Privacy Policy
Last updated: 1 April 2026 · Samtrygg AB · Org. no. 556876-2529
1. Data controller
Samtrygg AB, reg. no. 556876-2529, Olof Palmes Gata 20 B, 111 38 Stockholm, is the data controller for the processing of your personal data. Contact us at dataskydd@samtrygg.se for questions about privacy and data protection.
2. What data we collect
To deliver our services we process the following categories of personal data:
- Identity data — name, personal identity number, BankID verification, profile photo.
- Contact data — email, phone number, address.
- Financial information — income data, credit check (UC), payment history.
- Housing data — addresses, contracts, rental periods, insurance-related events.
- Communications — messages between you and your counterparty, support cases, email.
- Technical data — IP address, device and browser info, page navigation.
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Providing the marketplace and creating rental agreements | Performance of contract (GDPR art. 6.1.b) |
| Credit check and fraud prevention | Legitimate interest (GDPR art. 6.1.f) |
| Identity verification with BankID | Contract + legal obligation (anti-money-laundering) |
| Managing rent guarantee and insurance | Performance of contract |
| Accounting and tax | Legal obligation (accounting law) |
| Marketing and newsletters | Consent (GDPR art. 6.1.a) |
| Product development and analytics | Legitimate interest |
4. Recipients of data
We share data with third parties only when necessary for the service. These are processors that follow our instructions:
- Scrive — digital signing of rental contracts
- BankID — identity verification
- UC AB — credit checks
- Omocom / Hedvig — insurance partners
- Trustly / Swedbank Pay — payment services
- AWS (Amazon Web Services) — hosting within the EU
- Mailgun, Plivo — email and SMS
We never sell your personal data. For transfers outside the EU/EEA we use the European Commission's standard contractual clauses.
5. Retention period
- Active accounts — as long as you have an account with us.
- Inactive accounts — deleted after 24 months of inactivity.
- Rental agreements and accounting — 7 years per Swedish accounting law.
- Credit reports — deleted immediately after check; only the outcome is retained.
- Support cases — 3 years.
6. Your rights
Under GDPR you have the following rights. We respond to a request within 30 days.
- Access — receive a copy of your personal data.
- Rectification — have inaccurate data corrected.
- Erasure — have data deleted (right to be forgotten), where it does not conflict with accounting requirements.
- Restriction — restrict how we use the data.
- Portability — receive the data in a machine-readable format.
- Objection — against processing based on legitimate interest.
- Withdraw consent — when processing is based on consent (e.g. marketing).
- Complain — to the Swedish Authority for Privacy Protection (IMY) at imy.se.
7. Security
We protect your data with technical and organisational measures: TLS in transit, encryption at rest, strict access controls and regular security audits. Our servers are located within the EU.
8. Children
Samtrygg's services are not directed at persons under 18. We do not knowingly register accounts for minors.
9. Changes to this policy
For material changes we notify you via email or on samtrygg.se at least 30 days in advance. Minor editorial changes are published directly on this page.
10. Contact
Data Protection Officer: dataskydd@samtrygg.se · +46 10-884 80 00 · Samtrygg AB, Olof Palmes Gata 20 B, 111 38 Stockholm.