GDPR, CCPA & Cookies Policy

Summary

This policy supplements our Privacy Policy and applies to everyone who visits this website or interacts with Bullraibyn Resort, Bullraikajen 1, 131 54 Nacka, Stockholm, Sweden.

GDPR disclosures for EU and EEA residents

Bullraibyn Resort is the data controller of personal data processed through this website and at the resort. We process personal data on the legal bases described in our Privacy Policy: performance of a contract, compliance with a legal obligation, our legitimate interests, and your consent where required.

Your GDPR rights

• Right of access to a copy of your personal data and information about how it is processed.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure where data is no longer needed, consent is withdrawn or processing is unlawful.
• Right to restriction of processing in certain circumstances.
• Right to data portability for data you provided to us, processed by automated means on the basis of consent or contract.
• Right to object to processing based on legitimate interests and, at any time, to direct marketing.
• Rights relating to automated decision-making: we do not make decisions producing legal or similarly significant effects based solely on automated processing.
• Right to withdraw consent at any time.
• Right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten) or your local supervisory authority.

Requests can be made to privacy@bullraibyn.com and will be answered within one month, extendable by two further months for complex requests, in which case we will tell you why.

CCPA and CPRA disclosures for California residents

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the "CCPA") gives you specific rights regarding your personal information.

Categories of personal information collected

In the preceding twelve months, and in connection with enquiries and bookings, we may have collected: identifiers (such as name, email and phone number); customer records (such as billing address and booking details); commercial information (such as services purchased); internet or network activity limited to standard server logs; audio or visual information (CCTV at the resort); and sensitive personal information limited to government identification for legally required checks and health information you choose to share for spa treatments. We use and disclose these categories only for the business purposes described in our Privacy Policy.

Sale and sharing

We do not sell personal information and we do not share personal information for cross-context behavioural advertising, as those terms are defined in the CCPA. We have not done so in the preceding twelve months. We do not knowingly sell or share the personal information of consumers under 16.

Sensitive personal information

We use sensitive personal information only for purposes permitted under the CCPA, such as verifying identity and age, complying with law and providing the services you request. We do not use it to infer characteristics about you.

Your California rights

• The right to know what personal information we collect, use and disclose.
• The right to delete personal information, subject to legal exceptions.
• The right to correct inaccurate personal information.
• The right to opt out of sale or sharing, which we honour by default because we do not sell or share.
• The right to limit the use of sensitive personal information.
• The right not to be discriminated against for exercising any of these rights.

How to submit a request

Email privacy@bullraibyn.com or call +46 8 520 270 00. We will confirm receipt within ten business days and respond within forty-five calendar days. We will verify your identity by matching information you provide with information we hold. You may use an authorised agent, who must provide written permission signed by you. We recognise Global Privacy Control signals as a valid opt-out request.

Retention

Retention periods for each category are described in our Privacy Policy.

What cookies are

Cookies are small text files placed on your device by a website. Similar technologies include local storage, pixels and device fingerprinting. Under the EU ePrivacy rules as implemented in Swedish law, websites may store or access information on your device only with your consent, unless it is strictly necessary to provide a service you have requested.

Cookies used on this website

This website has been built without cookies. It contains no analytics tools, no advertising tags, no embedded social media content, no third-party fonts or scripts and no tracking pixels. The 18+ notice is dismissed using a simple on-page control that does not store anything on your device, which is why it may reappear when you load a new page.

If we ever introduce non-essential cookies in future, we will update this policy, change the date shown on every page and ask for your consent before any such cookie is placed.

Controlling cookies

You can manage or delete cookies at any time through your browser settings, and most browsers allow you to block cookies entirely. Because this website does not depend on cookies, blocking them will not affect how it works.

Server logs

Like all websites, our server automatically records basic technical information when a page is requested, including IP address, date and time, the page requested and browser type. These logs are used only to keep the website secure and working, are processed on the basis of our legitimate interests and are deleted after no more than ninety days.

Contact

Questions about this policy can be sent to privacy@bullraibyn.com or by post to Bullraibyn Resort, Bullraikajen 1, 131 54 Nacka, Stockholm, Sweden.