What data we process
Depending on your enquiry, we may process:
- name and contact details, such as email address, phone number and address,
- company or organisation and contact person details,
- travel details such as destination, dates, boarding point and number of travellers,
- booking, contract, invoicing and payment details,
- messages, requests, questions, complaints and other correspondence,
- information about dietary requirements, allergies, accessibility needs or health, when you provide it yourself and it is needed to plan and carry out the trip safely.
Please do not share more sensitive information than necessary. When a booking covers a group, the person providing data about other travellers is responsible for making sure those individuals have been informed about the processing.
Why the data is processed
Answering questions, planning transport and preparing a quote.
Legal basisContract, or steps taken prior to entering into a contract.
Administering bookings, travellers, transport, accommodation, activities and payment.
Legal basisPerformance of a contract.
Handling invoices, payments and documentation that must be kept by law.
Legal basisLegal obligation.
Handling follow-up, complaints, and establishing or defending legal claims.
Legal basisLegitimate interest and legal obligation.
Handling necessary information such as allergies or accessibility needs.
Legal basisExplicit consent, where required.
Website and forms
When you submit a form, the data is transferred to the website’s server and forwarded to Bergslagsbuss via our email provider. The data is used to respond to and handle your enquiry, and is not stored in any separate customer database on the website. Forms should not be used to share more sensitive information than the trip requires.
The website’s trips and gallery are managed in Sanity. Content published there is intended for display on the website and should not include customers’ personal data without support for publication. Read more about the website’s technical storage on the Cookies.
Who we may share data with
We may share necessary data with:
- drivers and staff who plan or carry out the assignment,
- hotels, guides, activity providers and other suppliers included in the trip,
- providers of IT, email, accounting and administrative services,
- authorities, when we are required to by law or a government decision.
We only share the data the recipient needs. Suppliers that process data on our behalf are covered by data processing agreements where required. We do not sell personal data.
Transfers outside the EU/EEA
A trip outside the EU/EEA may require necessary data to be shared with a local supplier. If personal data is transferred to a country outside the EU/EEA, there must be a valid legal basis and a permitted safeguard under the GDPR. We limit the transfer to what is needed for the trip in question.
How long the data is kept
- Enquiries that do not lead to a booking are normally kept for at most 12 months after the last contact, unless the data needs to be kept longer for a legal claim.
- Booking and contract data is kept for as long as needed for the trip, the customer relationship, and any complaints or legal claims.
- Data that constitutes accounting records is kept in accordance with the Swedish Accounting Act, normally up to and including the seventh year after the end of the calendar year in which the financial year ended.
- Data about health, allergies or special needs is deleted or de-identified once it is no longer needed for the trip, unless it must be kept to handle a legal claim.
Your rights
Depending on the circumstances, you may have the right to:
- obtain information about, and access to, the personal data we process about you,
- request correction of inaccurate or incomplete data,
- request erasure or restriction of the processing,
- object to processing based on legitimate interest,
- receive data in a portable format where the right to data portability applies,
- withdraw consent; withdrawal does not affect processing that has already taken place.
These rights are not absolute. We may need to retain data where the processing is required by law, to perform a contract, or to establish, exercise or defend legal claims. We normally respond within one month and may need to verify your identity.
Questions and complaints
Please contact us first if you have questions or concerns. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), the Swedish supervisory authority for data protection. More information is available at imy.se.
Changes to this policy
We may update this policy as the business, the website or the applicable rules change. The latest version is always published on this page with its update date.