Last updated: Oct 21, 2026
In short: We use your personal data to book your journey, deliver your tickets and help you if your plans change. We share passenger details with the train and bus companies that issue your tickets. Our own systems are hosted in the EU, and we never sell your data.
All Aboard AB is the controller of the personal data described in this policy. This means we decide why and how that data is used.
All Aboard is a booking platform for train and bus travel in Europe. We do not operate any trains or buses. Each journey is operated by a carrier under its own conditions of carriage.
Bookings made directly with us. This policy applies to everything we do with your personal data when you search, book, pay or contact us on allaboard.eu or through our own booking tools.
Bookings made through a travel agent. Many travel agents and other businesses book through our API, dashboard or booking widgets. For these bookings, the agent decides how your data is used and we process it on the agent's behalf. The agent's privacy policy applies, and you should contact the agent first with any questions. We remain the controller for a small number of activities that we carry out for our own purposes, and this policy covers them:
Most of the data we hold comes from you when you make a booking or contact us. Some of it comes from carriers, from our payment provider or from the travel agent you booked through.
We need your contact, passenger, booking and payment details to complete a booking. Without them, we cannot book or issue your tickets.
We use your data only for specific purposes, and each purpose has a legal basis under the General Data Protection Regulation (GDPR).
To perform our contract with you (Article 6(1)(b) GDPR)
With your consent (Article 6(1)(a) GDPR, and Article 9(2)(a) GDPR for assistance needs)
For our legitimate interests (Article 6(1)(f) GDPR)
To comply with the law (Article 6(1)(c) GDPR)
Where we rely on consent, you may withdraw it at any time. Where we rely on our legitimate interests, we have weighed those interests against your right to privacy, and you have the right to object (see section 11).
We do not sell your data, and we do not use it to train AI models.
Stripe automatically screens every card payment for fraud and may decline a payment it considers high risk. If your payment is declined, contact us and a member of our team will review it.
Information about a disability or a need for assistance is a special category of personal data under the GDPR. We collect it only when you ask us to book wheelchair space or other assistance, and only with the explicit consent we ask for at that point.
We use this information for one purpose only: to pass it to the carriers on your route so that they can provide the assistance. We delete it 12 months after your last travel date (see section 9). You may withdraw your consent at any time. We then delete the information unless we need it for an ongoing claim, and the carrier may be unable to provide the assistance.
When you book for other people, you give us their names and other passenger details. Please make sure they know that you are sharing their details with us, and refer them to this policy. They have the same rights as you under section 11.
Companies that need your data for your journey. These companies use your data as independent controllers under their own privacy policies.
Service providers that work for us. These providers process your data on our behalf and may only use it in accordance with our instructions.
Authorities and legal matters. We disclose data to the police, courts and other public authorities where the law requires us to do so. We may also share data with insurers, professional advisors or opposing parties where this is necessary to establish, exercise or defend a legal claim.
Business transfers. If All Aboard merges with or is acquired by another company, your data may be transferred to the new owner, who will continue to handle it in accordance with this policy.
Our own systems and database are located in the EU. Some of your data is nevertheless transferred outside the EU/EEA. Stripe, Postmark and Loops process data in the United States, and carriers outside the EU/EEA receive passenger details when your journey takes you there. Each transfer is protected by one of the following safeguards:
You can ask us for a copy of the safeguards that apply to your data.
We keep personal data only for as long as we need it for the purpose for which it was collected. After that, we delete or anonymize it.
If a dispute, chargeback or legal claim is ongoing, we keep the data we need until it has been resolved.
We do not use advertising cookies or cookies that track you across other websites.
Our website statistics come from Plausible, which uses no cookies and does not identify individual visitors.
We only use cookies and similar technologies that are strictly necessary for our services to work:
Our newsletter emails contain a small image that tells us whether an email has been opened, and links that tell us whether they have been clicked. You can prevent this by blocking images in your email program or by unsubscribing.
Under the GDPR, you have the right to:
To exercise any of these rights, email security@allaboard.eu. There is no charge. We will reply within one month. If your request is complex, we may need up to two further months, and in that case we will tell you why within the first month. We may ask you to confirm your identity before we act on your request.
If you booked through a travel agent, please contact the agent first. We will forward any request we receive that concerns a booking made through an agent.
If you are unhappy with how we handle your personal data, please contact us first. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or with the data protection authority in the country where you live or work.
We receive children's data when an adult books a journey for them. We do not knowingly allow children to make bookings themselves.
We update this policy when our services or the law change. The date at the top shows when it was last updated. If a change materially affects how we use your data, we will notify you by email or on our website before the change takes effect.
All Aboard AB
Kivra 559214-7671
106 31 Stockholm, Sweden
security@allaboard.eu