Privacy Policy

For us at Hector Rail, it is important that you and your personal data are treated responsibly with regard to your privacy, and that you are informed about what information we collect about you, how we use it, and how you can exercise your rights.

1. What information do we collect?

We collect information to help us provide, maintain, and improve our transport and logistics services. The information you provide to us can include:

• Contact details (name, email address, phone number, company affiliation)
• Visitor identification details at our stations, depots, or offices
• Correspondence via email, phone, or contact forms

2. How do we use your information?

We use your personal data for the following purposes based on legal grounds (such as performance of a contract, compliance with a legal obligation, or our legitimate interest):

• Communicate with you and manage customer or supplier relationships
• Maintain safety standards and access controls on our locomotives and rail operational areas
• Comply with applicable laws, including railway safety regulations and transport legislation

3. Who do we share your data with?

We only share your personal data with trusted third parties as necessary to provide our services, follow legal or regulatory requirements, or protect railway safety. This may include:

• Government agencies and regulatory authorities (such as Transportstyrelsen in Sweden or Statens jernbanetilsyn in Norway)
• Subcontractors and IT service providers acting as data processors on behalf of Hector Rail

4. Storage location & Retention period

As a general rule, Hector Rail stores personal data within the EU/EEA. We retain your personal data only as long as necessary to fulfill the purposes for which it was collected, or to comply with legal obligations under applicable railway and accounting legislation.

5. Your Rights

Under the General Data Protection Regulation (GDPR), you have the right to:

• Request access to your personal data (obtain a registry extract)
• Request rectification of inaccurate or incomplete data
• Request erasure ("the right to be forgotten") under certain conditions
• Withdraw consent at any time