Privacy Policy

The controller responsible for the processing of your personal data is:

• Company: VG Transport AB
• Company registration number: 559588-9204
• VAT number: SE559588920401
• Registered address: Hallevadsvägen 7B, 461 55 Trollhättan, Sweden
• Email: [email protected]
• Telephone: +46 10-122 17 43 (010-122 17 43)
• Website: https://vgtransport.eu

If you have any questions about how we process your personal data, or wish to exercise any of your rights, you are welcome to contact us at [email protected].

We collect and process the following categories of personal data, depending on your relationship with us.

2.1 Data from website forms

On vgtransport.eu we provide forms for quote/lead enquiries and for contact. When you complete and submit a form, we process the data you provide, which may include:

• Name
• Email address
• Telephone number
• Company
• Location, as well as origin and destination
• Free-text message and information about your transport needs

2.2 Email and business communication

When you communicate with us by email, telephone or otherwise, we process the contact and content data contained in that communication, such as name, contact details, job title, correspondence and information about the relevant matter or assignment.

2.3 Transport and customs documents

In order to arrange and carry out a transport, customs or freight forwarding assignment, we process the data required for the assignment. This may include data on the consignor, consignee, contact persons, delivery and collection addresses, goods details and data contained in transport and customs documents (e.g. waybills, customs declarations and accompanying documents).

2.4 Invoicing and accounting data

In connection with invoicing and accounting, we process data such as name, invoicing and contact address, reference person, company or personal identity number where applicable, and payment and transaction data.

2.5 Web analytics data

If you consent to analytics cookies, we use Google Analytics 4 to collect data on how the website is used, such as the pages you visit, time, referring source and approximate geographic location, as well as technical information about your device and browser (e.g. device type, operating system and a pseudonymous identifier). This data is used for statistics and to improve the website. Web analytics is carried out only with your consent (see section 9), which you may withdraw at any time.

We do not normally process sensitive personal data (special categories of personal data under Article 9 GDPR). Please do not provide such data to us unless it is expressly requested and necessary for the assignment.

We process your personal data only for specified, explicit and legitimate purposes, and always on a legal basis under the GDPR.

• Responding to quote and contact enquiries – receiving and responding to enquiries from website forms, email and telephone; preparing quotes. Legal basis: legitimate interest (Art. 6(1)(f)) – to respond to and handle enquiries ahead of a possible contract. Where the enquiry is made prior to entering a contract, Art. 6(1)(b) may also apply.
• Entering into and performing contracts – arranging and carrying out transport, customs and freight forwarding assignments, including booking with transport partners and customs agents, planning, follow-up and customer communication. Legal basis: performance of a contract (Art. 6(1)(b)). Where the counterparty is a company and the data concerns its representatives or contact persons: legitimate interest (Art. 6(1)(f)).
• Managing the customer relationship and business communication – ongoing communication, customer service, case handling and documentation of assignments. Legal basis: legitimate interest (Art. 6(1)(f)) – to administer the business relationship and ensure delivery reliability.
• Invoicing and accounting – handling invoices, payments and accounting records. Legal basis: legal obligation (Art. 6(1)(c)), including under the Swedish Bookkeeping Act (1999:1078).
• Customs and transport-related obligations – preparing and handling customs and transport documentation and meeting requirements under customs and transport law. Legal basis: legal obligation (Art. 6(1)(c)) and performance of a contract (Art. 6(1)(b)).
• Security, troubleshooting and operation of the website – ensuring the website works, is secure and is protected against misuse. Legal basis: legitimate interest (Art. 6(1)(f)) – to provide a secure and functioning website.
• Web analytics and website improvement – measuring and analysing how the website is used via Google Analytics 4 to understand visitor patterns and improve content and functionality. Legal basis: consent (Art. 6(1)(a)) – analytics cookies are set only after your consent, which you may withdraw at any time.
• Complying with legal requirements and handling legal claims – meeting legal obligations and establishing, exercising or defending legal claims. Legal basis: legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) respectively.

Where we process personal data on the basis of consent (Art. 6(1)(a)), we obtain it separately, and you then have the right to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Where we rely on legitimate interest, we have carried out a balancing test and concluded that our interest in processing the data does not override your interest in the protection of your personal data. You have the right to object to such processing (see section 8).

We keep your personal data only for as long as necessary for the purpose for which it was collected, or for as long as we are required by law to retain it. After that, the data is deleted or anonymised.

• Accounting records – seven (7) years after the end of the calendar year in which the financial year ended, in accordance with the Swedish Bookkeeping Act (1999:1078).
• Customs and transport documents – for as long as required under applicable customs and transport law and to evidence assignments carried out.
• Data in customer and contractual relationships – for the duration of the contract and thereafter for as long as needed to handle the assignment, any complaints or legal claims.
• Quote and lead enquiries (that do not lead to a contract) – a reasonable period, normally up to twelve (12) months after the last contact, after which the data is deleted if no longer relevant.
• Email and business communication – for as long as needed for the matter and the business relationship, after which the data is cleared in accordance with our routines.
• Web analytics data (Google Analytics 4) – stored in pseudonymised form according to our Google Analytics setting, normally no longer than fourteen (14) months, after which it is deleted or aggregated.

Statutory retention periods always take precedence over our internal deletion routines.

In order to run our business and deliver our services, we share personal data, to the extent necessary, with selected suppliers and partners. These either process data on our behalf as data processors, or act as independent controllers for their own processing. Where a party processes data on our behalf, this is governed by data processing agreements that impose requirements on security and confidentiality.

Suppliers and sub-processors supporting our operations:

• Supabase – database and storage of data submitted via the website forms.
• Resend – sending notifications when a form is submitted.
• Microsoft (Microsoft 365 / Exchange Online) – email and business communication.
• Cloudflare (Pages) – web hosting and CDN/delivery of the website.
• Google (Google Analytics 4) – web analytics and statistics. Provider: Google Ireland Limited, with Google LLC (USA) as a sub-processor. Activated only after your consent to analytics cookies.

Other recipients in connection with assignments:

• Engaged transport partners (hauliers/carriers) – when they need consignor and consignee data and other data necessary to carry out the relevant transport assignment.
• Customs agents – when customs clearance forms part of the assignment and consignee/consignor data and documentation are required for customs handling.
• Public authorities – such as the Swedish Customs (Tullverket), the Swedish Tax Agency (Skatteverket) or other competent authorities, when we are required by law to disclose data.
• Advisers and other suppliers – e.g. auditors, accounting and IT suppliers, to the extent necessary for our operations.

We never sell your personal data.

Some of our suppliers and sub-processors may process or store personal data outside the EU/EEA, or belong to groups with operations outside the EU/EEA. When personal data is transferred to a country outside the EU/EEA, we ensure that the transfer takes place lawfully and that an adequate level of protection is maintained, for example through:

• the recipient country being covered by an adequacy decision from the European Commission, or
• the transfer being protected by the European Commission's Standard Contractual Clauses (SCCs), supplemented where necessary by additional safeguards.

This applies, among others, to Google (Google Analytics 4), where personal data may be processed in the USA. Such transfers are based on the European Commission's adequacy decision under the EU–US Data Privacy Framework, to which Google is certified, and/or on Standard Contractual Clauses (SCCs).

If you would like to know more about the safeguards we apply to a particular transfer, or to obtain a copy of the relevant safeguards, please contact us at [email protected].

We take appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration or disclosure. This includes access restrictions, authorisation controls, encryption in transit where applicable, and engaging suppliers that maintain an appropriate level of security. We process the data confidentially, and only the staff and partners who need the data for their work are given access to it.

Under data protection law, you as a data subject have a number of rights. You have the right to:

• Access – obtain confirmation of whether we process personal data about you and, if so, receive a copy of that data.
• Rectification – have inaccurate or incomplete data corrected or completed.
• Erasure ("the right to be forgotten") – have your data erased where we have no legal obligation or other valid basis to retain it. See the section Deletion of your data below for how to make a request.
• Restriction – request that the processing of your data be restricted in certain cases.
• Data portability – receive the data you have provided to us in a structured, commonly used and machine-readable format and, where technically feasible, have it transferred to another controller, where the processing is based on consent or a contract and is carried out by automated means.
• Object – object to processing based on legitimate interest, on grounds relating to your particular situation. You also have the right to object at any time to processing for direct marketing.
• Withdraw consent – where processing is based on consent, withdraw it at any time.

To exercise your rights, please contact us at [email protected]. We respond to your request without undue delay and within one month at the latest. To protect your privacy, we may need to verify your identity before disclosing data.

Please note that some rights may be limited, for example where we are required by law (such as the Bookkeeping Act or customs legislation) to retain certain data.

Complaints to a supervisory authority

If you consider that we process your personal data in breach of applicable data protection law, you have the right to lodge a complaint with the supervisory authority. In Sweden, this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY): Box 8114, 104 20 Stockholm, Sweden, [email protected], www.imy.se.

We would, however, appreciate it if you first contacted us at [email protected], so that we have the opportunity to answer your questions and remedy any shortcomings.

You can at any time ask us to delete the personal data we hold about you. Here is how:

1. Send an email to [email protected] with the subject line "Deletion of personal data".
2. State which data your request concerns – for example the email address or telephone number you used when contacting us, or the form/matter it relates to.
3. To protect your privacy, we may need to verify your identity before the deletion is carried out.

What is deleted: the data you submitted via our forms (quote, lead and contact enquiries) in our database, your email correspondence with us and your contact details in our systems – to the extent we are not required by law to retain them.

What may need to be retained: data in accounting records (seven years under the Swedish Bookkeeping Act) and customs and transport documents we are required by law to keep. Such data is excluded from the deletion but is not processed for any other purposes.

Timeframe: we confirm your request and carry out the deletion within 30 days.

A cookie is a small text file stored in your browser when you visit a website. We use two types of cookies:

Strictly necessary cookies – required for the website to function and remain secure (basic operation, security and content delivery via our supplier Cloudflare). These do not require consent and are session-based or short-lived.

Analytics cookies (Google Analytics 4) – used to measure and understand how the website is used so that we can improve it. These are set only if you consent. We use Google Consent Mode, meaning that no analytics cookies (e.g. _ga, _ga_*) are activated until you have given your consent in our cookie banner. Analytics cookies are stored for up to 13 months.

When you first visit the website, a cookie banner lets you choose whether to allow analytics cookies. You can change or withdraw your choice at any time via the cookie settings on the website, or by blocking or deleting cookies in your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Please note that some functions may be affected if you block cookies.

Change or withdraw your choice: Change cookie settings.

We may update this privacy policy, for example in the event of changes to our operations, our suppliers or applicable law. The latest version is always published at vgtransport.eu. We will provide appropriate notice of any material changes. This version is in force from the date stated at the top of the page.

If you have any questions about this privacy policy or about how we process your personal data, you are welcome to contact us:

VG Transport AB
Hallevadsvägen 7B, 461 55 Trollhättan, Sweden
Email: [email protected]
Telephone: +46 10-122 17 43 (010-122 17 43)
Website: https://vgtransport.eu

VG Transport AB operates in accordance with NSAB 2015 (the General Conditions of the Nordic Association of Freight Forwarders).