Privacy Policy

Privacy Policy

Your personal data

Nordic Leisure Travel Group (NLTG) respects your privacy. This policy explains how your personal data is processed when you visit www.nltg.com or contact us about matters covered by this policy. It also explains your rights and how to contact us.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection legislation.

Who is responsible for your personal data

[Full legal name of the company responsible for Ving], company registration number [registration number], is the data controller for the processing described in this policy. In this text, “NLTG”, “we” and “us” refer to that company in its capacity as the data controller for www.nltg.com.

This policy applies to www.nltg.com and the interactions with us described below. When you book a trip, use another group company’s website or contact another company within the group, the privacy information provided by that company applies. Its policy identifies the responsible entity. Information about other processing activities, such as job applications, is provided when the data is collected.

Contact details

If you have questions about how we process your personal data or would like to exercise your rights, please contact us or our Data Protection Officer.

Data controller: [full legal name of the company responsible for Ving]
Data Protection Officer: DPO@nltg.com,
Telephone: +46 (0)8-5551 3200
Postal address: NLTG, Rålambsvägen 17, 105 20 Stockholm, Sweden
Form: [confirm whether Ving’s data rights form also covers nltg.com]

What personal data we collect

Personal data is information that can directly or indirectly identify a living individual. Examples include a name, email address, telephone number or IP address.

When you contact us

When you contact us by email, telephone or a contact form, we process the information needed to answer your question or handle your enquiry. This may include your name, contact details, the company or organisation you represent and the information you provide in your message.

Please only provide personal data that is relevant to your enquiry. Avoid sending sensitive personal data, such as health information, unless we have specifically requested it and explained how it will be processed.

When you represent a company or organisation

If you are a contact person at a supplier, business partner or another organisation, we may process your name, job title, business contact details and information about our interactions or business relationship.

When you visit the website

When you visit www.nltg.com, we may process technical data such as your IP address, information about your browser and device, and information recorded in security logs. If you consent to analytics cookies, we may also process information about how you use the website, such as the pages you visit. The information collected depends on the functions and cookies you use and the consent you have given.

[Specify the actual data categories and distinguish security logging from analytics and any marketing. Describe any links between visitor data and identifiable individuals.]

When we receive data from someone else

We primarily receive data directly from you. In business relationships, we may also receive your business contact details from the organisation you represent or another company within the group. If we receive data from other sources, we will inform you in accordance with applicable data protection rules.

Why we process your personal data

We process personal data for specific purposes and on a legal basis. The processing activities covered by this policy are described below.

To answer questions and handle enquiries

We use your contact details and the information in your enquiry to answer questions and follow up on our interactions. The legal basis is our legitimate interest in communicating with people who contact us and handling their enquiries. We balance this interest against your interest in protecting your personal data.

To manage business relationships

We process information about contact persons to administer and follow up on relationships with suppliers and business partners. The legal basis is our legitimate interest in managing these relationships. If you are personally a party to a contract, processing necessary for that contract may instead be based on performing the contract or taking steps at your request before entering into it.

To operate and protect the website

We process necessary technical data to provide a functioning website, identify technical problems and protect it against unauthorised access and misuse. The legal basis is our legitimate interest in operating and protecting the website.

To analyse how the website is used

If you give your consent, we use analytics cookies and associated data to understand how the website is used and improve it. The legal basis for the personal data processing described here is your consent. You can withdraw it at any time through the website’s cookie settings.

To comply with legal obligations and handle legal claims

We may process personal data where necessary to comply with a legal obligation. We may also process data to establish, exercise or defend legal claims, based on our legitimate interest in protecting our legal rights.

[Confirm the purposes, legitimate interest assessments and legal bases above. Specify the legal obligations that actually apply. Add other processing activities where necessary.]

How long we keep your personal data

We do not keep your personal data for longer than necessary for the purpose of the processing. Retention depends on the type of data, why it is processed and whether we need to retain it to comply with a legal obligation or handle legal claims.

Enquiries: [specify the retention period or clear criteria for deletion].
Business contacts: [specify the retention period or clear deletion criteria].
Technical data and security logs: [specify the retention period].
Website analytics data: [specify the retention period and refer to the relevant cookie information].

When data is no longer needed, it is deleted or anonymised. Anonymisation means that the data can no longer be linked to you.

Who we share your personal data with

Companies within the group

Your personal data may be shared with other companies within Nordic Leisure Travel Group where necessary to handle your enquiry or provide shared functions, such as IT support. We only share the data needed for the relevant purpose. Being part of the same group does not mean that companies can share personal data without restrictions.

[Identify the relevant companies or sufficiently specific categories of recipients, the purposes and the allocation of responsibilities.]

IT providers and other service providers

We use providers that help us with services such as website hosting, IT systems and communications. They may have access to personal data where necessary to provide the service. Where a provider processes data on our behalf, the processing must be governed by a data processing agreement.

[Confirm the actual providers and categories of recipients. Include Microsoft if its services are used for the processing covered by this policy.]

Authorities and legal advisers

We may disclose personal data to authorities where required by law or a binding decision. Data may also be disclosed to legal advisers or other recipients where there is a legal basis and disclosure is necessary to handle legal claims. We assess the need and legal basis in each case.

Transfers of personal data outside the EU and EEA

[Confirm whether data is transferred to or made accessible from countries outside the EU/EEA, for example through providers’ hosting or support services. If no such transfers take place, state this. If transfers take place, identify the countries and recipients, whether an adequacy decision applies or which appropriate safeguards are used, and how individuals can obtain a copy of or access those safeguards. Use wording that reflects actual processing.]

How we protect your personal data

We take technical and organisational measures to protect your personal data against unauthorised access, loss and unlawful processing. Access should be limited to people who need the data for their work.

Your rights

You have rights under the GDPR. Which rights apply depends on why your personal data is processed and the legal basis for the processing.

Access. You can find out whether we process personal data about you and obtain a copy of the data and information about the processing.

Rectification. You can ask us to correct inaccurate data and complete incomplete data.

Erasure. In certain circumstances, you can ask us to delete your data. We may need to retain data, for example to comply with a legal obligation or handle legal claims.

Restriction. In certain circumstances, you can ask us to restrict processing, for example while we verify data you believe is inaccurate.

Objection. You can object to processing based on our legitimate interests. Unless we can demonstrate compelling legitimate grounds or need the data for legal claims, the processing must stop. You always have the right to object to direct marketing, including profiling related to such marketing.

Data portability. Where processing is automated and based on your consent or a contract with you, you may in certain circumstances obtain data you have provided in a structured, commonly used and machine-readable format and transfer it to another data controller.

Withdrawing your consent

Where processing is based on your consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before you withdrew your consent. Data may need to be retained if it is also processed for another purpose on a different legal basis.

How to exercise your rights

Please contact us using the details in the Contact details section. Where necessary, we may request additional information to verify your identity and prevent data from being disclosed to the wrong person.

We handle your request without undue delay and normally no later than one month after receiving it. If the request is complex or we have received a large number of requests, this period may be extended by a further two months. We will inform you of the extension and the reason within the first month.

Making a complaint

If you believe that we process your personal data in breach of data protection rules, you have the right to lodge a complaint with a supervisory authority, such as the Swedish Authority for Privacy Protection (IMY). More information is available at www.imy.se.

If you choose not to provide personal data

You can choose not to provide personal data to us. If we need certain information to answer your question or handle your enquiry, this may mean that we cannot fully assist you. Where forms are used, we indicate which fields are mandatory.

Cookies and similar technologies

We use cookies and similar technologies on www.nltg.com. Some are necessary for the website to function and can be used without your consent. Other cookies, such as those used for analytics or marketing, are only used if you give your consent.

You can change your preferences or withdraw your consent at any time through [link to the website’s cookie settings]. In [link to NLTG’s cookie policy or equivalent cookie information], you can read more about the cookies used, their purposes, retention periods and the providers involved.

[Adapt this section to the actual use of cookies. Remove purposes that do not apply.]

Changes to this policy

We may update this policy when our personal data processing changes. The latest version is available at www.nltg.com. The date of the latest update is shown at the top of the policy. Where changes require specific notice, we will provide it through an appropriate channel.