Privacy and cookie policy
Privacy policy for Lost Goats AB
Effective date: November 20, 2024
1. Introduction
Lost Goats AB (referred to as "we," "us," or "our") is committed to protecting the privacy and security of your personal data. We are the Data Controller responsible for processing the personal data you provide to us.
This policy outlines how we collect, use, store, and protect your personal data in compliance with the European Union's General Data Protection Regulation (GDPR) and relevant Swedish data protection legislation.
Our details:
Legal name: Lost Goats AB
Company registration number (Org. nr.): 559322-8371
Registered address: Lindås 2408, 34394 Älmhult, Sweden
Contact email for privacy matters: lostgoatsab@gmail.com
2. The data we collect about you
We may collect, use, store, and transfer different kinds of personal data about you, which we have grouped together as follows:
| Type of data | Data examples | Purpose of collection | Legal basis (GDPR) |
|---|---|---|---|
| Identity data | Name, address, date of birth. | Booking and identification, communication. | Contract: necessary for fulfilling the contract (organizing and delivering the trip). |
| Contact data | Email address, telephone number. | Sending booking confirmations, pre-trip information, and emergency communication. | Contract: necessary for fulfilling the contract. |
| Transaction data | Details about payments, trips purchased, and transaction history. | Processing payments, managing accounting, and financial reporting. | Contract and legal obligation: necessary for legal/tax compliance. |
| Special category data (health) | Relevant allergies, pre-existing medical conditions, dietary restrictions impacting safety. | Ensuring your safety and providing necessary support during the trip. | Explicit consent: requires your specific, affirmative consent. |
| Technical data | IP address, browser type, time zone setting, location. | Website optimization and ensuring network security. | Legitimate interest: to administer and protect our business and website. |
| Marketing data | Your preferences in receiving marketing from us. | Sending you promotional communications (if requested). | Consent: freely given, specific, informed, and unambiguous. |
3. How we use your personal data
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
- To fulfil a contract: when processing your booking and providing the trail trip services you have purchased.
- To comply with a legal obligation: when we need to comply with Swedish law, such as keeping financial records for tax purposes.
- For our legitimate interests: to run and manage our business, provided your rights do not override these interests (e.g., website security, general customer service).
- Where we have your consent: when processing health data or sending you marketing communications.
4. Disclosure of your personal data
We may need to share your personal data with the parties set out below for the purposes described in Section 3:
- Internal third parties: other companies within our corporate group (if applicable) for IT, system administration, and reporting.
- External service providers: third parties who provide services on our behalf (Data Processors), such as payment processing providers (e.g., Stripe, Swish); IT, website hosting and system administration services; local guides, transportation companies, or accommodation providers who need your identity and health data to safely and effectively deliver the trip services.
- Regulatory/legal bodies: the Swedish Tax Agency (Skatteverket) or other regulatory bodies where we are legally required to do so.
We require all third parties to respect the security of your personal data and treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your data for specified purposes and in accordance with our instructions.
International transfers: if we transfer your personal data out of the European Economic Area (EEA) (e.g., using a non-EEA based email or hosting provider), we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented: the country is deemed to provide an adequate level of protection for personal data by the European Commission; or we use specific contracts approved by the European Commission which give personal data the same protection it has in Europe (Standard Contractual Clauses – SCCs).
5. Data security
We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. This includes:
- Encryption for sensitive data (e.g., health information).
- Secure booking forms that use SSL/TLS encryption.
- Strict access controls to limit personal data access only to employees, agents, contractors, and other third parties who have a business need to know.
We have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
6. Data retention
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
- Transaction/booking data: we generally keep this data for 7 years after the trip completion to meet the requirements of the Swedish Accounting Act (Bokföringslagen).
- Health data: data collected for safety is typically deleted 30 days after the trip is completed, unless required for ongoing safety follow-up or legal claims.
- Marketing consent: we retain your contact details for marketing purposes until you withdraw your consent.
7. Your legal rights (GDPR rights)
Under certain circumstances, you have the following rights under data protection laws in relation to your personal data:
- Right to access: you have the right to request a copy of the personal data we hold about you.
- Right to rectification: you have the right to have incomplete or inaccurate data we hold about you corrected.
- Right to erasure ('right to be forgotten'): you have the right to ask us to delete or remove personal data where there is no good reason for us to continue processing it.
- Right to restrict processing: you have the right to suspend the processing of your personal data.
- Right to data portability: you have the right to request the transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format.
- Right to object: you have the right to object to the processing of your personal data where we are relying on a legitimate interest.
- Right to withdraw consent: where we are relying on consent to process your personal data (e.g., for health data or marketing), you have the right to withdraw that consent at any time.
To exercise any of these rights, please contact us using the email address provided in Section 1.
8. Complaints
You have the right to make a complaint at any time to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten – IMY), the supervisory authority for data protection issues in Sweden. We would, however, appreciate the chance to deal with your concerns before you approach the IMY, so please contact us in the first instance.
9. Cookies
See the cookie policy below.
10. Changes to the privacy policy
We may update this policy from time to time. Any changes will be posted on this page with an updated "Effective date." If the changes are significant, we may choose to notify you directly via email.
Cookie policy for Lost Goats AB
1. What are cookies?
Cookies are small text files that are placed on your computer or mobile device when you visit a website. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site.
2. Cookies on this website
This website does not set any cookies of its own, and we do not use analytics or marketing cookies. Our contact and sign-up forms are processed by our hosting provider (Netlify) without cookies.
3. Third-party cookies
Some pages show an embedded video from YouTube. We use YouTube's privacy-enhanced mode (youtube-nocookie.com), and the video is only loaded from YouTube when you scroll to it or press play. It then starts playing without sound, and YouTube (Google) may set its own cookies. Links to Instagram, Facebook and other sites take you to those services, which have their own cookie policies.
4. How to manage and delete cookies
Most web browsers allow control over cookies through their settings. You can usually find these settings in the 'options' or 'preferences' menu of your browser. To find out more about cookies, visit www.aboutcookies.org or www.allaboutcookies.org.
5. Contact us
If you have any questions about our use of cookies, please contact us at lostgoatsab@gmail.com.