1. Who we are
Manecab is provided by Naxdor, Linjegatan 3D, 302 50 Halmstad, Sweden ("we", "us"). The business registration number is provided when entering into an agreement. Questions about personal data: kontakt@manecab.se.
2. Two roles — controller and processor
For data that taxi companies enter into the service (data about drivers, employees, shifts and bookings), the taxi company is the data controller and we are the processor. That processing is governed by our data processing agreement, not by this policy.
This policy covers processing where we are the controller: visits to this website, registration and administration of customer accounts, and support contacts.
3. This website
The manecab.se website sets no cookies and uses no analytics or tracking. Our hosting provider (Vercel Inc.) keeps technical server logs (including IP address, timestamp, requested URL and browser type) for operations and security. On the plan we use, the logs are kept for at most one day and are then deleted automatically by the provider — legal basis: legitimate interest (Art. 6(1)(f) GDPR).
4. Data we process as controller
- Account registration:name, email address, phone number and company details for the person who enters into and administers the customer account. For a sole trader the organisation number given is the proprietor's personal identity number. Purpose: to enter into and perform the Manecab agreement and to administer the account. Legal basis: contract (Art. 6(1)(b)) where the customer is a natural person or a sole trader; otherwise our and the customer company's legitimate interest (Art. 6(1)(f)) in being able to enter into, administer and perform the agreement with an identifiable contact person. Data about drivers and employees that the customer itself enters into the service is processed by us as processor — see the data processing agreement.
- Support and contact: correspondence you send us and details of the matter. Purpose: to receive, answer and follow up support and contractual enquiries and to be able to show what was agreed. Legal basis: legitimate interest (Art. 6(1)(f)) — our legitimate interest in being able to support our customers and to handle and document enquiries.
- Billing (once the paid service launches): invoicing and payment details. Legal basis: contract and legal obligation (the Swedish Bookkeeping Act).
Are you obliged to provide the data? The data under Account registration is necessary for us to enter into and perform the Manecab agreement — without it no account can be created and the agreement cannot be concluded. Invoicing and payment data must be processed under the Swedish Bookkeeping Act (1999:1078) so that we can invoice and keep accounts; without it the service cannot be provided against payment. Data you provide in support matters is voluntary, but without it we cannot answer the enquiry.
5. Recipients
We use a small number of vendors that process personal data on our behalf as our processors: Vercel Inc. (hosting, EU), Neon Inc. (database, EU), Cloudflare Inc. (file storage, EU), Resend/Plus Five Five Inc. (transactional email, USA) and Functional Software Inc./Sentry (error monitoring, EU). When the paid service launches a payment provider will be added (planned: Stripe). Data may also be disclosed to our accounting consultant and to public authorities where the law requires it. The same vendors are engaged as sub-processors in our processor role — regions and transfer mechanisms are set out in the table in the data processing agreement. We never sell personal data.
6. Third-country transfers
Regular processing takes place within the EU. Our email provider Resend (Plus Five Five Inc.) stores email content and logs in the United States. Cloudflare Turnstile (Cloudflare, Inc.) receives the visitor's IP address when public forms are protected against spam. Our other vendors process the data within the EU, but support and operations access from the United States may occur. These transfers rely on the EU-U.S. Data Privacy Framework and/or the European Commission's standard contractual clauses (Decision 2021/914) — see the table in Section 7 of the data processing agreement. A copy of the standard contractual clauses and details of the vendors' current DPF certification are provided free of charge on request to kontakt@manecab.se; the standard text of the clauses is published at eur-lex.europa.eu and certifications can be checked at dataprivacyframework.gov.
7. Retention
- Account data: for the duration of the agreement.
- When a customer relationship ends: a complete export is delivered to the customer, after which all data is deleted no later than 90 days after termination — see Section 10 of the data processing agreement.
- Our own accounting records (our invoices to customers): preserved until the end of the seventh year after the end of the calendar year in which the financial year ended, under Chapter 7, Section 2 of the Swedish Bookkeeping Act (1999:1078) — in practice up to approximately eight years from the invoice date. During that time the data cannot be erased on request (Art. 17(3)(b) GDPR).
- Support and contact correspondence: 24 months after the matter is closed, or longer where the correspondence is needed to establish, exercise or defend legal claims.
- Enquiries from prospects who do not become customers: deleted no later than 12 months after the last contact.
8. Your rights
You have the right to request access to your personal data, rectification, erasure, restriction of processing and data portability. Contact kontakt@manecab.se.
Right to object: you have the right at any time to object to processing based on our legitimate interest (Art. 6(1)(f)) — this covers the server logs under Section 3 and the support correspondence under Section 4. If you object, we will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests.
In the processing where we are the controller we take no automated decisions producing legal effects concerning you or similarly significantly affecting you, and we carry out no profiling (Art. 22 GDPR). Per-driver and per-vehicle follow-up in the service takes place under the taxi company's responsibility as controller. The anomaly flags the service shows in shift reports are decision support for the employer — no decision is taken automatically by the system.
You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, imy@imy.se, www.imy.se.
9. Changes
We may update this policy; the date at the top shows the current version. Material changes are communicated to account holders.