Privacy policy

Wine Mechanics AB, company number 559064-3986, Lilla Waterloogatan 15, 415 02 Göteborg, is the data controller for personal data processed in connection with Vingelrundan. If you have questions about how we handle your data, email vingelrundan@winemechanics.se.

What we process, and where it comes from. The data reaches us from three directions:

From your Tickster ticket purchase: first name, last name, email address, mobile number, order reference and number of tickets. We import Tickster's export into our participant roster, one row per ticket.
From you in the participant portal: first and last name per ticket, shirt size, and requests to change start group or shirt size including any free-text note you add.
From us, in order to run the event: start group, bib number and the on-site check-offs (group assigned, size confirmed, shirt handed out, bib handed out), plus whether the welcome email with your portal link has been sent.

We never ask for a personal identity number, a postal address or payment details. Payment is handled by Tickster and we do not see it.

Technical data: when you visit the site our hosting provider sees your IP address, and it appears in the operational log (see below for how long). We use it briefly in memory to slow down abuse of forms and APIs. It does not go into the database holding participant data. When a map is drawn, the map style and tiles are fetched from Mapbox, which means Mapbox sees your IP address. Mapbox's own telemetry is switched off in our code.

Why, and on what legal basis.

Running the event: start groups and start times, bib numbers, shirts, your personal portal link and emails about your own participation. Legal basis: performance of a contract (GDPR article 6(1)(b)) connected to your ticket purchase.
Security and operations: preventing abuse of portal links, forms and APIs, and being able to troubleshoot mailings. Legal basis: legitimate interest (article 6(1)(f)) in protecting participant data and being able to show that an email actually went out.

GPS in the run companion. The run companion uses your phone's GPS to show where you are on the course, which stop comes next and how far away it is. Your position stays on your own phone. We do not collect it, do not store it and do not show it to anyone else, neither other participants nor the organiser.

If you stray off the course, your coordinates and the nearest point on the course may be sent to Mapbox to work out a walking route back. No name and no order reference is sent with that request, and we do not store the answer.

Your portal link. The link to your tickets is a magic link valid for 7 days. We never store the link as it appears in the email, only a cryptographic hash of it together with your email address and which event it belongs to. Treat the link as a personal document: whoever holds it can see the name, start group and bib number of every ticket bought on your email address, and can change the names and shirt sizes on them.

Who processes the data for us.

Tickster sells the tickets and is its own controller for the purchase. We import their participant export into our roster.
Supabase hosts the database holding the roster, portal tokens and the email log, as well as our administrators' sign-in.
Fly.io runs the server that delivers the website, in Stockholm, and therefore processes traffic data such as IP addresses and requested URLs.
Mapbox provides the map style, the map tiles and walking directions.
Mailchimp (Intuit) sends our email and therefore receives your email address and the contents of the message.

Transfers outside the EU/EEA. The website runs in Stockholm and the database is inside the EU. Maps and email are handled by providers in the United States, so some processing takes place outside the EU/EEA. That processing is covered by the European Commission's Standard Contractual Clauses, and for those providers who participate, also by the EU-US Data Privacy Framework. Email us if you want to know more.

How long we keep things.

Portal links: 7 days, after which they stop working and are deleted.
The email log: we keep the subject line, the template, the recipient count, the status and the provider's message id, so we can see what was sent. The log holds no recipient addresses, and for email carrying a personal portal link the text is not stored.
Operational logs: our hosting provider records the IP address and the time of calls, for operations and security. The logs are rotated continuously and are not used to follow visitors around.
The participant roster: deleted no later than three months after the event.

Cookies and local storage. We use no cookies for statistics, analytics or advertising, and the site loads no tracking scripts. As a participant you receive no cookies at all. The organiser's sign-in uses one necessary session cookie.

Your browser also keeps your language choice and a copy of the course, so the map still works in a dead spot. That lives in your browser, not with us, and you can clear it whenever you like.

Your rights. You have the right to access your data, to have inaccurate data corrected, to have data erased, to request restriction of processing, to object to processing based on legitimate interest, and to receive the data you provided yourself in a machine-readable format (portability). Contact vingelrundan@winemechanics.se and we will help you. If you are unhappy with how we handle your data you can lodge a complaint with the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), imy.se.

Last updated: 2026-08-20.