At Destination Gotland we care about a high level of protection for our customers' personal privacy. You should always feel safe when you provide your personal data to us We want with this Privacy Policy to show how we ensure that your personal data is processed in accordance with applicable personal data legislation 1. General "Privacy Policy" describes how we Destination Gotland AB, reg. no. 556038-2342, Korsgatan 2, Box 1234, 621 23 Visby, e-mail: info@destinationgotland.se, ("Destination Gotland", "we") collect, use, disclose and store your personal data. The Privacy Policy applies when Destination Gotland provides services and products in connection with the purchase of travel or accommodation, customer cases and other contact with Destination Gotland, such as visits to the website. The Privacy Policy also applies to the processing of personal data carried out in connection with holding an account in the customer club "Min Destination" 2. Data controller Destination Gotland is the data controller for Destination Gotland's processing of your personal data and is responsible for ensuring that such processing is carried out in accordance with applicable legislation 3. When do we process your personal data? 3.1 In order for you to be able to visit our website, book travel or accommodation or contact us for service or information we must collect and process personal data about you 3.2 Destination Gotland collects and processes personal data about you when you make a booking, regardless of whether it is on the website, in the app, by phone booking or physically at one of our terminals. The information collected from you at bookings and purchases is required for you to be able to enter into an agreement with Destination Gotland, in accordance with applicable legislation, and for Destination Gotland to be able to provide its services and offers 3.3 If you are an Account Holder Destination Gotland collects personal data about you that you provide when registering your account, and during the time you are an Account Holder within the framework of your account, such as your travel and purchase history 4. What personal data do we process about you? 4.1 For you who are a customer of Destination Gotland The personal data we collect and process about you as a customer who makes a booking are: - Name - Date of birth - Gender - Nationality - Any disability - Address - Telephone number and e-mail - Payment details 4.2 For you who are an account holder The personal data Destination Gotland collects and processes about you as an Account Holder are: - Name - Personal identity number - Gender - Nationality - Any disability - Address - Telephone number and e-mail - Payment details - Account information 4.3 For you who are a member of "Min Destination" - The personal data Destination Gotland collects and processes about you as an Account Holder are: - Name - Date of birth - Gender - Nationality - Address - Telephone number and e-mail - IP address and information about your use of Destination Gotland's website - Information about which of our services or offers you have been interested in, how you interact with our newsletters 5. Why do we process data about you? 5.1 For you who are a customer of Destination Gotland Destination Gotland processes your personal data for various purposes. Mainly we process your personal data for the purpose of: - Fulfilling our obligations to you as a customer, such as carrying out bookings, purchases, invoicing and providing support - Enabling general customer service, such as answering questions and correcting incorrect information - Sending information by post, e-mail, SMS and telephone - Complying with applicable legislation, for example accounting legislation and maritime regulations The data may also constitute a basis for statistics as well as market and customer analyses 5.2 For you who are an account holder In addition to the list above Destination Gotland processes personal data about Account Holders also for the purpose of: - Administering the account - Enabling you to use the account's benefits such as the possibility to save co-travelers, prefilled information - Enabling communication with you as an Account Holder via post, e-mail, telephone or SMS 5.3 For you who are a member of "Min Destination" Destination Gotland processes your personal data for the purpose of: - Providing special offers - Enabling communication with you via post, e-mail, telephone or SMS - Enabling personalized offers, marketing and event invitations via telephone, post, e-mail and SMS/MMS 6. The legal bases for our processing of your personal data 6.1 Destination Gotland bases the processing of your personal data on a number of legal bases. These are described in this section 6.2 We process, among other things, your personal data in order to be able to fulfil the contract with you as a customer, as an account holder or as a member of Min Destination. For example, we need to be able to identify you as a customer in order to handle your bookings and payments 6.3 Some of the processing of personal data that we perform is based on a so-called balancing of interests. This applies, for example, to the processing we carry out in order to be able to send traffic information and important messages. Destination Gotland does not process sensitive personal data on the basis of a balancing of interests and does not perform any processing that constitutes profiling on the basis of a balancing of interests 6.4 As a member of Min Destination the processing of personal data is based on consent. This applies, for example, to the processing we perform in order to be able to send offers, information and inspiration. You can at any time choose to withdraw a consent you have given. Destination Gotland uses profiling to be able to send relevant information and offers to members of Min Destination 6.5 In some cases Destination Gotland may have a legal obligation to process your personal data. This applies, for example, to processing of personal data that we perform in order to fulfil the requirements of accounting legislation and maritime regulations 7. Profiling 7.1 Destination Gotland may process your personal data through profiling if you are a member of Min Destination. If you are a member information about how you use our website is analysed, which of our services and offers you have been interested in, which of our newsletters you have interacted with, details about your travels, purchases and information in order to provide you with offers that we think suit you 7.2 You can at any time object to the processing of personal data through profiling. You do this by e-mailing: info@destinationgotland.se. When Destination Gotland has received your notice we will stop processing your personal data for this purpose 8. How long do we store data about you? 8.1 Your personal data is stored only as long as there is a need to store them to fulfil the purposes for which the data were collected in accordance with this Privacy Policy. The information you have provided for booking and booking management will be stored for up to 7 years, personal data will be pseudonymized after 3 years 8.2 Destination Gotland may retain the data longer if it is necessary to comply with legal requirements or to safeguard Destination Gotland's legal interests, for example if a legal process is ongoing 9. Who do we disclose personal data to? 9.1 Destination Gotland may disclose your data to data processors. In cases where it is necessary to be able to perform our services we share your personal data with companies that are so-called data processors for us. A data processor is a company that processes information on our behalf and according to our instructions. We have data processors who help us with: - Payment solutions – payment service providers such as banks and card acquiring companies - IT services – companies providing operation, technical support and maintenance of our IT solutions - Information distribution – e-mail and SMS services linked to traffic information - Marketing – media and advertising agencies. Print and distribution. Social media - Subcontractors of services in Destination Gotland's offering – accommodation providers, event companies, bus companies When your personal data is shared with data processors it is only for purposes that are compatible with the purposes for which we collected the information, e.g. to be able to fulfil our obligations under the contract 9.2 Personal data may further be disclosed by Destination Gotland if it is necessary to comply with applicable legal requirements or requirements from authorities, to protect Destination Gotland's legal interests or to detect, prevent or discover fraud and other security or technical issues 9.3 Destination Gotland processes your personal data within the EU/EEA area. In cases where your data would be used outside the EU, e.g. by one of our service providers, we always ensure that there are safeguards in place, such as data transfer agreements, so that the recipients process the data in the same secure way as we do 9.4 Destination Gotland will not sell your personal data to third parties unless we have your consent to do so 10. What are cookies and how do we use them? A cookie is a small text file that is stored on your computer. It contains information to improve your experience. Some cookies on www.destinationgotland.se are used to improve the website. These cookies save statistics about, for example, the visitor's operating system and browser and which pages are more or less visited. No personal information is stored. Other cookies, so-called session cookies, are used for purely technical reasons for our online booking. Without session cookies the online booking would not function, because they keep track of your session ID during the time you book. Session cookies on our website are temporary and disappear when you close the browser If you do not allow cookies, the online booking will not have full functionality. However, our information pages work without cookies If you do not want to allow storage of cookies, you can search for information about this in your browser's help function You can read more about cookies in general on the Post and Telecom Authority's website, pts.se 11. How do we protect your personal data? We use IT systems to protect the confidentiality, integrity and availability of personal data. We have taken security measures to protect your personal data against unlawful or unauthorised processing. Only those persons who actually need to process your personal data in order for us to be able to fulfil our stated purposes have access to them With regard to sensitive personal data we have established special authorization controls, which means an even higher level of protection for your personal data 12. Your rights 12.1 Destination Gotland is responsible for ensuring that your personal data is processed in accordance with applicable legislation 12.2 Destination Gotland will at your request or on its own initiative correct, de-identify, delete or supplement information that is found to be incorrect, incomplete or misleading 12.3 You have the right to request: – Access to your personal data. This means that you have the right to request an extract of the register over the processing we carry out concerning your personal data. You also have the right to receive a copy of the personal data that is processed. You have the right once per calendar year, through a written and signed request, to receive a register extract free of charge of which personal data is registered about you – Correction of your personal data. At your request we will as soon as possible correct the incorrect or incomplete data we process about you – Deletion of your personal data. This means that you have the right to request that your personal data be deleted if they are no longer necessary for the purpose for which they were collected. However, there may be legal requirements that we do not immediately delete your personal data, for example in accounting and tax legislation – Restriction of processing. This means that your personal data are marked so that they may only be processed for certain limited purposes 12.4 Destination Gotland will notify each recipient to whom the personal data have been disclosed pursuant to section 9 above of any corrections or deletions of data as well as restriction of processing of the data 12.5 Right to data portability. You have the right to request that the data concerning you and which you have provided to us be transferred to another data controller (so-called data portability) A prerequisite for data portability is that the transfer is technically possible and can be done automatically 12.6 If you do not want Destination Gotland to process your personal data for direct marketing you always have the right to withdraw your consent. Objection to such processing is made by e-mail to info@destinationgotland.se. When we have received your objection we will cease to process the personal data for such marketing purposes 12.7 If you consider that our processing of your personal data is in violation of applicable data protection legislation we would be happy to hear from you, and you also have the right to file a complaint with the Swedish Authority for Privacy Protection (IMY) 13. Changes to the privacy policy Destination Gotland has the right to make changes to the Privacy Policy. The latest version of the Privacy Policy is always available on our website. For updates that are decisive for our processing of personal data or updates that are not decisive for the processing but that may be of decisive importance to you, we will inform on destinationgotland.se and by e-mail before the updates come into effect 14. Contact information Contact us if you have any questions about our Privacy Policy or the processing of your personal data. Our contact information can be found below POSTAL ADDRESS Destination Gotland AB Box 1234 621 23 Visby E-MAIL dataskydd@destinationgotland.se Last updated: 15 May 2018