliance documents | While the vehicle is connected, plus 12 months |
| A declined application | 12 months, so we can explain the decision |
| Administrative audit log | 24 months |
| Sessions and login records | 90 days |
Part C — Everyone
C1. Who we share data with
| Supplier | What they do |
|---|---|
| Supabase | Our database — bookings, driver records and document scans. AWS eu-west-1, Ireland |
| Vercel | Runs the website and API. Functions in Dublin; company established in the USA |
| Stripe | Card payments and refunds. Card details go to Stripe, never to us. EEA entity, with US group companies |
| Resend | Transactional email — confirmations, receipts. USA |
| 46elks | SMS — confirmations, reminders, driver details. Sweden |
| Titan (billed via Hostinger) | Our @forare.eu mailboxes. EU |
| Browser push services (Google, Mozilla, Apple) | Deliver ride notifications to a driver's device |
| Our accountant | Bookkeeping, VAT. Sweden |
Swedavia operates the flight information service we use. We send it a flight number — never your name, phone or address. The driver and åkeri carrying you receive your name, phone, pickup, drop-off and flight number — they need them to collect you. The åkeri is a separate controller for its own legal duties, notably taximeter reporting to a redovisningscentral. Booking partners: if you booked through a travel platform, hotel or corporate account, we exchange booking data with them so the trip can be arranged and settled. Authorities: we disclose data to Skatteverket, Transportstyrelsen, Polismyndigheten or a court where the law requires it.
C2. Transfers outside the EEA
Our data lives in the EEA — the database in Ireland, the site served from Dublin. Some suppliers are established in the United States and their staff may access data from there. Where that happens we rely on the European Commission's standard contractual clauses, or on the EU–US Data Privacy Framework where the supplier is certified. Ask us which mechanism applies to a specific supplier and we will tell you.
C3. Security
Data is encrypted in transit. Uploaded documents are never reachable by a public link — every request passes our own session check. Access is role-based: a driver sees their own jobs, an åkeri sees its own drivers, and personnummer and bank details are visible only to administrators. Administrative changes are logged. We will notify you and Integritetsskyddsmyndigheten of a breach where GDPR Art. 33–34 require it.
C4. Cookies
We use only cookies necessary for the site to work: keeping you signed in, keeping a booking together across steps, and security. These do not require consent under Swedish law, but you are entitled to know they exist. We do not currently use analytics, advertising or tracking cookies — if that changes, we will ask first, through a banner where refusing is as easy as accepting.
C5. Your rights
Under the GDPR you may access the data we hold about you, rectify anything wrong, erase data we have no legal duty to keep, restrict processing while something is disputed, port the data you gave us, object to processing based on legitimate interests, withdraw consent at any time where consent is the basis, and ask for a human where a decision was automated.
To use them, email support@forare.eu with what you want. We reply within one month, and may need to verify who you are first. One honest limit: we cannot delete a booking's accounting record before the 7-year bookkeeping period expires — Swedish law requires us to keep it. We delete everything around it that is not required.
C6. Complaining to the supervisory authority
If you think we are handling your data wrongly, tell us first — we would rather fix it. You have the right to complain regardless, to Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, imy@imy.se, imy.se. If you live in another EEA country you may complain to your own authority instead.
C7. Changes
The version number and date at the top always tell you which version you are reading. Material changes affecting drivers or åkerier are notified in the portal.
See also our Terms of Service.