1. Introduction

We value your privacy; therefore, we focus on security and how we handle and store your personal data.

This document describes how Orsa Grönklitt Friluftsanläggning AB (publ.) manages your personal data and outlines your rights. This information is directed to those who:

• Are existing customers.
• Visit our website or connect to any of our open Wi-Fi networks.
• Participate in our marketing activities, such as guest surveys or competitions.
• Communicate with us, e.g., via our customer service.
• Are suppliers, partners, shareholders, or have other professional relations with us.

We strive to ensure that your collected personal data is handled and stored in accordance with data protection legislation and that it is managed securely. If you have any questions regarding our handling and storage of your personal data, please contact us. Our contact details are provided at the bottom of this document.

2. What is Personal Data?

Personal data is any information that can be directly or indirectly linked to a living individual. This includes, for example, photos, names, personal identification numbers, and IP addresses.

3. Collection of Personal Data

We collect personal data at various times and in different contexts to provide you with relevant services, experiences, and offers.

We collect personal data in the following ways:

• Information you provide to us, such as through a purchase, newsletter subscription, or participation in a marketing activity or guest survey.
• Information provided by a partner who transmits information on your behalf.
• Information from third parties, e.g., creditworthiness information from banks or credit rating agencies, or other address purchases.

3.1 When Purchasing a Product or Service

When you purchase a product or service at our facility, we handle and store the following personal data that you provide:

• Your name (and any co-guests) and your contact details.
• Your personal identification number, e.g., when making a booking.
• Your booking number, if you provide it when booking/purchasing.
• Information about your booking, such as arrival and departure dates, price, and product type.
• Payment information and payment history.

We handle this personal data to:

• Identify you as a customer, e.g., for additional booking information or product returns and in case of complaints.
• Process payment for the booking, product, or service, including managing card payments.
• Possibly detect and prevent fraud in connection with payment.
• Manage and deliver what you have purchased in accordance with our purchase and booking terms.
• Contact you in case of changes to the booking, product, or service.
• Send arrival and facility-related information.
• Market our services and products, e.g., via email, SMS, or other electronic communication (you can unsubscribe from this through a link in the newsletter).
• Compile statistics on the purchase of our products and services.
• Develop statistics and conduct analyses to improve our services, goods, and offers.

If you choose to pay by invoice, with or without installments, we also handle personal data about you together with our payment solution partners.

When you communicate with us as a business customer regarding, e.g., a conference quote or partnership agreement, we also handle:

• Billing and contract information.
• Contact information and personal data related to you and the company you represent.

3.2 When Making a Complaint

If you file a complaint about a product or service, or contact us with other compensation claims, we handle:

• Information you provide to us, such as contact details, personal data, payment information, account details, and case history.
• Information about the basis for your compensation claim.
• Documents you attach to your case, such as receipts or medical certificates.

We handle your personal data to:

• Manage and assess your compensation claims.
• Detect and prevent fraud in connection with compensation claims.
• Develop possible statistics on compensation cases to improve our services.

3.3 When Communicating with Us

There are many ways to communicate with us, such as social media, web forms, telephone, or email. When you communicate with us, we handle the information you provide:

• Name, contact details, and possibly booking number.
• Information about your comment, question, or case.

We handle your personal data to:

• Answer your questions and handle your case, e.g., resolve issues and handle complaints.
• Deliver requested information, e.g., annual reports.
• Improve our services and the information we provide and publish on our websites.

3.4 When Participating in Marketing Activities or Guest Surveys

In connection with marketing activities (competitions, campaigns, etc.) or guest surveys (questionnaires, interviews, etc.), we handle the personal data you provide to us, such as your name and contact details. We handle this information to:

• Administer the marketing activity or guest survey, e.g., to contact you again.
• Inform you and offer new marketing activities and guest surveys.
• Contact you with information about both general and personalized offers, campaigns, and benefits from us, via e.g., email.

3.5 When Connecting to Our Wi-Fi Networks or Using Our Website

When you connect to any of our Wi-Fi networks at our facility, we are responsible for processing the data to connect you to the internet but not for the continued processing or content of your communication via Wi-Fi. When you connect, we handle your IP address, MAC address, and timestamps during your connection period. When you visit our website/Wi-Fi, we handle:

• Information on how you interact with and use our website, e.g., when booking a trip.
• Information about your visits to our websites, through, among other things, cookies (https://www.orsagronklitt.se/om-webbplatsen).

We handle your personal data to:

• Provide digital tools and services.
• Support you when you have technical problems.
• Maintain, test, and improve our digital tools and services.
• Detect and prevent security attacks, such as virus attacks.
• Analyze visitor behavior on our website.

3.6 When Required by Law to Handle Personal Data

In addition to what is described above, we may handle your personal data when we are required to do so by law, e.g., due to our accounting obligations or requests from authorities.

Legal Basis: When we handle your personal data because we are required to do so by law, we do so based on a legal obligation.

4. How Long Are Your Personal Data Stored?

We store your personal data only as long as necessary to fulfill the purposes of the processing, or as long as required by law. Thereafter, we delete the data securely so that it can no longer be linked to you.

The personal data we collect during a booking is stored in our customer database for 36 months. If you make a new booking within this period, information about previous bookings/products will be stored for an additional 36 months. The personal data is stored to facilitate your experience as a guest and as a basis for market and customer analyses to improve our offerings and product range. If personal data is linked to accounting information, it will be retained for seven (7) years in accordance with accounting laws.

The personal data you provide when subscribing to our newsletter is stored as long as you are an active reader. If you unsubscribe from the newsletters, the personal data will be stored for up to one (1) month.

Data collected during website visits is stored anonymously indefinitely.

5. To Whom Are Your Personal Data Disclosed?

Orsa Grönklitt Friluftsanläggning AB (publ) will not sell your data to third parties. However, we may disclose your personal data to the following recipients:

• Suppliers within and outside the EU/EEA who provide IT services, manage bookings, or perform payment mediation and credit checks on our behalf.
• If you have entered into an agreement with us on behalf of a company, purchase history data may be disclosed to the relevant company (e.g., your employer).
• Other recipients when required by law, regulation, or government decision.

Recipients who handle personal data on behalf of Orsa Grönklitt Friluftsanläggning AB (publ) must always enter into a data processing agreement with us to ensure that your data is handled correctly and securely. If we use suppliers who process your personal data on our behalf outside the EU/EEA, we take special protective measures, such as signing contracts that include the standardized model clauses for data transfer adopted by the EU Commission, available on the EU Commission's website.

When your personal data is shared with a recipient who is independently responsible for the data, such as an authority or a bank, the recipient's privacy policy and information on personal data handling apply.

6. How Do We Protect Your Personal Data?

We value your privacy, so we focus on security and how we handle and store your personal data. We work in accordance with the General Data Protection Regulation (GDPR) and established guidelines for information security and take measures to protect your data. We have procedures and rules regarding data protection, such as sending your data securely and ensuring that staff only have access to the data they need to perform their work.

7. About Cookies

When you visit our website, we may also collect information about you and your internet usage through the use of cookies. Read more about our use of cookies here: https://www.orsagronklitt.se/om-webbplatsen.

8. Your Rights

You have certain rights under data protection legislation. If you wish to exercise any of your rights, you can contact us using the contact details below.

• Access your personal data – you have the right to confirm whether we process your personal data and to receive a copy of the data being processed.
• Request correction – you have the right to have incorrect data corrected.
• Request deletion – you have the right to have your data deleted under certain circumstances.
• Object to processing based on our legitimate interest and to processing for direct marketing – you have the right to object to the processing of your personal data or to restrict the processing.
• Right to data portability – you have the right to request that personal data be transferred from us to another company, authority, or organization. This right is limited to data that you have provided to us.

If you want to know more about data protection legislation and your rights, you can read more here: http://eur-lex.europa.eu/legal-content/SV/TXT/?uri=CELEX:32016R0679.

If you believe that our processing of your personal data is not in accordance with data protection legislation, we ask you to contact us by letter (see the contact section below). You also have the right to complain to the Swedish Data Protection Authority (Datainspektionen), which is the supervisory authority.

If you want to contact us to request correction or deletion, see the contact details and procedure below. From the time we receive your letter, we reserve the right for it to take up to one (1) month before the changes are implemented.

9. How to Object to Electronic Direct Marketing

Orsa Grönklitt Friluftsanläggning AB (publ) may use your email address or mobile number for marketing and information mailings. If you do not want us to use your data for marketing purposes, please contact us and we will remove your data from the channels we have access to. Contact us at: Info@orsagronklitt.se

10. Contact Information

Orsa Grönklitt Friluftsanläggning AB (publ) (org. no. 556098-7462) is the data controller for the handling of your personal data. If you would like more information on how your personal data is handled, contact us via email at info@orsagronlitt.se.

For record extracts or corrections; contact us through a written, personally signed request sent to: Orsa Grönklitt Friluftsanläggning AB (publ) Box 133 794 22 ORSA

11. Updates to the Information Text

This information text was last updated on August 8, 2023, and may be changed. Changes will be published as a new version on our website.