Steerly AB — information about the processing of personal data

General information

This information about the processing of personal data describes how Steerly AB (“we”, “us”, “our”) processes personal data when you use our services, visit our website or otherwise come into contact with us.

The purpose is to give you clear information about what data we collect, the applicable purposes, the legal basis used and your rights under the EU General Data Protection Regulation (GDPR).

Controller

Steerly AB is the controller for the processing of your personal data in connection with the provision of our services and our website. You can contact us as follows:

Steerly AB

Postal address: Kungsängsgatan 35, 753 22 Uppsala

Email: info@steerly.se

How do we collect your data?

We collect personal data in different ways depending on whether you visit our website or use our services (the app and web service). Below we describe what data is collected in each situation and how.

Website visitors

When you visit our website, technical data needed to deliver and protect the website is processed. Tracking is switched off in the current website version. The website’s own code loads no analytics or marketing tools and neither reads nor saves a consent choice.

The information that may be processed to operate the website is:

• IP address
• browser type and device information
• the requested page’s address (URL), which may contain query parameters
• technical logs needed to operate the website

If the prepared optional advertising measurement feature is enabled, the Meta Pixel script is fetched directly from Meta, only after your consent. You can decline and still read the whole website.

When the consent feature is enabled, our code saves your yes or no, the time and a version number in the browser’s local storage (localStorage). This data is used to remember and follow your choice, not for marketing. If the browser prevents storage, the choice applies only in the open page’s memory.

After acceptance, our code sends the PageView event for the current page and on subsequent page changes, and ViewContent when you visit the pricing page. ViewContent contains the page labels content_name: Priser and content_category: pricing. Page visits before acceptance are not reported retrospectively. The events describe page visits, not installations, registrations, trial starts, purchases or redeemed campaign codes.

The Pixel may also receive an IP address, browser and device information, the page address, the referring page’s address, and pixel and cookie identifiers. The addresses may contain query parameters, for example a campaign code or fbclid from an ad. The fact that our code requests only the two events mentioned does not mean that the data is anonymous or that parameters are removed from the addresses.

For information about which cookies may be used, their lifetimes and how to manage them and your consent choice, see our separate information about cookies.

Users of our services

When you use our service (through your account and in the app), we collect personal data in two main ways:

Data you provide yourself

When you create an account, enter information in the app or use features of the service, we collect data directly from you, for example:

• name, email address and other account information
• practical-stage and lesson status, notes and assessments
• theory results, quiz results and number of attempts
• checklists relating to the driving-licence process
• feedback (e.g. thumbs up/down and comments)

Data generated automatically when you use the service

When you use the service, certain data is also collected automatically so that the service works as intended:

• real-time location data needed to calculate suggested routes (not stored in our backend)
• technical information about your device
• authentication and API logs
• information about how you use the features in the app.

Users under 18

Our service can be used from the age of 16. If you are under 18, our terms of use require your legal guardian to have approved your entering into the agreement. We process the same data about users under 18 as about other users.

Your legal guardian’s approval of the agreement is not consent to optional advertising measurement. A consent choice on the website applies only to the website and does not change settings in the app or at Meta.

Purposes, legal bases and retention periods

We process personal data for the purposes set out in the table below. For each purpose, we give examples of the data processed, the legal basis and how long the data is kept.

• Operating and providing our website

  Examples of personal data

  IP address, browser information, device data, requested web address, technical logs

  Legal basis

  Legitimate interest (providing a functioning and secure website)

  Retention period

  Up to 1 year for technical logs needed to operate the website

• Saving and following your choice about the website’s advertising measurement, when the consent feature is enabled

  Examples of personal data

  Yes or no, time and version number in localStorage

  Legal basis

  Legitimate interest (remembering and respecting your choice and preventing measurement without consent)

  Retention period

  The choice applies for 365 days from the most recent choice. Page visits do not extend this period. An expired record does not give consent but may remain until it is replaced or the website’s data is removed

• Optional advertising measurement and sharing with Meta on the website, if the feature is enabled and you consent

  Examples of personal data

  PageView, ViewContent, IP address, web address and referring address, browser and device information, pixel and cookie identifiers

  Legal basis

  Consent to collection and transmission, including the joint processing described below

  Retention period

  Collection and transmission by our code take place only while valid consent applies. Cookie lifetimes are set out in the information about cookies. Meta states in its Business Tools Terms that event data may be retained for a maximum of two years

• Registration and administration of user accounts

  Examples of personal data

  Name, email address, language choice, age, authentication data

  Legal basis

  Performance of a contract

  Retention period

  Up to 1 year after the most recent login or until the account is deleted

• Managing subscriptions and payments

  Examples of personal data

  Transaction ID, customer ID, subscription type, status, period (start/end)

  Legal basis

  Performance of a contract and legal obligation (bookkeeping)

  Retention period

  Agreement and subscription data: up to 1 year after the account is closed. Bookkeeping data: 7 years

• Providing the features of the service (theory, practice, progression, checklists, route feature)

  Examples of personal data

  Practical-stage status, lesson status, assessments, notes, theory results, number of attempts, checklists, feedback, dates, real-time location data (not stored), device data

  Legal basis

  Performance of a contract

  Retention period

  Progression and theory data: up to 1 year after the most recent login or until deletion is requested. Location data: processed only in real time on the device

• Support and customer communication

  Examples of personal data

  Name, email address, case history, technical diagnostics when troubleshooting

  Legal basis

  Performance of a contract or legitimate interest (support)

  Retention period

  Until the case is closed or for up to 1 year

• Operation, security and troubleshooting of the service

  Examples of personal data

  IP address, technical logs, authentication logs, API logs, storage logs

  Legal basis

  Legitimate interest (security and prevention of misuse)

  Retention period

  Technical logs are kept for up to 30 days

• Development and improvement of the service

  Examples of personal data

  Usage data, aggregated behavioural data, cookie ID (depending on choices)

  Legal basis

  Legitimate interest (developing and improving the service)

  Retention period

  As set out in our cookie information; for analyses based on usage data, up to 1 year

• Legal claims and regulatory compliance

  Examples of personal data

  Data needed to establish, exercise or defend legal claims; data required by law

  Legal basis

  Legitimate interest / legal obligation

  Retention period

  In accordance with applicable limitation and retention rules (usually up to 3 years, or longer if required by law)

Consent to storage and access on your device under the Swedish Electronic Communications Act is separate from the legal basis for processing personal data under the GDPR. Legitimate interest does not replace consent required for such storage or access. Storing the consent choice itself is necessary to remember and respect your choice and is not used for advertising. The row about development and improvement of the service does not refer to the website’s optional advertising measurement.

The retention periods above also apply if a subscription ends. The end of a subscription does not in itself mean that the account or history is deleted, but neither does it mean that the data is kept indefinitely. Access to paid features may be restricted under the terms of use.

With whom do we share your data?

We never sell personal data. If the website’s optional advertising measurement is enabled and you consent, we share data with Meta as described below. We may also need to disclose personal data to third parties that are controllers in their own right, such as our payment provider when you make a payment, or to public authorities and other parties if we are required to do so by law or to handle legal claims. These other disclosures take place only when necessary to provide the service or when required by applicable legislation.

We also use certain external service providers to operate our platform and offer our services securely and reliably. Those providers that are processors act on our behalf and process personal data only in accordance with our instructions and subject to appropriate contractual safeguards.

For optional advertising measurement, the recipient is Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Dublin 4, Ireland. Under Meta’s Business Tools Terms, Steerly and Meta are joint controllers for the collection and transmission of event data for ad targeting, ad delivery and personalisation. Joint controllership does not cover Meta’s subsequent own processing for these purposes; for that processing, Meta is an independent controller. For certain specific measurement and analytics services, such as campaign reports, the same terms instead state that Meta is a processor. The terms also refer to Meta’s Controller Addendum. You can exercise your rights in relation to the joint processing with both Steerly and Meta.

Our purpose is to measure how ads on Facebook and Instagram lead to visits to the website and the pricing page. Meta’s terms also describe how event data may be combined with other information and linked to Meta accounts to personalise content and ads. This may involve profiling, meaning that data is used to assess, for example, your interests. Meta may receive data even if you do not have a Facebook or Instagram account. Read more about Meta’s own processing and your choices at Meta in Meta’s Privacy Policy.

Where do we process your data?

We aim to process personal data within the EU/EEA, and our primary operating environment for the app is located within the EU. However, some providers may process personal data outside the EU/EEA, for example in connection with payment processing or technical safeguards provided by global infrastructure providers. In these cases, we ensure that the transfer is protected in accordance with applicable data protection rules, for example through the European Commission’s standard contractual clauses in combination with appropriate technical and organisational safeguards.

The fact that Meta Platforms Ireland Limited is established in Ireland does not mean that Meta’s processing is limited to the EU/EEA. You can contact us at info@steerly.se for information about applicable transfer safeguards and how to obtain a copy of them.

Your rights as a data subject

As a data subject, you have certain rights in relation to the processing of your personal data. If you wish to exercise any of them, please contact us at info@steerly.se

Right of access

You have the right to receive information about what personal data we process about you, including the purpose of the processing and the legal basis for the processing.

Right to correction/rectification

If you believe that we process inaccurate personal data about you, you can ask us to correct it.

Right to restriction of processing

You can request that we restrict the processing of your personal data. This may, for example, be relevant if we hold inaccurate data about you and you do not want processing to continue until we have corrected the data.

Right to erasure / right to be forgotten

You can request that we delete your personal data. Although we will comply with such a request to the extent required by applicable law, please note that, despite your request, we may continue processing certain data (such as data we need to retain to protect our legal interests or that we are required by law to retain).

Right to object

Where personal data is processed on the basis of legitimate interest, you have the right to object to the use of your personal data. If your privacy interests outweigh our interests in processing certain data, we will stop processing that data. When data is processed for direct marketing, you always have the right to object, including to profiling related to such marketing. Processing for that purpose must then cease.

Right to data portability

You may also have the right to access the personal data you have provided to us in a structured, commonly accepted and machine-readable format, and the right to transfer the data to another controller.

Right to withdraw consent: You can withdraw consent at any time. When the website’s consent feature is enabled, you can select “Reject” under Your measurement choice, which can also be reached through “Change your choice” in the footer. Withdrawal does not affect the lawfulness of processing based on consent before you withdrew it.

When you withdraw consent to the website’s advertising measurement, new measurement events from our code are stopped, and a Pixel that has already started is notified that consent has been withdrawn. The code also attempts to remove the Pixel’s first-party cookies, but cannot delete all cookies, such as cookies on Meta’s own domains. Withdrawal does not automatically erase data already sent, undo requests already started or remove a script that has already loaded. This does not limit your rights, including the right to request erasure.

If you are not satisfied with us

If you are not satisfied with how we process your personal data, you are welcome to contact us at info@steerly.se. You can also contact the Swedish data protection authority (Integritetsskyddsmyndigheten, www.imy.se, imy@imy.se).