Orbi Student ID, Sweden

Updated: September 14, 2026 (Effective September 15, 2026)

The Orbi student ID is offered in Sweden only. If you don't hold or apply for one, this page does not affect you, except for the "Data from CSN" section below.

The card

A free digital student ID issued by Orbi in the Orbi app. It can display a student travel symbol from Svensk Kollektivtrafik Service AB (SKT) and, when available, from SL. The requirements for the travel symbols are set by SKT and SL, not by Orbi, and are stricter than the requirements for the card itself. You can hold a valid card without qualifying for a travel symbol.

The card is personal and non-transferable. We may withdraw it or a symbol if you no longer qualify, if it was issued on incorrect grounds, or if it is misused.

Personal data

Controller: Ornamental Tree AB, reg. no. 559032-9735, Vallgatan 26, 411 16 Göteborg. Contact: privacy@orbi.io.

What we process: name, date of birth, personal identity number, educational institution, study period and study pace, card number and validity, travel symbols held, and certificates you send us.

Legal basis: performance of the agreement you enter into when you apply for the card (Art. 6(1)(b) GDPR), and legitimate interest for holding the dataset described below (Art. 6(1)(f) GDPR), supported by §15 studiestödsdataförordningen (2009:321). Where you rely on an adjusted study pace we ask for your explicit consent in the app (Art. 9(2)(a) GDPR). Processing your personal identity number is justified under Chapter 3, Section 10 of the Swedish Data Protection Act because the approved sources identify students by that number and no other identifier is reliable enough.

Data from CSN. When you apply, we verify your student status by matching your personal identity number against a dataset delivered to us by CSN under §15 studiestödsdataförordningen. If you have been granted Swedish student finance you may be in that dataset even if you never apply for a card. In that case Orbi acts as CSN's processor for the dataset, holds it only to answer that matching question, and shares it with no one. To have your record suppressed, email privacy@orbi.io.

Where the data is held: within the EU (Google Cloud, Netherlands). Where a subprocessor involves a transfer outside the EU/EEA, Standard Contractual Clauses apply. Personal identity numbers are excluded from analytics, marketing, CRM and error-monitoring tools.

Retention: the CSN dataset is replaced each term. Certificates you send us are kept for at least 6 months and no longer than 24 months after the card has expired, per SKT's requirements. Identity data is kept while you hold a card and deleted or irreversibly anonymised within 12 months after it ends. Accounting records are kept for 7 years as required by law.

Automated decision-making. Whether you qualify for a travel symbol is decided automatically by applying SKT's and SL's requirements to the data above. You can request a human review at privacy@orbi.io.

Your rights: access, rectification, erasure, restriction, objection, portability, withdrawal of consent where consent applies, and human review of automated decisions. We respond within one month, free of charge. You may lodge a complaint with Integritetsskyddsmyndigheten (IMY), imy@imy.se, www.imy.se.