Privacy & cookies
Your details have a job to do: help manage your appointment. Here is how we use them.
Who is responsible
Olleu AB · Sweden
Organisation number: 559345-1031
Svärdsliljegatan 8 A, 722 27 Västerås, Sweden
Olleu AB is the controller of the personal data used by CitaExpress. Privacy contact options.
What we collect and why
Your account email and a password hash provide secure account access. Names, document details, contact details, search preferences and appointment references let us carry out the appointment services you request. We store booking progress, outcomes, notification history and support reports to recover interrupted work and help with problems. You can also save your own appointment date, office, reference and optional notes; these records are encrypted and do not change the official booking.
We process service information to perform our agreement with you, and limited technical and security information for our legitimate interests in operating and protecting the service. We also retain information where required by applicable law. We do not sell personal data or use it for advertising profiles. For reviewed portals that show availability without identity details, we may reuse public times seen within the last five minutes for an equivalent search. This shared information contains the procedure, office and time, never an applicant’s identity, contact details, private portal token or booking reference.
Optional email connection
Gmail connection is currently limited to the private beta. If enabled for your account, Google asks you to authorise mailbox access. We use that access to find appointment-related messages and verification details, and sending access only if granted. The current connection can grant broader inbox permission than a single message; access is not limited by Google to appointment emails. Tokens and stored identity details are encrypted in our database. You can disconnect in Settings or revoke access in your Google account. Connecting Gmail is not required to create a CitaExpress account.
Google data use
CitaExpress uses Google data only for the appointment features you authorize and follows the Google API Services User Data Policy, including Limited Use. Google API Services User Data Policy.
We do not sell Gmail data, use it for advertising or train AI models with it. Human access is limited to your specific permission, security investigations or legal requirements.
Optional phone notifications
If you enable notifications, we store an encrypted browser subscription and send generic updates through your browser’s push provider, such as Apple, Google or Mozilla. Notifications contain no document numbers or appointment references. You can remove connected devices in Settings or revoke permission in your browser. Email remains available.
Who receives information
We submit the details needed for your chosen procedure to the official appointment portal. Hostinger provides hosting, Cloudflare provides domain/DNS infrastructure, forwards messages sent to our public contact addresses and stores encrypted backups in an EU storage region. Google provides email connectivity where enabled. Service email may be sent through our connected Google mailbox. These providers process relevant technical or service information; their processing locations may include countries outside the EEA under their applicable transfer arrangements.
Automated searches follow the dates and permissions you set. They do not decide your nationality application or your eligibility for a public service. You remain responsible for reviewing the official requirements.
Retention and your choices
We retain account and appointment records while they are needed to manage your appointments, resolve unfinished bookings and handle support. Pausing a search does not delete its records. You can ask us to access, correct, export or delete your data, or restrict or object to processing where applicable. Deletion requests are handled manually, subject to unfinished actions and legal retention obligations; rotating backups can retain a copy for up to 14 days. We keep a minimal deletion receipt to prevent a restored backup from reactivating a deleted account.
privacy@citaexpress.es · Download your data in Help & privacy
You may complain to your local data-protection authority, including Spain’s AEPD or Sweden’s IMY. AEPD · IMY
Package payments
Stripe Checkout handles payment details. We send Stripe your account email, chosen package, amount and an order reference. We do not send identity document numbers, grant codes or appointment references. CitaExpress stores the package, payment status, consent and any refund to manage your purchase; full card details are entered on Stripe’s hosted checkout.
Last updated: 18 October 2026.