Privacy Policy – Handling of Personal Data

Contents

1. Background

2. What personal data is collected and how is it used?

3. How are personal data and consents collected, and how long are they stored?

4. Legal basis for the use of personal data

5. Who do we share information with?

6. Customer rights

7. Contact for data protection-related questions

BACKGROUND

Lumi Tours strives to provide our customers, as well as our partners and their customers, with the best and most cost-effective travel experience. To achieve this goal, it is necessary to collect certain personal information.

The GDPR (General Data Protection Regulation) is the EU’s data protection legislation that applies in all member states. From May 25, 2018, GDPR replaced the previous Swedish Personal Data Act (PUL).

Lumi Tours considers it self-evident that you, as a customer, should be fully aware of what information we collect about you, how it is used, and why it is collected. This document explains how we handle your personal data.

WHAT PERSONAL DATA IS COLLECTED AND HOW IS IT USED?

Personal data is collected to fulfill the products and services we promise our customers. Only the data necessary to fulfill this purpose is collected. The use of personal data is based on specific purposes, and the customer’s consent covers only the defined purposes.

• Name, title, and date of birth: This information is used to ensure bookings are processed correctly and tickets are issued in accordance with the requirements of airlines and hotels. For security reasons, this data must match the customer’s passport or ID card. If the information does not match, the customer may be denied boarding, even if the booking and payment have already been made.

• Home address, email address, IP address, and phone number: This information is used for:

  • Verifying bookings

  • Issuing invoices and ensuring payments

  • Delivering tickets

  • Communicating with customers about the trip and providing important information about the destination

  • Updating customers on any changes, such as departure times or gate information

  • Informing customers about new destinations, products, and campaigns

• Passport number: This data is collected if the destination country requires a visa for entry.

• Personal ID number: Used for credit checks when the customer chooses to pay via invoice. This is handled by contracted payment solution providers, and Lumi Tours does not have access to this information.

• Medical certificate: Collected if the customer has purchased cancellation protection and cannot proceed with the trip due to illness, in accordance with applicable rules.

• Bank account number, credit card, or debit card number: Used to process payments for invoiced trips. This information is handled through payment solutions that Lumi Tours does not have access to.

• Cookies: These are used to improve the customer experience on the Lumi Tours website by remembering certain settings and user information, making marketing and campaigns more relevant, and developing our products and services.

No other information is collected or used for purposes other than those mentioned above.

HOW ARE PERSONAL DATA AND CONSENTS COLLECTED, AND HOW LONG ARE THEY STORED?

All information and consents are collected digitally during the booking and payment process when the customer:

• Books a trip and agrees to the terms and conditions related to the booking

• Purchases additional services such as cancellation protection, travel insurance, or refund protection, and agrees to the associated terms and conditions

• Pays for the trip and agrees to the terms and conditions for the selected payment method

• Name, email address, and phone number may also be collected if the customer submits an inquiry through the form on the website or via customer service. Phone numbers are recorded during customer service calls.

• Medical certificates are collected digitally when the customer purchases cancellation protection and submits a scanned certificate to the specified email address. This information is deleted once the case is concluded.

• Bank account numbers and email addresses are collected if the customer files a complaint about their trip and provides relevant information via the "My Bookings" feature. This information is also deleted once the case is resolved.

• Consent for the use of the email address for marketing purposes is obtained when the customer actively subscribes on the website. Consent for the use of personal data is stored for two years and is automatically deleted unless the customer provides new consent before this period expires.

• Information collected during the billing process is stored in accordance with the Accounting Act and retained in Lumi Tours' accounting system for seven (7) years, after which it is deleted.

LEGAL BASIS FOR THE USE OF PERSONAL DATA

The use of personal data is based on the following legal grounds:

• EU 2016/681: Passenger Name Record (PNR)

• EU 2015/2302: Package Travel and Linked Travel Arrangements

• Accounting Act 1999:1078

WITH WHICH PARTNERS DO WE SHARE INFORMATION?

Lumi Tours collaborates with selected partners to provide the services we offer. In some cases, we may need to share personal data with these partners to fulfill our obligations to customers. Our partners are primarily involved in areas such as air travel, hotels, transportation, and marketing.

When booking, the customer may consent to Lumi Tours processing their data for marketing purposes. If this consent is given, Lumi Tours and/or our identified partners may use the data to send newsletters and personalized offers.

If the customer accepts analytical cookies on our website, they consent to the transfer of pseudonymized data about website usage to Lumi Tours for analysis and optimization of the user experience.

CUSTOMER RIGHTS

Customers have the right to:

• Access their personal data: Customers can request access to the personal data Lumi Tours has collected and stored about them.

• Correct incorrect personal data: If any personal data stored by Lumi Tours is incorrect, the customer has the right to have it corrected free of charge.

• Delete personal data: Customers may request the deletion of their personal data if:

  • The data is no longer needed for the purposes for which it was collected.

  • The customer withdraws their consent and there is no other legal basis for processing.

  • The personal data has been processed unlawfully.

  Customers cannot request the deletion of data that Lumi Tours is required to retain to fulfill legal obligations, such as information that must be kept under the Accounting Act.

• Object to the use of data for direct marketing or automated profiling: If a customer believes they are subject to unauthorized direct marketing or profiling, they have the right to object and report this to the authorities.

To exercise these rights, customers can contact Lumi Tours via email.

CONTACT FOR DATA PROTECTION-RELATED QUESTIONS

For general inquiries regarding Lumi Tours' data protection, please send an email to info@lumitours.se.