Privacy Policy

For Hassela Ski Resort, protecting the personal data of its employees, customers and others is of the utmost importance. We apply and comply with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR). We strive to maintain a high level of data protection. In this policy, we explain how we process your personal data. We also describe your rights and how you can exercise them. As a data subject, you are welcome to contact us if you have any questions about how we process your personal data. Our contact details can be found at the end of this policy.

Terms and definitions

1.1 Processing: any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

1.2 Sensitive personal data: Sensitive personal data refers to data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a person’s sex life or sexual orientation.

1.3 Lawful basis: Hassela Ski Resort processes personal data only when there is a lawful basis under the GDPR. Examples include:
• consent from the data subject;
• processing necessary for the performance of a contract;
• compliance with a legal obligation;
• legitimate interests, provided that the rights and interests of the data subject do not override those interests.

1.4 Necessary: We process only the personal data required for a clearly specified purpose and no more data than is necessary to achieve that purpose.

1.5 Personal data: any information relating to an identified or identifiable natural person (”Data Subject”). An identifiable natural person is someone who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

1.6 Data controller: a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

1.7 Data processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.

1.8 Data Processing Agreement: a written agreement or other legal act that is binding on a data processor in relation to a data controller and is established in accordance with Article 28 of the GDPR. Data processors and data controllers must always enter into Data Processing Agreements.

1.9 Data Subject: a natural person who can be identified directly or indirectly through specific personal data.

Personal data collected by Hassela Ski Resort

2.1 Hassela Ski Resort primarily collects personal data directly from you as a customer. This may include your name, telephone number, email address and postal address.

2.2 Hassela Ski Resort processes personal data in connection with:

• booking accommodation, activities or other services with us;
• subscribing to our newsletters;
• contacting us by email, telephone or other means of communication;
• visiting our website, where information such as IP addresses, browser details and technical information may be processed;
• using our digital travel assistant, Nova Travel Agent;
• participating in customer surveys and questionnaires to help us develop and improve our services;
• our communication with customers, suppliers and business partners.

How Hassela Ski Resort uses collected information

3.1 Hassela Ski Resort primarily processes personal data for the purposes listed below, as well as for any additional purposes specified at the time of collection:

• to manage bookings of accommodation, activities and other services;
• to provide customer service, answer questions and handle enquiries;
• to send practical information before, during and after a booked stay;
• to send newsletters, offers and other marketing communications where there is a lawful basis for doing so;
• to help visitors find information, accommodation and offers through our digital travel assistant, Nova Travel Agent;
• to conduct customer surveys and develop our products and services;
• to administer and improve our website and analyse visitor statistics in accordance with applicable cookie settings;
• to comply with legal obligations, for example under the Swedish Bookkeeping Act;
• to manage employment relationships and communication with suppliers and business partners.

Information that may be disclosed

4.1 We may share information with other companies that process data on our behalf in order to enable us to provide our services, such as analytics, distribution or other services necessary to maintain and enforce our terms of use and terms of delivery. A high level of security and confidentiality is always maintained when processing personal data.

4.2 Hassela Ski Resort uses external service providers for bookings, newsletters and digital customer service, among other services. These providers and their subcontractors may process personal data on our behalf.

For our digital travel assistant, Nova Travel Agent, we use Qliva (Pelilo AB). Conversations are stored with Amazon Web Services (AWS) in Sweden, while AI processing takes place via OpenAI in the United States. Transfers are carried out on the basis of the European Commission’s Standard Contractual Clauses (SCC).

If personal data is transferred outside the EU/EEA, such transfers shall take place in accordance with the GDPR and with appropriate safeguards.

About cookies

5.1 When you visit our website, we use cookies and similar technologies. Some cookies are necessary for the website and its functions to operate correctly and therefore do not require consent.

Other cookies, such as those used for statistics and marketing, are only used if you have given your consent. You can change or withdraw your consent at any time through the website’s cookie settings.

Lawful basis, storage and deletion of personal data

6.1 Hassela Ski Resort processes personal data on the basis of the lawful grounds applicable to each specific purpose, including contracts, consent, legal obligations and legitimate interests.

6.2 Hassela Ski Resort retains personal data for as long as it is needed for the purpose for which it was collected or for as long as required by law.

Data relating to bookings is retained to administer the stay, handle any subsequent matters and fulfil legal obligations, such as those under the Swedish Bookkeeping Act.

Personal data used for newsletters and marketing is processed only for as long as there is a valid lawful basis and a current need. You may unsubscribe from our marketing communications at any time.

When personal data is no longer needed, it shall be deleted or anonymised unless it must be retained by law.

Conversations in Nova Travel Agent are stored for 180 days from the time they are started and are then automatically deleted. Hassela Ski Resort may also delete individual conversations earlier. OpenAI may retain API data for up to 30 days to detect abuse. Conversations are not used to train AI models.

Hassela Ski Resort as data controller

7.1 Hassela Ski Resort is the data controller for all personal data that we collect directly from customers, partners and employees. Where Hassela Ski Resort uses data processors, written Data Processing Agreements are always entered into with those processors.

Your rights and choices

8.1 Under the GDPR, you have the right to receive information about how we process your personal data and to request access to it (a subject access request). You may also request rectification, erasure or restriction of processing, object to certain processing and, in some cases, have your data transferred to another organisation (data portability).

The rights that apply depend on the purpose and lawful basis of the processing.

8.2 The right to erasure does not apply where we are legally required to retain the data, for example accounting records.

8.3 If a personal data breach occurs that is likely to result in a high risk to the data subject, Hassela Ski Resort shall inform the data subject of the breach without undue delay.

8.4 If you have any comments or complaints regarding how Hassela Ski Resort processes your personal data, you are welcome to contact us. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), which is the supervisory authority responsible for data protection in Sweden.

8.5 You may unsubscribe from our newsletters and other marketing communications at any time by using the unsubscribe link in our emails or by contacting our customer service.

IT security

Hassela Ski Resort only uses data processors that maintain reliable IT and information security practices. When acting as a data controller, we always implement appropriate technical and organisational measures to protect the personal data being processed in accordance with Section 2 of the General Data Protection Regulation.

We have established a separate IT and information security policy governing the management of information security.

Contact details for Hassela Ski Resort

9.1 If you have any questions about how we process your personal data or wish to exercise your rights under the GDPR, you are welcome to contact us.

Hassela Ski Resort AB
Company registration number: 556486-5508
Älvåsen 1, 829 98 Hassela, Sweden
Telephone: +46 652 56 56 00
Email: info@hasselaski.se

You can also find our contact details at hasselaski.se/kontakt/.