Privacy Policy

Who we are

This Privacy Policy explains how Bullraibyn Resort, Bullraikajen 1, 131 54 Nacka, Stockholm, Sweden ("Bullraibyn", "we", "us" or "our") processes personal data about guests, visitors to our resort and users of this website. We are the data controller for the processing described here. You can contact us about any privacy matter at privacy@bullraibyn.com or by post at the address above, marked for the attention of our Data Protection Officer.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the Swedish Data Protection Act and other applicable laws. Additional information for residents of California is set out in our GDPR, CCPA & Cookies Policy.

Personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

• Identity and contact data: name, title, postal address, email address, telephone number and nationality.
• Booking and stay data: arrival and departure dates, room preferences, number of guests, special requests, dining and spa reservations, and correspondence with our team.
• Payment data: payment card type and the last four digits of the card, billing address and transaction history. Full card numbers are handled by our certified payment service providers and are not stored by us.
• Identification data: where legally required, details from a passport or national identity card, including date of birth, for hotel registration, age verification for adult venues and gaming salons, and anti-money-laundering checks.
• Preference and wellbeing data: dietary requirements, allergies and, for spa guests, health information you choose to provide in a treatment questionnaire.
• Responsible gambling data: records of voluntary limits, cooling-off periods and self-exclusion requests.
• Website and enquiry data: information you submit through our contact form and basic technical data such as IP address, browser type and the pages requested, as recorded in standard server logs.
• CCTV images: recorded in public areas, entrances and gaming salons for safety, security and regulatory compliance.

How we collect personal data

We collect personal data directly from you when you make an enquiry or booking, check in, use our services, sign up for updates, or contact us. We may also receive data from travel agents, tour operators or companies booking on your behalf, and from our payment providers. Where the law requires it, we verify identity documents presented at the resort.

How we use personal data and our legal bases

We use personal data only where we have a lawful basis to do so:

Purpose	Legal basis
Managing enquiries, reservations, stays, dining, spa and theatre bookings	Performance of a contract or steps prior to entering into one
Hotel guest registration, accounting and tax records	Legal obligation
Age verification, identity checks and anti-money-laundering procedures for gaming salons	Legal obligation
Responsible gambling measures, including self-exclusion	Legal obligation and, where applicable, consent
Health information for spa treatments and allergy information for dining	Explicit consent
Safety and security, including CCTV	Legitimate interests and legal obligation
Improving our services and website	Legitimate interests
Sending news and offers by email	Consent, which you may withdraw at any time

We never use personal data to target gambling marketing at people who have self-excluded or who show signs of harm, and we never send gambling-related marketing to anyone under 18.

Sharing personal data

We do not sell personal data. We share it only where necessary with:

• service providers acting on our behalf, such as IT hosting, reservation systems, payment processors and professional advisers, under written data processing agreements;
• public authorities, including tax, police and gambling regulators, where we are legally required to do so;
• travel agents or companies who made a booking for you, to the extent required to manage that booking;
• a successor organisation in the event of a merger, acquisition or reorganisation, subject to equivalent protections.

International transfers

We primarily store data within the European Economic Area. Where a service provider processes data outside the EEA, we ensure an adequate level of protection through an adequacy decision of the European Commission or the Commission's Standard Contractual Clauses, supplemented by additional safeguards where necessary.

How long we keep data

We keep personal data only for as long as necessary for the purpose for which it was collected. As a guide: booking and stay records are kept for up to three years after your stay; accounting records for seven years as required by Swedish bookkeeping law; anti-money-laundering records for at least five years; spa health questionnaires for twelve months after your last treatment; self-exclusion records for the duration of the exclusion plus any period required by law; and CCTV footage for up to thirty days unless needed for an investigation. Contact form messages are deleted within twelve months unless they lead to a booking.

How we protect your data

We apply appropriate technical and organisational security measures, including encryption in transit and at rest, role-based access controls, multi-factor authentication for staff systems, regular security testing, staff training and confidentiality obligations. Payment card processing is carried out by providers certified under the Payment Card Industry Data Security Standard. No system is entirely secure, but we continually review our safeguards and will notify you and the supervisory authority of any personal data breach where required by law.

Your rights

Subject to the conditions set out in law, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased where there is no longer a legal reason to keep it;
• restrict or object to processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time without affecting earlier processing;
• object at any time to direct marketing.

To exercise any right, email privacy@bullraibyn.com. We will respond within one month and may ask you to verify your identity. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or with the supervisory authority in your country of residence.

Children

This website and our adult venues are not directed at people under 18. Children may stay at the resort with a parent or guardian, who provides any necessary information on their behalf. We do not knowingly collect personal data from children through this website.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in law or in our services. The date at the top and bottom of this page shows when it was last updated. Significant changes will be highlighted on our website.