PRIVACY POLICY

(Principles of Personal Data Processing)
ArtioTravel AB
Version: 21.10.2025

​

1. Data Controller

ArtioTravel AB
Organisation number: [insert]
Registered office: [street, ZIP, city, Sweden]
Registered in: Kammarkollegiet – Travel Guarantee Register
E-mail: info@artiotravel.com
Tel.: [+46 …]
Web: www.artiotravel.com

ArtioTravel AB (hereinafter the “Controller” or “Travel Agency”) determines the purposes and means of personal-data processing in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (the GDPR).
The Controller has not appointed a Data Protection Officer (DPO).

​

2.What Data We Process

The scope of processing is defined by applicable law, the concluded package-travel contract, related documentation, or your given consent.

We process the following categories of personal data:

• Identification and contact details: title, name, surname, residential address, date of birth, e-mail, and telephone number.

• Travel-document data: passport or ID-card number and copy (where necessary to provide travel services).

• Service-usage information: reservations, type of trip, itinerary, booking history.

• Communication records: contents of e-mails, messages, calls, and other correspondence.

• Marketing data: photographs or recordings from tours or events (only with your consent).

We obtain your data:

• directly from you during booking, communication, or registration on our website;

• from fellow travellers or authorised agents acting on your behalf;

• from public registers (e.g. company registers);

• occasionally from partners who are authorised to share such data with us.

The Controller always processes data only to the extent necessary for the given purpose.

​

3. Purposes and Legal Bases of Processing

Purpose of processing

Typical activities

Legal basis under GDPR

Conclusion and performance of a travel contract

handling reservations, communication, arranging insurance, visas

Art. 6 (1)(b) – contract performance

Compliance with legal obligations

accounting, taxation, archiving, travel-guarantee duties, statutory reporting

Art. 6 (1)(c) – legal obligation

Legitimate interests of the Controller

protection of rights, fraud prevention, dispute defence, internal audit

Art. 6 (1)(f) – legitimate interest

Marketing and customer communication

newsletters, promotional offers, contests, personalised content

Art. 6 (1)(a) – consent

Statistical and analytical purposes

service evaluation, product improvement

Art. 6 (1)(f) – legitimate interest

Consent for marketing activities is voluntary and can be withdrawn at any time.

​

4.Data-Retention Periods

• Data processed to perform a contract or legal duty are stored for the period required by law (typically 10 years after the end of the contractual relationship).

• Data processed on the basis of consent are kept for the duration of the consent, but no longer than 10 years after contract termination or until consent is withdrawn.

• After the applicable period expires, data are securely deleted or anonymised, unless further storage is required by law.

 

5.Data Recipients and Transfers

Your personal data may be shared, to the necessary extent, with trusted partners and processors assisting us in service delivery.
Main categories of recipients include:

1. accommodation providers, airlines, transport companies, tour guides;

2. local partner travel agencies in destination countries;

3. insurance companies, embassies, and consular offices;

4. IT-service and system providers;

5. accounting, tax, and legal advisors;

6. public authorities when required by law.

In some cases, data may be transferred to third countries (for example, destination or transit states).
Such transfers occur only when adequate safeguards are ensured under Articles 45 et seq. GDPR (e.g. EU Standard Contractual Clauses).

​

6.Your Rights

As a data subject, you have the following rights:

1. Access – to know what data we hold and obtain a copy.

2. Rectification – to correct inaccurate or outdated information.

3. Erasure (“Right to be forgotten”) – to have data deleted when no longer necessary.

4. Restriction of processing – to temporarily limit processing in certain cases.

5. Data portability – to receive data in a machine-readable format.

6. Objection – to object to processing based on legitimate interest.

7. No automated decision-making, including profiling.

8. Withdrawal of consent – at any time, if consent is the legal basis.

9. Lodging a complaint – with a supervisory authority.

Supervisory authorities:​

• Sweden – Integritetsskyddsmyndigheten (IMY),
  Box 8114, 104 20 Stockholm, Sweden, imy@imy.se, www.imy.se

• ​

7.Exercising Your Rights

You can exercise your rights:

• in writing to our registered office, or

• by e-mail to info@artiotravel.com.

We will respond within one (1) month of receiving your request.
Where necessary (complex or numerous requests), this period may be extended by up to two (2) additional months, and you will be notified of any extension and the reasons for it.

​

8.Withdrawal of Consent

You may withdraw your consent at any time by sending an e-mail to info@artiotravel.com or a written request to our postal address.
Please state at least your name, surname, and address, and specify that you do not wish your data to be further processed (or limit processing to specific purposes such as marketing).

​

9.Final Provisions

• By entering into a travel contract, the customer confirms having been informed of these privacy principles.

• Where the customer concludes a contract also on behalf of other travellers, he/she declares to be authorised to provide their personal data and consent on their behalf.

• The Travel Agency may update this Privacy Policy; the current version will always be available on www.artiotravel.com and, if substantial changes occur, will be sent to customers by e-mail.

   

📜 ArtioTravel AB
Registered Travel Agency, Sweden
Member of the Kammarkollegiet Travel Guarantee Register
Effective as of: 21.10.2025