Discover Kiruna Privacy Policy

Data Controller: Luleå Travel AB Organisation Number: 559157-5542 Address: Kaserngatan 1
97442 Luleå, Sweden Contact Email: info@discoverkiruna.com Effective Date: 1st December 2025

This Privacy Policy explains how Discover Kiruna, a brand operated by Luleå Travel AB, collects, processes, and protects your personal data in accordance with the European Union’s General Data Protection Regulation (GDPR) and relevant Swedish data protection legislation.

1. Data Controller Responsibility

Luleå Travel AB is the Data Controller responsible for the processing of your personal data collected via the Discover Kiruna website. We determine the purposes and means of processing this data.

2. Data We Collect

We collect and process personal data based on the type of interaction you have with the Discover Kiruna website.

First, we collect Booking Data, which includes essential information required to fulfill your reservation, such as your name, email address, phone number, billing address, traveler names, payment details, and any special requirements. The legal basis for processing this data is the necessity for fulfilling the booking contract you enter into with us and the Activity Provider.

Second, we process Communication Data when you reach out to us. This encompasses information you provide when contacting us via email, chat, or phone. The legal basis for this processing is our Legitimate Interest in efficiently responding to your inquiries and providing comprehensive customer service.

Third, Technical Data is collected automatically as you use our website. This includes your IP address, browser type, operating system, and geographical location, along with overall website usage data, primarily gathered via cookies. The legal basis for processing this Technical Data, specifically for non-essential purposes like analytics and marketing, is your explicit Consent, which is managed via our cookie banner.

Finally, we process Marketing Data, which primarily relates to your preferences regarding receiving promotional materials, newsletters, or special offers. The legal basis for any marketing communication you receive is your explicit Consent, which is given through a subscription opt-in process.

3. How We Use Your Data

We process your data for the following purposes:

1. To Manage Bookings and Deliver Services: To process your reservation via our booking system (Rezdy), issue confirmations, and manage customer service.
2. To Share with Activity Providers: We must share your essential booking data (names, dates, special requests) with the specific Activity Provider running your selected tour to ensure delivery of the service.
3. To Process Payments: We use third-party payment processors to handle payment transactions securely. We do not store full credit card details on our servers.
4. Marketing: To send you relevant offers and updates, but only if you have given explicit consent.
5. Site Improvement & Security: To analyze website traffic, prevent fraud, and maintain security based on our legitimate interest in running an efficient business.

4. Data Sharing and Third Parties

We use the following categories of third parties who may process your data:

• Booking Platform: Rezdy, which processes booking and payment data on our behalf.
• Activity Providers: The local tour operators who deliver the husky sled ride or other activities you book.
• IT & Analytics: Services like Google Analytics for monitoring site performance (subject to your cookie consent).

We ensure that all third parties meet adequate levels of data protection required by GDPR.

5. Your GDPR Rights (Data Subject Rights)

As a data subject, you have the right to:

1. Access (Registerutdrag): Request a copy of the personal data we hold about you.
2. Rectification (Rättelse): Request that we correct inaccurate or incomplete data.
3. Erasure (Rätt att bli glömd): Request the deletion of your personal data when it is no longer necessary for the purpose it was collected.
4. Restriction of Processing: Request that we temporarily stop processing your data under certain conditions.
5. Data Portability: Request that we transfer your data directly to another controller.
6. Object: Object to processing based on legitimate interests or for direct marketing purposes.
7. Withdraw Consent: Withdraw any consent you have previously given for specific processing activities (e.g., marketing).
8. Complaint: Lodge a complaint with the Swedish Data Protection Authority (Integritetsskyddsmyndigheten – IMY) if you believe we have breached data protection laws.

To exercise any of these rights, please contact us at the email address provided above.