Privacy Policy

Last updated: September 2026

This privacy policy describes how Yoku Buss AB (corporate identity number 559060-8211) collects, uses, protects, and shares personal data collected through our website hyrabuss-stockholm.se.

1. What Personal Data We Collect

When you submit a quote request, complete a booking, or contact us, we collect the following personal data:

• Name / Contact person
• Email address
• Phone number
• Details of your planned trip (pick-up and drop-off address, any stops along the way, date and time, any return journey, number of passengers)
• Any free-text message you choose to write in the form

2. Purpose and Legal Basis

We process your personal data under the following conditions:

• Purpose: To process your quote request, provide a competitive price proposal, and execute transport bookings.
• Legal Basis: Processing is necessary in order to take steps at the request of the data subject prior to entering into a contract (GDPR Article 6.1.b) as well as for the performance of a contract.

3. Data Retention

We retain your personal data only as long as necessary for the purposes for which it was collected:

• Quote requests are deleted automatically from our database 12 months after we receive them — whether or not they led to a booking.
• If your inquiry has been forwarded to our booking and dispatch system (see section 5), that system applies its own retention periods to its copy.

4. Anonymous Visitor Statistics

Please note: visitor statistics are currently switched off — nothing at all is being measured or stored. This section describes how the measurement works if and when we turn it back on.

We count how many people visit the website each day, how often visitors click our phone number, WhatsApp link or e-mail address, and how many quote requests are submitted. This is measured by our own software on our own server — there is no Google Analytics and no third-party analytics provider, and the statistics are stored only within the EU. (The providers that carry the traffic itself are listed in section 5.)

To do this without cookies, we do not store your IP address or your browser's user agent. When a page is loaded, our server combines them with a secret value that is replaced every day and converts the result into a one-way hash. That hash lets us tell two visitors apart on the same day, but it cannot be reversed, cannot be traced back to you, and cannot be linked to the day before or after.

What we store for each visit:

• The date and which page was viewed
• Which action was measured (a page view, a click on our phone number, WhatsApp link or e-mail address, or a submitted quote request)
• The language version (Swedish or English)
• Whether the device is a phone, tablet or computer
• The domain you arrived from, if you followed a link (e.g. google.com)
• The daily, non-reversible hash described above

Legal basis: legitimate interest (GDPR Article 6.1.f) in understanding how our website is used. Because this measurement stores nothing on, and reads nothing from, your device, the consent requirement in the Swedish Electronic Communications Act (LEK ch. 9 § 28) does not apply anywhere on this website. The statistics are deleted automatically after 26 months.

If you do not want to be counted: our server respects the Global Privacy Control (Sec-GPC) and Do Not Track (DNT) signals. If your browser sends either of them — Firefox, Brave and DuckDuckGo do, and most privacy extensions can — your visit is discarded and nothing at all is written. You can also object at any time by emailing us at the address in section 8.

5. Recipients, Third Parties and Transfers

We never sell your personal data and never use it for advertising. To run the website and handle your inquiry we rely on the following categories of processors:

• Web hosting within the EU — runs the website and the background service that handles inquiries.
• MongoDB Atlas — stores inquiries; the servers are located in Stockholm (EU).
• Cloudflare — delivers and protects the web traffic; may process your IP address.
• Email provider — sends the confirmation email to you and the notification email to us; the provider is established outside the EU/EEA.
• Booking and dispatch system — the system we use to plan, schedule and book the transport. Your inquiry may be forwarded to it so that the journey can be arranged.
• Google Maps/Places — address suggestions in the quote form. The suggestions are fetched by our own server: your browser never contacts Google, no Google script is loaded, Google places nothing on your device and never sees your IP address. What you type in the address field is, however, forwarded by us to Google, which may process it outside the EU/EEA. Legal basis: steps taken at your request prior to entering into a contract (GDPR Article 6.1.b). You can always type the address by hand and submit the form without using the suggestions.

Transfers to third countries: some of the services above may involve processing outside the EU/EEA. Such transfers are governed by the safeguards set out in each provider's data processing agreement, as a rule the European Commission's Standard Contractual Clauses (SCC). Contact us if you would like to know which safeguards apply to a particular service.

6. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, loss, or destruction. All data transmission on our website is secured via SSL/TLS encryption (HTTPS).

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (to receive a copy of your processed data)
• Right to rectification (to correct inaccurate or incomplete data)
• Right to erasure ("the right to be forgotten")
• Right to restriction of processing
• Right to object to processing
• Right to data portability (to receive the data you provided in a structured, commonly used and machine-readable format)

To exercise any of these rights, contact us using the details in section 8. We will respond within one month.

You also have the right to lodge a complaint with the Swedish supervisory authority, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), if you believe we process your personal data unlawfully: www.imy.se, [email protected], Box 8114, 104 20 Stockholm.

8. Contact Information

If you have any questions about this privacy policy or our data processing practices, please contact us:

Yoku Buss AB
Bruttovägen 16 B, 175 43 Järfälla
Email: [email protected]
Phone: +46 76-768 88 88