Privacy Policy

Effective as of May 25, 2018

Table of contents

1. Introduction
2. What is personal data and what does processing personal data involve?
3. Who does this policy apply to?
4. What does this policy cover?
5. What does it mean to be a data controller?
6. J Nacka Strand as data controller
7. Why are we allowed to process personal data?
8. What personal data do we collect?
9. How long do we store personal data?
10. Our measures to protect your personal data
11. When do we share personal data?
12. Your rights
13. Changes to this policy
14. Contact

1. Introduction

Thank you for choosing J Nacka Strand and a special thank you for taking the time to carefully read through this Privacy Policy. We would like to begin with a brief summary explaining why we have created this policy. Our fundamental goal is to explain in a clear and easy-to-read manner

• explain what role you and we have in this context
• explain how we use the information you share with us so that we can deliver and continue to develop Sweden's best hotel experience;
• ensure that you understand what information we collect and what we actually do with it;
• show how we work to protect your rights and privacy.

Our goal is that, after reading this policy, you will feel confident that your personal privacy is respected and that your personal data is processed correctly. We therefore work continuously to ensure that our processing of personal data is fully compliant with applicable legislation, primarily the new General Data Protection Regulation (GDPR) that came into effect on May 25, 2018.

2. What is personal data and what does processing personal data involve?

2.1 Personal data is any information that can be directly or indirectly linked to a living natural person. A non-exhaustive list of examples of personal data includes:

• Name
• Personal identification number
• Credit card number
• Email address
• IP address
• Images

2.2 Processing of personal data includes any action taken with personal data, regardless of whether it is performed automatically or not. This means that the following actions, among others, are included:

• Fundraising
• Registration
• Use
• Merger
• Transfer
• Deletion

3. Who does the policy apply to?

This Privacy Policy primarily applies to individuals who stay at our hotel and whose personal data we process (the "Data Subject"). Different parts of this Privacy Policy may also be relevant to you depending on your relationship with J Nacka Strand . In summary, this policy applies to individuals who

• are guests at our hotel
• eating at our restaurant
• organize meetings or events at our premises
• visit our website or interact with us on social media
• communicate with us in other ways, such as through our customer service

By accepting this Privacy Policy, you consent to J Nacka Strand processing your personal data in accordance with this Privacy Policy.

4. What about the policy?

This Privacy Policy governs how J Nacka Strand collects and processes personal data in order to deliver and continue to develop our Services.

5. What does it mean to be a Data Controller?

A data controller is a natural or legal person or other body that determines the purposes and means of processing personal data. A company is a data controller with regard to personal data it holds on its own behalf about its employees, customers, suppliers, and others.

6. J Nacka Strand as Data Controller

J Nacka Strand (company registration number 556630-6667) is the data controller for the processing of your personal data within the framework of J Nacka Strand Services and is responsible for ensuring that such processing is carried out in accordance with applicable legislation.

7. Why are we allowed to process personal data? 7 .1 In order for the processing of personal data to be permitted, there must always be support in the GDPR, a so-called legal basis. Such a legal basis includes, among other things

• consent from the Data Subject
• the processing of personal data is necessary for the performance of a contract with the data subject, for example, a contract for the use of the Services
• to fulfill a legal obligation, for example regarding the storage of data due to accounting requirements
• that, after weighing up the interests involved, J Nacka Strand interest in processing personal data outweighs the data subject's interest in protecting that data.

7.2 J Nacka Strand always processes your personal data in accordance with applicable legislation. Our primary basis for processing your personal data is that it is necessary to fulfill our agreement with you regarding the use of our services.

7.3 It may happen that the same personal data is processed both on the basis of the performance of a contract, specifically on the basis of consent, or on the basis that the data is necessary to fulfill other legal obligations. This means that even if you withdraw your consent and the processing based on consent ceases, the personal data may still remain with us for other purposes.

8. What personal data do we collect?

In this section of our policy, we would like to provide you with some examples of how we handle personal data to ensure that we consistently deliver exceptional experiences with a high level of service.

8.1 When you book a room at our hotel

When you book a room at our hotel, regardless of whether the booking is made at the hotel reception, by telephone, by email, or at https://www.hotelj.com, we process the following information that you provide to us:

• Your name and contact information (phone number, email)
• Credit card number and other payment information
• Your name and contact information (phone number, email)
• Your name and contact information (phone number, email)
• Your name and contact information (phone number, email)
• Information about your question, comment, or issue

8.1.1 We process your personal data for the following purposes:

• Identify yourself in connection with your booking and stay at J Nacka Strand
• Charge you for the services and products you have purchased from us
• Contact you with information regarding your stay, e.g. via email and text message
• Compile statistics and perform analyses for the purpose of improving our Services, goods, and offers
• Provide, maintain, test, improve, and develop our Services and the technical platform used to provide them
• Ensuring the security of our Services, to detect or prevent various types of illegal use or use that otherwise violates our Terms of Use
• Get info about personalized and customized offers, promotions, and benefits from us and our partners, like through email and text messages.
• Identify yourself in connection with your reservation and dining experience at our restaurants
• Charge you for the services and products you have purchased from us
• Contact you with information regarding your stay, e.g. via email and text message
• Compile statistics and perform analyses for the purpose of improving our Services, goods, and offers
• Provide, maintain, test, improve, and develop our Services and the technical platform used to provide them
• Ensuring the security of our Services, to detect or prevent various types of illegal use or use that otherwise violates our Terms of Use
• Get info about personalized and customized offers, promotions, and benefits from us and our partners, like through email and text messages.
• Identify yourself in connection with your booking and your experience at our hotel
• Charge you for the services and products you have purchased from us
• Contact you with information regarding your booking, e.g. via email and text message
• Compile statistics and perform analyses for the purpose of improving our Services, goods, and offers
• Provide, maintain, test, improve, and develop our Services and the technical platform used to provide them
• Ensuring the security of our Services, to detect or prevent various types of illegal use or use that otherwise violates our Terms of Use
• Get info about personalized and customized offers, promotions, and benefits from us and our partners, like through email and text messages.
• Answer your questions and handle your case, for example by rectifying errors and handling complaints
• Improve our Services and the information we communicate through our various channels

8.1.2 Legal basis for processing:

We process your personal data based on the performance of a contract when we fulfill our obligations to you as a hotel guest (e.g., when we administer services related to your hotel room and when we provide relevant offers) and based on a balancing of interests when we have a legitimate interest in using information about your stay and purchases to compile statistics and to develop, improve, and ensure the security of our Services.

8.1.3 Storage period:

We store your personal data during your hotel stay and for up to 3 months thereafter. To ensure traceability, we store data about our communication with you for 12 months. Your hotel history is stored for up to 2 years for our legitimate interest in analyzing trends over time.

8.2 When you book a table at our restaurants

When you book a table to eat at our restaurant, regardless of whether the booking is made in the restaurant, by telephone, by email, or at https://www.hotelj.com, we process the following information that you provide to us:

8.2.1 We process your personal data for the following purposes:

8.2.2 Legal basis for processing:

We process your personal data on the basis of contract performance when we fulfill our obligations to you as a restaurant guest (e.g. when we administer services related to your table reservation and when we provide relevant offers) and based on a balancing of interests when we have a legitimate interest in using information about your visits and purchases to compile statistics and to develop, improve, and ensure the security of our Services.

8.2.3 Storage period:

We store your personal data for up to 3 months after your restaurant visit. To ensure traceability, we store information about our communication with you for up to 12 months. Your visit history is stored for up to 2 years for our legitimate interest in analyzing trends over time.

8.3 When you book our meeting and event rooms

When you book one of our wonderful meeting or event venues, whether you do so at the hotel reception, by telephone, by email, or at https://www.hotelj.com, we process the following information that you provide to us:

8.3.1 We process your personal data for the following purposes:

8.3.2 Legal basis for processing:

We process your personal data on the basis of contract performance when we fulfill our obligations to you as a visitor (e.g., when we administer services related to your meeting or event booking and when we provide relevant offers) and based on a balancing of interests when we have a legitimate interest in using information about your stay and purchases to compile statistics and to develop, improve, and ensure the security of our Services.

8.3.3 Storage period:

We store your personal data for up to 3 months after your visit. To ensure traceability, we store information about our communication with you for 12 months. Your visit history is stored for up to 2 years for our legitimate interest in analyzing trends over time.

8.4 When you communicate with us

You can choose to communicate with us in a number of ways, including through our social media accounts or by contacting our customer service via phone or email.

When you book and communicate with us, we process the following information that you provide to us:

8.4.1 We process your personal data for the following purposes:

8.4.2 Legal basis for processing:

We process your personal data based on our and your legitimate interest in handling the matter (balancing of interests).

8.4.3 Storage period:

To ensure traceability, we store information about our communication with you for 12 months.

8.5 When you use our Wi-Fi or visit our website

When you connect to our Wi-Fi, we are the data controller for the processing that takes place to connect you to the Internet, but not for the continued processing or for the content of your communications via Wi-Fi. When you connect to our Wi-Fi, we process

• Your IP address and MAC address

When you visit our website, we process:

• Information about how you integrate with and use our website, e.g., when booking a hotel room
• Information about your visits to our website, through so-called cookies. For more information about how we use cookies, see https://www.hotelj.com/cookiep...

8.5.1 We process your personal data to:

• Providing our digital services
• Provide you with support when you experience various types of technical problems
• Maintain, test, and improve our digital services
• Detect and prevent security attacks, such as virus attacks

8.5.2 Legal basis for processing:

We process your personal data based on the performance of a contract when we provide Wi-Fi, and based on our legitimate interests in maintaining, testing, and improving our digital services.

8.5.3 Storage period:

We store your personal data for 3 months after you have used our digital channels and for 6 months after you have connected to our Wi-Fi.

9. How long do we store personal data?

Your personal data will only be stored for as long as it is necessary to fulfill the purposes for which the data was collected in accordance with this Privacy Policy. J Nacka Strand may store the data for longer if necessary to comply with legal requirements or to protect J Nacka Strand legal interests, e.g. if legal proceedings are ongoing.

10. Our measures to protect your personal data

10.1 We at J Nacka Strand have ensured that we have taken appropriate technical and organizational measures to protect your personal data against, among other things, loss, misuse, and unauthorized access.

10.2 To ensure that personal data is processed in a secure and confidential manner from a technical perspective, we use digital networks that are protected against intrusion by means of encryption, firewalls, and password protection, for example. In the event of a breach, J Nacka Strand has established effective procedures for identification, damage minimization, and reporting. Finally, J Nacka Strand has also developed an effective method for safeguarding the rights of data subjects, including the right to be forgotten.

10.3 To ensure a good level of knowledge regarding the processing of personal data, ongoing training courses on GDPR are arranged for both J Nacka Strand employees and consultants who are occasionally hired to perform assignments for the company.

11. When do we share personal data?

11.1 J Nacka Strand will not sell, disclose, or distribute personal data to third parties, except as specified in this Privacy Policy. Within the scope of the Services, personal data may be disclosed to, for example, subcontractors and partners, if necessary for the performance and provision of the company's services. In cases where we choose to share personal data, we enter into a so-called personal data processing agreement to ensure that the recipient of the personal data processes this data in accordance with applicable legislation and that the recipient has taken the necessary technical and organizational measures in accordance with the GDPR to satisfactorily protect the rights and freedoms of the data subject.

11.2 Furthermore, we may disclose personal data if we are required to do so by applicable law, court order, or if such disclosure is otherwise necessary to cooperate with a legal investigation.

12. Your rights

12.1 J Nacka Strand is responsible for ensuring that your personal data is processed in accordance with applicable legislation.

12.2 J Nacka Strand will, at your request or on its own initiative, correct, de-identify, delete, or supplement any information that is found to be incorrect, incomplete, or misleading.

12.3 You have the right to request access to your personal data. This means that you have the right to request a register extract of the processing we carry out regarding your personal data. You also have the right to receive a copy of the personal data that is processed. Once per calendar year, you have the right to receive, free of charge, a register extract detailing the personal data registered about you, the purposes of the processing, and the recipients to whom the data has been or will be disclosed, by submitting a signed written request. You also have the right to obtain information in the register extract about the anticipated period during which the data will be stored or the criteria used to determine this period.

12.4 You have the right to correct your personal data. At your request, we will correct any incorrect or incomplete information we process about you as quickly as possible.

12.5 You have the right to have your personal data deleted. This means that you have the right to request that your personal data be deleted if it is no longer necessary for the purpose for which it was collected. However, there may be legal requirements that prevent us from immediately deleting your personal data, for example due to applicable accounting and tax legislation.

12.6 You have the right to object to the processing of personal data carried out on the basis of a balancing of interests. If you object to such processing, we will only continue the processing if there are legitimate reasons for the processing that outweigh your interests.

12.7 If you do not want us to process your personal data for direct marketing purposes, you always have the right to object to such processing by either unsubscribing directly in each specific email message or by sending an email to gdpr@hotelj.com. Once we have received your objection, we will cease processing your personal data for such marketing purposes. If you are not satisfied with how we handle your personal data, you also have the option of reporting our processing of your personal data to the Swedish Data Protection Authority. However, for smooth and efficient handling, we recommend that you contact us first so that we can help you with any questions or concerns you may have.

13. Changes to this policy

J Nacka Strand reserves the right to revise this Privacy Policy from time to time. The date of the most recent change is indicated at the end of the Privacy Policy. If we make any changes to the Privacy Policy, we will publish these changes on the website. You are therefore advised to read this Privacy Policy regularly to be aware of any changes. If we change the Privacy Policy in a way that differs significantly from what was stated when your consent was obtained, we will notify you of these changes and, if necessary, ask you to re-consent to J Nacka Strand processing of personal data.

14. Contact

J Nacka Strand (company registration number 556630-6667) is the data controller responsible for processing your personal data. If you would like further information about how your personal data is processed, please contact us by sending a written, hand-signed request to:

J Nacka Strand

Ellensviksvägen 1, P.O. Box 1220

SE-131 28 Nacka Strand

In the letter, please state your name, address, email, telephone number, and personal identification number in addition to your case. Please also enclose a copy of your ID. A response will be sent to your most recent registered address.