On May 25, 2018, a new data protection law will come into force in the EU. The law is called GDPR, which stands for General Data Protection Regulation. GDPR replaces the Swedish Personal Data Act (PuL).
The new regulation increases the protection of how companies and organizations may handle and process your personal data. Swike AB (hereinafter referred to as Swike) protects your personal integrity and it is important to us that you feel secure in our processing of your personal data.
Our privacy policy describes how we collect and use your personal data and what rights you have. If you have any questions about the policy, you are always welcome to contact us.
What is personal data and what is processing of personal data?
Personal data is any information that can be directly or indirectly attributed to a natural person. Images and sound recordings processed in a computer can be personal data even if no names are mentioned.
Processing of personal data is anything that is done with the personal data. Any operation performed on personal data, whether or not by automated means, constitutes processing. Examples of common processing operations are collection, recording, organization, structuring, storage, adaptation, transfer and erasure.
Who is responsible for the personal data collected?
The controller of the company’s processing of personal data is:
Swike AB
Tunnlandsvägen 92
561 46 Huskvarna
Org.nr: 559237-6569
What personal data do we collect about you and why do we do it (purpose)?
| Purpose | Treatments | Categories of personal data |
| To be able to handle package travel orders | Communication around the booking Booking of accommodation, transport and any connecting trips Sending confirmation of the booked trip Handling of payment Sending of travel documents Sending a survey after the trip has ended | Name Postal address E-mail address Telephone number Passport number if connecting flights are booked through Swike Date of birth E-mail communication about the order Information about the trip that has been ordered Travel period Requests for room type Special dietary requirements Other information provided by the customer |
| Legal basis: Performance of the sales contract and legitimate interest To be able to fulfill our obligations under the of sale and to handle any complaints. | ||
| Storage period: From the start of the booking process, over the time of delivery of materials and the completion of the trip to the end of the year, which occurs no later than 36 months after the end of the trip. Approximately 50% of Swike’s customers make a new trip within the above period, which is why there is an interest in preserving the data during this period. | ||
| Purpose | Treatments | Categories of personal data |
| In order to monitor customer satisfaction | – Mailing of the survey | E-mail address Optional information that the customer chooses to provide: name, destination and travel period |
| Legal basis: Performance of the sales contract and legitimate interest To follow up on opportunities for improvement and development of services and destinations. | ||
| Retention period: Until these development projects have been completed, maximum 12 months from the date the responses are received by Swike. | ||
| Purpose | Treatments | Categories of personal data |
| In order to handle complaints | – Investigation of grounds for complaint and possible decision on compensation | Name of the person Contact details Bank account number |
| Legal basis: Performance of the sales contract In order to follow up any complaints. | ||
| Lagringsperiod: Tills eventuell reklamation/kompensation är avslutad | ||
| Purpose | Treatments | Categories of personal data |
| To be able to make improvements to our trips and provide references regarding our trips | – Posting of references on Swike.se after approval from the referee. | E-mail address Optional information that the customer chooses to provide: name, destination and travel period |
| Legal basis: Legitimate interest To allow the customer to provide references regarding the trip | ||
| Retention period: Personal data relating to references are not deleted as they are considered to be of value to others interested in purchasing a trip. | ||
| Purpose | Treatments | Categories of personal data |
| To manage the mailing of Swike magazine | Mailing by post Mailing once a year in a single mailing or as requested by recipients | Name of the person Email address or phone number provided when ordering Postal address |
| Legal basis: Legitimate interest To be able to send Swike magazine to customers and people who have ordered the magazine separately. | ||
| Retention period: Personal data is stored until the customer unsubscribes from future mailings of the magazine (occurs once a year). | ||
| Purpose | Treatments | Categories of personal data |
| In order to send out newsletters | – Distribution by e-mail about 10-12 times / year | Your name E-mail address |
| Legal basis: Legitimate interest To be able to send out newsletters to customers and people who have ordered the newsletter separately. | ||
| Retention period: Personal data is stored until the customer unsubscribes from future newsletters. Recipients can unsubscribe from the newsletter at any time. | ||
| Purpose | Treatments | Categories of personal data |
| To carry out and manage participation in competitions and/or events. | Communication before and after participation in a competition or event Selection of winners and communication of prizes (presented in newsletters and social media) | Name of the person Contact details Information provided in competition entries |
| Legal basis: Legitimate interest To be able to meet the request for participation in the competition/event. | ||
| Retention period: For the duration of the competition/event until the winner is selected and announced. | ||
| Purpose | Treatments | Categories of personal data |
| In order to fulfill its legal obligations | – Processing necessary to comply with the company’s legal obligations under legal requirements, court rulings or official decisions (e.g. Accounting Act) | Name of the person Contact details Payment history Payment information Correspondence Time of purchase and channel (by phone, email or booking engine) |
| Legal basis: This collection is required by law. | ||
| Retention period: From the start of the booking process until the end of the period required to fulfill the legal obligation (e.g. under the Accounting Act). | ||
Who might we share your personal data with?
Data processors
Where we use partners (known as processors) to provide our services and fulfill our obligations to you, we share some of your personal data with them.
A processor is a company that processes information on our behalf and according to our instructions. We have data processors who help us with:
- Hotel bookings
- Issuing of airline tickets
- Transportation of persons and luggage
- Marketing (print and distribution)
- IT services (companies that handle the necessary operation, technical support and maintenance of our IT solutions)
The purpose of sharing the personal data is only to be able to fulfill agreements with you as a customer, to satisfy your legitimate interest or to fulfill the company’s legal obligations.
Companies that are independent data controllers
These companies have control over how the information provided to them is handled and it is their personal data handling policy that applies. We share your personal data with the following entities:
- Air, bus and train companies (if tickets are booked via Swike)
- Government authorities (police, tax authorities and other authorities) if we are obliged to do so.
- Payment service providers
- Insurance intermediaries
Safety and security
In order to securely process your personal data, we have taken the reasonable technical measures that may be required. Only staff who need to handle your personal data in order to fulfill the stated purposes have access to it.
Your rights
- You have the right to know what personal data we process about you.
- If you believe that this information is inaccurate, you also have the right to request rectification of the data.
- If you do not want your personal data to be processed by us, you have the right to have your data erased. Please note that a situation may arise where we are unable to provide the requested service. In some cases, we may be entitled to refuse the request if we are prevented from doing so for legal reasons.
- In cases where we process your personal data on the basis that we have assessed that there is a legitimate interest (e.g. marketing purposes), you have the right to object to certain types of processing.
Social security number and date of birth
We do not collect personal data relating to social security numbers. In cases where birth data is needed, for example, to be able to take advantage of discounts linked to age, this personal data is collected.
Supervisory authority
The DPA is the supervisory authority for the GDPR. This means that they monitor the correct application of the legislation. If you think we are handling your personal data incorrectly, you can contact the DPA.
Contact us for more information
If you have any questions about our privacy policy or how we process your personal data, please contact us by e-mail hello@swike.se or by phone +46 (0)760-22 33 90.