Privacy Policy – Lapland Arctic Ultra

Last updated: 12 October 2026

1. Introduction

The Lapland Arctic Ultra is committed to protecting your personal information and respecting your privacy.

This Privacy Policy explains how we collect, use, store, share and protect personal data when you visit our website, contact us, register for the Lapland Arctic Ultra or participate in the event.

We process personal data in accordance with the European Union General Data Protection Regulation (GDPR), applicable Swedish data protection legislation and other relevant legal requirements.

2. Data Controller

The person responsible for processing your personal data is:

Robert Pollhammer
Lapland Arctic Ultra / TRAILS4U
Ringvägen 21
956 32 Överkalix
Sweden

Email: info@trails4u.com
Telephone: +49 (0) 174 3364854
Swedish organisation number: 740109-7758
VAT registration number: SE740109775801

For questions about privacy or requests concerning your personal data, please contact us using the details above.

3. Personal Information We Collect

Depending on how you interact with us, we may collect the following categories of personal information:

Website information

  • IP address and technical connection information
  • Browser type, device information and operating system
  • Pages requested, access times and error information
  • Cookie preferences and consent records

Contact information

  • Name and email address
  • Information you provide through our contact form or by email

Event registration information

  • Full name and contact details
  • Address, nationality and other identification details requested during registration
  • Selected race distance and category
  • Previous racing and outdoor experience
  • Emergency contact information
  • Dietary requirements and relevant logistical information
  • Insurance information
  • Signed declarations, waivers and acknowledgements

Medical and health information

  • Medical conditions and relevant medical history
  • Allergies and medication
  • Information about previous injuries or other health-related risks
  • Medical certificates and other documents requested for participation
  • Information relevant to emergency medical assistance

Medical and health information constitutes a special category of personal data under Article 9 GDPR and receives additional protection.

4. Why We Process Personal Data

We process personal information for the following purposes:

Purpose Legal basis under GDPR
Responding to enquiries Legitimate interests (Article 6(1)(f)) or steps requested before entering a contract (Article 6(1)(b))
Registering participants and administering the event Performance of a contract (Article 6(1)(b))
Communicating race information, schedules and logistical arrangements Performance of a contract (Article 6(1)(b))
Organising race safety and responding to incidents Performance of a contract, legitimate interests or protection of vital interests, as applicable
Processing medical information for participation and safety planning Explicit consent (Article 6(1)(a) and Article 9(2)(a))
Providing information to medical responders in an emergency Vital interests where applicable (Article 6(1)(d) and Article 9(2)(c)), or another applicable legal basis
Retaining necessary records for legal claims Legitimate interests (Article 6(1)(f)) and, for health data, Article 9(2)(f)
Maintaining website security and preventing misuse Legitimate interests (Article 6(1)(f))
Complying with accounting and other legal obligations Legal obligation (Article 6(1)(c))
Using non-essential cookies or loading optional third-party content Consent (Article 6(1)(a)), where required

We do not use medical information for advertising or unrelated marketing purposes.

5. Event Registration Through Jotform

We use Jotform, an external online form provider, to collect and manage registrations for the Lapland Arctic Ultra.

When you complete a registration form, the information you submit is processed through Jotform on our behalf.

Our Jotform account has been migrated to Jotform’s European data centre in Germany. This means that the account is configured for European storage of submitted form data.

Jotform acts as a service provider in connection with the registration process. Its handling of information is also governed by its applicable data protection documentation.

Further information is available at:

https://www.jotform.com/privacy/

Registration information is required to the extent necessary to process your application and organise your participation. If essential information is not provided, we may be unable to complete your registration.

6. Medical Information and Participant Safety

The Lapland Arctic Ultra takes place in remote Arctic conditions, where participants may encounter extreme cold, physical exhaustion, injury and other medical emergencies.

For safety reasons, we request relevant medical information and may require medical certificates as part of registration.

Why we collect medical information

We use this information to:

  • Assess relevant participation and safety considerations.
  • Prepare appropriate emergency and safety arrangements.
  • Inform authorised personnel about medical risks where necessary.
  • Assist emergency responders in providing appropriate care.
  • Document relevant medical and safety incidents.

Consent

Participants are asked to provide separate, explicit consent to the processing of medical information in the registration form.

This consent is separate from the race waiver and general acceptance of event rules.

You may withdraw consent by contacting us. Withdrawal does not affect processing already carried out lawfully and does not necessarily require deletion of information that must be retained under another applicable legal basis.

Because relevant medical information may be essential to organising a safe event, withholding or withdrawing consent may affect our ability to assess or permit participation. We will explain the practical consequences where applicable.

Access and confidentiality

Medical information is accessible only to the organiser and authorised race personnel who require it for legitimate safety, medical or administrative purposes.

We do not routinely make participants’ medical information public.

Emergency disclosure

In an emergency, relevant information may be provided to external emergency medical services, ambulance personnel, hospitals, treating physicians, rescue services or other appropriate responders when necessary to protect a participant’s health or life.

Only information reasonably relevant to the situation should be disclosed.

7. Data Retention

We retain personal information only for as long as there is a justified purpose or applicable legal requirement.

Given the particular risks associated with Arctic endurance racing, medical complications and related claims may arise after an event has ended.

Our intended retention arrangements are:

Registration records, signed waivers and relevant safety documentation

We may retain these records for up to 10 years after the event, where necessary for documenting participation, investigating incidents and establishing, exercising or defending potential legal claims.

Medical information and medical certificates

Relevant medical information may be retained for up to 10 years after the event where continued retention is necessary and proportionate for safety documentation or potential legal claims.

This does not mean that every medical detail will automatically be retained for the full period. We will review whether particular information remains necessary and delete or anonymise information that no longer serves a justified purpose.

Incident records

Where an injury, medical incident, dispute, insurance matter or legal claim has arisen or is reasonably anticipated, relevant records may be retained for the period necessary to resolve the matter and comply with applicable legal requirements, including where this extends beyond the ordinary retention period.

Accounting records

Accounting information is retained for the period required by Swedish bookkeeping legislation, generally until the end of the seventh year following the calendar year in which the relevant financial year ended.

Contact enquiries and website information

Information from ordinary enquiries and technical records is retained only as long as necessary for responding, administration, security or applicable legal requirements.

When a retention period ends and no further lawful reason for processing remains, we delete or anonymise the relevant information.

8. Website Hosting and Technical Logs

Our website is hosted by IONOS.

When you visit the website, the hosting infrastructure may process technical information such as your IP address, browser details, requested pages, timestamps and error information.

This information is necessary to deliver the website, maintain its functionality, troubleshoot problems and protect it against misuse.

The legal basis is our legitimate interest in operating a reliable and secure website under Article 6(1)(f) GDPR.

9. Website Security – Wordfence

We use Wordfence to help protect the website against unauthorised access, malicious activity and other security threats.

Wordfence may process technical information, including IP addresses, login attempts and security events.

This processing is based on our legitimate interest in protecting the website, its users and the personal information entrusted to us.

Further information:

https://www.wordfence.com/privacy-policy/

10. Contact Forms and Cloudflare Turnstile

Our website uses Contact Form 7 to allow visitors to send enquiries.

When you contact us, we process the information you submit, including your name, email address and message, to respond to your enquiry.

We use Cloudflare Turnstile to help distinguish legitimate submissions from automated or abusive activity.

Cloudflare may process technical information relating to the device, browser and interaction with the website for security verification.

Further information:

https://www.cloudflare.com/privacypolicy/

Please avoid including sensitive medical information in ordinary website contact forms unless it is necessary for your enquiry.

11. Cookies and Consent Management

We use Complianz to manage cookie consent and help control the loading of non-essential cookies and third-party scripts.

When you visit the website, you can accept or deny optional cookies and adjust your preferences through the cookie banner.

Strictly necessary cookies may be used without consent where permitted by applicable law.

You can change or withdraw your cookie preferences using the consent settings available on the website.

Detailed information about cookies, services and their purposes is provided in our separate Cookie Policy:

https://lapland.arcticultra.de/cookie-policy-eu/

12. Locally Hosted Fonts

Our website uses fonts to display text and other visual elements.

We use OMGF to support local hosting of Google Fonts, reducing the need for visitors’ browsers to contact Google’s font servers when loading those fonts.

The use of locally hosted fonts does not ordinarily require transferring visitors’ IP addresses to Google solely for font delivery.

13. Social Media and Embedded Content

Our website may include links to or embedded content from third-party services, including:

  • Instagram
  • Facebook
  • YouTube
  • Google Maps

We use an Instagram feed integration, including Smash Balloon, to display social media content on the website.

When third-party content is activated or loaded, the relevant provider may receive information such as your IP address, browser details and interaction data. Depending on the service and your settings, the provider may also use cookies or associate activity with your existing account.

Where required, we use our consent management system to request permission before loading optional third-party services.

The providers’ own privacy policies apply to their processing activities:

We do not control the independent processing practices of these providers.

14. Website Performance and Functional Plugins

We use WP Rocket to improve website performance through caching and related technical optimisation.

We may also use technical plugins to support website functionality, weather information, email delivery and administration.

These tools may process technical information to the extent necessary for their operation.

Our use of such services is based on legitimate interests, contractual necessity or consent, depending on the particular processing activity.

15. Sharing Personal Information

We do not sell participants’ personal information.

We may share personal information with the following recipients where necessary:

  • Authorised race organisers, staff and volunteers.
  • Race medical and safety personnel.
  • External emergency medical services, hospitals and rescue organisations.
  • Technology providers supporting registration, hosting, security, communications and website operation.
  • Professional advisers, insurers or relevant authorities where necessary and legally justified.
  • Other recipients where disclosure is required by law or supported by an applicable legal basis.

Access to sensitive information is restricted according to the recipient’s responsibilities and the purpose of disclosure.

16. International Data Transfers

We operate from Sweden and use service providers that may be established in other countries.

Our Jotform account is configured to store registration form data in the European Union, in Germany.

However, some other service providers, including certain website, security, communications and social media providers, may process or access personal information outside the European Economic Area.

Where GDPR rules on international transfers apply, we seek to rely on an appropriate legal transfer mechanism, such as an adequacy decision or applicable contractual safeguards.

You may contact us for further information about relevant international transfers and safeguards.

17. Your Rights Under GDPR

Subject to applicable conditions and exceptions, you have the right to:

  • Access: Request information about the personal data we hold about you.
  • Rectification: Request correction of inaccurate or incomplete information.
  • Erasure: Request deletion of personal data where the legal requirements are met.
  • Restriction: Request that certain processing be restricted.
  • Data portability: Receive certain personal data in a structured, commonly used, machine-readable format.
  • Objection: Object to processing based on legitimate interests in circumstances provided by law.
  • Withdrawal of consent: Withdraw consent where consent is the basis for processing, without affecting earlier lawful processing.

These rights are not absolute. For example, we may need to retain information where required by law or where necessary for establishing, exercising or defending legal claims.

To exercise your rights, contact:

info@trails4u.com

We will respond in accordance with applicable GDPR requirements, normally within one month of receiving a valid request.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection:

Integritetsskyddsmyndigheten (IMY)
https://www.imy.se/

18. Information About Other People

During registration, participants may provide emergency contact information about other individuals.

Please ensure that the emergency contacts you identify are aware that their contact details have been provided to the event organiser and may be used in connection with an emergency.

We process such information for event safety and emergency communication purposes.

19. Information Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.

These measures include website security tools, access controls and restrictions on who may access sensitive registration and medical information.

Medical information is treated as confidential and should be accessed only where necessary for an authorised purpose.

No internet-based system can guarantee absolute security.

20. External Websites

Our website may contain links to external websites, registration services, social media platforms, sponsors and other third parties.

We are not responsible for the privacy practices or content of websites operated independently by those parties.

We encourage you to review their privacy policies.

21. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, data processing practices, legal requirements or website functionality.

The latest version will be published on this website, together with its date of revision.

Where required by law, we will provide additional notice or obtain consent for material changes.

22. Contact

For questions about this Privacy Policy or the handling of your personal information, please contact:

Robert Pollhammer
Lapland Arctic Ultra / TRAILS4U
Ringvägen 21
956 32 Överkalix
Sweden

Email: info@trails4u.com
Telephone: +49 (0) 174 3364854