Swedish master version • Version 1.3 • Effective from 11 October 2026

This policy explains how Movo Mobility AB processes personal data when you register an account, visit our digital services or use them for parking, charging, bookings, permits and other offerings. You will learn which data we use, why, which other parties receive data and how you exercise your rights. The processing depends on which features you use and Movo's role in the relevant service.

You do not need to consent to the entire policy in order to use Movo. The policy is information. Where a particular processing activity requires consent, we ask you separately and you may withdraw it. Many basic processing activities are instead carried out in order to perform a contract, comply with law or satisfy a documented legitimate interest.

1 Who is responsible and how to contact us

1.1 Movo Mobility AB, company registration number 559585-1543, Smedjegatan 33, 131 54 Nacka, Sweden, is the controller for the processing activities for which we determine the purpose and essential means. Depending on the service you use, this includes, among other things, administration of your Movo account, Movo's transactions, security and our own legal obligations.

1.2 Data protection questions and rights requests should be sent to privacy@getmovo.com. Customer service can be reached at hello@getmovo.com. Website: getmovo.com. You may also write to the postal address above and mark the letter "Data Protection".

1.3 privacy@getmovo.com is Movo's shared point of contact for data protection. A request is handled by the function responsible for the matter and, where necessary, forwarded to the correct person or responsible party. You do not need to know the name of an individual case handler in order to exercise your rights.

1.4 The policy applies to users, guests, business users and other individuals whose data is processed within the services described, such as drivers and vehicle holders. It covers the website, app, Marketplace, customer portal, embedded features and QR-based purchases. Personal data is processed for the functions you use or are affected by. Mention of a feature does not mean that it is enabled for you. The policy is not a general staff, recruitment or investor policy.

2 The responsibilities of Movo and other parties

2.1 The operator specified for the facility is responsible for the local CCTV surveillance and the handling of parking charges. The operator shall provide information about its processing and points of contact on site, in the relevant offer or in the case concerned. A municipality, property owner, housing association, employer, charging operator or hotel business may additionally be an independent controller for its own letting, authorisation checks, customer relationship or service.

2.2 When Movo processes data relating to CCTV surveillance, parking monitoring or parking charges in Movo Field solely on the operator's documented instructions, Movo is a processor. The same applies to customer-specific registers that Movo handles solely on a principal's instructions. The principal determines the purpose, legal basis and retention requirements. Movo is responsible for its obligations as a processor and for separate processing of its own, such as account administration and performance of a contract with you.

2.3 A processor role does not entitle Movo to reuse the principal's personal data for its own advertising, its own customer profiles or other independent purposes. If Movo itself determines a separate purpose, it must have its own legal basis and be described to you.

2.4 Where Movo is named as the seller in the purchase flow, Movo is responsible for the processing of personal data for its own order and customer relationship. Where a partner is named as the seller, that partner is responsible for its customer relationship. A shared technical system or a shared checkout does not, in itself, mean that the parties are joint controllers. If a particular feature entails such joint responsibility, specific information about the parties and the allocation of responsibility will be provided before processing begins.

2.5 A payment provider, bank or credit reference agency may be independently responsible for, for example, secure payment, statutory checks and credit information, even if the service is initiated from Movo. An invoicing or support provider may have different roles for different data items. These roles are set out in the recipient information in Appendix 1.

2.6 If you are unsure who is responsible, you may contact us. We handle the part we are responsible for and help you identify the correct party for other parts. Where we are a processor, we assist the principal within the scope of the engagement.

3 Data that may be processed

3.1 Account and contact. Name, email address, telephone number, address, customer number, language, country, account settings, contract versions, confirmations and records of approvals. Data on an organisation and your authority may be added when you connect a business account.

3.2 Identification and authorisation. Identification results and references from electronic ID, where applicable personal identity number or coordination number, verified address and information showing entitlement to a particular service. An identification result should be distinguished from login credentials; we will not ask you to provide security codes or passwords for your electronic ID.

3.3 Vehicle and permits. Registration number, country of registration, vehicle type, vehicle designation, the link between vehicle and account, permits, validity, authorisations, queue registration, queue points and offers made or accepted. A registration number may be personal data even where the driver's name is not stated.

3.4 Parking and access. Facility, zone, space, start and end time, entry and exit, booking data, access decisions and use of a digital key, code, RFID tag or access card. Camera integrations may provide number plate readings and, where needed for the purpose, limited images. Where an operator uses Movo Field, control time, control location, service notes, photographs, permit checks, charge documentation and objections may also be processed on the operator's behalf.

3.5 Charging. Station, outlet, session time, energy delivered, meter readings, fees and error codes. Technical vehicle data are processed only where the integration provides them and they are needed for a described purpose. We do not routinely collect all information that a connected vehicle may produce.

3.6 Payment. Order and transaction number, amount, currency, VAT, discount, chosen payment method, payment status, receipt, invoice, debt and refund. In Adyen's payment flow, card data is handled by Adyen. Movo uses payment references, status and limited card data in order to link the payment to the order and manage an approved stored payment method. Security codes must not be provided in customer service cases.

3.7 Device and usage. IP address, browser, operating system, app version, session identifiers, timestamps, error and security logs, and settings for cookies and permissions. Optional analytics and advertising tracking are subject to separate choices; it is not mixed together with necessary security logging.

3.8 Location. Your chosen search location and, if you use and permit a feature that requires it, the device's geographic location. A parking facility stated on a receipt is a different piece of data from a continuous GPS location. Turning off GPS therefore does not delete the facility information needed for a completed purchase.

3.9 Communication. Messages to customer service, materials you submit, case numbers, replies, complaints and any documentation of a dispute. Do not provide sensitive data that is not needed for the case. Any recording or transcription of calls requires specific information to be given when contact is made.

3.10 Data that may reveal health information, such as certain parking permits, is not collected as general account information. Where a specific permit service requires such data, the responsible party must provide specific information and ensure that there is also a legal basis under the rules on special categories of personal data. Data on suspected offences also requires specific legal basis; ordinary security logging does not provide a general right to keep criminal records.

3.11 Digital contracts and additional services. Signing results, contract version, timestamp and the necessary identification reference may be processed when you approve a contract. For hotel, transfer or vehicle services, the booking data needed for your order may additionally be processed, such as stay period, requested pick-up, number of travellers, vehicle and service selected. The data is limited to what the responsible provider needs in order to deliver the order.

4 Where the data comes from

4.1 We obtain data directly from you when you register, use the service, choose settings, place an order or contact us. Other data arises through usage, such as times, fees, security logs and confirmed changes.

4.2 We may obtain data from the identified provider of your parking, charging, booking or additional service. A hotel may, for example, provide a guest registration, and an employer an invitation to the business account. Such a transfer shall be limited to what is needed for the specific purpose.

4.3 Where an offered feature requires it, we may obtain identification results from BankID, address and population register data from the Swedish State Personal Address Register (SPAR), payment information from Adyen or Billogram, and relevant data from the register or credit reference agency identified in the relevant feature. Access to registers takes place within the authority and purpose applicable to the source. Credit information is obtained in accordance with section 5.6, not merely because a Movo account is created.

4.4 Another authorised person may register a vehicle or place an order on your behalf. That person must be entitled to provide the data. Movo's own information obligations remain in place. Where we obtain data indirectly, we provide information within the time and in the manner required by the GDPR, normally no later than within one month and earlier where the first contact or disclosure requires it, unless a lawful exemption applies.

4.5 In the event of a lawful transfer of a customer relationship, we may obtain data from a previous service provider. We will then inform you of the source, the purpose and how the processing is affected. A migration does not automatically mean that a marketing consent or a permission for another purpose can be used by Movo.

5 Purpose and legal basis

5.1 The legal basis is determined per processing activity. Contract is used only for processing that is objectively necessary for a contract with you or a step that you request prior to such a contract. A contract between Movo and your employer does not in itself make the contractual basis applicable to your personal data. Where we rely on legitimate interest, we weigh this against your privacy and document the assessment.

5.2 Creating and administering your account

We use account, contact, login and contractual data for registration, authentication, your settings, receipt access and management of your contract. For a personal account, the basis is performance of a contract, Article 6(1)(b) GDPR. Security checks beyond what is necessary for the contract are processed under 5.8.

For a contact person or user under an organisational agreement, the basis may be legitimate interest, Article 6(1)(f). The interest is to give authorised persons access to an agreed corporate service and administer the relationship with the organisation. Movo then limits the data and powers required.

5.3 Carrying out parking, charging and booking

We process vehicle, location, time, charging, order and payment data to carry out your order, confirm validity, calculate price and handle changes. Where the processing is necessary for our contract with you, Article 6(1)(b) is used. This includes transferring necessary validity information to the responsible supplier.

Where the transaction concerns a person other than the contracting party, for example an authorised driver, the processing may instead rely on Article 6(1)(f). The interest is to correctly administer the ordered vehicle or visitor service. We limit the data and provide information to those concerned in accordance with applicable rules.

5.4 Permits, queues and authorisation

Where you yourself enter into a contract with Movo regarding a permit or queue function, we use necessary vehicle, authorisation, queue and contact data for the contract under Article 6(1)(b). Where we merely administer the supplier's register as a processor, that supplier determines the purposes and legal basis and provides the detailed information.

A check of residency or identity must be proportionate. Where Movo carries out an independent security check, legitimate interest in secure identification and correct allocation is used where applicable, under Article 6(1)(f). Personal identity numbers are, in addition, handled in accordance with supplementary Swedish rules, see section 6. We do not collect complete supporting documentation where a limited verification result is sufficient.

5.5 Payment, invoicing and accounting

To handle your purchase, an approved payment authorisation, refund and payment status, necessary transaction, contact and payment data is used under Article 6(1)(b). For an organisation's invoicing basis, the contact person's data may be processed under Article 6(1)(f), with the interest of administering and receiving payment for the service provided.

Accounting records are retained under Article 6(1)(c) to comply with the Swedish Bookkeeping Act and applicable tax rules. The legal obligation concerns information that genuinely constitutes accounting records and does not mean that the entire user profile or all GPS history may be retained for the same length of time.

In the case of a specific overdue receivable and handling of legal claims, Article 6(1)(f) is used, with the interest of establishing, exercising or defending a legitimate claim. A specific statutory obligation may instead provide support under Article 6(1)(c). Movo does not claim a general obligation to carry out anti-money-laundering checks for all ordinary parking.

5.6 Invoice and credit assessment

The facility's authorised administrator may activate the seller's invoice and credit options. The seller or credit provider identified before your choice is responsible for the credit assessment and related information. Movo normally processes necessary application data, settings, decisions and payment status in order to forward the application and carry out the chosen payment arrangement. Where Movo does this solely on the seller's instructions, Movo is a processor.

For processing necessary for Movo's own contract or your request prior to such a contract, Article 6(1)(b) is used. A necessary statutory credit check is supported by Article 6(1)(c) where the obligation applies to the responsible party. Limited fraud protection may be supported by Article 6(1)(f) following a balancing of interests. The legal basis and responsible party must be stated in the information pertaining to the actual credit choice.

An activated setting does not give unrestricted right to carry out credit checks. Before the check, you must be given information about the responsible party, source, data used and the relevant decision process. The credit reference agency is responsible for its own obligations, for example a copy of the credit report. Significant automated decisions are handled under section 13. You may choose an offered alternative without credit if you do not wish to apply for credit.

5.7 Customer service and correction

We use contact, case and relevant transaction data to answer questions and resolve issues. Where the processing is necessary for our contract with you, Article 6(1)(b) is used. For general enquiries and contact persons without their own contract, Article 6(1)(f) is used; the interest is to provide service and handle a received case. Requests for rights under the GDPR are processed to comply with a legal obligation under Article 6(1)(c).

5.8 Security and prevention of misuse

We use limited login, device, transaction and access logs to detect unauthorised use, incorrect authorisation, fraud and attacks, and to investigate incidents. The basis is Article 6(1)(f) and the interest in protecting users, payments, facilities' authorisations and our systems. For specific obligations under the GDPR, for example necessary incident handling and notification, Article 6(1)(c) may be applicable.

Security data must not be used routinely for indefinite surveillance or advertising profiling. During an investigation, access, data volume and retention are limited to what the investigation requires. Data on suspected offences is handled only where applicable special rules also permit it.

5.9 Location and other optional device functions

Where you choose to use the device's location to find parking, charging or other services near you, we process the location with your consent under Article 6(1)(a). You may instead search manually. The precise location is used for the search and is not stored as an ongoing movement history. You can disable the permission in the device's settings.

If a separate function requires location in the background, the scope, purpose and retention period must be explained and separate consent obtained before it is activated. Account registration does not activate such tracking. Permission for camera or notifications relates to the function you choose; it does not confer the right to use the data for other purposes.

5.10 Statistics and improvement

Movo may use limited operational and error data to measure technical quality, identify faults and plan capacity. Where the processing can take place without consent-requiring access to your device and does not involve more privacy-sensitive profiling, Article 6(1)(f) may be used; the interest is a safe and functioning service. We use aggregated or anonymised data where this is sufficient.

Optional analytics cookies and corresponding SDK functions are activated only after consent where the law requires it. The processing of personal data for such optional analytics is based on Article 6(1)(a). Pseudonymised data is still personal data if it can be linked back to you; only genuinely anonymised statistics fall outside the scope of the GDPR.

5.11 Offers and marketing

Newsletters and other voluntary mailings take place with consent under Article 6(1)(a) where required. Limited direct marketing of our own similar services to existing customers may be supported by Article 6(1)(f), with the interest of informing about relevant offers, only where the Marketing Act's rules on electronic mailings are also satisfied. You must then have been given a simple and free-of-charge opportunity to object to such use, both at the time of collection and in every message.

You may always object to processing for direct marketing purposes, including related profiling. Movo will then cease that processing. We do not disclose your identifiable parking history or precise location to advertisers for their own advertising purposes. Any new such processing requires a separate assessment and information before it is possibly introduced.

5.12 Legal obligations and changes to the business

We process necessary data for lawful regulatory requirements, court proceedings, audit and compliance. Article 6(1)(c) is used where a specific obligation applies. Article 6(1)(f) is used for the necessary handling of legal claims or protection of rights where no specific statutory obligation forms the basis.

In the event of a planned business transfer, limited data may need to be processed to evaluate and carry out the transaction. The interest under Article 6(1)(f) is to carry out a legitimate reorganisation or transfer. In an early-stage review, anonymous information is used in the first instance. Personal data is disclosed only where necessary, with confidentiality and access restrictions. Those concerned are informed of a change of data controller in accordance with law.

6 Personal identity numbers, e-identification and registers

6.1 Personal identity numbers and co-ordination numbers are used only where clearly justified, for example for secure identification in an access-controlled service, or where other valid support exists. They are not used as general public usernames and are not shared with all connected parties.

6.2 In connection with e-identification, Movo may receive name, identifier, authentication result and technical references needed for login or evidence. The data actually provided must be described at the point of identification and in Appendix 1. Movo does not gain access to your e-identification's secret security code through this flow.

6.3 Where SPAR or another population register is used for address verification or authorisation, this takes place within the purposes of the register authorisation and the law. Protected personal data requires special handling. Contact us via the data protection contact if you need a secure means of contact; do not send protected data in an unprotected message without prior instruction.

6.4 If you are unable or unwilling to use a particular identification method, the function concerned may be unavailable where the check is actually required. We must explain which data is mandatory and whether an alternative is available. This does not provide support for requiring a personal identity number for functions where there is no justified need.

7 Cameras, parking and other drivers

7.1 The facility operator is responsible for local camera surveillance, its purposes, legal basis, retention and signage. Movo may handle material as a processor for the operator. In order to carry out parking or payment under your contract, Movo processes necessary entry and exit events and account links also for its own contractual purpose. The data protection information at the facility and this policy describe their respective parts.

7.2 When you activate automatic payment, the registration number and applicable entry and exit events are linked to the payment profile in order to carry out the contract. Images are transferred only where needed for a described purpose and the role permits it, for example checking an incorrect reading. Activating automatic payment is not a general GDPR consent to all camera surveillance.

7.3 A facility may have lawful grounds for its camera surveillance even for vehicles that do not have a Movo account. The local responsible party must then provide information about that processing. Deleting a Movo account does not automatically stop an independent operator's lawful processing.

7.4 If someone else uses a vehicle linked to your account, the account's transaction history may show the location and time of that person's parking. Inform the driver accordingly and disable links that should no longer apply. This instruction does not replace Movo's or the facility's own information obligations.

7.5 Identifiable parking and access history is not used to create a general movement profile for other purposes. Contact us in the event of an incorrectly linked vehicle or suspected misuse of a registration plate. We need to verify who is entitled to see the data before details are disclosed.

7.6 Data in Movo Field is used by the operator to check parking, document an event, handle a charge and respond to an objection. Registering an account with Movo is not a condition for being subject to the operator's lawful surveillance. A person who merely appears in such a case may use the operator's contact channel or contact privacy@getmovo.com for help identifying the correct responsible party. The material is not used for Movo's own marketing.

8 Organisations and administrators' access

8.1 When you use a corporate account, authorised administrators may see the information needed for the company's payment and administration, for example user identity, registration number, chosen cost centre, facility, time and cost of service purchases. The insight that follows from the connection shall be disclosed when you are invited or choose the profile.

8.2 Private history shall not be shared with the employer solely because the same person also has a corporate profile. The employer's own use of received information is subject to its responsibility and information to employees. Corporate functions do not give the employer unrestricted access to a private account.

8.3 A hotel, an association or a property owner only has access to the information needed for its own guests, residents, permits or facilities. An account hierarchy in the platform is not in itself legal grounds for reading all underlying personal information. Access shall follow assignment, authorisation and data protection role.

8.4 When Movo displays a function embedded on another party's website, that website may have a separate processing of visitor data and cookies. Movo's processing in the embedded function is described here and in accompanying information. The host site's general approval does not replace a consent that Movo must obtain separately.

9 Recipients and sharing

9.1 We only disclose information when needed for a described purpose and with valid grounds. Recipients may be the relevant operator or service provider, payment and invoicing party, identity or register provider, authorised organisation administrator, and providers of operations, support, communication and security.

9.2 Providers that process information solely on Movo's behalf shall be covered by data processing agreements and may only process the information in accordance with documented instructions. Access is restricted according to task and need. A provider is not automatically a processor for all processing merely because Movo pays for its service.

9.3 Independently responsible recipients, for example certain banks, authorities, operators, lawyers or debt collection actors, are responsible for their own processing. Movo checks that the disclosure has grounds and limits the amount of information. A general cooperation agreement does not give unrestricted right to exchange customer data.

9.4 Information may be disclosed to an authority or court when a binding legal requirement exists, or when another clear legal basis permits the disclosure. Movo assesses the scope of the request and the legal basis; an informal request does not automatically mean that the entire account is disclosed.

9.5 Group affiliation does not create an unrestricted right to the information. If an affiliated company performs a service or is a party in a transaction, the same assessment of role, purpose, need and protection is required as for other recipients. Parkit Sweden AB is therefore not automatically the data controller for all Movo accounts or entitled to other operators' customers.

9.6 Appendix 1 describes key providers, recipient categories and international transfers. Information about a particular operator, vendor or function is also provided in the relevant offer. Contact privacy@getmovo.com for further information on the actual recipients of your information.

10 Processing outside the EU and EEA

10.1 Storage, support access and other processing may take place in different countries depending on provider and service. Remote access from a recipient in a third country may constitute a transfer even if the server is located within the EU/EEA. We therefore identify both the country of storage and the relevant country of access.

10.2 Movo's service providers include actors in Sweden, Luxembourg and the Netherlands. The providers' group and sub-processor chains may involve processing outside the EU/EEA, including in the USA, depending on service and payment method. Appendix 1 describes the providers' roles and relevant transfer terms. A company's registered office is not in itself the same as the place where information is stored or can be accessed.

10.3 When a transfer takes place, an applicable mechanism under the GDPR is used. This may be a current adequacy decision covering the actual recipient and the processing, or the European Commission's standard contractual clauses together with necessary risk assessments and supplementary safeguards. An applicable derogation is used only when its specific conditions are actually met.

10.4 Movo shall ensure valid transfer protection for the transfers for which Movo is responsible. AWS provides a data processing addendum with standard contractual clauses; Billogram describes adequacy decisions and standard contractual clauses as possible safeguards; Adyen describes standard contractual clauses for transfers within the group and to service providers. These are used to the extent they are applicable to the specific processing. When a provider is independently responsible as a data controller, the provider is responsible for its own transfers.

10.5 You may, via the data protection contact, request information about the safeguards and a copy or description of relevant guarantees. Trade secrets and other individuals' personal data may be redacted without undermining your right to comprehensible information.

11 How long information is retained

11.1 We retain personal data for as long as needed for the stated purpose and apply the retention periods below. Information is deleted earlier when the need ceases and there is no other grounds for continued storage. Retention periods for Movo's own processing are separate from an operator's or other independently responsible actor's periods. Accounting information is kept separate from ordinary user profiling when it only needs to be retained for bookkeeping purposes.

11.2 Account. Account information is used while your account is active. After a requested closure, information that is no longer normally needed is deleted or separated within 30 days. An account without an active product, debt or ongoing matter may be closed after 24 months of inactivity, following notice with at least 30 days' opportunity to retain the account. Limited documentation of agreements and claims may be retained pursuant to 11.8.

11.3 Transaction history. The detailed parking, booking and charging history shown for account use is normally retained for up to 24 months after the transaction. In the event of earlier closure, continued storage is limited to concrete bookkeeping, complaint or claim needs. The history is not retained indefinitely merely because the account still exists.

11.4 Accounting information. The information covered by the Swedish Bookkeeping Act is retained up to and including the seventh year after the end of the calendar year in which the financial year ended. For example, information for a financial year ending in 2026 is normally retained up to and including 2033. Only the information covered by the obligation or other documented necessity is retained on this ground.

11.5 Permits and queues. Information is needed during a valid permit period or active queue participation. After closure, supplementary authorisation documentation, queue information and unnecessary links are normally deleted within 90 days. Minimal documentation of decisions made and claims arising may be retained pursuant to 11.8. A principal's records that Movo only handles as a processor follow that principal's established instructions.

11.6 Images and access. When Movo temporarily receives camera images for its own technical reading control, they are normally deleted within 72 hours of receipt. An image needed in a concrete fault, payment or legal matter may be separated and retained for as long as necessary pursuant to 11.8. The parking event itself follows the retention period for transaction history. Digital access logs in Movo's own processing are retained for a maximum of 90 days. The operator's camera material and documents in Movo Field follow the operator's documented instructions and published retention periods; the operator shall limit retention to what is necessary for the purpose.

11.7 Location and technical logs. Precise GPS location for a single proximity search is normally processed temporarily and is not retained as separate movement history after the search. Any other location function has its own published retention period. Ordinary operational and error logs are retained for a maximum of 90 days and limited security logs for a maximum of 12 months when the risk picture warrants it. Routine logs shall not contain more information about trips or payment than necessary.

11.8 Support and claims. Ordinary support matters are normally deleted no later than 24 months after closure. Limited material that is needed to handle contractual disputes, prove acceptance of an agreement or pursue claims may be retained for as long as the specific claim can be pursued and the processing is necessary. For consumer claims, a three-year limitation period may often be relevant; interruption of limitation, another type of claim or an ongoing dispute may change the assessment. No general ten-year retention of the entire customer profile occurs on this basis.

11.9 Marketing and consent. Contact information for mailings is used until you withdraw consent, object or the purpose otherwise ceases. Limited evidence of consent and withdrawal is normally retained for a maximum of three years after the consent ceased, when needed to demonstrate compliance. A minimal suppression entry may be retained longer when needed to respect your objection. It is then not used for advertising.

11.10 Backups. Information that has been deleted in active systems may exist in separate backup copies during the backup cycle, for a maximum of 90 days. The copies are used for restoration, have restricted access and shall not return deleted information to ordinary use. Any statutory archives are kept separate from this cycle.

11.11 A documented legal requirement or a concrete legal claim may justify longer retention of certain information. We then segregate the material, restrict access and other uses, and reassess the need. When the purpose ceases, the information is deleted or anonymised in a manner that prevents re-identification.

12 Cookies and similar technology

12.1 Movo may use cookies, local storage, SDKs and other technology that stores or reads information on your device. Strictly necessary technology is used for the function you have expressly requested, for example a secure session, login, purchase flow or saved privacy choice. It shall be described even when consent is not required.

12.2 Analytics, advertising and other optional technologies are activated only after valid consent when such is required. It shall be possible to decline optional categories and equally easy to withdraw consent as to give it. Continuing to browse or merely accepting the terms of use does not replace an active choice.

12.3 Information about the cookies and corresponding technologies used, their providers, purposes and lifespan is provided in the service's cookie information and settings panel. Where optional technologies are offered, the choice shall be able to be changed via Cookie settings in the website's menu or footer, or the privacy settings in the app. You may also contact privacy@getmovo.com. Browser settings and device permissions may need to be managed separately.

12.4 If an external map, video, analytics function or payment component reads information from your device, its use shall be assessed according to its actual function. The fact that something is located in an embedded window or is provided by a partner does not automatically exempt it from consent requirements.

13 Automation, profiling and AI

13.1 Automatic functions may, among other things, match registration numbers, calculate fees, check the validity of a permit, sort according to selected search criteria and calculate loyalty points according to published rules. These functions must be explainable and errors must be capable of correction. Not all technical automation constitutes such a significant automated decision as referred to in Article 22 GDPR.

13.2 Movo's standard procedure is that decisions with legal or similarly significant effects for you are not finally made solely automatically by Movo. Automatic rules may flag a case or show a preliminary result; such a final decision must involve genuine human intervention. For credit or allocation determined by another seller or operator, that party is responsible for its own decision-making process. If a particular service uses significant wholly automated decisions, its separate information provided before the processing must state the responsible party, the permitted legal basis, the main logic, the consequences and the available safeguards.

13.3 Where Article 22 applies, you must receive information about the legal basis, which data is taken into account, how the logic mainly works, and the significance and likely consequences of the decision. The safeguards required by law must be in place, including the possibility to express your point of view, contest the decision and obtain genuine human review where the rules grant a right to this. A customer service link does not replace such a functioning review.

13.4 If an AI assistant is used in customer service, it must be made clear that you are interacting with such a function and how you can get in touch with a human being. Data provided to an external AI provider must be covered by proper recipient information, role and transfer safeguards. Movo does not disclose identifiable customer dialogues or parking history to a provider for training a publicly available model for the provider's own purposes.

13.5 Personalised recommendations and marketing profiles require a specified purpose and their own legal assessment. If such a function is introduced, the information here and in the function dialogue must be updated before the data begins to be used. A general objective of product development is not used as unlimited authorisation for new profiles.

14 Your rights

14.1 Access. You may request confirmation as to whether Movo processes your personal data, obtain a copy and information about, among other things, purposes, data, recipients, sources, storage and safeguards in the event of third-country transfers. The right also applies to data not shown on the account page, subject to the restrictions needed for other people's rights and permitted by law.

14.2 Rectification. You may request rectification of inaccurate data and completion of incomplete data, having regard to the purposes of the processing. A rectification of account data does not necessarily mean that a historically correct receipt is rewritten; a correcting document or credit invoice may be needed instead.

Request deletion of your data →

14.3 Erasure. You may request erasure where the data is no longer needed, consent has been withdrawn and no other legal basis exists, a justified objection prevents further processing, or another legal ground for erasure exists. The right is not unconditional; certain data may need to be retained for statutory requirements or legal claims. We will then explain why and what limited processing remains.

14.4 Restriction. Under the conditions of the GDPR, you may request that processing be restricted, for example while the accuracy of data or an objection is being investigated. The data may then normally be stored but not freely used for other purposes. We will inform you before the restriction is lifted where the law requires this.

14.5 Objection. For reasons relating to your particular situation, you may object to processing based on legitimate interest. We may then continue only if the GDPR provides a basis for this, for example through compelling legitimate grounds which override your interests or the need to establish, exercise or defend legal claims. For direct marketing, the right to object is unconditional; we will also stop any profiling linked to such marketing.

14.6 Data portability. For data that you have provided and which is processed automatically on the basis of consent or contract, you may receive the data in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted directly to another controller. The right may cover observed usage data but does not automatically cover all derived assessments.

14.7 Withdrawal of consent. You may withdraw consent at any time via the relevant setting, unsubscription or the data protection contact point. Withdrawal affects future consent-based processing, not the lawfulness of processing before the withdrawal. Another legal basis is not used retroactively as a pretext to continue the same processing that the consent concerned.

14.8 Automated decisions. You have the rights described in Section 13 where its conditions are met. You may also request comprehensible information about a decision affecting you and about incorrect data that has influenced it.

14.9 Complaints and judicial remedy. You may contact the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten), imy.se, or another competent data protection authority, for example in the country where you live or work, directly. You do not need to contact Movo first in order to lodge a complaint. The GDPR also grants the right to judicial review and, under its conditions, compensation for damage. The terms of use do not restrict these rights.

15 How we handle a request

15.1 Contact the data protection address in Section 1 and describe what you wish. You do not have to use a particular form or cite the correct article number. We may ask for limited supplementary information if there is reasonable doubt as to identity. We do not routinely request a full copy of an identity document where a less intrusive check is sufficient.

15.2 We respond without undue delay and normally within one month. Where necessary due to the complexity of the request or the number of requests, the time limit may be extended by a further two months at most. You will then be informed within the first month of the extension and the reasons for it.

15.3 Exercising the rights is normally free of charge. A fee or refusal can only become relevant under the special conditions of the GDPR, for example a manifestly unfounded or excessive request. A repeated request is not automatically subject to a fee. A further copy may be covered by the special rules on copy fees.

15.4 If we are unable to comply with a request, you must be given a justification and information about complaints and judicial remedy. Where rectification, erasure or restriction must be notified to recipients, we do so in accordance with the rules of the GDPR.

15.5 In the case of a processing assignment, we forward or refer the request to the correct controller and assist them. Movo at the same time answers the part that concerns our own processing. You do not lose your rights against Movo because the same data is also held by an operator.

16 Security and incidents

16.1 Movo must protect personal data with technical and organisational measures adapted to the risks of the processing. Security work includes access control, restriction of access between customer organisations, protection of communications, supplier control, and procedures for incidents, backup, rectification and erasure. Access to personal data must be restricted to persons who need it for their work duties and who are subject to applicable confidentiality obligations.

16.2 No technical solution can guarantee absolute security. This does not reduce Movo's obligations under the GDPR. When a personal data breach occurs, it must be assessed and handled in accordance with applicable rules. Notification to the supervisory authority is made when required, and information to the persons affected is provided without undue delay when the breach is likely to result in a high risk and no applicable exception exists.

16.3 Contact Movo if you see someone else's data, suspect unauthorised access, or discover an incorrect account link. Only provide the material needed for troubleshooting and do not pass on other people's data further.

17 Children and data about others

17.1 Movo's ordinary personal accounts are aimed at persons who have turned 18. Movo does not routinely request data about children for parking. If a particular additional service needs data about a minor, for example for a transport booking, the responsible party must provide separate and comprehensible information and limit the collection.

17.2 Contact us if a child has been registered or data about another person is being processed without sufficient basis. We will investigate and rectify or erase the data in accordance with applicable rules. One user's approval cannot generally replace another person's rights.

18 Changes and international use

18.1 We update the policy when services, data processing or legal requirements change. The version date is shown at the top and earlier versions can be requested. A material change is communicated in a manner that ensures you receive the information before the new processing begins, where the law requires this.

18.2 A published policy change does not in itself create a new legal basis and does not replace new consent where such consent is required. We do not use historical data for an incompatible new purpose merely because the policy has been rewritten.

18.3 This is the principal Swedish information with the GDPR as its starting point. For services offered in other countries, the information is supplemented as necessary with local details about the responsible party, rights, authorities and international transfers. The information applicable to the relevant offer must be available before the data is used for a new purpose.

Annex 1 Suppliers and other recipients

Movo uses the following central suppliers in the functions where the respective integration is offered. Only the data needed for the relevant service is to be disclosed. An external policy describes the supplier's own processing and does not replace Movo's responsibility under this policy.

Amazon Web Services

Amazon Web Services EMEA SARL, Luxembourg, provides cloud infrastructure and operation. The supplier is a processor for the customer content processed on Movo's instructions and a sub-processor when Movo itself is a processor. Infrastructure may process the account, transaction, authorisation and technical data needed for the service. AWS also processes its own business and service data in accordance with its terms.

Which storage and access countries are affected depends on the AWS services used and their configuration. AWS describes possible international transfers and safeguards in its data protection terms. Movo provides further information on the relevant processing and transfer safeguards via privacy@getmovo.com.

AWS information on European data protection

AWS Data Processing Addendum and international transfers

Adyen

Adyen N.V., Amsterdam, the Netherlands, registration number 34259528, provides electronic payment services. Necessary payment, transaction, contact and technical data may be processed for payment, authentication, fraud protection, refunds and statutory obligations.

Adyen is an independent controller for its own regulated payment business and the other own purposes described in its privacy information. Where a limited processing activity is carried out solely on instruction, it is governed by the applicable processor arrangement. Adyen describes transfers to group companies and suppliers outside the EU/EEA and the use of standard contractual clauses. Contact for Adyen's own data protection processing: dpo@adyen.com.

Adyen's privacy information

Billogram

Billogram AB, registration number 556801-7155, Sveavägen 50, 111 34 Stockholm, provides invoicing and payment management. Invoice, contact, payment, accounts receivable and case data are provided when Billogram is used for the relevant order.

Billogram is a processor for invoicing processing on the invoice issuer's instructions and an independent controller within its licensed payment services business. Billogram's public list of sub-processors covers processing within the EU/EEA and certain services in the United States, depending on which functions are used. Transfer safeguards are described in Billogram's policy and processor agreement. Contact for Billogram's own processing: support@billogram.com.

Billogram's information for invoice payers

Billogram's processor agreement and sub-processors

Identity, registers and other functional services

BankID is used where identification or signing with BankID is offered. SPAR is used for the address and authorisation checks included in the relevant function. Banks, identity providers and register custodians are responsible for their own services. Movo processes the relevant results in accordance with Sections 5 and 6.

Suppliers of maps, messaging, customer service, troubleshooting and optional analytics may process the necessary contact, technical and case data for the respective function. The service's cookie or function information identifies recipients where the function involves special access or optional processing. Information about actual recipients and safeguards can be requested from privacy@getmovo.com. A new recipient or a new purpose must be assessed and covered by correct information before the processing is introduced.

Operators, sellers and organisations

The operator and seller specified for the facility or purchase receive the data needed for their performance, validity checking and handling of errors or claims. Contact details and relevant privacy information must be provided in the offer, the purchase flow, the order confirmation or the local information, depending on the processing.

An employer, association or hotel business receives only the access that pertains to the relevant connection and the authorisations described in Section 8. An invoicing or debt collection party receives the data necessary for the identified assignment. A Movo account does not give any operator general access to other operators' customers or to your private history.