This policy describes how KBK Vemdalen AB processes personal data when you book with FlipIt Vemdalen or visit flipitvemdalen.se.
Who is responsible
KBK Vemdalen AB, company registration number 559492-5702, Ã…sgatan 4, 846 71 Vemdalen, Sweden, is the data controller.
Contact for data protection matters: kontakta@flipitvemdalen.se, +46 684 30 391.
What we collect and why
When you book
We process your name, your email address, your phone number and the details of your booking: which day and time you chose, how many of you there are, whether anyone has a Non-Jumping band, which price type applied and what you paid.
We do this in order to complete the purchase and give you the time you booked. The legal basis is that the processing is necessary to perform the contract with you.
We also record that you accepted the park rules, and which version of the rules you accepted. The legal basis is our legitimate interest in being able to show what applied at the time of your visit.
When you buy an annual pass
We process the name of the person the pass is for, your email address, your phone number, which type of pass it is and what you paid. We also store a photo of the person the pass is for.
We use the photo only so that the staff at reception can see that the right person is using the pass. It is not shown anywhere else on the site, and we do not pass it on. The legal basis is that the processing is necessary to perform the contract with you, since the annual pass is personal.
If you buy a Locals pass, we record that you have certified that the holder is a registered resident of Härjedalen or Berg municipality. We check the certification manually. The legal basis is our legitimate interest in being able to show what applied when the pass was sold at the local price.
Each time the pass is used in the park, we store the time. The legal basis is our legitimate interest in being able to see that the pass is used by the person it is issued to.
When you pay
Payment is handled by our payment provider. We never see your card details; they go directly to the payment provider, which is the data controller for its own processing of them. We receive a confirmation that the payment has gone through, and the amount it concerned.
Accounting
Records relating to the purchase are kept so that we comply with the Swedish Bookkeeping Act. The legal basis is a legal obligation.
When you visit the site
Read about cookies and web statistics in our cookie policy.
Statistics
If you say yes to statistics, we use Google Analytics to see how the site is used. We see which pages are visited, roughly where visitors are and what kind of device they use. The legal basis is your consent. Google is our data processor and processes the data on our behalf.
Adverts on Google
If you say yes to marketing, we use Google Ads to measure how our adverts perform. Google can then also show our adverts to you if you have visited us. The legal basis is your consent. Google is an independent data controller for its own processing of the data for advertising.
Adverts on Meta
If you say yes to marketing, we use Meta's pixel to measure how our adverts on Facebook and Instagram perform. Meta can then also show our adverts to you if you have visited us. If you have said yes to marketing, the pixel can also send the email address and phone number you enter on the site, for example in a form. They are sent in hashed form, so that Meta can link the visit to an account without the data being sent in plain text. The legal basis is your consent. We and Meta are joint controllers for the collection of the data and its transfer to Meta. Meta is the sole controller for its further processing.
When you buy something
If you have said yes to statistics, we send details of the purchase to Google Analytics from our server. We send the amount, what you bought and a code for your browser. We do not send your name, your email address or your phone number to Google Analytics.
If you have said yes to marketing, we also send your email address and phone number to Google and Meta in hashed form. This means the data is turned into codes that do not reveal the data itself. Google and Meta compare the codes with data they already hold, to see whether the purchase came from an advert. To Meta we also send your IP address and which browser you use. We keep the IP address and the browser details only until the purchase has been sent, at most seven days.
Before you have chosen, and if you say no
The site still sends simple signals to Google, without cookies. They say, for example, that a page has been shown and that you have not said yes. The signals include your IP address. According to Google, it is used only to work out roughly where the visitor is. Google uses the signals to estimate how many visits and purchases cannot be measured. The legal basis is our legitimate interest in being able to evaluate our advertising without storing anything in your browser.
Your choice in the consent box
We store what you chose and when you made the choice, together with a random code that is also held in your browser. We do this so that we can demonstrate which consent you gave. We do not store your IP address, your name or other contact details. The data is kept for 12 months. The legal basis is our legal obligation to be able to demonstrate consent.
Transfers to the USA
Google and Meta may process the data in the USA. Both are certified under the EU-US Data Privacy Framework. The European Commission has decided that the framework provides an adequate level of protection.
How long we keep data
- Booking details: 24 months after the visit, so that we can handle questions and complaints.
- Accounting records: 7 years after the end of the calendar year in which the financial year ended, as required by the Swedish Bookkeeping Act.
- Emails you have sent us: for as long as the matter is open and 12 months after that.
- Photo on an annual pass: for as long as the pass is valid and three months after that. It is then deleted automatically.
- Photo you uploaded for a purchase that was never paid: one day.
- Visits to the park with an annual pass: 12 months after the visit.
- Your choice in the consent box: 12 months, then we ask again. The proof of your choice is kept for the same period.
- What is stored on an order for measurement, that is your choice and the code for your browser: 30 days. IP address and browser: until the purchase has been sent, at most seven days.
Who can see the data
The data is used by us at FlipIt. Beyond that, it is shared with suppliers who process it on our behalf, under data processing agreements:
- our web hosting and operations provider, which stores the site and the database,
- our payment provider, to complete the payment,
- our email delivery provider, for booking confirmations,
- Google, for the statistics in Google Analytics, only if you have said yes to statistics,
- Google, for the advertising in Google Ads, only if you have said yes to marketing,
- Meta, for the advertising on Facebook and Instagram, only if you have said yes to marketing.
We never sell your data. The data is stored within the EU/EEA. What goes to Google and Meta when you have said yes may be processed in the USA, see above.
Your rights
You have the right to
- find out what data we hold about you, and receive a copy,
- have inaccurate data corrected,
- have data deleted, when we no longer need it and no law requires us to keep it,
- request that we restrict processing,
- object to processing based on legitimate interest,
- receive the data you have provided in a machine-readable format and transfer it.
Contact kontakta@flipitvemdalen.se and we will help you.
If you are not satisfied with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, Sweden, imy.se.
Changes
If we change the policy, we publish the new version here.