Privacy Policy

Visit Group International AB ("Visit Group", "we", "us" or "our") is a Swedish Software as a Service ("SaaS") company that provides innovative solutions for our customers within the hospitality industry.

At Visit Group, we are committed to protecting your privacy and handling your Personal Data with care and transparency. This Privacy Policy explains how we collect, use, and safeguard Personal Data from various categories of individuals, including (i) our contacts at customers, suppliers and other partners, (ii) our personnel's contacts, such as emergency contacts, and (iii) users of our websites (https://www.visitgroup.com/, https://iticket.com/, https://bookvisit.com/, https://visbook.com/, https://www.citybreak.com/) ("Website"). We take our obligations under the Data Protection Legislation seriously and strive to provide the highest level of data protection.

In this Privacy Policy:

• "Personal Data" means information relating to a living individual and from which that individual can be identified.
• "Sensitive Personal Data" is Personal Data concerning an individual's (i) racial or ethnic origin, (ii) political opinions, (iii) religious beliefs or other beliefs of a similar nature, (iv) membership of a trade union, (v) physical or mental health or condition, (vi) sexual life or orientation, (vii) commission or alleged commission of any offence or any proceedings for any offence committed or alleged to have been committed by him/her, the disposal of such proceedings or the sentence of any court in such proceedings.
• "Data Protection Legislation" means any law applicable to Visit Group from time to time relating to the processing of Personal Data and/or privacy, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation) (the "EU GDPR"), the EU GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the "UK GDPR"), the UK Data Protection Act 2018, and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

Data Controller

Visit Group International AB, with its registered office at Kungsgatan 34-36, 411 19 Gothenburg, and/or its subsidiaries, are the data controllers responsible for the processing of your Personal Data under this Privacy Policy.

Please note that we may also process, as data processor, the Personal Data of our customer's own individual customers. Our customers are responsible for providing those persons with information about how their Personal Data is collected and processed.

Categories of Personal Data We Collect

The Personal Data we collect will vary depending on your relationship with Visit Group.

Contacts at Customers

• Contact information (e.g. name, email address, phone number)
• Billing information (e.g. credit card details, billing address)
• Communication history (e.g. emails, support inquiries)
• User-generated content (e.g. reviews, feedback)

Our Personnel's Contacts

• Your contact details, if you are listed an emergency contact
• Your name, contact details and other relevant information, if you are listed in relation to employee benefits arrangements

Job Applicants

• The information in your CV and any separate application form
• Information provided during job interviews
• Information about your right to work
• Information provided by job references

Contacts at Suppliers and Partners 

• Contact information (e.g. name, email address, phone number)
• Financial information (e.g. bank details, payment history)

Users of our Website

• Information about your preferences in respect of our Website
• Information about the device used to access our Website

Collecting Personal Data

We may collect your Personal Data directly from you. Most commonly, we would collect Personal Data directly from you in the following circumstances:

1. Where you engage with us (e.g. by sending us emails, contacting us via telephone, visiting or making an enquiry through our Website, entering into a contract with us or preparing to enter into a contract with us), you may provide us with Personal Data including your name and contact details.
2. Where you apply for a job with us, you may provide us with Personal Data. Where we offer you a job, you may provide us with additional Personal Data.
3. Where you make use of our Website, we may collect information about your use of the Website (e.g. your IP address and choice of web browser). See section entitled 'Use of Cookies' of this Privacy Policy for more information on our use of cookies.
4. In order to improve the quality of our services, we record all calls made on certain employees' telephone lines. If your call is recorded, the recording may contain Personal Data that you provide during the call.

Receiving Personal Data

We may collect your Personal Data from third parties. For example: 

1. your employer may provide your Personal Data to us in connection with a service they provide to us or in connection with services that we provide to our customers;
2. our personnel may give us emergency contact information as part of our emergency scenario planning, and may also give us details of their dependents and of other people in relation to their employee benefits arrangements; and
3. we may receive information from past employers and others concerning your employment history and suitability for the role where you apply for a job with us; and
4. where a third party controls a CCTV camera that is in a communal area of our premises, we may request CCTV footage from that third party in limited circumstances, for example where we suspect the commission of a criminal offence. 

Where this is the case, the third party is responsible for informing you that they have shared your Personal Data with us, directing you to this Privacy Policy as to how we will process your Personal Data and obtaining any relevant consents from you. However, once we are holding it, we will only handle Personal Data in accordance with this Privacy Policy and Data Protection Legislation.

Where you provide Personal Data on behalf of another individual, you are responsible for notifying that individual that you have provided their Personal Data to us and directing them to this Privacy Policy for information on how we process their Personal Data.

Purposes of Processing Personal Data

We process Personal Data for the following purposes:

Purpose	Legal Basis	Retention Period
Contacts at Customers
Providing and maintaining our SaaS services	To perform a contract	6 years
Managing billing and payments	To perform a contract	6 years
Communicating with you about service updates and support	To perform a contract	6 years
Improving our services	Necessary for the purposes of the legitimate interests of Visit Group	6 years
Performing our contract with our customer or taking steps at your request prior to entering into a contract	To perform a contract	6 years
Our Personnel's Contacts
Contacting you if you are listed as an emergency contact for one of our staff members, or administering our employee benefits arrangements	To protect the vital interests of the data subject or another person To perform a contract	6 years
Job Applicants
Hiring and recruitment purposes	To take steps at the request of the data subject prior to entering into a contract	Two years after notifying unsuccessful candidates
Contacts at Suppliers and Partners
Managing supplier and partner relationships	Necessary for the purposes of the legitimate interests of Visit Group	6 years
Processing payments and invoices	To perform a contract	6 years
Ensuring compliance with contractual agreements	To perform a contract	6 years
Communicating about business matters	Necessary for the purposes of the legitimate interests of Visit Group	6 years
Users of our Website
Providing and improving our Website and other services	Necessary for the purposes of the legitimate interests of Visit Group	6 years
Delivering personalized advertisements and marketing communications	Necessary for the purposes of the legitimate interests of Visit Group	6 years or until consent is withdrawn

Where you have explicitly consented or where we otherwise have a right to do so, we may also use your Personal Data for marketing purposes. You have the right to ask us not to process your Personal Data for marketing purposes, by following the instructions outlined in any marketing communications you receive, or by using the contact details in this Privacy Policy.

Legal Basis for Processing

We may process your Personal Data because the processing is necessary for us to perform our contract with your or take steps at your request prior to entering into a contract, because it is necessary for us to comply with our legal obligations, where you have consented to the processing and/or because the processing is necessary for our legitimate interests or the legitimate interests of a third party (and these interests are not outweighed by the rights and freedoms of the individual). Our legitimate interests include the carrying out and improving our business, analyzing the use of our Website and servicing and supporting our customers and personnel.

Where we require Personal Data to comply with our legal or contractual obligations, the provision of such Personal Data is mandatory; if it is not provided, we will not be able to meet obligations placed on us.

We will only process your Sensitive Personal Data if you have given your express consent to the processing, the processing is necessary for the purpose of carrying out or obligations and exercising our or your rights in the field of employment, the processing is necessary for reasons of substantial public interest on the basis of domestic law, you have made the Sensitive Personal Data public and/or the processing is necessary for the establishment, exercise or defense of legal claims. If we rely on your express consent to the processing, we will let you know (and give you the chance to withdraw consent).  

Sharing Data

Personal Data may be shared with group companies, third party service providers (such as IT service providers), appointed representatives and our professional advisors, in each case for one or more of the purposes referred to above. Personal Data shared with other group companies will be processed in accordance with this Privacy Policy and as otherwise described in any additional policies or notices provided to you from time to time. We will never sell your Personal Data.

Personal Data may also be shared with government authorities, law enforcement agencies, courts and/or similar bodies (i) if we are under a duty to disclose your Personal Data in order to comply with any legal obligation (such as anti-money laundering obligations or anti-terrorist financing obligations), (ii) to assist a regulator or any competent authorities (including tax authorities), courts and/or similar bodies, (iii) to enforce our rights under any agreement we may have with you, (iv) to carry out an internal investigation, or (v) otherwise to protect the rights, property, or safety of the company, our group companies and our customers, directors, employees or other personnel. This includes exchanging information with other companies and organizations for the purposes of fraud protection and prevention.

In exceptional circumstances, if we are sold or merged with another company we may disclose your information to a potential buyer, including your Personal Data and other information concerning your relationship with us, so that they can continue to provide the services you have requested/maintain any existing relationship (as applicable).

Data Transfer

It may be necessary for us to transfer your Personal Data outside the European Economic Area ("EEA") or the UK. Your Personal Data may also be accessed by staff operating outside the UK or the EEA who work for us or for one of our suppliers or group companies. This includes staff engaged in, among other things, the provision of support services.

We will take all steps reasonably necessary to ensure that your Personal Data is treated securely and in accordance with this Privacy Policy and the Data Protection Legislation when it is processed in, or otherwise accessed from, a location outside the UK or the EEA.

Where any transfer takes place under a written contract, you have the right to request a copy of that contract and may do so by contacting us using the details in this Privacy Policy. 

Data Retention

We retain Personal Data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by applicable laws and regulations. To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of such information, the purposes for which we process such information and whether we can achieve those purposes through other means, and the applicable legal requirements. 

As a general rule, Personal Data should be retained for as long as it is current/in force, and for at least six years thereafter. However, it might be appropriate to retain data for longer or shorter periods of time, having regard to, among other things, the possibility of legal action, whether the data relates to service-providers whose performance has been judged as unsatisfactory and/or whether the data is likely to be useful to analysis historic trends of our business. In some cases, shorter retention periods may be justified; for example, certain Personal Data should not be kept for longer than necessary, having regard to the purpose for which such data is held.

For each purpose of processing data, as set out in the table above, we have specified the corresponding retention period.

Data Security

We implement technical and organizational measures to safeguard your Personal Data from unauthorized access, disclosure, alteration, and destruction. Unfortunately, the transmission of information via the internet is not completely secure and we cannot guarantee the security of your Personal Data transmitted via our Website; any transmission is therefore at your own risk.  

The Website may contain links to and from third party websites. If you follow a link to any of these websites, please note that these websites have their own privacy policies that we do not accept any responsibility or liability for these websites or their related policies. Please check these policies before you submit any Personal Data via these websites.

Your Rights

Under the Data Protection Legislation and subject to some exceptions you have certain rights regarding your Personal Data:

Right to information: You have the right to be informed about how we process your Personal Data. We do this through this Privacy Policy and by answering your questions. If you want to know more about our processing of your Personal Data, you can contact us and request additional information.

The right to access your Personal Data: You have the right to request information if we process Personal Data about you, and to receive a copy of such Personal Data. Upon such request, we will also provide information about e.g. which categories of Personal Data we process, what the Personal Data is used for and the recipients of the Personal Data, in the event that your Personal Data is shared.

The right to correct inaccuracies in your Personal Data: We strive to always have accurate Personal Data about you and to update our records when necessary. If you discover that we process inaccurate information about you, you have the right to have this corrected. You also have the right to ask us to complete incomplete data we hold about you, if this is relevant based on the purposes for which your Personal Data is processed, by providing us with additional information.

The right to erase your Personal Data: You have the right to request the erasure of your Personal Data. However, certain conditions are required in order for us to erase your Personal Data. For example, you may have the right to have your Personal Data erased if it is no longer necessary for the purposes in which it was collected. The right to erasure is not absolute and it may not always be possible to erase Personal Data on request, for example, when processing the information is still necessary for the purpose in which the data was originally collected or because we have a legal obligation to keep it.

The right to restrict processing of your Personal Data: You can request that the processing of your Personal Data is restricted, for example if you do not think that the information we have about you is correct or if you believe that the processing is unlawful. A request for restricting the processing of Personal Data can also be made if we are investigating whether our legitimate interests override your interests, rights and freedoms (in response to an objection to our processing).  See more about this under 'The right to object to processing' below.

The right to data portability: You have the right to receive the Personal Data that you have provided to us in a structured, commonly used and machine-readable format. However, this presupposes that the processing takes place by automated means (i.e. not in physical form on paper). If technically possible, and you wish to do so, we may also transmit such Personal Data to another data controller.

The right to object to processing: You have the right to object to our processing of your Personal Data which is based on our legitimate interests (see legal bases above). If you object, we do not have the right to process your Personal Data anymore, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or if it is needed for the establishment, exercise or defense of legal claims. If we consider that we have such legitimate grounds, or if the data is needed for the establishment, exercise or defense of legal claims, we will notify you of this, and the reasons for such assessment. You can also object to your Personal Data being processed for marketing purposes. If you do so, we will stop sending marketing messages to you.

The right not to be subject to automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces adverse legal effects concerning you, or similarly significantly affects you.

In addition, where we have asked for your consent to process your Personal Data, you have the right to withdraw that consent at any time. If you ask to withdraw your consent to the processing of your Personal Data, this will not affect any processing which has already taken place but this may affect our ability to process your Personal Data in accordance with this Privacy Policy.

To exercise these rights, please contact us using the information provided below.

Please note that these rights may be limited (e.g. if fulfilling your request to access your Personal Data would reveal Personal Data about another person, or if you ask us to delete Personal Data which we are required by law to keep or have compelling legitimate interests in keeping). Where applicable, we will inform you of relevant exemptions we rely upon when responding to any request you make.

Use of Cookies

A cookie is a small file that is sent to your browser from a web server and is stored on your computer. We use cookies in order to make our Website work, to make our Website work more efficiently (e.g. by remembering information about your preferences), and to gather information on use and performance of our Website (for example, to analyze web traffic and identify which pages of our Website are being used).

A cookie in no way gives us access to your computer or any information about you, other than information about how you use our Website and the Personal Data you choose to share with us (including Personal Data you automatically share with us by way of your browser settings).

In particular, we may use the following cookies on our Website:

1. Strictly Necessary Cookies. These cookies are essential in order to enable you to move around our Website and use their features, such as accessing secure areas.
2. Performance Cookies. These cookies collect information about how visitors use our Website, for instance which pages visitors go to most often and if they get error messages from the web pages. These cookies don't collect information that identifies a visitor; all information these cookies collect is aggregated and therefore anonymous. It is only used to improve how our Website works.
3. Functional Cookies.  These cookies enable the Website to provide enhanced functionality and personalization.
4. Targeting Cookies.  These cookies may be set through the Website by advertising partners, to build a profile of your interests and show you relevant adverts on other sites.

You can manage cookie use via your browser settings (this will allow you to refuse the setting of all or some cookies) and your browser provider may ask you to confirm your settings. Note, however, that if you block all cookies (including strictly necessary cookies) via your browser settings you may not be able to access or use all or parts of our Website.

Contact Information

If you have questions or concerns about this Privacy Policy or how we handle your Personal Data, please contact us at:

Visit Group

Kungsgatan 34-36, 411 19 Gothenburg, Sweden

Email: [email protected]

Phone: +46 31 380 60 00

Alternatively, you have the right to make a complaint to the Information Commissioner's Office (which is the supervisory body in the UK) or, if you are an EU data subject, one of the competent European supervisory authorities.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices. When we make changes, we will revise the "Last Updated" date at the beginning of this Privacy Policy. We encourage you to review this Privacy Policy periodically. If you do not agree to any changes that we make, you should not use or access (or continue to use or access) the Website and/or our services.  

By using our services, you consent to the practices described in this Privacy Policy.