Midnattsloppet's Privacy Policy

Effective from 1 November 2026

This policy describes how Midnattsloppet Nordic AB processes personal data in connection with registration, participation, customer service and communication.

WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA

Midnattsloppet Nordic AB, company registration number 556789-1303, is the data controller for the processing activities described here, unless otherwise expressly stated. You can contact us at kundservice@midnattsloppet.com.

1. WHAT INFORMATION WE COLLECT

We collect information from you when you register, purchase a race entry, create an account, contact us or respond to a survey. If someone else registers you, we receive your participant information from that person. You will then be provided with information about our processing of your personal data in accordance with applicable data protection regulations.

Depending on the circumstances, we may process your name, date of birth or year of birth, contact details, address, competition category, nationality, club or company, booking and payment details, race number, distance, starting group, race results and customer service correspondence. We may also process photographs, videos, survey responses and documentation of your consent.

Mandatory fields are indicated during registration. If the necessary information is not provided, we may not be able to administer your purchase or participation. You are not required to provide optional information. Contact details and personal identity numbers are not published in start or results lists.

REGISTRATION, PAYMENT AND INFORMATION

We process personal data in order to register your race entry, handle payment, determine the correct competition category and starting group, provide your race package, conduct timekeeping and send your race confirmation and necessary information about the event.

For participants who are themselves a party to the contract, the legal basis is the performance of a contract pursuant to Article 6(1)(b) of the GDPR.

Where another person is the party to the contract, for example in the case of a company registration or registration of a child, the legal basis must be assessed separately.

Accounting records are processed to comply with legal obligations pursuant to Article 6(1)(c) of the GDPR. Necessary information may also be processed to handle legal claims on the basis of a documented legitimate interest pursuant to Article 6(1)(f) of the GDPR.

PERSONAL IDENTITY NUMBER

If you have a user account, we process your name, email address and login history in order to administer your account and provide account and registration functions. The legal basis is the performance of a contract pursuant to Article 6(1)(b) of the GDPR.

Account and results history are retained in accordance with the section on data retention below.

START LISTS, RESULTS AND REPORTING

In order to conduct the race and publish the results, we publish names, year of birth, competition category, club or hometown, race number and results in start and results lists. The lists are available online. We do not publish personal identity numbers, email addresses or street addresses.

The proposed legal basis is our legitimate interest in conducting a sporting event with reliable start and results lists. If you have protected personal data or other specific protection needs, please contact us before registering so that we can arrange secure handling of your information.

For sanctioned races, certain participant information may need to be provided to the Swedish Athletics Association.

For sanctioned races, names, year of birth, club and race results are provided to the Swedish Athletics Association for official statistics and rankings, based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR.

CUSTOMER SERVICE AND PARTICIPANT SURVEYS

When you contact us, we process your contact details and information relating to your case in order to respond to you and provide assistance. The legal basis is the performance of a contract when the matter concerns your purchase, or our legitimate interest in responding to other enquiries. Please avoid sending sensitive information that is not necessary for the matter.

We may send a post-race survey to help us improve the event. The legal basis is our legitimate interest in evaluating and developing our races. Participation in the survey is voluntary. We use anonymised statistics where possible.

NEWSLETTERS AND PARTNER OFFERS

You may voluntarily choose to receive newsletters about Midnattsloppet races. You may separately choose to receive offers from our partners that are sent by Midnattsloppet. For these communications, we use your contact details and document your choice. The proposed legal basis is consent pursuant to Article 6(1)(a) of the GDPR. Declining consent does not affect your ability to purchase or participate.

You may withdraw your consent at any time by using the unsubscribe link in the communication or by contacting customer service. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Necessary information relating to an already purchased race entry may still be sent.

Partner offers are administered by Midnattsloppet. Partners do not gain access to the participant or customer register through these communications.

CANCELLATION DUE TO INJURY OR ILLNESS

In order to assess a claim under the cancellation protection, we may need a certificate confirming that you are unable to participate for medical reasons. The information is used only for this matter and access is restricted to authorised persons. Please do not provide details of diagnoses or medical records that are not necessary.

The legal basis for processing medical certificates is the performance of a contract pursuant to Article 6(1)(b) of the GDPR, as well as your explicit consent pursuant to Article 9(2)(a) of the GDPR for the processing of health data.

PHOTOGRAPHY, FILMING AND INTERVIEWS

We take photographs and record video during the races to document the event and provide information about our activities. Material in which individuals can be identified constitutes personal data.

For documentary use that is not subject to a requirement for advertising consent, the legal basis may be our legitimate interest, following a documented balancing of interests. We take into account the context, the participants’ reasonable expectations and the need for protection, particularly in relation to children.

For the use of identifiable individuals in advertising, we obtain separate permission in accordance with applicable legislation concerning the use of names and images in advertising, as well as valid consent where consent is the legal basis under the GDPR. The permission must specify the purpose, media, period of use and any named partners. Providing such permission is voluntary and is not part of the purchase terms.

For images of children, the processing must be adapted to the child’s age and maturity and to the role of the child’s legal guardian.

Images containing identifiable participants are not provided to partners for their own advertising purposes unless a lawful basis and the necessary permissions have been established. A partner that determines its own purposes and means of use is not automatically considered our data processor.

If you wish to object to the use of an image or withdraw your consent, please contact customer service and, if possible, provide the link and a description of the image. We assess each request in accordance with applicable regulations, including when an image contains multiple people. Where GDPR consent is withdrawn, we will cease any further processing that is based solely on that consent.

WHO MAY ACCESS YOUR PERSONAL DATA

Authorised personnel and service providers receive the information necessary for registration, participant services, timekeeping, payments, delivery, IT operations and communications.

Where service providers process personal data on our behalf, the processing must be governed by a data processing agreement. Organisations that process personal data for their own purposes may be independent data controllers.

Information may be disclosed to public authorities where required by law or where necessary for legal claims and legally permitted. We do not sell the participant register.

HOW LONG WE RETAIN YOUR PERSONAL DATA

We retain personal data only for as long as it is needed for the relevant purpose or where retention is required by law. The data is then deleted or anonymised. Retention periods by category are set out below.

• Registration and participant administration: Retained during the current season and for up to 3 years after the race for customer service and administration purposes. Customer service: Cases are retained for up to 2 years after the case has been closed. Accounts: Retained while the account is active and deleted after 3 years of inactivity.
• Start lists: Retained until the race has been completed. Results and results history: Retained indefinitely in the race’s official archive for sports-historical purposes and to allow participants to view their historical performances.
• Newsletters: Retained until you unsubscribe or until 2 years of inactivity have passed. Proof of consent and suppression list: Retained for 3 years after unsubscribing to ensure that your preferences are respected.
• Photographs and videos: Retained for up to 5 years for marketing and documentation purposes. Cancellation certificates: Deleted no later than 3 months after the matter has been resolved, unless a legal dispute is ongoing.
• Accounting information: Retained for the period required under applicable accounting legislation.

YOUR RIGHTS

You may request access to your personal data and have inaccurate information corrected. Subject to the conditions set out in the GDPR, you may also request deletion, restriction of processing and data portability. Not all rights apply to all processing activities; for example, the law may require certain information to be retained.

You may object to processing based on legitimate interests. We will then assess whether the processing may continue in accordance with the GDPR. You always have the right to object to direct marketing, in which case we will stop processing your personal data for this purpose. Where we rely on consent, you may withdraw your consent at any time.

To exercise your rights, please contact kundservice@midnattsloppet.com. We may need to verify your identity in a proportionate manner. We normally respond within one month. If the response deadline needs to be extended in accordance with the GDPR, we will inform you of the extension and the reason for it.