Privacy Policy

1.1 Thank you for choosing Bahn Express. This privacy policy explains how we collect, use, share, and protect your personal data when you use our Services.

1.2 We at Bahn Express (hereinafter "Bahn Express" or "us" or "we" or "our") are committed to your privacy. We go to the best possible extent to protect your data and keep it private and secure when you use our Services.

1.3 Our Service utilizes a pool of freelance and light entrepreneurs as drivers to transport vehicles internationally. Data related to assignments, such as schedules and compensation, is shared with drivers who are free to accept tasks without a minimum or maximum limit.

1.4 For the purposes of this Privacy Policy, "Service" refers to the comprehensive suite of operations provided by our company, which includes the international transportation and relocation of vehicles, the facilitation of driving assignments for drivers and the delivery of cars to customers. This encompasses all related logistical, information processing, and operational aspects necessary to execute these activities efficiently and effectively.

1.5 Data we may collect within the scope of our Service are with the purpose of providing best solutions, personalized experience and to continuously improve our Services. This privacy policy applies to the collection, processing, and disclosure of personal data for customer and driver account management, marketing, and sales of Services, customer, and driver agreements and when you use our Services, including our mobile application, or visit our website.

2.1 We collect data to provide our Services to you. Primarily we use the information you have provided to us. Additionally, we may collect information from publicly available sources, such as business information services, to assist us in this process, provide insights, and extend offers from our third-party service providers.

2.2 Customer Information: We collect and process personal information such as names, emails, and phone numbers of our customers, who primarily consist of car dealerships and car resellers. This information is essential for facilitating communication, primarily through WhatsApp, and managing orders via our platform. Customer data is stored in a third-party platform, where information of car dealerships is maintained.

2.3 Driver and Transport Manager Information: For drivers, transport managers, and fleet managers, we collect names, phone numbers, email addresses, and birth dates. This information is essential for facilitating communication and managing assignments through our platform and mobile application. Additionally, we may collect drivers' social security numbers for payment processing, driver's license information to verify driving eligibility, passport copies for specific purposes, for example when car dealerships request driver identification, and criminal record extracts to validate driver suitability.

2.4 The personal data we collect includes, but is not limited to the following categories:

• Basic information, such as name and contact details, e.g. email address and phone number;
• information relating to our relationship, such as Services and order details, contract information, payment details, billing information, and your relation to a company you represent;
• marketing and communication data e.g., your interests and preferences, selections, marketing permissions, and prohibitions;
• your interaction and related records such as correspondence, your comments, or responses to our surveys;
• personal data generated while visiting our website through cookies or otherwise, and how you use the website;
• driver location data collected through tracking devices or our mobile application during active assignments for operational, logistical, and regulatory purposes. Location data is also used (i) in identifiable form for the handling of customer claims or legal proceedings, and is retained for this purpose for twelve (12) months following the completion of each assignment; and (ii) in anonymised and aggregated form for analytics purposes to enhance and improve our Services;
• data generated through the use of our mobile application, including user account information, device information, and photographs taken in connection with assignments;
• other travel and logistics information, including flight arrangements and related booking data (which may include passport information) shared with relevant parties to facilitate transportation services, criminal record extracts collected for the purpose of validating driver suitability, where permitted by applicable law or contractual obligations; and
• other data, which is based on your consent and defined in detail on a case-by-case basis.

2.5 We may collect and use aggregated data for any purpose, where individual person is not identified from e.g., statistical data collected in connection with the provision of Services.

3.1 We may market and inform you about our Services. We may combine the personal data collected about you from publicly available sources, and from our different interactions with you. Furthermore, your personal data may also be used for market research and customer surveys. Processing of personal data is based on our legitimate interest to collect and analyse relevant information to better understand our customers and develop relevant services.

3.2 Based on your consent we may store and access information, including personal data, on your device in order to create personalized ads profile and deliver relevant content at the website (e.g., information and ads about the Services) as well as to measure the effectiveness of the advertising. Respectively, your personal data may also be processed to develop and improve the website, or for developing our own or our partners' services.

4.1 The purposes for which we process your data are:

• To provide and keep you updated on our transportation Services;
• To provide customer support;
• To gather analysis or valuable information so that we can improve our Service;
• To ensure the security of vehicles during transportation, drivers may be equipped with location-tracking devices or a mobile application to monitor the live location of vehicles during active assignments. Location data may also be used for the handling of customer claims or legal proceedings. In addition, anonymised and aggregated location data may be used for analytics purposes to enhance and improve our Services; and
• To provide you with news, special offers and general information about other goods, services, and events which we offer that are similar to those that you have already purchased or enquired about unless you have opted not to receive such information.

4.2 We may process your personal data also for specific purposes if you have consented to such processing.

5.1 We process your personal data for the performance of an agreement to provide our Services to you, or our processing is based on legitimate interest in providing quality services to our customers, to improve our Services, and to comply with legal obligations. For direct marketing purposes, the legal basis for processing personal data is consent, which you may cancel any time.

5.2 The processing of location data is based on the necessity of executing our contractual obligations and on our legitimate interest in protecting our legal rights and interests, including the handling of customer claims and legal proceedings, and to manage logistics. For these purposes, location data is retained in identifiable form for twelve (12) months following the completion of each assignment. In addition, location data is anonymised and processed in aggregated form for analytics purposes to enhance and improve our Services. As anonymised data does not constitute personal data, such processing falls outside the scope of data protection legislation.

6.1 When you visit our website, cookies and other similar technologies ("Cookies") may be used to automatically collect information about your visit. It is possible for you to accept or refuse the use of the Cookies. You can manage your consent preferences through the cookie banner on our website.

6.2 Cookies are files with small amount of data which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your device. Tracking technologies also used are beacons, tags, and scripts to collect and track information and to improve and analyse our Service.

6.3 If the Cookies are collected, you have the option to disable them through the cookie banner or clear your Cookie history for all visited websites via your browser settings.

6.4 Accepting Cookies will enable you to get the best from our website. If you refuse Cookies, some aspects of the website may not work on your device, and you may not be able to access all areas thereof.

7.1 We may share your personal data with third-party service providers who assist us in providing our Services. These may include intermediaries who assist us in finding suitable light entrepreneurs to facilitate our Services. We may also share personal data with service providers for accounting, customer relationship management, communication, and analytics purposes. We may also disclose your personal data to comply with legal obligations or protect our legal interests.

7.2 Customer and driver information may be shared with international car dealerships, as necessary. International dealerships may require confirmation from both the seller and the buyer.

7.3 Location data collected during active assignments is stored securely and is accessible only to authorized personnel who require this information to fulfil their job responsibilities. During active assignments, this data may be reviewed in real-time when necessary, for example, when there is a good reason to believe that a vehicle is being used against instructions or is missing. Following the completion of an assignment, location data is retained in identifiable form for a period of twelve (12) months to enable the handling of customer claims or legal proceedings. After this retention period, the identifiable location data is securely deleted. Separately, location data is anonymised so that it is no longer attributable to an individual driver and may be used in aggregated form for analytics purposes to enhance and improve our Services. We ensure that this data is minimized, handled in compliance with our privacy practices and any applicable legal requirements.

8.1 The data we collect is processed by us within the European Union (EU)/European Economic Area (EEA) and in third party data processing facilities within the EU/EEA.

8.2 Some of our service providers may have access or are located outside the EU/EEA and their processing of your personal data will involve a transfer of data outside of EU/EEA. We will take necessary steps to provide appropriate safeguards for international data transfers and to the extent necessary implement supplementary measures for protection of personal data as required by applicable laws. Personal data is transferred only to countries that have been deemed to provide an adequate level of protection of personal data, and where not we will implement the standard contractual clauses and implement necessary technical, organisational, or contractual supplementary measures to ensure that personal data has the same protection as in EU/EEA.

9.1 We will retain your personal data only for as long as necessary to provide Services to you, and for one (1) year after that, or as long as required by law as different data categories have different retention periods. For drivers who have registered but have not completed any assignments, or where twelve (12) months have elapsed since the driver's last completed assignment, personal data will be securely deleted unless a longer retention period is required by law. After the applicable retention period, we will securely dispose of your personal data.

9.2 To comply with our data minimization practices, the following data category-specific retention rules apply: (a) social security numbers are securely deleted once the relevant payment account has been created with the light entrepreneur service provider; (b) driver's license information is deleted upon completion of the relevant assignment; (c) passport copies are deleted immediately after identity verification has been completed; (d) criminal record extracts are deleted once the driver's suitability has been confirmed; (e) location data is retained in identifiable form for twelve (12) months following the completion of each assignment to enable the handling of customer claims or legal proceedings, after which the identifiable data is securely deleted. Separately, location data is anonymised so that it is no longer attributable to an individual driver and may continue to be used in aggregated form for analytics purposes; and (f) photographs of vehicles are retained only for the duration necessary to fulfil the purpose of the relevant assignment. Other personal data may be retained as required for continued use according to what is stated above.

10.1 You have certain rights regarding your personal data:

• 10.1.1 Right to Access: You have the right to access your personal data that we hold.
• 10.1.2 Right to Rectify Personal Data: You have the right to request that we correct any inaccurate or incomplete personal data that we hold.
• 10.1.3 The Right to Object to the Processing: You have the right to object to the processing of your personal data for certain purposes.
• 10.1.4 The Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• 10.1.5 The Right to Be Forgotten: You have the right to request that we erase your personal data under certain circumstances.
• 10.1.6 The Right to Restriction of the Processing: You have the right to request that we restrict the processing of your personal data under certain circumstances.
• 10.1.7 The Right to Give and Withdraw Your Consent: You have the right to give or withdraw your consent for the processing of your personal data.

11.1 We use the stringent technical measures and best practices within the Platform to ensure the confidentiality, integrity, and availability of data stored within our Service.

11.2 Our platform, including our mobile application, requires authenticated login credentials. Users can review, correct, and delete their personal data or deactivate their accounts. We ensure the security of all data transmitted and stored within our systems using industry-standard encryption methods.

11.3 Hosting and Data Transmission Security: Our platform is hosted within the European Union (Stockholm region). All connections are encrypted.

11.4 Data Storage and Encryption: Data within the Platform is integrated with CRM, which collects data and is integrated into the platform. All data is encrypted to ensure data integrity and availability.

11.5 Although our good faith efforts to store your data in a secure operating environment that is not available to the public, please remember that unfortunately no data transmission or storage is 100% risk free. You provide your personal data at your own risk, and we cannot guarantee the absolute security of your data. In the unfortunate case of a security breach that endangers your privacy or data we will inform you as well as the relevant authorities, as required by law. We may also temporarily shut down services to protect the personal data.

12.1 We may use third parties to facilitate our Service ("Service Providers"), to provide the Service on our behalf, to perform Service-related services or to assist us in analysing how our Service is used.

12.2 These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

13.1 We may update this privacy policy from time to time. We will notify you of any significant changes by posting a notice on our website or by sending you an email.

14.1 If you have any concerns or questions about this privacy policy or our use of your personal data, please feel free to get in touch with us at privacy@bahnexpress.fi.

14.2 This Privacy Policy has been updated on 15th of April 2026.