Privacy policy

Sollenbrant & Co. (org. no. 559573-6785) is the data controller responsible for the processing of your personal data. You can reach us by email at privacy@falununlocked.se or by phone at +46 76 049 16 55.

Contact form

When you send a message through the contact form we collect your name, email address and message. This data is used solely to respond to your enquiry.

Experience bookings

When you book an experience through our booking partner Ticket Tailor, they collect the data needed to process your booking: name, email address, phone number and any options you select. If you pay online, payment details are processed by Ticket Tailor's payment provider (Stripe). We never have access to your card details.

Website visits

We use Plausible Analytics for anonymous visitor statistics. Plausible does not set any cookies, does not store personal data and is GDPR-compliant without a consent banner. The statistics are collected in a Plausible instance we run ourselves. When you sign up for the newsletter your IP address is additionally hashed and stored briefly at Cloudflare, solely to limit how many signups one source can make. The hash cannot be read back as an address and it expires on its own.

Marketing

If you consent to marketing cookies, we use Meta Pixel (Facebook) to measure and improve our advertising. Meta Pixel sets cookies that may track your visit to our website and link it to your Facebook or Instagram profile. The pixel only loads if you actively accept it via our cookie banner. You can change or withdraw your choice at any time via the cookie settings link at the bottom of every page.

• Responding to contact enquiries: legitimate interest (Art. 6.1f GDPR).
• Processing and managing bookings: performance of a contract (Art. 6.1b GDPR).
• Sending booking confirmations and practical information: performance of a contract (Art. 6.1b GDPR).
• Sending newsletters or marketing: consent (Art. 6.1a GDPR). You can unsubscribe at any time.
• Measuring and improving advertising via Meta Pixel: consent (Art. 6.1a GDPR). You choose via the cookie banner.

We share your data with the following service providers who process personal data on our behalf:

• Resend (email delivery for the contact form). Data may be processed in the US under EU Standard Contractual Clauses.Resend's list of sub-processors is available at resend.com/legal/subprocessors.
• Ticket Tailor (Zimma Ltd, UK). Handles booking data and ticket sales. Data stored in the EU (Ireland). GDPR compliant with data processing terms included in their Terms and Conditions.A list of Ticket Tailor's sub-processors is available at tickettailor.com/legal/gdpr-third-parties.
• Stripe (payment processing). Processes card payments when booking experiences. Data may be processed in the US under EU Standard Contractual Clauses.Stripe's list of sub-processors is available at stripe.com/legal/service-providers.
• Cloudflare (web hosting and CDN). Serves the website and stores images. Data may be processed in the US under EU Standard Contractual Clauses.Cloudflare's list of sub-processors is available at cloudflare.com/gdpr/subprocessors.
• Our own listmonk installation (listor.falununlocked.se), running on our own server in Sweden, so the list itself never leaves the EU. It stores your email address, your name if you gave one, and when the subscription was created and confirmed. We run the installation ourselves and the list is not shared onward. You can unsubscribe at any time via the link at the bottom of every mailing. The link is personal to you, so there is no general unsubscribe page.
• Amazon Web Services (SES). Delivers the newsletter confirmation mail and mailings. Sending is handled in an AWS region inside the EU. AWS is US-owned, so the EU standard contractual clauses cover any case where data is nonetheless processed outside the EU.The AWS list of sub-processors is at aws.amazon.com/compliance/sub-processors.
• Meta Platforms (Meta Pixel). Sets marketing cookies to measure advertising performance, but only if you consent. Data may be processed in the US under EU Standard Contractual Clauses.Meta's information on data processing is available at facebook.com/privacy/policy.

• Contact enquiries: deleted within 12 months after the matter is resolved.
• Booking data: retained in accordance with Swedish bookkeeping law (7 years for financial transactions).
• Newsletter subscription: until you unsubscribe. The address is then deleted from the list.
• Marketing consent: until you unsubscribe.

Under the GDPR you have the right to:

• Request access to your personal data.
• Request correction of inaccurate data.
• Request deletion of your data.
• Request restriction of processing.
• Receive your data in a machine-readable format (data portability).
• Object to processing based on legitimate interest.

Contact us at privacy@falununlocked.se to exercise your rights.

Our visitor statistics (Plausible Analytics) are entirely cookie-free. Ticket Tailor may use technically necessary cookies (session cookies) in the booking flow to manage your booking. If you consent via our cookie banner, Meta Pixel sets marketing cookies to measure advertising performance. Without your consent, no marketing cookies are set.

We may update this privacy policy as needed. The latest version is always available on this page. If we make significant changes that affect how we process your data, we will inform you by email or on the website.

If you believe we are processing your personal data incorrectly, you have the right to file a complaint with the Swedish Authority for Privacy Protection (IMY). More information is available at imy.se.