Privacy policy – Caroli Trafikskola
Last updated: 30 October 2026
Who is responsible for your personal data?
Caroli Förarutbildning AB is the controller of the personal data we process when you buy from our online shop, book training or are a student with us. Here we explain which data we collect, why, how long we keep it and your rights under the General Data Protection Regulation (GDPR).
Which personal data do we process?
We collect data directly from you when you make a purchase, book or contact us.
- Identity and contact details: name, Swedish personal identity number or coordination number, address, email address and phone number.
- Purchases and training: orders, payments, gift cards, booked lessons and courses, and your training progress.
- Communication:
questions and messages sent by form, email, phone, chat or text message.
- Technical information: IP address and similar information generated when you use our website.
- Photos:
only if you have agreed to us taking and using photos of you.
We need your identity and contact details for you to make a purchase and attend training with us. Without them, we cannot accept your order or register you with Transportstyrelsen.
Why do we process your personal data?
Each purpose has a legal basis under Article 6 of the GDPR.
About Swedish personal identity numbers
We process your Swedish personal identity number because this is clearly justified for reliable identification, as required by Chapter 3, Section 10 of the Swedish Data Protection Act. We need it to register your training with Transportstyrelsen, ensure that the right student receives the right training, and check gift cards and campaign benefits per student. Your personal identity number is not shown to unauthorised persons and is not used for marketing.
Who do we share your personal data with?
We never sell your personal data. We only share it when necessary for the purposes described above.
- Public authorities:
Transportstyrelsen (the Swedish Transport Agency) and other authorities when required by law.
- Suppliers (data processors): companies that help us with online sales, payments, booking systems, IT services, email and text messages. They may only process your data according to our instructions and have agreements with us.
- Payment service providers:
when you pay, the payment provider processes your data under its own terms.
We aim to process data within the EU/EEA. If a supplier processes data outside the EU/EEA, we ensure that the transfer has a basis under the GDPR, for example the European Commission's standard contractual clauses.
How long do we keep your personal data?
We keep data for as long as needed for its purpose and then delete it.
Your rights
You have the right to:
- know what data we hold about you and receive a copy (a subject access request)
- have inaccurate data corrected
- have data erased when it is no longer needed or has no legal basis
- restrict processing in certain circumstances
- object to processing based on legitimate interest – you can always object to marketing
- receive data you have provided to us in a machine-readable format (data portability)
- withdraw consent at any time, without affecting processing that has already taken place
Contact us at Email or by post. We may need to confirm your identity before providing data. We respond within one month.
If you are unhappy with how we process your personal data, you can complain to Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection, www.imy.se.
Cookies and changes
Our separate cookie policy explains how we use cookies. We may update this privacy policy. The latest version is always available on our website, and we will inform you of significant changes.
