Privacy Notice
DIB TRAVEL
Last updated: May 2026.
1. Introduction
In this privacy notice, we describe what personal data about you that we use and why, including your rights under the General Data Protection Regulation (GDPR).
This privacy notice applies to the DIB Travel Group, including:
DIB Services AB Company reg. no. 559036:8758 Box 6067, 102 31 Stockholm
DIB Professionals AB Company reg. no. 559309-9616 Box 6067, 102 31 Stockholm
DIB Denmark ApS Company reg. no. 42929557 Nymøllevej 50 DK-2800 Kongens Lyngby
DIB Services Balkan D.O.O. Company reg. no. 21247545 Prilepska 1 11040 Beograd
DIB Norge AS Company reg. no. 936 953 158 Postboks 146 Vinderen, 0319 Oslo
When referring to “DIB”, “we”, “us” or “our”, this means the relevant DIB company or companies that are responsible (either as separate controllers or joint controllers) for the processing of your personal data. For more information, see the section “Responsibility for the use of your personal data” below.
2. Who is covered by this information
This privacy notice covers you who:
- Visit and interact with our website and other digital channels.
- Represent or are a contact person of a customer that we do business with.
- Represent or are a contact person of a prospective customer.
- Make bookings or otherwise interact with DIB’s travel portal through our website or app as a user, as well as guests included in bookings.
- Represent or are a contact person of a supplier or a partner that we do or intend to do business with (such as IT and travel service providers, online travel agencies, and providers of global distribution systems (GDS)).
- Otherwise interact with us, for example if you register for an event or otherwise communicate with us.
In this privacy notice, “website” means dibtravel.com and app.dibtravel.com.
When referring to “travel portal”, this means DIB’s travel portal available for users via app.dibtravel.com or the “DIB Travel” app
3. Responsibility for the use of your personal data
User of the travel portal
If you are a user of the travel portal and DIB Services AB has a business relationship with the organisation that you represent, DIB Services AB is responsible (as controller) for the processing of your personal data.
If you are a user of the travel portal and DIB Denmark ApS has a business relationship with the organisation that you represent, DIB Denmark ApS and DIB Services AB are responsible together (as joint controllers) for the processing of your personal data.
If you are a user of the travel portal and DIB Norge AS has a business relationship with the organisation that you represent, DIB Norge AS and DIB Services AB are responsible together (as joint controllers) for the processing of your personal data.
DIB has entered into an Intra-Group Data Transfer Agreement (IGDTA), including an arrangement under article 26 of the GDPR, that sets out the roles and responsibilities of each DIB entity when processing your personal data. You have the right to obtain the essence of this arrangement upon request. This privacy notice also reflects the key elements of that arrangement.
Visitors of our website and digital channels
If you visit our website, app or other digital channels, DIB Services AB is responsible (as controller) for the processing of your personal data collected through cookies and other tracking technologies.
Main principles for other scenarios
The DIB company that is responsible (as controller) for the processing of your personal data under this privacy notice is normally the DIB company:
- that has, or is seeking, a business relationship with the organisation that you represent or for which you are a contract person; or
- with which you otherwise interact or communicate.
4. What personal data we process
In the below table we describe what categories of personal data that we process with examples of types of personal data covered by each category.
Categories of personal data: Examples of types of personal data
Account details: Username, password, user profile
Background check data: Results from background checks, for example KYC checks
Communication data: Content in e-mail and other forms of communication
Contact information: Address, e-mail address, phone number
Event data: Type of event, participants, preferences
Feedback data: Feedback, opinions, answers from surveys
Identity data: Name, personal identity number, signature
Organisational data: Title, position and the company or organisation that you work for
Payment data: Payment card details, payment method, amount
Picture, video and audio material: Video, photos, audio recordings
Technical data: Type of device, IP address, version of web browser and operating system
Travel and logistics data: Travel itinerary, hotel or other accommodation details, travel preferences, including dietary preferences and allergies, as well as accessibility needs and health related requirements
Travel documentation: Personal data included in passports, visas and national ID cards (for example full name, passport/visa number, nationality, date and place of birth, sex, photo and signature, type of visa, duration of stay/validity period), as well as travel tickets (for example booking reference, destination and other itinerary details) and loyalty travel data
User generated data: Click and visit statistics on the website, user preferences, interactions when using the website and other digital channels
5. From which sources we collect personal data
The personal data that we collect about you is mainly collected directly from yourself when you provide your personal data to us, for example when you contact or otherwise communicate with us, use our travel portal or visit our website or other digital channels.
We also collect, where necessary, personal data from other sources as described below.
- Group companies, which have collected your personal data and shared them with us, for example in connection with communication and to conduct our business in general.
- The company or organisation that you work for, for example if someone else in the company or organisation you work for makes a booking in DIB`s travel portal involving you.
- Social network platforms if you follow or interact with us on social media.
- Partners that we collaborate with, for example travel service providers and partners to carry out events or similar activities.
- Global distribution system (GDS) providers, to handle bookings.
- External persons that we communicate with for the purposes described in this privacy notice.
6. For which purposes we use your personal data
We collect and use personal data for various purposes. The purposes for which we in practice process your personal data may, however, vary depending on your relationship with us or how you interact with us.
To read more about which personal data, which legal basis that we rely on for the processing of your personal data for each purpose and for how long your personal data is stored in relation to the relevant categories of individuals, please see our detailed information on our use of personal data.
7. How we share your personal data
Transfer of personal data to other external recipients (controllers)
We share your personal data with external recipients where necessary for the purposes described in this privacy notice. These recipients act as controllers for their own processing of your personal data, unless stated otherwise.
For more details on the purposes for which we share your data and the legal bases for such sharing, please see our detailed information on our use of personal data, which outlines the external recipients associated with each processing purpose.
Transfer of personal data to service providers (processors)
We also transfer personal data to service providers that we have engaged (including group companies) when necessary for the purposes for which we process personal data as described in this privacy notice.
These service providers (including group companies) provide, for example, IT, financial and other administrative services, development services and communication services to us. The service providers which process personal data on our behalf and in accordance with our instructions act as data processors in relation to us. These service providers may not process your personal data for their own purposes and are legally and contractually obligated to protect your personal data.
Where we process your personal data
As a main rule, we store your personal data within the EU/EEA. However, in certain cases, we transfer your personal data to recipients located in third countries outside the EU/EEA, for example to service providers engaged by us.
To ensure an essentially equivalent level of protection for your personal data when transferred (or otherwise made available) to service providers in third countries which do not provide an adequate level of protection, we generally rely on the EU Commission’s adopted standard contractual clauses for international transfers according to decision 2021/914 and implement supplementary measures as necessary to ensure an essentially equivalent level of protection for your personal data as provided under the EU GDPR.
We also rely upon adequacy decisions issued by the EU Commission where personal data is transferred to countries and recipients covered by such decisions (i.e. where the EU Commission has determined that such country and/or recipient provides an adequate protection). By way of example, this includes the EU-US Data Privacy Framework for transfers to the United States.
Moreover, where relevant, we rely on specific provisions in Article 49 of the GDPR, such as where the transfer is necessary for the performance of a contract between us and you or is necessary to conclude such contract.
8. Your rights
Rights in relation to the use of your personal data
You have the following rights in relation to your personal data under the GDPR:
- Access to and receive a copy of your personal data (Article 15).
- Rectify or supplement your personal data (Article 16).
- Withdraw your consent to a processing of your personal data (Article 7).
- Delete your personal data (Article 17).
- Object to a processing of your personal data (Article 21).
- Restrict a processing of your personal data (Article 18).
- Obtain a copy of your personal data and have your personal data transferred to an external recipient (data portability) (Article 20).
Automated individual decision-making
We do not carry out any automated individual decision-making which have legal effects or similar significant effects on you.
Further information on your rights
Please note that each right above comes with certain caveats and exemptions. This means that these rights only may be successfully exercised in certain situations. For more information on your rights and when they apply, see for example the information provided by the Swedish Authority for Privacy Protection available on their website.
Exercise your rights
If you wish to exercise your rights at any time, please contact us on the contact details under section 8 “If you have any questions” below.
If possible, we would grateful if you use the e-mail address that you have registered with us or used when you have previously been in contact with us. This would make it easier for us to manage your request.
Right to lodge a complaint
You have the right to lodge a complaint with your supervisory authority. Contact details to the data protection authorities in the EU/EEA can be found here.
9. If you have any questions
Please contact us by e-mail at info@dibtravel.com if you have any questions about this privacy notice, how we use your personal data or if you wish to exercise your rights.
You can also find contact details to each DIB entity here: https://dibtravel.com.
Detailed information on our use of personal data
Introduction
In this detailed information on our use of personal data, we explain the purposes for which we use personal data, the categories of personal data processed for each purpose, our legal basis for the use, for how long we store personal data and with which external recipients (in their role as controllers) that we share your personal data for each purpose.
Detailed information on our use of personal data
Visitors of our website and digital channels
Follow up on and evaluate the use of our website and digital channels
| What we do: We process your personal data to better understand how our website and digital channels are used, for example by analysing numbers of visitors and activities on our webpages. This is carried out by using cookies and similar technologies which allow us to analyse visitor and user statistics. | ||
|---|---|---|
| Categories of personal data: User generated data Technical data | Legal basis: Consent (Article 6.1 (a) of the GDPR). The processing relies on the consent that you provide by accepting the use of cookies and similar technologies for the same purpose. | External recipients: |
| Storage period: Personal data is stored during the period stated in our cookie information available on the website. |
Improve the user experience on our website and in our digital channels
| What we do: We process your personal data to provide a more personalised and user-friendly experience when visiting our website and digital channels. This is carried out by using cookies and similar technologies which inter alia allow us to remember user preferences such as language, screen and device settings. | ||
|---|---|---|
| Categories of personal data: User generated data Technical data | Legal basis: Consent (Article 6.1 (a) of the GDPR). The processing relies on the consent that you provide by accepting the use of cookies and similar technologies for the same purpose. | External recipients: |
| Storage period: Personal data is stored during the period stated in our cookie information available on the website. |
Provide marketing and tailored content on our website and in our digital channels
| What we do: If you visit our website or digital channels, we collect your personal data by using cookies and similar technologies to provide you with marketing and other tailored content which we believe are of interest to you, for example based on your interactions with our digital channels, including our website (such as browsing behaviour and websites visited). | ||
|---|---|---|
| Categories of personal data: User generated data Technical data | Legal basis: Consent (Article 6.1 (a) of the GDPR). The use of your personal data relies on the consent that you provide by accepting the use of cookies and similar technologies for the same purpose. | External recipients: Social media providers |
| Storage period: Personal data is stored during the period stated in our cookie information available on the website. |
Ensure functionality on our website and in our digital channels
| What we do: We process your personal data to ensure necessary technical functionality and security on our website and in our digital channels, for example by using strictly necessary cookies and other technologies on these platforms. Since the cookies and similar technologies are necessary in order to provide our website as intended, your consent to our use of cookies and similar technologies is not needed. | ||
|---|---|---|
| Categories of personal data: Technical data | Legal basis: Legitimate interest (Article 6.1 f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of ensuring technical functionality on our website and in our digital channels. It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, given the purpose of the processing as such and that only basic personal data is processed for this purpose. | External recipients: |
| Storage period: Personal data is stored during the period stated in our cookie information available on the website. |
Contact persons of customers
Manage the business relationship with customers
| What we do: We process your personal data to manage the customer relationship, for example to communicate with you as a contact person or representative of such organisation, register you as a contact person as well as manage orders and invoices. | ||
|---|---|---|
| Categories of personal data: Communication data Contact information Identity data Organisational data | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest in managing the business relationship with our customers and thereby fulfil our rights and obligations under relevant contracts. Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, since we otherwise would not be able to manage the relationship. | External recipients: Group companies |
| Storage period: Personal data is stored for this purpose as long as there is an active relationship with the customer. |
Follow up on and evaluate sales and campaigns
| What we do: We process your personal data to follow up on and evaluate our sales and campaigns that we carry out, for example to compile statistics of orders and in general to better understand what services that are used by our customers and how. This in order for us to obtain a better understanding and insight in our customers’ behaviours and patterns, to allow us to develop and improve our business for the benefit of our customers. We do not carry out any profiling activities in relation to your personal data for this purpose, since analyses are made on an aggregated level. We are not interested in your specific behaviour, but instead our customers’ behaviours on an aggregated level. | ||
|---|---|---|
| Categories of personal data: Communication data Feedback data Identity data Organisational data | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of follow up on and evaluate our sales and campaigns that we carry out. Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since reports and statistics only are saved on an aggregated level and that the information therefore cannot be related to you. | External recipients: |
| Storage period: Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice. |
Provide offers and marketing
| What we do: We process your personal data to provide you offers and marketing in different channels, for example via e-mail, regarding our services. Such communication may also include newsletters and other business-related communication, which necessarily are not tailored to your profile. No profiling will take place in connection with this processing. However, we may tailor which target groups that shall receive a certain offer or marketing communication on an organisation level, for example based on where the customer is established geographically, on previous orders and your position/role, to ensure that the communication is relevant for you. We will only send you communication for marketing purposes if you have not objected (opted out) to such communication. | ||
|---|---|---|
| Categories of personal data: Contact information Identity data Organisational data | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of providing you with relevant offers and marketing. Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since you always may decline or unsubscribe to such communication for this purpose and since we have a professional relationship to you. | External recipients: |
| Storage period: Personal data is stored for this purpose as long as we have an active customer relationship with the customer that you represent and for a period of twelve (12) months thereafter. You can always unsubscribe from the relevant communication by clicking on the unsubscribe link in the e-mail or similar communication field or by contacting us. |
Communicate about us and our services
| What we do: We process your personal data to send you communications about us and our services in different channels, for example via e-mail. This to, for example, provide you with updates regarding our business, information about new features in and changes to our services. | ||
|---|---|---|
| Categories of personal data: Identity data Contact information Organisational data | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of communicating about us and our services. It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since we only will provide you with important updates and news regarding our services and business. | External recipients: |
| Storage period: Personal data is stored for this purpose as long as we have an active customer relationship with the customer that you represent and for a period of twelve (12) months thereafter. |
Carry out surveys to improve and develop our services
| What we do: We process your personal data to improve and develop our services. By way of example, this involves carrying out customer surveys, including determining to which target group we shall send a survey, which questions to be asked in a survey, sending out the survey and collecting and analysing the results from a survey. Your opinions about our business are important to us. You can always unsubscribe from our communication about surveys by clicking on the unsubscribe link in the e-mail or similar communication field or by contacting us. | ||
|---|---|---|
| Categories of personal data: Communication data Contact information Feedback data Identity data | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of carrying out surveys in order to obtain your opinions of our business. Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since it is voluntary to participate in surveys. | External recipients: |
| Storage period: Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice. |
Contact persons of prospective customers
Communicate with you regarding our services and products
| What we do: We process your personal data to communicate with you about our services, for example if you represent or is a contact person of an organisation that has shown interest in our services by interacting with us or if we otherwise have reasons to believe that the relevant organisation is interested in our services. We will only use your personal data for marketing purposes where permitted by applicable law, including where you have provided consent or have not objected (opted out) to such communications. | ||
|---|---|---|
| Categories of personal data: Communication data Contact information Identity data Organisational data | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The use of your personal data is necessary to satisfy our legitimate interest of communicating with you about our services. It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since only limited personal data would be used for this purpose and that you can always opt-out from the processing. | External recipients: |
| Storage period: Personal data is stored for this purpose for a period of 24 months from the collection or the last communication with you concerning our services for this purpose. You can always unsubscribe from the relevant communication by clicking on the unsubscribe link in the e-mail or similar communication field or by contacting us. |
Carry out sales meetings and demos
| What we do: We process your personal data to carry out sales meetings and demos of our services, including communicating with you for the same purpose. | ||
|---|---|---|
| Categories of personal data: Picture, video and audio material Identity data Communication data Contact information Organisational data | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The use of your personal data is necessary to satisfy our legitimate interest of carrying out sales meetings and demos. It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, given the limited impact that the processing of personal data may have. | External recipients: |
| Storage period: Personal data is stored for this purpose during the period the meeting or activity is carried out. |
Users of the travel platform
Manage your user account and access to the travel portal
| What we do: We process your personal data to manage your user account for the travel portal, for example to set up your user account and provide you with access to our services while logged in to the travel portal. | ||
|---|---|---|
| Categories of personal data: Identity data Account details Organisational data Contact information | Legal basis: Performance of the agreement with you (Article 6.1 (b) of the GDPR). The processing of your personal data is necessary to fulfil the agreement with you according to our terms and conditions. | External recipients: |
| Storage period: Personal data is stored for this purpose for as long as your user profile is deemed active. |
Mediate business travel reservations and bookings
| What we do: We process your personal data to manage travel reservations and bookings via our platform, for example when transportation (such as airline tickets and rail transport services) and accommodation (such as hotels) are reserved/booked. For example, this includes to transmit the reservation/booking (including travel documents) to relevant global distribution system (GDS) providers and travel service providers, issue booking confirmations, as well as enable cancellations, refunds and changes. Travel reservations and bookings may also be made by us manually outside the platform (directly on the supplier’s website), depending on the type of travel request made by you or the organisation you represent. Normally, DIB will also process your personal data to manage payments (for example when issuing invoices to the organisation you represent) and to manage refunds. DIB will act as an intermediary/agent for the reservations and bookings on behalf of the travel service provider in question. This means that the organisation who you represent will enter into a contact with the relevant travel service provider when a reservation/booking is made. | ||
|---|---|---|
| Categories of personal data: Identity data Account details Organisational data Travel documentation Travel and logistics data Contact information | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The use of your personal data is necessary to satisfy our legitimate interest in fulfilling the agreement with the organisation you represent regarding travel reservations and bookings. It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose. Otherwise, we would not be able to manage your reservations and bookings. Explicit consent (Article 9.2 (a) of the GDPR). If you have submitted any special categories of personal data in connection with the reservation or booking, such as allergies or accessibility needs (health data), we will obtain your explicit consent to process and transmit such information to the relevant travel service provider. | External recipients: Travel service providers (such as accommodation providers, airlines and other transportation companies) GDS providers |
| Storage period: Personal data is stored for this purpose until the reservation/booking has been completed. |
Manage private travel reservations and bookings
| What we do: If you have signed up as a user via the organisation you work for, you are also able to make private travel reservations and bookings via our travel portal. We will process your personal data in a similar way as described under the processing activity “Mediate business travel reservations and bookings”. In these situations, we will also process your payment data (such as payment card details and payment method) related to you as an individual. | ||
|---|---|---|
| Categories of personal data: Identity data Account details Organisational data Travel documentation Travel and logistics data Payment data Contact information | Legal basis: Performance of the agreement with you (Article 6.1 (b) of the GDPR). The processing of your personal data is necessary to fulfil the agreement with you according to our terms and conditions. | External recipients: Travel service providers GDS providers |
| Storage period: Personal data is stored for this purpose until the reservation/booking has been completed. |
Ensure your safety while travelling (duty of care)
What we do: Duty of care refers to an organization’s choice and responsibility to protect travellers from hazards and threats. As part of the services provided to Dib Travel’s customers, this includes traveller tracking and risk alerts.
To provide this service, we process your personal data in order to:
send you communications regarding ongoing incidents,
share relevant location information with your employer, according to the preferences configured for this service.
This enables us, for example, to provide you with updates about critical events and to help your employer support you and other travellers in affected areas in an appropriate manner.
This service does not involve the processing or storage of any additional personal data beyond the travel reservations and bookings described above.
| Categories of personal data: Identity data Account details Organisational data Travel documentation Travel and logistics data Contact information | Legal basis: Performance of the agreement with you (Article 6.1 (b) of the GDPR). The processing of your personal data is necessary to fulfil the agreement with you according to our terms and conditions. | External recipients: |
|---|
Communicate about us and our services
| What we do: We process your personal data to send you communications about us and our services in different channels, for example via e-mail or in the travel portal. This to, for example, provide you with updates regarding our business, information about new features in and changes to our services, including the travel platform. Certain content in the platform may be tailored to you based on your position/role. | ||
|---|---|---|
| Categories of personal data: Identity data Account details Contact information | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of communicating about us and our services. It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since we only will provide you with important updates and news regarding our services and business. | External recipients: |
| Storage period: Personal data is stored for this purpose for as long as your user profile is deemed active. |
Follow up on and evaluate the use of our travel platform
| What we do: We process your personal data to better understand how our travel platform is used, for example by analysing numbers of users and how they interact with the platform. This is carried out by using cookies and similar technologies which allow us to analyse visitor and user statistics. | ||
|---|---|---|
| Categories of personal data: User generated data Technical data | Legal basis: Consent (Article 6.1 (a) of the GDPR). The processing relies on the consent that you provide by accepting the use of cookies and similar technologies for the same purpose. | External recipients: |
| Storage period: Personal data is stored during the period stated in our cookie banner available on the user platform. |
Carry out analysis for user and customer insights
| What we do: We process your personal data to carry out analyses for user and customer insights on an aggregated level. Mainly this is done to better understand how you are using are services, for example means of travel, booking patterns, preferences (such as type of accommodation and destinations). This in order for us to obtain a better understanding and insight in our users’ and customers’ behaviours and patterns, to allow us to develop, tailor and improve our business, but also to provide users with relevant features and content on the platform. The aggregated statistics are also compiled for the benefit of our users and customers, for example to allow them to receive recommendations on popular travel arrangements but also to provide customers with insight on how you and other users (on an aggregated level) are using the services. We do not carry out any profiling activities in relation to your personal data for this purpose, since analyses are made on an aggregated level. We are not interested in your specific behaviour, but instead users’ behaviours on an aggregated level. | ||
|---|---|---|
| Categories of personal data: Travel and logistics data Identity data User generated data Technical data Organisational data Account details | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of carrying out analyses for customer insights. This in order for us to develop and improve our business for the benefit of DIB and our customers. Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, since reports and statistics only is saved on an aggregated level and that the information therefore cannot be related to you. | External recipients: Group companies |
| Storage period: Personal data is stored for this purpose during 24 months from the date of collection. Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice. |
Follow up on and evaluate the business
| What we do: We process your personal data to compile reports and statistics on an aggregated level to follow-up and analyse the business, for example on reservations and bookings to better understand how our travel platform and business perform. We do not profile your personal data for this purpose. | ||
|---|---|---|
| Categories of personal data: Travel and logistics data Identity data Organisational data Account details | Legal basis: Legitimate interest. The processing is necessary in order to satisfy our legitimate interest of follow-up on and analysing the business. Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since reports and statistics only are saved on an aggregated level and that the information therefore cannot be related to you. | External recipients: Group companies |
| Storage period: Personal data is stored for this purpose during 24 months from the date of collection. Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice. |
Follow up on and evaluate sales and campaigns
| What we do: We process your personal data follow up on and evaluate our sales and campaigns that we carry out, for example to compile statistics of reservations and bookings and in general to better understand what features and services that are used by users and how. This in order for us to obtain a better understanding and insight in our users’ behaviours and patterns, to allow us to develop and improve our business, including the travel platform, for the benefit of our customers and you as a user. We do not carry out any profiling activities in relation to your personal data for this purpose, since analyses are made on an aggregated level. We are not interested in your specific behaviour, but instead our users’ behaviours on an aggregated level. | ||
|---|---|---|
| Categories of personal data: Travel and logistics data Identity data Organisational data Account details | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of follow up on and evaluate our sales and campaigns that we carry out. Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since reports and statistics only are saved on an aggregated level and that the information therefore cannot be related to you. | External recipients: |
| Storage period: Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice. |
Contact persons of suppliers and partners
Manage the relationship with suppliers and partners
| What we do: We process your personal data to manage our business relationship with the company or organisation that you work for or represent, for example to register you as a contact person, manage invoices and to communicate with you. We also process your personal data where necessary to register orders for products and services, respond to requests for proposals (RFPs) and communicate with you for the same purpose. | ||
|---|---|---|
| Categories of personal data: Communication data Contact information Identity data Organisational data | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of managing the business relationship with our suppliers and partners. It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since we otherwise would not be able to manage the relationship with the company or organisation that you represent. | External recipients: Group companies |
| Storage period: Personal data is stored for this purpose as long as there is an active business relationship with the company or organisation that you work for or represent. |
Follow up and evaluate the supplier and partner relationship
| What we do: We process your personal data to evaluate the relationship with the company or organisation that you work for or represent, for example by generating statistics on orders of our services. This to better understand how the relationship is working between us and the relevant supplier or partner. | ||
|---|---|---|
| Categories of personal data: Communication data Contact information Identity data Organisational data | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of following up and evaluating the supplier or partner relationship. It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since reports and statistics only are saved on an aggregated level and that the information therefore cannot be related to you. | External recipients: |
| Storage period: Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice. |
All individuals above and other external persons
Respond to questions and provide customer service
| What we do: We process your personal data to respond to questions when you contact us to provide customer service, for example if you have questions about our business and services in your role as a contact person of a customer, supplier or partner to us. | ||
|---|---|---|
| Categories of personal data: All personal that you provide to us and is necessary to assist you in the matter. | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of responding to questions and to provide customer service. It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially when you yourself have reached out to us. | External recipients: Group companies |
| Storage period: Personal data is stored for this purpose as long as necessary to respond to and manage the matter. |
Recordings of phone calls for safety, quality and training purposes
| What we do: If you contact our travel support, we may record the conversation with you for safety and quality purposes, for example to ensure that we provide accurate information, handle your request correctly, and maintain a high level of customer service. The recordings may also be used for internal training of our staff, for example where we review conversations to identify areas for improvement, enhance service quality, and ensure consistent handling of customer requests. You will be informed in advance that the call may be recorded before any recording takes place. If you do not wish to be recorded, we ask you to contact us through other means than phone, for example via e-mail. | ||
|---|---|---|
| Categories of personal data: All personal data that you provide to us during the travel support conversation and that is recorded. | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest in ensuring service quality, improving our customer support, and providing training to our staff. It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially as you are informed in advance, the recordings are used in a controlled manner, and retained for a limited period. | External recipients: Group companies |
| Storage period: Personal data in recordings is stored for this purpose for a period of twelve (12) months from when the recording was made. |
Carry out meetings, events and similar activities
| What we do: We process your personal data to carry out meetings, events and similar activities, for example to register your participation, carry out the activity and to communicate with you about the activity. | ||
|---|---|---|
| Categories of personal data: Picture, video and audio material Communication data Contact information Identity data Organisational data Event data | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The use of your personal data is necessary to satisfy our legitimate interest of carrying out meetings, events and similar activities. It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially if you have voluntarily signed up for or participates in the activity. | External recipients: Partners Group companies |
| Storage period: Personal data is stored for this purpose during the period the meeting, event or activity is carried out. |
Follow up and evaluate activities carried out
| What we do: If you have participated in an activity that we have carried out, for example a meeting, a demo, or an event, we process your personal data to follow up and evaluate the activity, for example to compile statistics of the number of participants and to plan for future activities. | ||
|---|---|---|
| Categories of personal data: Picture, video and audio material Communication data Contact information Identity data Organisational data | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of following up and evaluating activities carried out. It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since it concerns harmless personal data. | External recipients: |
| Storage period: Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice. |
Document the business
| What we do: We process your personal data to document the business and activities relating to our business, for example in connection with company milestones, events, including personal data in legal documents and other material which we deem are of interest for the business to keep. | ||
|---|---|---|
| Categories of personal data: Relevant categories of personal data as are necessary for the purpose. | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of documenting the business. It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose. | External recipients: Group companies |
| Storage period: Personal data is stored for this purpose until further notice. |
Develop and improve the business
| What we do: We process your personal data to develop and improve the business, including our services and products. By way of example, this includes to draft reports, analyses and compile statistics of various activities and events (such as sales, results and partnerships). | ||
|---|---|---|
| Categories of personal data: Relevant categories of personal data as are necessary for the purpose. | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of developing and improving the business. It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose. | External recipients: |
| Storage period: Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice. |
Manage sales and restructuring of all or parts of the business
| What we do: If all or parts of the business would be sold, or in any other way transferred or restructured, we process your personal data where necessary for this purpose. Should the business be transferred to a buyer, your personal data would also be transferred and disclosed to the buyer. The buying company would in such case be responsible (data controller) for your personal data and the processing that takes place for the same purposes as stated in this privacy notice, unless you receive any other information in connection with the sale. | ||
|---|---|---|
| Categories of personal data: Relevant categories of personal data as are necessary to manage the sale or restructuring of all or parts of the business in each case. | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of managing a sale or restructuring of all or parts of the business. It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose if the buyer carries out the same or similar type of business that we do. | External recipients: Buyers/investors Potential buyers/investors External advisors Group companies Public authorities |
| Storage period: Personal data is stored for this purpose for the period that is necessary to manage the sale or the restructuring. |
Manage, defend and exercise legal claims
| What we do: We process your personal data where necessary to manage, defend and exercise legal claims in an individual case, for example in connection with a dispute or a court proceeding. | ||
|---|---|---|
| Categories of personal data: Relevant categories of personal data needed for managing and defending a legal claim in the individual case. | Legal basis: Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of managing, defending and exercising legal claims. It is our assessment that our legitimate interest clearly outweighs your interest of not having your personal data processed for this purpose. | External recipients: Counterparty Courts Debt collecting companies External advisors Insurance companies Relevant authorities |
| Storage period: Personal data is stored for this purpose for the period as necessary to manage, defend and/or exercise the legal claims. |
Fulfil our legal obligations
| What we do: We process your personal data where necessary to fulfil our legal obligations, for example accounting obligations and obligations under applicable data protection laws. | ||
|---|---|---|
| Categories of personal data: Relevant categories of personal data that are necessary to fulfil the specific legal obligation. | Legal basis: Fulfil legal obligation (Article 6.1 (c) of the GDPR). The use of your personal data is necessary to fulfil our legal obligations. | External recipients: Relevant authorities |
| Storage period: Personal data is stored for such period that is necessary in order for us to fulfil the specific legal obligation. By way of example, personal data in accounting material is stored for seven (7) years calculated from the end of the calendar year when the relevant fiscal year ended according to the Swedish Accounting Act (1999:1048). |
Ensure technical functionality and security in our IT systems
| What we do: We process your personal data to ensure necessary technical functionality and security in our IT systems, for example in connection with backups, access controls and troubleshooting. | ||
|---|---|---|
| Categories of personal data: All categories of personal data that are stated in relation to the purposes of processing your personal data. | Legal basis: Legitimate interest (Article 6.1 f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of ensuring technical functionality and security of our IT systems. It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose. | External recipients: |
| Storage period: Personal data is stored for the same period as stated in relation to each relevant purpose of the processing. |
Respond to legal requests
| What we do: We process your personal data to respond to legal requests from authorities, for example law enforcement, tax authorities or any other authorities. | ||
|---|---|---|
| Categories of personal data: All categories of personal data as necessary to respond to and evaluate the request in each case. | Legal basis: Fulfil legal obligation (Article 6.1 (c) of the GDPR). The processing of your personal data is necessary to fulfil our legal obligations. Legitimate interest (Article 6.1 f) of the GDPR). If there is no explicit legal obligation requiring that we respond to the legal request, but we consider that we and the public authority have a legitimate interest (which outweighs your privacy interest), we rely on this legitimate interest for the use of your personal data for this purpose. | External recipients: Relevant authorities |
| Storage period: Personal data is stored for this purpose for the period that is necessary to respond to the specific legal request and thereafter for the period as necessary to document the request and our response to the request. |