Privacy policy
This policy describes how Växlat processes your personal data when you book with us, are our customer or contact us.
1. Data controller
The data controller is Växlat.
2. Data we process
- name and contact details - addresses where we visit you - details about your bikes and the work we have done, including photos - bookings, invoices and payments - messages between you and us - a necessary cookie for logging in to My bikes We need your name, phone number and email address to receive and carry out your booking.
3. Purposes and legal basis
- Carrying out and administering the services you book: contract. - Invoicing and bookkeeping: legal obligation. - The customer page with your service history: contract and legitimate interest. - Newsletters and offers: consent, which you can withdraw at any time. - Asking for a review after a visit: legitimate interest. - Security and protection against abuse: legitimate interest.
4. How long we keep the data
- Accounting records are kept for 7 years after the end of the financial year they relate to, under the Swedish Bookkeeping Act (bokföringslagen). - Customer and service history is kept for as long as you are our customer. If you have not been a customer for 36 months, we review the data and delete what is no longer needed.
5. Recipients
- Heading AB (HDNG) runs the booking system for us as a data processor, on servers within the EU. - Emails are sent via Scaleway (France). - Our accounting system, if one is connected. - The OpenStreetMap Foundation (United Kingdom) receives visit addresses, without names, when we plan routes and look up where the addresses are. The United Kingdom is covered by an EU adequacy decision. Apart from the recipients above, no data is transferred to countries outside the EU/EEA. We never sell your data.
6. Your rights
You have the right to access your data and to have incorrect data rectified. You can also ask us to erase your data or to restrict its processing, object to the processing and receive your data in a machine-readable format (data portability). You can always withdraw a consent. Contact us.
7. Complaints
You can lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se.
8. Cookies
We only use necessary cookies: for logging in, for your language choice and for remembering an association's or company's access code to its service days. No cookies for tracking or marketing.
Last changed: 2026-10-17.