1. Data controller

This privacy notice applies to the processing of personal data carried out by Bubla.

BUBLA SERVICES AB
Company registration no.: 5594732736
Address: Stora Badhusgatan 18, 411 18 Göteborg
Email: privacy@bubla.se
Support: support@bubla.se

If Bubla appoints a data protection officer, their contact details will be published here.

2. The personal data we process and where it comes from

We process personal data only to the extent necessary and appropriate for the purpose concerned. The personal data we process can be divided into the following categories.

2.1 Account details
We process information you provide when creating or using your account, such as:

• Name
• Email address
• Phone number
• User ID
• language settings
• account status and onboarding information

2.2 Booking and service details
We process information needed to offer, plan and carry out the services you book, such as:

• Type of service and any additional services
• Booking date and time
• Address and other location information needed to perform the service
• Instructions for the assignment
• Booking history

2.3 Identity and verification details (BankID)
When identity verification is used, for example through BankID, we may need to process information required to verify your identity and prevent misuse. See BankID and personal identity numbers for more information.

2.4 Payment details
Information needed for payments and refunds, such as payment method, payment status and transaction references. As a rule, we use third-party providers for card payments and do not store full card numbers ourselves.

2.5 Support and communication details
When you contact us, we process the content of the communication, any attachments and the case history so that we can help you.

2.6 Technical and usage data
We may collect information such as IP address, device type, app/browser version, session and log data, and information about how you use the Services (e.g. which features you use). We use cookies and similar technologies where necessary or where consent is required.

Where the data comes from:

• Directly from you when you register an account, book services, contact support or provide feedback
• From your device when you use our app or website
• From identity providers during verification, such as BankID, when you choose to use these services
• From payment service providers in connection with payments
• From providers that help us with operations, communication, analytics, security or support

3. Why we process your personal data

We process personal data only for clear and legitimate purposes. One or more of the following legal bases may apply at the same time.

3.1 To create and manage your account
When you create an account, we need to process your account details to register you, give you access to the Services and manage your account. (Legal basis: performance of a contract).

3.2 To carry out identity checks and secure onboarding
When Bubla uses BankID or other identity verification, we process relevant identity and verification details to confirm that the right person is using the account, prevent misuse and protect the service against fraud. Where identification requires a personal identity number, it is processed restrictively and in a protected form. (Legal basis: performance of a contract and/or legitimate interest; in some cases another legal basis where required by law).

3.3 To receive, plan and carry out bookings
We process booking and service details to receive your order, plan the assignment, match it with the right service provider and carry out the service. (Legal basis: performance of a contract)

3.4 To communicate with you about the Services
We process contact, booking and support details to send booking confirmations, reminders and updates, manage changes, answer questions and handle complaints or customer service cases.
(Legal basis: performance of a contract and legitimate interest in customer service and quality assurance)

3.5 To manage payments, receipts, refunds and accounting
We process payment details and certain booking details to collect payment, issue receipts, administer refunds and fulfil obligations under accounting and other applicable legislation.
(Legal basis: performance of a contract and legal obligation).

3.6 To prevent fraud, misuse and security incidents
We process identity details, technical data, payment details and booking history to protect the Services, detect suspicious activity, prevent fraud, handle disputes and strengthen security.
(Legal basis: legitimate interest).

3.7 To improve our services
We process technical data, usage data and booking data for analysis, troubleshooting, statistics, product development and improvements to the user experience.
(Legal basis: legitimate interest. Where analytics or tracking requires consent under applicable rules, for example for certain cookies or similar technologies, processing is instead based on consent).

3.8 For marketing
We may process contact details, booking history and usage data to send offers, campaigns and other information about Bubla’s services. (Legal basis: legitimate interest or consent, depending on the channel, content and legal requirements).

You can object to direct marketing or withdraw your consent at any time.

3.9 To fulfil legal obligations
We process personal data where required by law, for example for accounting, consumer protection, security or dealings with authorities.
(Legal basis: legal obligation).

4. BankID and personal identity numbers

We use BankID to verify identity during onboarding when you choose this option. Where a personal identity number is required for identification, we process it only to the extent necessary for verification and fraud prevention.

We do not store personal identity numbers in plain text in our systems. Instead, technical safeguards are used to reduce the risk of unauthorised access, such as encryption and protected representations. Only a limited number of system components and authorised individuals can access information in its protected form under strictly controlled circumstances. The personal identity number is used only for verification and legitimate security purposes and is not shared with third parties in plain text.

5. Recipients of personal data

We share personal data only when necessary for the purposes stated in this privacy notice.

5.1 Service providers and partners
We may share details such as name, address, phone number and booking instructions with the service provider or partner who needs the information to carry out the assignment.

5.2 Payment service providers
We share necessary information with providers that handle payments, refunds and financial administration.

5.3 IT, operations and support providers
We use providers for services such as cloud services, databases, communication tools, support tools, security and analytics. These providers process personal data on our behalf under agreements and in accordance with our instructions.

5.4 Authorities, courts and advisers
We may disclose personal data if required by law or an authority’s decision, or where necessary to establish, exercise or defend legal claims.

5.5 Business transfers
If Bubla is sold, merged or reorganised, personal data may be shared with buyers, sellers or advisers to the extent necessary and lawful.

6. Transfers of personal data outside the EU/EEA

If we or our providers transfer personal data to countries outside the EU/EEA, we ensure that the transfer complies with applicable data protection legislation, with appropriate safeguards such as adequacy decisions or standard contractual clauses.

Contact us if you would like more information about the safeguards used for transfers.

7. How long we retain your personal data

We retain personal data for as long as necessary for the purposes described in this privacy notice or as required by law. For example:

• Account details are normally retained for as long as your account is active and then for a reasonable period for support, disputes, security and legal requirements
• Booking history is retained for as long as needed for the service, support, complaints and legal obligations
• Payment-related information is retained for as long as needed to manage payments, refunds and any disputes
• Data processed on the basis of consent is retained until consent is withdrawn or the data is no longer needed.

8. Your rights

You have the following rights in relation to your personal data:

Right to information
You have the right to receive information about how we process your personal data.

Right of access
You have the right to obtain confirmation of whether we process personal data about you and, if so, to access that personal data.

Right to rectification
You have the right to request correction of inaccurate or incomplete personal data concerning you.

Right to erasure
You can ask us to erase your personal data. We will do so unless we have a legal basis for continuing to process the data.

Right to restriction of processing
In certain cases, you can request that the processing of your personal data be restricted.

Right to object
In certain cases, you can object to the processing of your personal data, particularly where processing is based on our legitimate interest or where the data is used for direct marketing.

Right to data portability
You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format.

Right to withdraw consent
Where our processing is based on your consent, you have the right to withdraw that consent at any time.

Right to lodge a complaint
If you believe that our processing of your personal data breaches applicable data protection legislation, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or another competent supervisory authority.

How to exercise your rights
You can exercise your rights by contacting us using the contact details above. We may ask for additional information to confirm your identity before processing your request.

9. Direct marketing

You have the right to object at any time to our use of your personal data for direct marketing. If you do so, we will stop using your personal data for those purposes.

10. Information security

We use administrative, organisational and technical security measures to protect personal data. These measures may include access controls, encryption, logging, backups, monitoring and limited access based on job responsibilities. Sensitive information used for identity verification is processed with specific technical safeguards, and access to it is strictly controlled.

We aim to limit the information recorded in logs or included in error messages and ensure that sensitive information is not unintentionally exposed in logs or third-party services.

11. Automated decisions

Bubla may use automated processes for purposes such as security, fraud prevention, analytics or personalisation. If we use a fully automated decision that has a legal or otherwise significant effect on you, we will specifically inform you about this and your right to request human review.

13. Changes to this privacy notice

We may update this privacy notice from time to time to reflect changes to our services, our processing or applicable law. The latest version is always available in the app or on our website. We will inform you appropriately of any significant changes.