Privacy policy

Bilbo AB (business registration number 556423-4168) (“Bilbo”, “we”, “us”, or “our”) is the data controller for the processing of personal data on this website.

Contact:
Email: GDPR@bilbo.se
Postal address: Bilbo AB, Södra Riddarholmshamnen 13, SE-111 28 Stockholm, Sweden

Processing of personal data

We only process personal data when you choose to provide it to us, for example when you contact us or subscribe to our newsletter.

The personal data we may process includes your name, email address, and any other information you voluntarily provide.

When you subscribe to our newsletter, we also process information related to your consent, such as the date, time, and source of your subscription, in order to demonstrate that valid consent has been obtained.

Purpose and legal basis

We process personal data for the following purposes:

  • To respond to enquiries and communicate regarding matters that you initiate. (Legal basis: Legitimate interest.)

  • To send newsletters that you have actively chosen to receive. (Legal basis: Consent.)

You may withdraw your consent at any time. Every newsletter includes an unsubscribe link.

Data retention

Personal data is retained only for as long as necessary to fulfil the purpose for which it was collected. After that, the data is deleted or anonymised, unless a longer retention period is required by law.

Cookies and analytics

This website uses only technically necessary cookies. No cookies are used for tracking, marketing, or third-party analytics purposes.

We use local, cookieless analytics to obtain aggregated information about how the website is used. The data is anonymised and cannot be linked to individual visitors.

Transfer of personal data

We do not disclose personal data to third parties except where required by law or where service providers process data on our behalf under a data processing agreement (DPA).

For the distribution and management of newsletters, we use the email platform Sender, which processes personal data on our behalf under a DPA.

No personal data is transferred to countries outside the EU/EEA.

Your rights

You have the right to request access to the personal data we process about you, to request that inaccurate personal data be corrected or deleted, to object to our processing of your personal data, and to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

Changes to this policy

We may update this privacy policy from time to time. The latest version will always be available on this website.

Last updated: January 2026