Privacy Statement
How The Better Cities Company AB collects, uses, and protects personal data in connection with our services, programmes and platforms.
1. Who we are
The Better Cities Company AB (“we”, “us”, “our”) is an organisation providing advisory services in urban development, sustainability, planning, and related strategic services. We are committed to protecting and respecting your personal data and ensuring transparency in how we use it.
For the purposes of applicable data protection laws, including the General Data Protection Regulation (GDPR):
- The Better Cities Company AB acts as a data controller for the personal data described in this notice; and
- In certain circumstances The Better Cities Company AB acts as a data processor on behalf of its clients (see Section 3 below).
Contact details
Email: info@bettercitiescompany.com
Address: Jordholmsvägen 69, 235 99 Vellinge, Sweden
2. What personal data we collect and how we use it
| Category | Description | Purpose & legal basis |
|---|---|---|
| Identification & contact data | Name; residential address; date of birth; nationality; phone number; email address; partner or programme identifiers; national ID number; national ID card number; government identification numbers where required by law. | Identify contractors and service participants; administer contractor engagement and eligibility; communicate regarding vehicles, services and programmes; comply with legal and regulatory obligations. Legal basis: Contract — Art. 6(1)(b); Legal obligation — Art. 6(1)(c); Legitimate interests — Art. 6(1)(f). |
| Contractual & engagement data | Services provided; agreement terms; compensation details; programme participation; confirmation of vehicle receipt and responsibilities. | Manage the contractor relationship; deliver services; administer programme participation; enforce contractual obligations. Legal basis: Contract — Art. 6(1)(b); Legitimate interests — Art. 6(1)(f). |
| Vehicle & employment-related data | Current vehicle data (make, model, financing method, uploaded vehicle photo); confirmation of whether the relevant work is the contractor's main income and length of service. | Administer vehicle-based services and programmes; assess eligibility; manage operational requirements. Legal basis: Contract — Art. 6(1)(b); Legitimate interests — Art. 6(1)(f). |
| Project & service data | Information provided during engagements; stakeholder contact details; consultation responses or submissions; service participation data including applications, registrations, eligibility assessments and service usage information; work performance and service delivery records. | Manage projects, pilots, consultations and service programmes; assess service delivery; support operational planning and reporting. Legal basis: Contract — Art. 6(1)(b); Legitimate interests — Art. 6(1)(f); Consent — Art. 6(1)(a), where applicable. |
| Location, tracking & telematics data | Precise geolocation data of the vehicle (real-time or periodic); route information; journey timestamps; mileage; vehicle usage; driving behaviour; vehicle status, performance and related operational information. | Insurance administration; vehicle maintenance; legal and compliance purposes; service operation, monitoring and improvement; verification of vehicle use; incident investigation and fraud prevention.
Vehicle advertising: telematics data may support marketing and advertising purposes limited strictly to advertisements displayed on the vehicles themselves. Not used for: telematics data is not used for marketing or advertising directed at the driver or user of the vehicle. Legal basis: Contract — Art. 6(1)(b); Legitimate interests — Art. 6(1)(f); Legal obligation — Art. 6(1)(c) where applicable. Processing is limited to what is necessary for the stated purposes and accessed only by authorised personnel. |
| IT, website & technical data | IP address; browser type and device information; usage data via cookies (where applicable); IT usage and system access logs where necessary for security. | Operate websites, portals and systems; ensure IT security, access control and system integrity. Legal basis: Legitimate interests — Art. 6(1)(f); Consent — Art. 6(1)(a), where required. |
| Marketing & communications data | Preferences for receiving communications; event registrations or subscriptions. | Manage communications and engagement activities. Legal basis: Consent — Art. 6(1)(a); Legitimate interests — Art. 6(1)(f). |
| Financial, tax & compliance data | Bank account details for payment processing; tax information; invoicing and billing records; supplier payments; procurement processes; insurance or compliance-related information where required. | Payment processing; invoicing; accounting; tax reporting; insurance administration and financial compliance. Legal basis: Contract — Art. 6(1)(b); Legal obligation — Art. 6(1)(c). |
| Emergency contact data | Emergency contact details, where voluntarily provided. | Health, safety and emergency response. Legal basis: Legitimate interests — Art. 6(1)(f); Vital interests — Art. 6(1)(d), where applicable. |
3. When we act as a processor for our clients
In certain engagements, The Better Cities Company AB processes personal data on behalf of its clients (the data controllers) and strictly in accordance with their documented instructions. In such cases:
- The Better Cities Company AB acts solely as a data processor.
- The relevant client acts as the data controller.
- We process personal data only on the documented instructions of the controller.
- We do not independently determine the purposes or essential means of processing.
- The scope, purposes, retention periods, disclosure decisions and lawful bases for such processing are determined by the controller.
Scope of processing
The categories of personal data processed on behalf of our clients may include, depending on the nature of the engagement and the controller's instructions:
- Identification and contact data.
- Contractual, service participation and administrative data.
- Vehicle-related, operational or usage data.
- Location, tracking or telematics data, where applicable.
- Communications and service support information.
The specific data types, purposes of processing, retention periods and disclosure decisions are determined by the relevant controller and set out in the applicable contractual arrangements.
Data protection safeguards
Where we act as a processor for our clients:
- Processing is governed by a data processing agreement compliant with Article 28 GDPR.
- We implement appropriate technical and organisational measures to protect personal data.
- We may engage approved sub-processors only in accordance with contractual and legal requirements.
- Personal data is not retained or used for our own purposes.
Telematics and location data (processor clarification)
Where tracking, geolocation or telematics data is processed on behalf of a client, such processing is conducted only on the controller's documented instructions, limited to the purposes defined by the controller, and governed by the applicable data processing agreement.
For the avoidance of doubt, this section does not apply to telematics, vehicle or operational data processed by The Better Cities Company AB as a data controller for its own services, which is described separately in Section 2 of this Statement.
Data subject rights
Where personal data is processed by us on behalf of a client:
- The controller is responsible for responding to requests to exercise data protection rights.
- If an individual submits a request directly to us, we will promptly refer it to the relevant controller, unless otherwise required by law.
4. Special category data
We do not intentionally process special category data (e.g. health, ethnicity) unless it is necessary for a specific project. Where we do, we will ensure an appropriate legal basis under Article 9 GDPR applies.
5. Sources of personal data
We collect personal data from:
- You directly (e.g. when engaging our services).
- Your organisation.
- Publicly available sources (e.g. LinkedIn, public registers).
- Project partners or stakeholders.
6. Sharing your personal data
We may share your personal data with:
- Service providers (hosting systems).
- Professional advisers (legal, accounting).
- Project partners and collaborators.
- Public authorities or regulators where required.
All third parties are required to respect the security of your data and process it in accordance with the law.
7. International transfers
Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as:
- Standard Contractual Clauses (SCCs).
- Adequacy decisions (where applicable).
8. Data retention
We retain personal data only for as long as necessary:
- Client and project data: duration of contract plus 6–7 years for legal and accounting purposes.
- Recruitment data: typically up to 12 months after conclusion of recruitment.
- User accounts and service requests: for the duration of the relationship.
- Marketing communications: until you withdraw consent or opt out.
- Website and technical data: in accordance with cookie and log retention policies.
9. Your rights
As an individual, under EU law you have certain rights to apply to us to provide information or make amendments to how we process personal data. These rights apply in certain circumstances and are set out below:
- The right to access data relating to you (access right).
- The right to rectify or correct data relating to you (right to rectification).
- The right to object to processing of data relating to you (right to object).
- The right to restrict the processing of data relating to you (right to restriction).
- The right to erase or delete data relating to you (right to erasure).
- The right to "port" certain data relating to you from one organisation to another (right to data portability).
These rights are not absolute and only apply in certain circumstances.
To exercise these rights, contact info@bettercitiescompany.com. If these rights are restricted due to legal obligations, we will notify you where legally permitted.
Contacting supervisory authorities
If you have any questions about how we process your personal data, or if you wish to exercise your data protection rights, you can contact info@bettercitiescompany.com.
If you believe that your personal data has not been processed in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) or applicable national data protection law, you also have the right to lodge a complaint with a Supervisory Authority.
In particular, you may contact the Supervisory Authority in the country where:
- You normally live,
- You work, or
- The alleged infringement of data protection law has taken place.
The Swedish supervisory authority (Integritetsskyddsmyndigheten, IMY) can be reached on telephone +46 8 657 61 00.
10. Data security
We implement appropriate technical and organisational measures to protect personal data, including but not limited to:
- Access controls.
- Encryption where appropriate.
- Secure systems and hosting.
11. Updates to this Privacy Statement
We may update this Privacy Statement from time to time. The latest version will always be available on our website.
Last updated: 22 April 2026.