How Arctic Adventure processes personal data
| Last updated | 22 September, 2026 |
| Website | https://www.arcticadventure.se |
| Data controller | Arctic Adventure i Boden ekonomisk förening |
| Organisation number | 769613-7418 |
This Privacy Policy explains how Arctic Adventure processes personal data when you visit our website, contact us, request or make a booking, participate in an activity, or otherwise interact with us. It also explains your rights under the General Data Protection Regulation and Swedish data-protection law.
1 Data controller and contact details
Arctic Adventure i Boden ekonomisk förening is the data controller for the processing described in this policy.
Postal address: Box 93, SE-961 21 Boden, Sweden
E-mail: info@arcticadventure.se
Telephone: +46 921 137 00 or +46 70 629 84 33
Website: https://www.arcticadventure.se
2 Personal data we process
Depending on your relationship with us, we may process:
identity and contact details, such as name, email address, telephone number, postal address and the organisation you represent;
inquiry and booking details, such as activity, preferred date, party size, participants, meeting point, accommodation, transport needs, correspondence and booking reference;
payment, invoicing and accounting information, such as price, payment status, invoice details and transaction references. We do not intend to store complete payment-card details;
participation and safety information that you choose or need to provide, such as age, clothing or shoe size, mobility needs, dietary requirements, allergies and relevant health information;
incident, complaint and insurance information where an accident, safety event, claim or complaint occurs;
photographs or recordings where you have agreed to their use or where another lawful basis clearly applies;
website and device information, such as IP address, browser, device, pages visited, cookie identifiers, approximate location and server logs;
marketing preferences and records of consent or objection.
Please do not include health information, identity documents or other sensitive information in the general website inquiry form. If information is needed for safe participation, we will tell you how to provide it.
3 Where the data comes from
We normally obtain personal data directly from you. We may also receive it from the person making a group booking, a family member or guardian, your employer, a hotel, travel organiser, destination management company or other booking partner. Technical information is generated when you use the website. If another person provides your details, they should make sure that you receive this policy.
4 Why we process data and our legal bases
| Purpose | Typical data | Legal basis |
| Respond to inquiries and prepare an offer or booking | Contact details, requested activity, dates, party size and correspondence | Steps requested before entering a contract; legitimate interests for business inquiries |
| Administer and deliver a booking, transfer or activity | Participant, schedule, accommodation, logistics, payment and communication data | Performance of a contract |
| Manage safety and reasonable adaptations | Age, sizes, mobility, dietary, allergy and relevant health information | Contract and legitimate interests; explicit consent for special-category data; vital interests in an emergency |
| Invoice, account and meet tax obligations | Customer, invoice, payment and transaction data | Legal obligation and contract |
| Handle complaints, incidents and legal claims | Booking, correspondence, incident, witness, insurance and medical information where relevant | Contract, legal obligation and legitimate interests in establishing, exercising or defending legal claims |
| Operate and secure the website | IP address, request data, device/browser and server logs | Legitimate interests in reliable and secure services |
| Measure website use with Google Analytics | Cookie identifiers, usage events, approximate location and device/browser information | Consent |
arcticadventure.se |
ARCTIC ADVENTURE
Legal bases continued
| Purpose | Typical data | Legal basis |
| Send relevant marketing | Contact details, customer relationship and marketing preferences | Consent where required; otherwise legitimate interests subject to your right to object |
| Use identifiable photographs or recordings for promotion | Image, voice, activity and agreed context | Consent, unless another lawful basis has been clearly communicated in advance |
5 Special categories of personal data
Information about health, allergies or disability can be special-category personal data. We request only what is reasonably necessary to assess suitability, adapt an activity and protect participants. For advance planning, we normally rely on your explicit consent. In a genuine emergency, relevant data may be processed to protect vital interests. You may withdraw consent, but this may make a requested adaptation or safe participation impossible if the information is essential.
6 How long we keep personal data
| Record | Normal retention |
| Inquiry that does not become a booking | Up to 24 months after the last meaningful contact, unless you ask us to delete it sooner and no overriding reason applies. |
| Booking and customer service file | Normally up to 3 years after the activity or final contact; longer only where necessary for an unresolved complaint or legal claim. |
| Accounting records | Seven years after the end of the calendar year in which the relevant financial year ended, where Swedish accounting law requires preservation. |
| Routine safety, allergy or adaptation information | Removed or anonymised as soon as it is no longer needed, normally within 30 days after the activity. |
| Incident, insurance and legal claim records | For the time needed to investigate and resolve the matter and for the applicable limitation period. |
| Website security logs | Normally up to 90 days, unless a security event requires longer preservation. |
| Google Analytics user and event data | Up to 14 months in the Analytics account; browser cookies may remain for up to 2 years unless withdrawn or deleted sooner. |
| Marketing consent and suppression records | Until consent is withdrawn or the relationship has been inactive for 24 months; a minimal suppression record may be kept to honour an objection. |
| Photographs and recordings | For the period stated when consent is obtained, or until consent is withdrawn where withdrawal applies to future use. |
We may keep data longer where required by law, necessary for a legal claim or needed to document an incident. When the reason ends, data is deleted or anonymised.
7 Who receives personal data
We disclose personal data only where necessary. Recipients may include:
guides, employees and contractors who need the information to arrange or safely deliver the service;
hotels, transport providers, specialist activity suppliers and booking partners involved in your itinerary;
one.com and other providers of website hosting, content delivery and business email;
Google, where you consent to Google Analytics or where remote Google Fonts are requested by the current website configuration;
banks, payment providers, accounting providers, auditors and professional advisers used for the transaction or our legal duties;
insurers, emergency services, healthcare providers and public authorities where necessary for safety, a claim or a legal requirement.
A provider that processes data only on our instructions acts as a processor and must be bound by appropriate data-protection terms. Independent providers may be separate controllers for their own processing. We update this policy before introducing a new booking, payment, marketing or embedded-content provider that materially changes how personal data is processed.
8 International transfers
Some technology providers, including Google, may process data outside Sweden or the European Economic Area. Where this occurs, we use a lawful transfer mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary measures where required. You may contact us for information about the safeguard relevant to a particular transfer.
9 Cookies and analytics
The website uses necessary preference storage and, with your consent, Google Analytics. Our Cookie Policy identifies the relevant technologies, purposes and duration. You can refuse Analytics without losing access to the main website and can change your choice through the Cookie settings link.
10 Group bookings and children
A group organiser should provide only the participant information needed for the booking and should share this policy with participants. Where a child participates, we may process limited information about the child and the responsible adult to administer the booking and protect safety. We do not knowingly use children’s data for behavioural advertising.
11 Your rights
Subject to the conditions in the General Data Protection Regulation, you may have the right to:
- receive information and access a copy of your personal data;
- correct inaccurate or incomplete data;
- request deletion or restriction of processing;
- object to processing based on legitimate interests and object at any time to direct marketing;
- receive certain data in a portable format where processing is based on consent or contract and is automated;
- withdraw consent at any time, without affecting earlier lawful processing;
- lodge a complaint with the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten, at https://www.imy.se.
To exercise a right, contact info@arcticadventure.se. We may need to verify your identity before releasing or changing personal data. Rights are not absolute; for example, legal accounting duties can prevent immediate deletion of some records.
12 Automated decisions
We do not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects.
13 Security
We use organisational and technical measures appropriate to the nature of the data, including access controls, secure connections, restricted staff access, backups and procedures for incidents and deletion. No internet service can guarantee absolute security, so sensitive information should not be sent through the general inquiry form or ordinary email unless we have agreed a suitable method.
14 Changes and contact
We may update this policy when services, suppliers, legal requirements or processing activities change. The latest version is published on the website with its revision date. Questions and requests should be sent to info@arcticadventure.se or Arctic Adventure, Box 93, SE-961 21 Boden, Sweden.