Privacy Policy

Updated: October 27, 2026

1. Who We Are

Buckettrips AB ("we," "us," "our") is a private limited company registered in Sweden, corporate identity number 559472-1416, VAT number SE559472141601. Our registered office is at Regementsgatan 20, 211 42 Malmö, Sweden.

For privacy questions, write to us at dpo@buckettrips.travel.

2. What Information We Collect

Our trips are for adults. Every traveler is 18 or over, and we do not knowingly hold data about anyone younger.

Information You Provide

Identity Data: First name, last name, gender, date of birth, nationality.
Contact Data: Email address, phone number, address.
Profile Data: Booking history, the trips you have taken and the trips you have saved, preferences, dietary preferences, reviews and other feedback, and, if you allow statistics cookies while signed in, the time zone your browser keeps, so an email meant for the morning reaches you in yours.
Financial Data: Payment details (processed through secure third-party providers; we do not store card numbers).
Document Data: Copies of passports and insurance documents (encrypted on upload).

Information About Other People on a Booking

The lead traveler gives us the names, dates of birth, email addresses and phone numbers of the other travelers on their booking, and a traveler may give us an emergency contact. If someone else booked the trip you travel on, that is where we got your details. We use them to run the trip, as this policy describes, and you have the same rights over them as anyone else.

Information We Collect Automatically

Technical Data: IP address, browser type, device type and operating system, each page your browser requests, including what you search for, the page that referred you and the campaign tags in the link you followed, and whether the page ran its small script and whether an automated browser is in control. We record these for every request, to keep the site secure, to tell visitors from bots and to know where our visitors come from.
Usage Data, if you allow statistics: Your visits joined together over time, how long you stay on a page, how far you scroll and how you move and click on it, your screen and window size, time zone, languages and number of processor cores, and which campaign led you to book. A cookie lets us recognize your browser from one visit to the next. See our Cookie Policy.

If you allow statistics, usage data is connected to your account when you are signed in, including the pages of that visit you saw before you allowed statistics, and to the email address we sent a link to when you follow it, together with your later visits from the same browser. What you do with your account, such as signing in, booking or changing your settings, is always recorded against it.

Email Communications

We record whether each email we send you was delivered. If you allow it, our emails also report when they are opened, which links you follow and whether you view them in your browser. We use the answer you gave about statistics cookies in the browser where you gave us your email address and, while you are signed in, the answer you give in the cookie dialog. You can change it at any time with Manage cookies at the bottom of any page while you are signed in, and switching Statistics off also stops emails we already sent you from reporting. You can manage your email preferences in your Communication Settings, or unsubscribe with the link in any marketing email.

3. How We Use Your Information

Essential Uses (Contract / Legal Obligation)

Creating and maintaining your account.
Processing bookings and payments.
Providing customer support.
Sending transactional emails (booking confirmations, payment and document notices, password resets, security alerts), written with details from your account and your bookings.

Legitimate Interests

Security monitoring: detecting vulnerability scanning, credential stuffing, and abuse.
Knowing where our visitors come from: the page that referred them and the campaign tags in the link they followed, counted across all visits.
Emailing you about new trips and offers once you have booked with us, chosen and written for you from the information above and, if you allow statistics, from what you look at on our website and in our emails. You can say no when you book, and stop them at any time with the link in any of them or in your Communication Settings.
Personalizing our website and the emails we send you, and recommending trips. We use your identity and profile data, including your gender, date of birth, nationality and where you live, together with your bookings, the trips you have taken and saved, your reviews and when you last signed in, to decide what we show you, what an email says and when it arrives. For example, a trip that starts around your birthday, a trip from near where you live, or news about a trip you saved.

You can object to this at any time. See Your Right to Object.

Sending our newsletter, once you ask for it when you sign up, in the footer or in your Communication Settings; and emails about new trips and offers, if you have not booked with us, once you ask for them as your account is made or in your Communication Settings.
Understanding how our website and emails are used, so we can improve them and learn which trips and messages interest people, including connecting your usage data and email activity to your account or email address, if you allow statistics. See section 2.
Using your images from trips for marketing purposes.
Measuring and showing our ads on Facebook and Instagram, if you allow marketing cookies. See section 4.

Personalization and Profiling

Choosing what to show or send you from what we know about you is profiling. It never makes decisions with legal or similarly significant effects on you. We never use your dietary preferences, your passport or other document details, or your payment details to personalize anything or to choose who receives marketing. You can object to personalization at any time, and stop marketing emails with the link in any of them.

We do not sell your data, and we share as little of it as the trip allows. The recipients are:

Our payment provider (Revolut): To take payment. Your card details are entered directly with them and never reach our systems. They receive the amount, your booking reference, which trip it is for, the lead traveler's name and email address, and the name on the card and the billing address you give at checkout. Revolut keeps the card you pay with on file for us, so the later payments of your booking can be charged to it.
The local operators who run your trip, and the coordinator who leads your group: Names, travel dates, and the contact and dietary details needed to host you. Where a trip requires it, passport details for permits, entry formalities or accommodation registration. The coordinator also sees each traveler's phone number, emergency contact and answer about photos, to look after the group. They receive what running your trip needs, not your account with us.
Our hosting provider: Runs the servers this site and its database sit on.
Meta, only if you allow marketing cookies: We use the Meta Pixel on our website and Meta's Conversions API from our server to measure our ads and show them to people likely to be interested. Meta receives the trips and pages you view, your searches, the trips you save, that you signed up for our newsletter or made an account, when you start a booking, reach the payment step and complete a payment (with the amount and the number of travelers), together with your IP address, browser details and cookie identifiers. From our server, Meta also receives, in hashed form, your email address, your mobile number if you have given us one, and the number of your Buckettrips account if you have one, which it uses to match these events to a Facebook or Instagram account if you have one.
Legal obligations: Where required by law, or to establish or defend legal claims.

We run our own mail server, so your email address is not handed to a bulk email provider.

For the data collected on our website and sent to Meta, Buckettrips AB and Meta Platforms Ireland Limited are joint controllers. We are responsible for asking your permission and for telling you about it. Meta is responsible for what it does with the data once it has it, which is described in Meta's Privacy Policy, and for your rights over the data it holds. You can contact either of us.

5. International Data Transfers

Your account, booking and document data is held on servers we rent inside the European Economic Area (EEA).

One transfer leaves the EEA: the local operator running your trip needs to know who is arriving, and that operator is in the country you are traveling to. We rely on Article 49(1)(b) of the GDPR, which permits a transfer that is necessary to perform the contract you entered into with us. Your trip cannot be run without it. We send the operator only what they need to host you, and for as long as your trip requires.

If you allow marketing cookies, Meta may process the data it receives outside the EEA, under the safeguards described in Meta's Privacy Policy.

6. Your Rights

While the General Data Protection Regulation (GDPR) applies to the processing of personal data of individuals in the European Union, we believe that privacy is a universal right. We extend the same protections and rights granted under the GDPR to all our customers, regardless of location.

This means every customer of Buckettrips AB enjoys the following rights:

Access: Request a copy of the personal data we hold about you.
Rectification: Correct inaccurate or incomplete data via your Profile Settings.
Erasure: Request deletion of your data under certain conditions.
Restriction: Limit how we process your data.
Portability: Obtain a copy of your data in a portable format.
Objection: Object to processing based on our legitimate interests, including personalization and profiling, and to direct marketing.
Withdraw Consent: At any time, without affecting processing before you withdrew it. For statistics, email opens and clicks included, and for marketing cookies, use Manage cookies at the bottom of any page.

Your Right to Object

You can object at any time to the uses we base on legitimate interests in section 3. We will stop unless we have compelling grounds to continue, such as protecting the site from attacks. Where the use is for marketing, we always stop.

To exercise these rights, write to us at dpo@buckettrips.travel.

If you think we have handled your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.

7. Data Security

We implement technical and organizational measures to protect your data. Sensitive documents (passports, insurance) are encrypted on upload. Despite our efforts, no online transmission can be guaranteed 100% secure.

8. Data Retention

How long we keep data depends on why we have it:

Booking and payment records: Until you ask us to delete them. Swedish accounting law requires us to keep them for at least seven years, even if you ask sooner.
Your account and profile: For as long as you have an account with us.
Copies of travel documents: For as long as your booking needs them, and after that until you ask us to delete them.
Technical data, usage data and email activity: Kept with no end date, until you ask us to delete them, because protecting the site and learning what works both depend on history. This includes the IP address each request came from.
Copies of the emails we send you: Each one is kept as it was sent, with no end date, until you ask us to delete it, so we can see what we told you.
Backups: Encrypted backups of our database and files are kept every night for 30 days and for the last night of each month for 12 months. A person we delete stays in them until they expire, and is not restored from one.
Data Meta receives: As described in Meta's Privacy Policy.

9. Cookies

We set cookies to keep you signed in and protect the site. With your permission we also recognize your browser between visits to understand how the site is used, and set marketing cookies from Meta. You can change your choice with Manage cookies at the bottom of any page. See our Cookie Policy for the full list, including the cookie that remembers the currency you chose and what we keep in your browser's local storage.

10. Changes to This Policy

We may update this policy from time to time. Significant changes will be communicated through our website or via email.

11. Contact

For any privacy questions or to exercise your rights:

Email: dpo@buckettrips.travel
Address: Regementsgatan 20, 211 42 Malmö, Sweden