Privacy policy – Caroli Trafikskola
Last updated: 30 October 2026
Who is responsible for your personal data?
Caroli Förarutbildning AB is the controller of the personal data we process when you buy from our online shop, book training or are a student with us. Here we explain which data we collect, why, how long we keep it and your rights under the General Data Protection Regulation (GDPR).
|
Company |
Caroli Förarutbildning AB (Caroli Trafikskola) |
|
Company registration number |
556965-5938 |
|
Address |
Mäster Nilsgatan 20, 211 26 Malmö |
|
Telephone |
040-656 60 60 |
|
|
Which personal data do we process?
We collect data directly from you when you make a purchase, book or contact us.
- Identity and contact details: name, Swedish personal identity number or coordination number, address, email address and phone number.
- Purchases and training: orders, payments, gift cards, booked lessons and courses, and your training progress.
- Communication: questions and messages sent by form, email, phone, chat or text message.
- Technical information: IP address and similar information generated when you use our website.
- Photos: only if you have agreed to us taking and using photos of you.
We need your identity and contact details for you to make a purchase and attend training with us. Without them, we cannot accept your order or register you with Transportstyrelsen.
Why do we process your personal data?
Each purpose has a legal basis under Article 6 of the GDPR.
|
Purpose |
Legal basis |
|
Managing purchases, payments, gift cards and delivery of training |
Contract |
|
Booking lessons and courses and following your training progress |
Contract |
|
Reporting to Transportstyrelsen, for example completed risk training |
Legal obligation |
|
Bookkeeping and receipts |
Legal obligation (the Swedish Bookkeeping Act) |
|
Answering questions and providing customer service |
Legitimate interest |
|
Sending newsletters and offers to you as a customer |
Legitimate interest – you can opt out at any time |
|
Improving our services, systems and security |
Legitimate interest |
|
Using photographs of you in marketing |
Consent |
About Swedish personal identity numbers
We process your Swedish personal identity number because this is clearly justified for reliable identification, as required by Chapter 3, Section 10 of the Swedish Data Protection Act. We need it to register your training with Transportstyrelsen, ensure that the right student receives the right training, and check gift cards and campaign benefits per student. Your personal identity number is not shown to unauthorised persons and is not used for marketing.
Who do we share your personal data with?
We never sell your personal data. We only share it when necessary for the purposes described above.
- Public authorities: Transportstyrelsen (the Swedish Transport Agency) and other authorities when required by law.
- Suppliers (data processors): companies that help us with online sales, payments, booking systems, IT services, email and text messages. They may only process your data according to our instructions and have agreements with us.
- Payment service providers: when you pay, the payment provider processes your data under its own terms.
We aim to process data within the EU/EEA. If a supplier processes data outside the EU/EEA, we ensure that the transfer has a basis under the GDPR, for example the European Commission's standard contractual clauses.
How long do we keep your personal data?
We keep data for as long as needed for its purpose and then delete it.
|
Data |
Retention period |
|
Student and training records |
During training and for 2 years after the last activity |
|
Accounting records, such as receipts and invoices |
7 years after the end of the financial year (the Swedish Bookkeeping Act) |
|
Gift cards |
The card’s validity period plus the time required for accounting |
|
Marketing |
Until you opt out, but no longer than 2 years after your latest purchase |
|
Photographs |
Until you withdraw your consent |
|
Customer service matters |
2 months after the matter is closed |
Your rights
You have the right to:
- know what data we hold about you and receive a copy (a subject access request)
- have inaccurate data corrected
- have data erased when it is no longer needed or has no legal basis
- restrict processing in certain circumstances
- object to processing based on legitimate interest – you can always object to marketing
- receive data you have provided to us in a machine-readable format (data portability)
- withdraw consent at any time, without affecting processing that has already taken place
Contact us at E-post or by post. We may need to confirm your identity before providing data. We respond within one month.
If you are unhappy with how we process your personal data, you can complain to Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection, www.imy.se.
Cookies and changes
Our separate cookie policy explains how we use cookies. We may update this privacy policy. The latest version is always available on our website, and we will inform you of significant changes.