Summary

We collect information about your travel habits to help improve mobility options. We don't collect your name or contact details. No one - including your employer - sees your individual responses. Results are only ever reported at group level. Raw response data is retained for up to 12 months and is then deleted or transformed into a generalised form.

Read our full privacy policy below.

Full privacy policy

Travalytics AB ("we", "us", or "our") conducts web-based surveys to understand travel behaviour and support the development of sustainable mobility solutions. This Privacy Policy explains how we handle your data.

Travalytics AB (Swedish organisation number 559527-2468) is the data controller.

What we collect and why

We collect information such as travel habits, commute distances, postal codes, workplace department or unit, and opinions about mobility. We do not collect names, email addresses, or other direct identifiers.

Although no single data point we collect is likely to identify you, certain combinations — such as postal code, organisational unit, and travel pattern — may constitute personal data under the GDPR where they could indirectly relate to an identifiable individual. We treat all response data accordingly.

Participation is entirely voluntary, and choosing not to participate has no consequences.

How we use and report your data

Responses are used for analysis, research, and reporting. Results are only published in aggregated form, with minimum group size thresholds (k-anonymity) applied so that no individual can be singled out.

Legal basis

We process your data on the basis of legitimate interest (Article 6(1)(f) GDPR). Our interest is in delivering travel behaviour analysis that supports sustainable mobility. We have conducted a Legitimate Interest Assessment and concluded that this interest is not overridden by your rights and freedoms, given that no direct identifiers are collected, results are only published in aggregate, and statistical safeguards are applied throughout. You have the right to object to processing based on legitimate interest at any time (Article 21 GDPR) — see Your rights below.

Data sharing

Raw response data is not shared with clients, employers, or other external parties.

We may engage contractors or sub-contractors to assist with survey analysis. These parties act as data processors on our behalf, are bound by data processing agreements, and are not permitted to use the data for any other purpose.

Clients who commission a survey receive only aggregated, anonymised results, subject to minimum group size thresholds (k-anonymity). These results contain no individual-level information and cannot be used to identify respondents.

We do not sell personal data or share it for marketing purposes.

Data retention and generalisation

We retain raw response data for a maximum of 12 months after the survey closes, to allow for analysis and quality assurance.

After this period, raw data is generalised for longitudinal research purposes. Generalisation includes measures such as truncating postal codes to a broader area, grouping small organisational units into larger categories, rounding commute distances into bands, and removing or generalising free-text responses. We assess that, following generalisation, the data no longer relates to identifiable individuals, taking into account the means reasonably likely to be used, in accordance with Recital 26 GDPR.

Generalised data is retained for as long as it is needed for longitudinal analysis. Aggregated results in published reports are retained indefinitely, as they contain no individual-level information.

We review stored data at least annually.

Storage and security

Survey data is stored by a third-party hosting provider acting as our data processor under a Data Processing Agreement (DPA). Data is hosted on servers within the European Union, using infrastructure provided by Amazon Web Services (AWS) in EU regions.

Data is encrypted at rest using AES-256 and in transit using TLS 1.2. Access controls, audit logging, and regular security testing (including third-party penetration testing) are in place.

No routine access to survey data occurs from outside the EU. Our hosting provider has entered into Standard Contractual Clauses (SCCs) and its key infrastructure sub-processors are certified under the EU-U.S. Data Privacy Framework. Should any transfer to a third country become necessary, we ensure appropriate safeguards are in place in accordance with Chapter V of the GDPR.

Cookies and local storage

We do not use tracking cookies or third-party analytics. Browser local or session storage may be used to preserve your progress during a survey session but is not used to identify you.

Your rights

Under GDPR you have rights including access, rectification, erasure, restriction, portability, and the right to object (Article 21). If you wish to object, the simplest approach is not to submit the survey — no data is recorded until you complete it.

Because we cannot identify individuals in the dataset after submission, these rights are limited in practice under Article 11 GDPR. If we cannot identify you, we are not required to process additional information solely to do so (Article 11(2)). If you can provide information enabling us to locate your responses, we will make reasonable efforts to help.

The Swedish data protection authority is Integritetsskyddsmyndigheten (IMY) at imy.se. You have the right to contact them if you have concerns about how your data is handled.

Other information

Our surveys are intended for respondents aged 16 or older. We may update this policy from time to time; the latest version is always available at travalytics.io/privacy-policy-survey.

Contact

Travalytics AB, 559527-2468

Raffinadgatan 2, 222 35 Lund, Sweden

hello@travalytics.io