Privacy Policy

Introduction

MapAndMove.se values your privacy. This policy describes what personal data we process, why, on what legal basis, how long it is kept and what rights you have under the General Data Protection Regulation (GDPR).

The policy covers the website mapandmove.se with its subdomains and the services we offer there. It does not cover websites we link to, which have their own policies.

For the rules on how you may use the site, see our terms of use. For storage in your browser, see our cookie policy.

Last updated: 2 August 2026.

Data controller

The controller responsible for the processing is:

MapAndMove, company reg. no. [ORG.NR], VAT no. [MOMSREG.NR]. Postal address: [POSTADRESS]. Phone: [TELEFON]. Email kontakt@mapandmove.se.

We have no data protection officer. The requirement in Article 37 does not apply to activity of our type and scale, since we are not a public authority, do not carry out regular and systematic monitoring on a large scale and do not process special categories of data on a large scale.

What data do we process?

You can use virtually the whole site without providing any data at all. We have no login and never ask for your name, personal identity number or address for you to view the map or the statistics. The following categories occur:

• Visitor statistics that we cannot link to you as a person: which pages are visited and for how long, type of device and browser, approximate location at country or region level, where you came from, and anonymous interaction events such as which key figures, filters, map layers and searches are used
• Technical data in the web server's operational logs: IP address, timestamp, the requested address including any parameters, response code, data volume, referring page and browser string
• Data you provide yourself: your email address for the newsletter, the content of messages you send through the feedback or contact forms, images you upload, and order details when purchasing a property report

We do not buy personal data, do not retrieve it from registers and do not combine it with other sources. Almost all data comes from you or from your browser's contact with our server.

Data about someone other than you. In three cases we do process data we received from someone other than the person it concerns. If someone uploads an image in which you are recognisable, or mentions you in a message to us, the categories are image and free text respectively, and the legal basis is legitimate interest (Art. 6(1)(f)) in being able to publish local history material and correct errors that are pointed out. If the map shows a paid placement with contact details for a named person, the basis is the legitimate interest of us and the advertiser in being able to reach each other. We normally have no contact details for you and therefore cannot inform you personally (Art. 14(5)(b)), and this text is then that information. You have the same rights as everyone else, see the section on your rights, and we remove the material on request.

We do not process special categories of personal data (for example health, ethnicity, political opinion or religious belief) and ask you not to provide such data in free text fields.

Purposes and legal basis

Each processing operation has a defined purpose and a legal basis under Article 6:

• Visitor statistics, to understand how the site is used and improve it. Basis: legitimate interest (art. 6.1 f)
• Operational logs, for operations, troubleshooting, security and to detect abuse such as automated bulk downloading. Basis: legitimate interest (art. 6.1 f)
• Newsletter, to send the mailings you signed up for. Basis: consent (art. 6.1 a), confirmed by double opt-in and revocable at any time
• Feedback and contact, to be able to reply to you and correct errors you point out. Basis: legitimate interest (art. 6.1 f)
• Image uploads, to be able to review and publish the contribution. Basis: consent (art. 6.1 a), which you give by uploading
• Purchase of a property report, to perform the order. Basis: contract (art. 6.1 b), and for the accounting a legal obligation (art. 6.1 c)

You do not need to provide any data to use the map, the statistics or any other part of the site. For the newsletter and for a report purchase your email address is necessary, however: without it we can neither send the newsletter nor deliver the report, and the purchase cannot be completed.

Our balancing of interests

Where we rely on legitimate interest we have weighed our interest against your privacy, one processing operation at a time. For the operational logs the interest is being able to run and troubleshoot the server and detect abuse such as automated bulk downloading, which recital 49 of the General Data Protection Regulation explicitly identifies. For the visitor statistics the interest is seeing which pages are used and improving them. For feedback and contact it is being able to answer you and correct what you point out.

The intrusion into your privacy is small: the statistics are collected without cookies and without storing your IP address, they are never broken down to an individual visitor, and we cannot follow you between visits or between websites. We nevertheless treat them as personal data for as long as it cannot be ruled out that an individual could be distinguished, and rely on legitimate interest in doing so. The operational logs contain IP addresses but are not used to build profiles and are not linked to any other data about you. None of the processing is used for marketing directed at you.

Our assessment is that you can reasonably expect this processing when you visit a website.

You have the right to object to this processing at any time. Email kontakt@mapandmove.se and we will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests.

How long do we keep the data?

We do not keep data longer than the purpose requires:

• The web server's operational logs: rotated daily and deleted after 14 days. The same applies to the server's system log, where the same data may appear
• Visitor statistics: kept in aggregated form in Plausible until further notice. They are never broken down to an individual visitor
• Newsletter address: an unconfirmed signup never becomes a recipient. A confirmed address is kept until you end the subscription, after which it is deleted entirely
• Messages sent via the feedback and contact forms: deleted automatically after 24 months. You may request earlier deletion
• Uploaded images: rejected contributions have their images deleted immediately on rejection. Approved images remain for as long as they are published, and are removed when you ask us to
• Report PDF: deleted automatically after 30 days. The email address in the order: anonymised automatically after 12 months
• Accounting records for purchases: kept through the seventh year after the end of the calendar year in which the financial year ended, under chapter 7, section 2 of the Swedish Accounting Act (1999:1078). That obligation takes precedence over a request for erasure

Cookies

MapAndMove.se sets no cookies of its own. Your settings and saved material sit in the browser's local storage and stay on your device. Read more in our cookie policy.

Recipients and processors

We never sell personal data and do not pass it on for anyone else's marketing. The following recipients process data on our behalf or receive it as a consequence of the site being delivered:

• HostUp (Stockholm): our server provider. The website, the database, the statistics and the journey planner run there. Processor
• Plausible Analytics: visitor statistics, which we host ourselves at stats.mapandmove.se. Without cookies and without IP logging. No data is shared with Plausible's company
• Bunny CDN: delivers the map tiles and the map's style files. Receives your IP address and browser information in order to deliver them and for its own operational logs. Data processor. Scripts, stylesheets and images are delivered from our own server, so a text page gives Bunny nothing
• Flagcdn.com: delivers the flag icons in the language selector and therefore sees your IP address. They are only fetched when you open the language menu
• Unpkg and Open-Meteo: called only by our older municipality page, which remains in place for links pointing to it. Unpkg delivers the map library and Open-Meteo the weather forecast, and then receives the municipality's coordinates. Both see your IP address
• Brevo: sends the newsletter and delivery emails. Receives the recipient's email address. Processor
• Payment provider for report purchases: processes your payment details as an independent controller. We never see or store card details

We may also have to disclose data if we are required to do so by law or by a decision of a public authority.

Map tiles, search, journey planning and municipal data run on our own server. The map is built on open data from sources including OpenStreetMap, but is not fetched from their servers when you use the site, so they receive no information about your visit.

Transfers outside the EU and EEA

Our server is located in Sweden and our intention is for the data to stay within the EU and EEA.

Two of our suppliers are international. Bunny CDN delivers from servers within the EU but may, under its terms, have access from countries outside the EU and EEA, and Brevo may process data outside the EU and EEA. To the extent a transfer takes place it relies on the European Commission's standard contractual clauses or an adequacy decision. If you would like a copy of the safeguards, contact us.

Features where you provide data yourself

Most features on the site require no login and leave no trace with us. These are the exceptions:

• The newsletter: when you sign up we send an email with a confirmation link. Only once you have clicked it do we store the address as a recipient, and without that click we send nothing. Every mailing contains a link that ends the subscription immediately and deletes the address from the list
• Feedback and contact: your message is stored together with your IP address, your browser string, which municipality the comment concerns and any email address you provide. Do not write sensitive information in the free text field
• Photo uploads to the digital museum: images are reviewed manually before publication. Location data and other hidden information in the image file (EXIF) is removed automatically on upload, so the photographer's position never travels with it. Do not upload images in which people are recognisable without their consent
• My location on the map: your position is retrieved by the browser only when you click the button yourself, is used to centre the map and is never sent to us
• The journey planner: the start and end points are sent to our own journey planning server to calculate travel time. They are not stored in any database, but may appear in the web server's operational logs, which are deleted after 14 days. They never leave our server

Saved municipalities, pins, notes and map settings are stored only in your own browser. If you move them to another device using the “continue on another device” link, the content sits in the fragment part of the address. Your browser never sends that part in its ordinary request, but our own visitor statistics read the whole address and send it to our statistics server when the page opens. The fragment is not stored there, but it does pass through us, so only share the link with someone you want to see the content.

Sharing aggregated statistics with municipalities

We may share aggregated, anonymised statistics with the relevant Swedish municipality through a private link, for example number of page views, geographic distribution of visitors and which other municipalities were compared. The material never contains personal data and cannot be used to identify individual visitors. It is therefore not a disclosure of personal data within the meaning of the GDPR.

Purchasing property reports

When you order a property report, we process the following data, with a contract as the legal basis (GDPR art. 6.1 b):

• Email address: used to deliver the report and the order confirmation. Anonymised in the order after 12 months
• Order details (property designation, amount, timestamp, consent): kept as records for accounting and support
• The report PDF: stored for 30 days for delivery and resending, then deleted automatically
• Processors: the delivery email is sent via Brevo. The payment provider processes your payment details as an independent controller, and we never see or store card details

A property report describes a property, not a person. We make no searches on owners or residents and the report contains no personal data about them.

Would you like us to delete your order details early? Contact kontakt@mapandmove.se and state your order reference. We must however retain the accounting records for seven years.

No profiling and no services aimed at children

We make no automated decisions producing legal effects concerning you or similarly significantly affecting you, and we do not profile you. Quizzes, tags and matches are calculated in your own browser from what you click yourself, and the result is not stored with us.

The site is not directed at children and we do not knowingly collect data about children under 13. If we discover that we have received such data, we delete it.

How we protect the data

We take technical and organisational measures under Article 32. All traffic is encrypted over HTTPS. The server is accessed only with key-based login, never with a password, and all data in the administration interface requires a separate login. Uploaded images are re-encoded so that hidden information in the file is removed, and the forms are protected against automated abuse.

If a personal data breach occurs that is likely to result in a risk to your rights, we report it to the Swedish Authority for Privacy Protection within 72 hours, and inform you directly if the risk is high.

Your rights

Under GDPR, you have the right to:

• Find out whether we process data about you and receive a copy of it (right of access, art. 15)
• Have inaccurate data corrected and incomplete data completed (art. 16)
• Have your data erased when it is no longer needed (art. 17)
• Request that processing be restricted while an objection or rectification is examined (art. 18)
• Object to processing based on legitimate interest (art. 21)
• Receive the data you provided yourself in a machine-readable format or have it transferred to someone else (art. 20)
• Withdraw a consent at any time, without affecting processing already carried out (art. 7.3)
• Lodge a complaint with the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, imy@imy.se

You exercise these rights by emailing kontakt@mapandmove.se. We respond without undue delay and at the latest within one month. If the request is complex we may extend by two months and will then tell you why. It is free of charge.

Since we have no login and the visitor statistics have no link to individuals, we often cannot determine which data is yours. We may then need something that ties you to the data, such as your order reference or the email address you used. If we cannot identify you we are not obliged to disclose anything, and we never ask for more information than is necessary to answer you.

Changes to this policy

We may update this policy as the site changes. The date at the top shows when it was last amended, and the published version is the one that applies. For material changes requiring your consent, we obtain it before the change takes effect.

This policy describes how we process personal data and is not legal advice. The content and figures on the site are covered by the disclaimer in our terms of use.