Visit Dalarna's Privacy Policy

Visit Dalarna’s privacy policy explains how we collect and use your personal data. It also describes your rights and how you can exercise them. It is important that you read and understand the privacy policy and feel secure in how we process your personal information. You are always welcome to contact us if you have any questions.

What is personal data and what does processing of personal data mean?
Personal data refers to any information that can be directly or indirectly linked to a living individual. For example, images and audio recordings processed by a computer may be considered personal data even if no names are mentioned. Encrypted data and various electronic identifiers (such as IP addresses) are also personal data if they can be connected to an individual.
Processing of personal data refers to any operation carried out with personal data. Every action taken with personal data is considered processing, regardless of whether it is automated or not. Common processing actions include collection, registration, organization, structuring, storage, modification, transfer, and deletion.

Who is responsible for the personal data we collect?
Visit Dalarna AB, registration number 556788-2609, with the address Vasagatan 6, 795 30 Rättvik, is the data controller for the company's processing of personal data.

From which sources do we collect personal data?
In addition to the information you provide to us, or that we collect based on your purchases and how you use our services, we may also collect personal data from third parties. These third-party data sources include:

Address information from public records to ensure we have your correct address.
Creditworthiness data from credit rating agencies, banks, or credit information companies.

What personal data do we collect about you as a customer and why?
We collect your name, contact information (e.g., email, phone number), and event-specific details (e.g., participation in program points, dietary requirements).
This is necessary to organize and manage event participation. The processing is required to fulfill both your and our legitimate interest in managing your event participation. Personal data is stored for the duration of the event and until all event-related matters are resolved (including reporting to third parties).

With whom may we share your personal data?
When necessary to provide our services, we share your personal data with companies that act as our data processors. A data processor is a company that processes personal data on our behalf and according to our instructions.
Our data processors help us with:

Payment solutions (payment processors, banks, and other payment service providers).
Marketing (printing and distribution, social media, media or advertising agencies).
IT services (companies that manage the operation, support, and maintenance of our IT systems).

When personal data is shared with data processors, it is only for purposes consistent with the original reason the data was collected. We assess all processors to ensure they can provide sufficient guarantees regarding data security and confidentiality. Written agreements ensure they meet our security requirements and limitations on international data transfers.

We also share personal data with companies that are independently responsible for the data. This means these companies determine how they use the information provided. Independent data controllers we share data with include:

Government authorities (e.g., the police, tax agency) if required by law or in cases of suspected crime.
Companies offering payment solutions. When your data is shared with an independent data controller, that company's privacy policy applies.

Where do we process your personal data?
We strive to process your data within the EU/EEA, and our IT systems are based in the EU/EEA. In cases of system support or maintenance, we may transfer data outside the EU/EEA, e.g., if a data processor or its subcontractor is based outside the region.
In these cases, only relevant information (e.g., log files) is shared. Regardless of the processing location, we take legal, technical, and organizational steps to ensure the same level of protection as in the EU/EEA. Transfers outside the EU/EEA are safeguarded either by adequacy decisions from the EU Commission or through appropriate safeguards.

How long do we store your personal data?
We never retain your personal data longer than necessary for each purpose.

How do we handle personal identification numbers?
We only process your personal ID number when necessary for clear purposes, secure identification, or for other legitimate reasons. We minimize the use of your personal ID number and use your birthdate when sufficient.

What rights do you have as a data subject?

Access: You can request access to the personal data we process about you. This is provided in a record of processing activities stating the purpose, data categories, recipients, retention periods, and more. We may ask for additional details to ensure proper handling of your request.
Correction: You may request corrections if your data is incorrect or incomplete for its intended purpose.
Restriction: You may request limited processing if you dispute the data's accuracy or need the data for legal claims after we no longer need it. Limited processing means we store the data but do not use it otherwise without your consent.
Deletion: You may request deletion of your data if:
- It’s no longer needed for its original purpose.
- You object to processing based on legitimate interest and your interests outweigh ours.
- It’s used for direct marketing.
- It's processed unlawfully.
- We are legally required to delete it.
- It was collected from a child under 13 in connection with digital services.
However, we may deny deletion requests if legal obligations require us to retain the data (e.g., accounting, tax, banking laws) or if the data is needed for legal claims. In such cases, we will block the data from being used for other purposes.
Data Portability: If our processing is based on consent or contract, you may request to receive your data in a portable format for transfer to another controller, if technically feasible.
Objection to Certain Processing:
- Legitimate Interest: You may object to processing based on our legitimate interest. We must then show compelling reasons to continue processing, or we may only process for legal claims.
- Direct Marketing: You may object to direct marketing, including profiling related to it. If you object, we will cease all such activities. You may also specify preferred contact methods for future communications.

How are your personal data protected?
We use IT systems to protect the confidentiality, integrity, and accessibility of personal data. Specific security measures are in place to prevent unauthorized processing (e.g., access, loss, destruction, damage). Only personnel who need the data to fulfill our purposes have access.

What does it mean that the Swedish Authority for Privacy Protection is the supervisory authority?
The Swedish Authority for Privacy Protection oversees the application of data protection laws. Anyone who believes a company is mishandling personal data may file a complaint with the authority.

Vill du bli partner?

Tack för din anmälan!

Tack så mycket