Last updated: 8 October 2026

This privacy policy explains how FulleRulle handles your personal data when you visit fullerulle.se, contact us or book a tour. We follow the EU General Data Protection Regulation (GDPR) and Swedish law, including the Swedish Data Protection Act (lag 2018:218).

1. Who is responsible for your data

The data controller is FulleRulle, Mogatan 6, 942 95 Vidsel, Sweden.

Email: info@fullerulle.se
Telephone: +46 (0) 73 256 47 41
For The Vault and The Arctic Hideout: vault@fullerulle.se

2. What data we collect

When you contact us by the contact form, email, telephone or WhatsApp: your name, email address, telephone number and your message.

When you book, depending on the tour:

First and last name, date of birth and country of residence of each guest
Telephone number and email address of the lead guest
Confirmation that each driver holds a valid category A or B driving licence
Your dates, airport and flight times, if we collect you
Payment and invoicing details
Email address of each guest, if the person making the booking gives it to us for the thank-you message after the tour. If a guest has no email address, nothing is stored and nothing is sent
If you choose to tell us how you ride, for example your background in rally or motocross: we use it only to plan your route and show it to your guide

Health information. For longer stays we ask about allergies and about joint, back or bone conditions, so that we can plan meals and activities safely. This is sensitive data under the GDPR. We only process it with your explicit consent, and you may withdraw that consent at any time.

Children. Data about guests under 18 is given to us by a parent or guardian.

When you visit the website: technical data such as your IP address, browser type and the pages you visit. Cookies for statistics and advertising are only used if you accept them in the cookie banner.

3. Why we use your data, and on what legal basis

To answer your questions and prepare an offer: steps before a contract (GDPR art. 6.1 b).
To carry out your booking, plan your tour and keep you safe: performance of the contract (art. 6.1 b).
To plan around allergies and health conditions: your explicit consent (art. 9.2 a).
To send each guest one thank-you message about seven days after the tour, with a link to write a review on Google: our legitimate interest in asking our guests for feedback (art. 6.1 f). You can object at any time by writing to info@fullerulle.se.
To keep booking details for three years, so that we can answer questions and complaints and handle legal claims: our legitimate interest (art. 6.1 f).
To keep accounting records: legal obligation under the Swedish Bookkeeping Act (art. 6.1 c).
To protect the website against spam and misuse, for example with reCAPTCHA on the contact form: our legitimate interest (art. 6.1 f).
Website statistics, advertising and marketing messages: your consent (art. 6.1 a), which you can withdraw at any time.

4. How long we keep your data

Health and allergy information, flight details and other notes, how you ride, and the dates of birth of guests: deleted 90 days after the end of your tour at the latest.
Name and contact details of the person who booked, and the names of the guests: deleted 3 years after the end of your tour. We keep them this long so that we can answer questions and complaints and handle legal claims.
Enquiries through the contact form or the tour builder without a booking: deleted 90 days after our last contact.
Gift card details of the buyer and the recipient: deleted 3 years after the card is used or expires.
Guest email addresses for the thank-you message: deleted right after we send the message, and in any case no later than 90 days after the end of your tour.
Accounting records, such as invoices and receipts: kept for 7 years after the end of the calendar year, as the Swedish Bookkeeping Act (bokföringslagen) requires. This includes payment records (amount, order number and status), which do not contain the name or card details of the payer.
Data based on consent: kept until you withdraw your consent.

5. Who receives your data

We do not sell your data. We share it only when it is needed to provide our service or when the law requires it:

Partners who provide part of your stay, such as the owners of the houses we book for you. They receive only what they need, for example the name of the lead guest and your dates.
Service providers who work on our behalf: website hosting, email and payment handling.
Google, for the contact form spam check (reCAPTCHA), website statistics through Google Tag Manager (only with your consent) and the fonts used on the website.
GTranslate, which provides the language switch on the website.
Public authorities, when Swedish law requires it.

6. Transfers outside the EU

Some providers, such as Google, may process data in the United States. Such transfers rely on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses.

7. Photographs

We publish photographs of guests only with their consent. Guests of The Vault and The Arctic Hideout are never photographed for publication.

8. Your rights

Under the GDPR you have the right to:

see the data we hold about you, and receive a copy
have incorrect data corrected
have your data deleted, unless the law requires us to keep it
restrict or object to our use of your data
receive your data in a machine-readable format
withdraw your consent at any time, without affecting earlier processing

To use any of these rights, write to info@fullerulle.se. We reply within one month.

If you believe we handle your data incorrectly, you may complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY): imy.se.

9. Security

The website uses an encrypted connection (HTTPS). Access to booking information is limited to the people who need it to run your tour.

10. Changes to this policy

We may update this policy. The current version is always published on this page, with the date of the latest change at the top.

Privacy Policy