GDPR

This policy describes what personal data Experience Transylvania processes about you, how your personal data is handled and why we process your personal data. The privacy policy also describes your rights towards Experience Transylvania and how you can exercise your rights.

Privacy Policy for Experience Transylvania


All processing of personal data takes place in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and applicable Swedish data protection legislation.

1. Introduction

This privacy policy describes how Experience Transylvania processes your personal data, why we collect it, our legal basis for processing, how long the data is retained, and your rights as a data subject.

We only use strictly neccesary cookies.

2. Data Controller

Experience Transylvania GV AB is the data controller responsible for the processing of your personal data.

Contact details:

  • Company Name: Experience Transylvania GV AB
  • Corporate ID Number: 556883-5101
  • Postal Address: 746 41 Bålsta, Sweden
  • Telephone: +46 8 68 45 5678
  • E-mail: info@transylvania.se

3. Personal Data We Process, Purposes, Legal Bases, and Retention Periods

3.1 When You Visit Our Website

  • Personal Data: IP address, device and browser information, geographic location, and information on how you interact with our website.
  • Purpose: To provide, secure, optimize, and improve our website, as well as to analyze user behavior.
  • Legal Basis:
  • Necessary cookies/functions: Legitimate interest (Art. 6.1 f GDPR) to maintain website functionality and security.
  • Analytics and marketing cookies: Explicit consent (Art. 6.1 a GDPR) provided via our cookie banner.
  • Retention Period: Session-based or up to 12–24 months depending on the type of cookie (see our Cookie Policy).

3.2 When You Book or Purchase a Trip/Service

  • Personal Data:
  • Name and contact details (address, email, phone number).
  • Identification and travel documents (passport details, driver's license, date of birth).
  • Payment and purchase history.
  • Insurance details relevant to the trip.
  • Sensitive Personal Data: Health and medical data (e.g., allergies, dietary requirements, accessibility needs, or disabilities) necessary for the execution of the trip.
  • Purpose: To administer your booking, issue tickets, arrange transportation, book accommodation, process payments, and customize the trip according to your needs.
  • Legal Basis:
  • Standard personal data: Performance of a contract (Art. 6.1 b GDPR).
  • Accounting and financial records: Legal obligation (Art. 6.1 c GDPR) under the Swedish Accounting Act (Bokföringslagen).
  • Health and dietary data: Explicit consent (Art. 9.2 a GDPR).
  • Retention Period:
  • Travel documents and booking data: Retained during the execution of the trip and up to 24 months following the conclusion of the trip to handle potential complaints.
  • Financial records: Retained for 7 years in compliance with the Swedish Accounting Act.
  • Health data: Deleted immediately after the conclusion of the trip.

3.3 When You Contact Us (Email, Phone, Forms, or Social Media)

  • Personal Data: Name, email address, phone number, and the content of your message.
  • Purpose: To answer inquiries, provide customer service, and manage support matters.
  • Legal Basis: Legitimate interest (Art. 6.1 f GDPR) to communicate with and provide service to customers and visitors.
  • Retention Period: Retained for as long as the matter is ongoing and deleted no later than 12 months after the last contact, provided no future contractual relationship is established.

3.4 If You Provide Data Regarding Other Individuals

If you make a booking on behalf of someone else (e.g., travel companions or children), you are responsible for informing them of the contents of this policy and ensuring you have authorization or valid consent to share their data with us.

4. Recipients and Sharing of Personal Data

To fulfill our contractual obligations and operate our business, we may share your personal data with carefully selected third parties:

  1. Subcontractors and Travel Partners: Hotels, airlines, local transport providers, tour guides, restaurants, and partners included in your itinerary.
  2. IT and System Vendors: Providers of booking systems, CRM tools, email servers, web hosting, and payment solutions.
  3. Public Authorities: Supervisory authorities or other public bodies when required by law or regulation.

All external providers processing personal data on our behalf enter into Data Processing Agreements (DPAs) with us to guarantee that your data is protected with an equivalent level of security. We never sell your personal data to third parties.

5. Transfers Outside the EU/EEA (Third Countries)

We strive to process your personal data within the EU/EEA. However, some of our partners (e.g., local guides, hotels, or transport providers in countries outside the EU/EEA) process data in the respective destination country.

Where transfers to third countries occur, we ensure that the transfer is lawful through:

  • Adequacy decisions adopted by the European Commission (Art. 45 GDPR),
  • European Commission Standard Contractual Clauses (SCCs, Art. 46 GDPR), or
  • Specific derogations for individual situations, such as when the transfer is necessary for the performance of your travel contract (Art. 49.1 b GDPR).

6. Data Security

We apply appropriate technical and organizational security measures (including encryption, access restrictions, and firewalls) to protect your personal data against unauthorized access, loss, alteration, or destruction.

7. Your Rights Under the GDPR

Under the General Data Protection Regulation, you have several rights regarding our processing of your personal data:

  • Right of Access (Subject Access Request): You have the right to obtain confirmation as to whether we process your personal data and to receive a copy of the data being processed.
  • Right to Rectification: You have the right to request the correction of inaccurate or incomplete personal data.
  • Right to Erasure ("Right to be Forgotten"): You can request the deletion of your personal data if it is no longer necessary for the purpose for which it was collected, or if you withdraw your consent. Please note that statutory requirements (e.g., accounting legislation) may prevent us from immediately deleting certain data.
  • Right to Restriction of Processing: You have the right to request that the processing of your data be restricted while an investigation is underway (e.g., if you have contested the accuracy of the data).
  • Right to Data Portability: You have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format for transfer to another data controller.
  • Right to Object: You have the right to object at any time to processing based on our legitimate interest or for direct marketing purposes.
  • Right to Withdraw Consent: Where processing is based on your consent (e.g., regarding health data or newsletters), you have the right to withdraw your consent at any time.

If you wish to exercise any of your rights, please contact us at info@transylvania.se.

8. Changes to This Privacy Policy

We reserve the right to update this privacy policy as necessary. The latest version will always be published on our website, indicating the date of the last update.

Last updated: October 27, 2026