I. General Information

1. Responsible Body & Data Protection Officer

Below we explain to you which personal data is collected and processed by us when using our services and offers.

We are:
EPTI AB
559117-2175
Linnégatan 87A,
115 23 Stockholm,
Sweden
Email: [email protected]

Our company data protection officer is:
Mr. Sanin Mujkic
Email: [email protected]

Personal data are individual details about personal or factual circumstances of a specific or identifiable natural person, this means all information that relates to a person.

2. Legal Basis

As far as a legal basis is mentioned in this Privacy Policy, they relate to the General Data Protection Regulation. We collect and process personal data based on the following statutory regulations:

• Consent according to Article 6 paragraph 1 (a) General Data Protection Regulation (GDPR). Consent is any voluntary expression of intent, in an informed and unequivocal manner, in the form of a statement or other unambiguous confirmatory act, which indicates that the data subject consents to the processing of his personal data.
• Necessity to fulfill the contract or carry out preparatory actions in accordance with Article 6 para. 1 (b) GDPR, this means that the data is required so that we can fulfill the contractual obligations to you or we need the data to prepare a contract closure with you.
• Processing to fulfill legal obligations under Article 6 para. 1 (c) GDPR, this means that a processing of the data is required by law or other regulations.
• Processing for the protection of legitimate interests in accordance with Article 6 para. 1 (f) GDPR, this means that processing is necessary to safeguard legitimate interests on our part or by third parties, unless the interests or fundamental rights and freedoms on your part that require the protection of personal data prevail.

3. Rights of affected

You are entitled to the following rights with regard to the processing of data by us in accordance with the respectively listed articles of the General Data Protection Regulation:

• Right of access by the data subject to Art. 15 GDPR
• Right to rectification according to Art. 16 GDPR
• Right to erasure (“right to be forgotten”) in accordance with Art. 17 GDPR
• Right to restriction of processing according to Art. 18 GDPR
• Right to data portability according to Art. 20 GDPR
• Right to object according to Art. 21 GDPR

Without prejudice to any other administrative or judicial remedy, you shall have the right to complain to a supervisory authority, in particular in the Member State of your place of residence, employment or the place of the alleged infringement, if you believe that the processing of the personal data is violating the GDPR.

4. Data Erasure and Storage Duration

The personal data of the data subject will be deleted or blocked as soon as the purpose of the storage lapses. In addition, storage may take place if provided for by the European or national legislator in EU regulations, laws or other regulations to which the processor is subject. Blocking or deletion of the data also takes place if a storage period prescribed by the standards mentioned expires, unless there is a need for further storage of the data for conclusion of a contract or fulfillment of the contract.

II. Concrete Data Processing

As part of our data processing, we use IT systems of our parent company, EPTI AB, to provide our services and also make use of services provided by EPTI AB both in terms of technical development and maintenance and for customer service. Therefore, our parent company has access to our ongoing customer data to the extent necessary to provide the aforementioned services. EPTI AB is headquartered in Sweden but has offices in non-EU countries.

The transfer of data to EPTI AB takes place on the basis of a data processing agreement processing within the meaning of Art. 28(3) DSGVO.

1. Data collection when visiting the website

a) Scope of data processing

When visiting our website, the following data is collected and stored by our web server: Storage of this data together with other personal data of the user does not take place.

b) Legal basis

The legal basis for processing the data is Art. 6 para. 1 (f) GDPR.
The legitimate interest within the meaning of Art. 6 para. 1 (f) GDPR therefore lies in the functionality of our website and its availability. The processing by our hosting provider based in the United Kingdom is based on Art. 28. Para. 6 GDPR.

c) Purpose of data processing

The temporary storage of the IP address by the system is necessary to allow delivery of the website to the computer of the user. To do this, the user’s IP address must be kept for the duration of the session.
The data is stored in order to ensure the functionality of the website. In addition, the data is used to optimize the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.

d) Duration of storage

The logfiles will be deleted after seven days at the latest, unless there is a need to keep the data for the aforementioned purpose due to specific events.
Storage beyond that is possible. In this case, the IP addresses of the users are deleted or alienated, so that an assignment to a specific user is no longer possible.

e) Objection and removal possibility

The collection of data for the provision of the website and the storage of the data in log files is essential for the operation of the website. There is consequently no possibility of objection by the user.

2. E-Mail contact

a) Scope of data processing

If you purchase goods or services on our website or our app and deposit your e-mail address, we may subsequently use this information to send you product information by e-mail regarding the booked product or similar products of the processor. In such a case, only direct advertising for our own similar goods or services will be sent by e-mail. We will also send you emails related to your bookings, such as: Reservation confirmations, warnings before the expiration of reservations, changes regarding bookings etc.

It is possible to subscribe to a free newsletter on our website or in our app, which contains direct advertising for our products or products of our cooperation partners. When you sign up for the newsletter, the data from the input mask will be transmitted to us or the e-mail address already stored will be used. In this case, the date and time of registration for the newsletter and the IP address used are also stored. As part of the confirmation of the newsletter registration, the date and time at which you click on the confirmation link for the newsletter registration as well as the IP address used will also be saved.

When sending the product information, your e-mail address will be forwarded to an external service provider, who will be responsible for sending the newsletter on our behalf. Any further use is not made by the service provider. The service provider is located in the European Union.

b) Legal basis

The legal basis for the processing of the data when sending out the newsletter due to the prior acquisition of goods or services is Article 6 para. 1 sentence 1 (f) GDPR in conjunction with § 7 para. 3 UWG.
The legitimate interest within the meaning of Art. 6 para. 1 (f) GDPR is therefore in direct advertising and the increase in sales to existing customers.
The legal basis for processing the data when registering directly for the newsletter is Art. 6 para. 1 (a) GDPR.
The legal basis for contacting in connection with current bookings is Article 6 para. 1 (b) GDPR.
The legal basis for the transfer of the data to the shipping service provider is Article 28 para. 3, 6 and 7, Article 46 para. 2 (c) GDPR. The standard data protection clauses of the EU Commission are used in contractual relation with the provider.

c) Purpose of data processing

The purpose of storing the e-mail address is the possibility of electronic contact for advertising purposes. The date and IP address of the registration as well as the confirmation of the registration will be recorded in order to document the consent to the newsletter shipment and to prevent misuse. Furthermore, for information regarding ongoing bookings, the proper execution of the contract is the purpose of the contact.
The transfer to the service provider is done for the purpose of sending the newsletter as a mass mailing.

d) Duration of storage

If we have received your e-mail address as part of the purchase of goods or services, it will be used for the delivery of advertising until you object to further use.
As far as you have expressly consented to the receipt of the newsletter, we will only delete or block the e-mail address for the advertising mailing, if you revoke your consent. The data confirming the order of the newsletter will be stored for the same amount of time.
The e-mails sent, as far as business letters are concerned, are stored for the duration of retention periods of the Tax Code or the Commercial Code. The further e-mails are deleted as soon as no further response by the user has to be expected.

e) Objection and removal possibility

You may object or revoke your consent to the use of the e-mail address for advertising purposes at any time, without incurring any costs beyond the charges of your communications tariff. You can object to the use of any advertising mail by clicking on a link provided there with effect for the future. You may also opt-out of advertising for future use by emailing [email protected] In the case of opposition by e-mail, the implementation of the cancellation or blocking can take up to 3 working days; In this period, you may still receive advertising emails. You can not contradict the use of the e-mail address for addressing in the context of the performance of the contract or storing of business letters. If you no longer wish this, you would have to delete the account at EPTI or have it deleted, otherwise we would not be able to properly fulfil the contract.

3. Contact Form

a) Scope of data processing

The EPTI website has a contact form which can be used for electronic contact. If you enter data in the input mask, these are transmitted to us and stored. This data is: your name, your e-mail address, if necessary your telephone number, the nature of your request and your individual message to us. In addition, the date and time of your message is automatically recorded.
Alternatively, contact via the provided e-mail address is possible. In this case, the user’s personal data transmitted by e-mail will be stored.

b) Legal basis

The legal basis for the processing of the data transmitted in the course of sending an e-mail is Article 6 para. 1 (f) and if necessary also (a) GDPR. If the e-mail contact aims to conclude a contract, the additional legal basis for the processing is Art. 6 para. 1 (b) or (c) GDPR.
The legitimate interest within the meaning of Art. 6 para. 1 (f) GDPR lies in answering a customer inquiry or answering a contact request on other topics.

c) Purpose of data processing

The purpose of the data storage is the contact at the request of the communication partner.

d) Duration of storage

The data will be stored for as long as necessary to complete the request. Insofar as these are commercial letters subject to commercial and tax law, these are also stored in accordance with the statutory retention periods.

e) Objection and removal possibility

You have the option at any time to revoke your consent to the processing of personal data with effect for the future or to object to further use. The contradiction can be explained by email to: [email protected] A deletion can only take place, as far as no legal storage period is given; in this case, the data will be locked for another use. In such a case, the conversation cannot continue.

4. Google Analytics

a) Scope of data processing

The EPTI website uses Google Analytics, a web analytics service provided by Google Ireland Ltd. (“Google”). This software collects information about how you use the website and compiles various statistics. The increased usage data include in particular the concrete selection of links, the length of stay on individual pages and the order of use of the website, the frequency of the page request. This data is collected together with your IP address.

In particular, the following information is collected:

– Information about the type of browser and the version used
– The operating system of the user
– The user’s Internet service provider
– The IP address of the user
– Date and time of access
– Websites from which the user’s system accesses our website
– Websites that are accessed by the user’s system via our website

Google Analytics uses so-called “cookies”, text files that are stored on your computer and that allow an analysis of the use of the website by you. The information generated by cookies about your use of this website is usually transmitted to a Google server in the USA and stored there.
We have activated a so-called IP anonymization on the EPTI website, this means that the IP address will be shortened beforehand by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area prior to retransmission to the USA.
Only in exceptional cases will the full IP address be sent to a Google server in the US and shortened there. Google itself describes here https://www.google.com/policies/privacy/ its data processing activity.

The data processing is essentially carried out by Google itself. Despite IP anonymization, the data is not anonymous and can be merged with other data by Google. Google can use the data for any of its own purposes, such as profiling, as well as link it with other data such as any Google accounts and also pass it on to associated US companies, e.g. Google LLC.

b) Legal basis

The legal basis for the processing of data when using the website is Article 6 para. 1 (a) GDPR in the form of your express consent.
The legal basis for the transfer of data to Google is Art. 26 GDPR and Art. 6 para. 1 (a) GDPR.

c) Purpose of data processing

The purpose of the processing is to analyse this website and the usage behaviour of its visitors.

d) Duration of storage

We ourselves no longer have access to personal data after anonymization by Google. With regard to a use by Google, the duration of the storage is not known.

e) Objection and removal possibility

You can prevent the storage of cookies, including the generation and transmission of data to Google, by restricting or prohibiting the use of cookies in your browser software. This may result in the deactivation of non-Google-related cookies as well as the inability to use all functions of this website to the full extent.
You can prevent the collection of the data generated by the cookie regarding your use (including your IP address) and their transmission to Google as well as the processing of this data by Google by downloading the browser plugin available under the following link and to install

[Http://tools.google.com/dlpage/gaoptout?hl=de].
In addition, you can also revoke your consent to data collection at any time in our Cookie Bar. For this purpose, a cookie is then stored so that we can recognize that you have not consented to the use of Google Analytics.

5. Google and Facebook Sign In

a) Scope of data processing

EPTI offers its users the option to sign into EPTI’s services with their Google (Google Ireland Ltd.), Apple (Apple Inc.) or Facebook (Facebook Inc.) account. In this case you allow Google, Apple or Facebook to share the following information with us, unless you limit the access during the approval process:
First and last name
email address
Gender
Your Google, Apple or Facebook User name (if not identical with your email address)
Your Google, Apple or Facebook User ID
If available a profile picture

In addition Google, Apple and Facebook approve to us on every login that you have before identified yourself toward their services.
We are not aware which data Google, Apple or Facebook collect when using the sign in feature. The data collected may be used to build a profile on you and the data may be transferred outside of the European Union.
Google provides privacy information here:
https://policies.google.com/privacy
Facebook provides privacy information here:
https://www.facebook.com/policy.php
Apple provides privacy information here:
https://www.apple.com/legal/privacy/en-ww/

b) Legal basis

The legal basis is your consent, Art. 6 para. 1 (a) GDPR.

c) Purpose of data processing

We use the data we receive to generate your user profile and to verify your individual login.

d) Duration of storage

The data is deleted, once you delete your user profile with us or change the data in the profile. Data regarding the Google or Facebook user name or user ID are deleted when you request to remove the account link.

e) Objection and removal possibility

You can change or delete your profile data in your user profile, unless we are legally obliged to store the data. Alternatively, a revocation is also possible at: [email protected] .