Privacy Policy
-
1. Introduction
Gotlandsbolaget prioritizes confidentiality and data security. This privacy policy applies to the processing of your personal data and sets out the guidelines for how Gotlandsbolaget handles your personal data.
This privacy policy provides the information you are entitled to receive under applicable data protection laws.
You should read this privacy policy before submitting your personal data to Gotlandsbolaget.
-
2. Data controllers and Contact information
Gotlandsbolaget consists of different companies.
The following legal entity will be the data controller for all processing activities related to www.gonordiccruiseline.dk, www.gonordiccruiseline.no and bookings made through DFDS for the Oslo-Frederikshavn-Copenhagen route ("OFC"):
Alvina Shipping A/S
Go Nordic Cruiseline A/S
Dampfærgevej 30
2100 Copenhagen, Denmark
Email: persondata@gonordiccruiseline.com
The following legal entity will be the data controller for all processing activities related to www.gotlandsbolaget.se and www.gotlandsbolaget.com:
Rederi AB Gotland
Company No.: 556000-8020
Hamngatan 1, Box 1104
621 23 Visby, Sweden
Email: rabg@gotlandsbolaget.se
The following legal entity will be the data controller for all processing activities related to www.destinationgotland.se:
Destination Gotland AB
Company No.: 556038-2342
Korsgatan 2, Box 1234
621 23 Visby, Sweden
Email: info@destinationgotland.se
Hereafter, each data controller will individually be referred to as “Gotlandsbolaget", "we", "us" or "our" in this privacy policy.
-
3. Use of your personal data
3.1 Cookies, Pixels and Social Media Tools
Types of personal data
Gotlandsbolaget uses cookies, pixels and social media tools on our websites and processes your personal data in this regard. Gotlandsbolaget may collect the following personal data about you when you visit our websites:
- IP address
- MAC address
- Session duration
- Conversion tracking
- Browser history
- Information about your use of our websites, including click behaviour
- Time stamp
- Data about button clicks
- Pixel ID when pixels are accepted for Meta, LinkedIn and Google
Purpose
Your personal data may be processed for the following purposes:
- Functionality of the websites
- General marketing, including personalized and targeted advertising
- Product and service development
- Statistics and analysis
Legal basis for processing
- Contractual obligations: Processing of personal data related to necessary cookies is based on an agreement between you and Gotlandsbolaget to use the functions on the websites (Article 6(1)(b) of the GDPR).
- Legitimate interest: Processing of personal data related to statistics and preference cookies is based on our legitimate interest in offering you the best possible websites, products and services (Article 6(1)(f) of the GDPR).
- Consent: Processing of personal data related to marketing and social media cookies is based on your prior consent (Article 6(1)(a) of the GDPR).
Retention perio
Data collected through cookies will be deleted in accordance with our cookie retention periods shown in the cookie pop-up windows.
However, the information may be retained for a longer period in anonymized form.
Joint control
When you accept social media tools (pixels) for marketing via the cookie pop-up window, Gotlandsbolaget may transfer information about your web browser, page location, IP address, pixel ID / cookie ID, visited pages, interests, and interaction with ads to our partners on social media.
The purpose of Gotlandsbolaget's processing and transfer is to:
- Measure the effectiveness of our ads
- See if the ads are relevant to the target audience
- Deliver targeted content
- Build customer groups for marketing
- Target ads at people who have visited the website
- Target ads at people who resemble current ones
The purpose of social media's processing of your personal data is to improve and optimize the social media’s advertising platform.
For the following social media, Gotlandsbolaget and the social media providers are jointly responsible for the processing of personal data collected for the purposes mentioned above:
- Facebook (Meta Platforms Ireland)
- Facebook’s privacy policy is available here
- Google Ads (Google Ireland)
- Google’s privacy policy is available here
- LinkedIn (LinkedIn Ireland Unlimited Company)
- LinkedIn’s privacy policy is available here
The legal basis for Gotlandsbolaget's transfer of your personal data for these purposes, is your prior consent, as per Article 6(1)(a) of the GDPR.
3.2 Communication with you
Types of personal data
When you use the contact form or chat function on our websites, contact customer service, or otherwise communicate with us, Gotlandsbolaget processes the following categories of personal data:
- Name
- Email address
- Phone number
- Subject of your inquiry
- Country
- Date of your inquiry
- Other information you provide related to your inquiry
- Recordings of phone calls
We encourage you not to provide sensitive personal data unless strictly necessary for the processing of your inquiry or booking.
Purpose
Your personal data will be processed for the following purposes:
- Handling your inquiry
- General communication
- Statistics and analysis
- To enter into an agreement with you
- To record phone calls for training purposes
Legal basis for processing
- Legitimate interest: We may process your personal data based on our legitimate interests in handling your inquiry, communicating with you, and developing our products and services (Article 6(1)(f) of the GDPR)
- Contractual obligations: To enter into an agreement (Article 6(1)(b) of the GDPR).
- Consent: We may obtain your consent to record phone calls for training purposes (Article 6(1)(a) of the GDPR).
Retention period
Generally, we store your personal data for 5 years after your last contact.
Phone call recordings will be stored for 30 days. Call log files are stored for 1 year.
3.3 Booking
Types of personal data
Gotlandsbolaget processes personal data about you when you make a booking and purchase tickets, whether on the website, in the app, by phone, through DFDS for the OFC route, or in person at one of our terminals. Gotlandsbolaget may process the following types of personal data:
- Name
- Date of birth
- Gender
- Nationality
- Address
- Identifying information
- Phone number and email
- Payment information
- Travel details, including tickets
- License plate (if booking travel with a vehicle)
- Information about whether you need special assistance when receiving our services
- Descriptions of reckless behaviour onboard if you put the safety of other guests and/or staff at risk
- If you are under 16 and traveling alone, we may collect details about your parent or guardian
We may receive your data from your travel agency and other companies involved in arranging your travel for these parties handling your reservations and bookings and arranging your travels and purchases. If for instance you book a trip through a travel agency or an online platform, we will receive your identifying information, contact details, and booking information from these third parties.
Purpose
Your personal data will be processed for the following purposes:
- Fulfilling our obligations to you as a customer, such as completing bookings, purchases, billing, and providing support
- General customer service, such as answering questions and correcting inaccurate information
- Statistics and analysis
- Service messages
- Sending satisfaction or market research surveys
- Compliance with applicable laws, such as accounting laws and shipping regulations
- Compliance with internal policies, including excluding guests from future trips in the case of reckless behaviour
Legal basis for processing
- Contractual obligations: We process your personal data to enter into or fulfil the agreement, handle complaints and refunds (Article 6(1)(b) of the GDPR).
- Legitimate interest: We process your personal data based on our legitimate interest in improving our services, ensuring safety, complying with internal policies, sending traffic information and important messages (Article 6(1)(f) of the GDPR).
- Legal obligation: We may process your personal data to comply with legal obligations, if you have a disability or for accounting purposes (Article 6(1)(c) of the GDPR).
Retention period
Generally, we store your personal data for 5 years after your last purchase or last contact.
Accounting information is stored for 5 years.
Contact information of excluded guests will be kept for the exclusion period.
However, we may process your personal data for a longer period in anonymized form.
3.4 Account holder
Types of personal data
Gotlandsbolaget processes the following categories of personal data about you when you create and use an account:
- Name
- Date of birth
- Gender
- Nationality
- Any disability
- Address
- Phone number and email
- Payment information
- Account details
Purpose
Your personal data will be processed for the following purposes:
- Management of account ownership
- Allowing you to use the benefits of account ownership, such as the ability to save co-travellers and pre-filled information.
- Enabling service communication with you as an account holder via mail, email, phone or SMS.
Legal basis for processing
- Contractual obligations: We process your personal data to enter into or fulfil the agreement related to your account (Article 6(1)(b) of the GDPR).
- Legitimate interest: We process your personal data based on our legitimate interest in improving our services and the account (Article 6(1)(f) of the GDPR).
Retention period
For 3 years if your account is made inactive
3.5 Members of "My Destination"
Types of personal data
Gotlandsbolaget processes the following categories of personal data about you when you are a member of "My Destination":
- Name
- Date of birth
- Gender
- Nationality
- Address
- Phone number and email
- IP address and information about your use of websites
- Information about which of our services or offers you have been interested in, and how you interact with our newsletters
Purpose
Your personal data will be processed for the following purposes:
- To offer you special deals
- To enable communication with you via mail, email, phone or SMS
- To enable personalized offers (profiling), marketing, and event invitations via phone, mail, email and SMS/MMS
Legal basis for processing
- Consent: The processing of personal data in relation to "My destination" may be based on your prior consent (e.g., for forwarding direct marketing) (Article 6(1)(a) of the GDPR).
- Legitimate interest: The processing of your personal data may be based on our legitimate interest in being able to market our products and services (Article 6(1)(f) of the GDPR).
Retention period
As long as you are a member and for a short period after your membership ends.
3.6 Marketing
Types of personal data
Gotlandsbolaget processes the following categories of personal data for marketing purposes when you subscribe to newsletters:
- Phone number
- Name
- Browser behaviour (provided that we have received your prior consent). This includes your browser and device information, IP address, pages visited, clicks, and product interactions
- Purchase history and travel frequency (price, location and number of products)
- Communication history
Purpose
Your personal data may be processed for the following purposes:
- Marketing and tailored marketing
- Analysis and statistics
- Optimization of products and services
Legal basis for processing
- Consent: Gotlandsbolaget will only use your personal data for direct marketing, including the sending of newsletters, if you have given prior consent (Article 6(1)(a) of the GDPR).
- Legitimate interests: The processing of your personal data for analysis and statistics, as well as tailoring newsletters, will be based on our legitimate interest in improving and developing our services and marketing our products and services (Article 6(1)(f) of the GDPR).
Retention period
Your personal data will be stored as long as your consent to receive newsletters is active.
You can always withdraw your consent by clicking the unsubscribe link at the bottom of each email.
Additionally, the information may be retained for a longer period in anonymized form.
3.7 Competitions
Types of personal data
Gotlandsbolaget processes the following types of personal data if you participate in competitions:
- Name
- Phone number
- If you win a competition, we may also collect your address
Purpose
Your personal data may be processed for the following purposes:
- Registering your participation
- Selecting a winner
- Sending a prize
Legal basis for processing
- Legitimate interests: The legal basis for processing your personal data is our legitimate interest in being able to carry out the competition (Article 6(1)(f) of the GDPR).
Retention period
3 years after the end of the competition.
-
4. Disclosure and Transfer of personal data
For the above purposes, we may grant third parties who provide relevant services based on a contractual relationship with Gotlandsbolaget, access to your personal data. This may include:
- IT providers
- Customer service providers
- Providers of payment solutions
- Providers of information dissemination
- Marketing providers
- Booking platform providers
- Providers of statistical and analytical tools in connection with surveys
Such providers will only process personal data in accordance with our instructions and subject to data processing agreements.
Under certain circumstances and in accordance with applicable law (Article 6(1)(c) of the GDPR), or to pursue our legitimate interest in establishing or defending legal claims (Article 6(1)(f) of the GDPR), it may be necessary to transfer your personal data to separate data controllers, such as the police, lawyers, auditors, courts, other public authorities, potential buyers, and other companies within the Gotlandsbolaget group. Gotlandsbolaget may also share your personal data with social media and platforms. Gotlandsbolaget and social media providers may periodically act as joint data controllers for marketing on these platforms as described above.
If your personal data is transferred to data processors or data controllers established in countries outside of the EU/EEA that do not have an adequate level of protection, such transfers will only take place once a basis for transfer has been secured.
Furthermore, the transfer will be based on the European Commission’s Standard Contractual Clauses or the EU-US Privacy Framework when recipients in the U.S. are certified.
If you have questions about the basis for transfers to countries outside of the EU/EEA, please contact us.
-
5. Your rights
You can contact Gotlandsbolaget to exercise any of the rights granted to you under the applicable data protection laws, including:
- a) Right of access and Right to rectification
You have the right to request copies of your personal data or ask us to correct data you believe is inaccurate. There are some exceptions, which means you may not always receive all the information we process, but generally you can always contact us and request your information.
- b) Right to erasure
You have the right to request that we delete your personal data under certain circumstances.
- c) Right to restriction of processing
You have the right to request that we limit the processing of your information.
- d) Right to data portability
You have the right to receive your personal data in a structured, commonly used and machine-readable format (data portability
- e) Right to object
You have the right to object to the processing of your personal data. This means that you can ask us to stop processing your personal data. This right only applies if “legitimate interests” (including profiling) is the legal basis for this processing.
You can object to direct marketing at any time and free of charge, if your personal data is used for this purpose. This includes profiling related to such direct marketing. If you exercise this right, we will no longer process your personal data for these purposes.
- f) Withdrawal of consent
You may withdraw your consent at any time by following the specific instructions regarding the processing for which you have given your consent. For example, you can withdraw your consent by clicking the unsubscribe link in an email, adjusting your communication preferences in your account (if available), or changing your smartphone settings (for push notifications and location data). You may also contact Gotlandsbolaget directly to withdraw your consent.
Denial or limitation of rights
There may be conditions or limitations to these rights. This means that you may not always have a specific right in each situation, depending on the circumstances of the processing activity. However, you are always welcome to contact us.
-
6. Questions and complaints
If you have questions or concerns about how we process personal data, please let us know so we can investigate the matter. You also have the right to file a complaint with a supervisory authority, especially in the country where you live or work, or with:
- Swedish Authority for Privacy Protection (IMY) Phone: +46 (0) 8-657 61 00, imy@imy.se
- Danish Data Protection Agency Phone: +45 3319 3200, dt@datatilsynet.dk
- Norwegian Data Protection Authority Phone: +47 22 39 69 00, https://www.datatilsynet.no/ postkasse@datatilsynet.no
-
7. Changes to the privacy policy
We will continually update this privacy policy to ensure that we provide you with accurate information and comply with applicable laws. This means we will regularly update and change this privacy policy.
In the event of significant changes, we will notify you via email if we have your email address.
The date of the most recent updates and changes will always be listed at the top of the privacy policy.
