Privacy policy

Privacy Notice - Information on the processing of personal data
1. Introduction
The individual who makes a booking or order via the https://www.spelapaintball.com website is hereinafter referred to as the "Booking Manager" and is also referred to as "you", "you" or "your".
The processing of personal data takes place within the framework of the contract concluded between the Booking Manager and one of the following companies belonging to the same group (the "Supplier" and also referred to as "we", "our" or "us"):
- Hypersports Paintball & Event Sweden AB, corporate identity number 556574-9339, or

- GAMES2U Event Sverige AB, corporate identity number 559131-1542.
Which of the above companies is your contractual partner depends on what is being booked:
- When booking a bouncy castle, obstacle course or other inflatable play equipment, and if the Booking Manager is not the operator for the entire event, the agreement is entered into with GAMES2U Event Sverige AB, which in this case also acts as Operator.

- In other cases, the agreement is concluded with Hypersports Paintball & Event Sweden AB.
Below you can read about how your personal data is processed by the Supplier in connection with your booking or order via the website https://www.spelapaintball.com.

2. definitions
For the purposes of this Privacy Notice, definitions consistent with those contained in the EU General Data Protection Regulation 2016/679 ("GDPR") were used, such as "personal data", "processing", "data subject", "supervisory authority", "controller", "processor" and others. Each of these definitions has the same meaning as set out in Article 4 of the GDPR. For a full list and exact definitions, please see this article.

3. Data controller
The Supplier is the data controller for the processing of your personal data, as the Supplier determines the means and purposes of the processing. The processing of your personal data is carried out in accordance with applicable Swedish data protection legislation, including the EU General Data Protection Regulation 2016/679 (also referred to as "GDPR").

4. How we access your personal data
We mainly collect personal data directly from you when you visit our website, contact us, subscribe to our newsletter or enter into a contract with us.
Some information may also be obtained from public registers or other publicly available sources.

5. categories of personal data we process
We only process personal data that is adequate, necessary and relevant to fulfil the purpose for which it was collected, in accordance with the principle of data minimisation.
The main personal data we process are: identifying data (e.g. first and last name) and contact details (e.g. e-mail address, telephone number and postal address), as well as delivery address and information about the order/booking of our services/products.
More information on the personal data processed is provided in section 7 below, where we describe the purposes of specific processing activities in more detail.

6. legal basis for the processing of personal data
We process personal data only for specified, explicit and legitimate purposes in accordance with the purpose limitation principle. The processing is mainly based on one of the following legal grounds:
- Consent (Article 6(1)(a) GDPR): You have given your consent to our processing of your personal data for specific purposes.
- Contract (Article 6(1)(b) GDPR): The processing of your personal data is necessary for entering into or performing a contract with you.
- Legal obligation (Article 6(1)(c) GDPR): We must process your personal data as required by law.
- Legitimate interest (Article 6(1)(f) GDPR): The processing of your personal data is necessary for our legitimate interests or those of a third party, after balancing your rights and freedoms.
In some cases, providing us with personal data is voluntary, but without it we cannot, for example, provide certain support, enter into or fulfil contracts.
If processing is based on consent, you can withdraw it at any time without prejudice to prior lawful processing.
In the case of processing based on legitimate interest, we have carried out a balancing of interests and assessed that there is a legitimate interest and that the processing does not restrict your right to privacy and integrity.

7. purposes of the processing of personal data
The purposes for which the Supplier processes personal data, the personal data processed, the legal basis for the processing, the recipients of the personal data, if any, and the duration of the storage of the personal data are described below.
7.1. When we enter into a contract with you
We process personal data in order to enter into and fulfil contracts with you in your capacity as an individual or consumer.
Purpose Initiate, conclude and fulfil contracts, and manage delivery, payment and support.
Personal data - Identifying information (e.g. first name and surname)
- Contact details (e.g. e-mail address, telephone number)
- Purchase information (e.g. products/services ordered, order history)
- Payment information (e.g. invoices, payment status)
- Correspondence and case history (e.g. customer service, complaints, support)
Processing - Contract administration
- Order and delivery management
- Invoicing and payment
- Communication and customer support
- Registration in business systems
Legal basis Contract - The processing is necessary for the conclusion and performance of the relevant contract with you as a natural person.
Recipients Financial and business systems.
Storage period Personal data is stored for the duration of the contractual relationship and for up to 3 years after its termination, to handle complaints or legal claims.

7.2. Management of booking and notifications
We process your personal data to be able to receive and administer your booking, handle delivery and send information related to the booking, such as status updates and other important communications.
Purpose To receive and process bookings and send digital notifications of booking status.
Personal data - Identifying information (e.g. first name, surname, customer number)
- Contact details (e.g. e-mail address, telephone number, address)
- Booking information (e.g. booked products, booking date, amount)
Processing - Register and manage the booking
- Send confirmations and booking information
- Send reminders and other relevant information about the booking
Legal basis Contract - The processing is necessary for the performance of our contract with you.
Recipients Payment intermediaries, IT and reservation systems, e-mail services.
Retention period Personal data is stored for the time required to process the booking and up to 3 years after the booking is finalised.

7.3. Handling of returns
We process personal data in connection with the handling of any returns of rented equipment or booked services.
Purpose To manage and document returns and ensure any refunds.
Personal data - Identifying information (e.g. first name, surname)
- Contact details (e.g. e-mail address, telephone number)
- Purchase information (e.g. order number, returned products)
- Payment information (e.g. transaction ID, refund status)
Processing - Register return
- Implement any repayment
- Communicate with the Booking Manager about the return
Legal basis Contract - Processing is necessary to fulfil rights and obligations under the contract.
Recipients Payment intermediaries, business systems, finance department.
Storage period Personal data is stored for up to 3 years after the return has been completed in order to handle any warranty or complaint cases.

7.4. Contact and customer service
When you contact us, we process your personal data in order to handle your enquiry.
Purpose Handling of incoming enquiries by phone, email, letter, contact form and/or social media.
Personal data - Identifying information (e.g. first name and surname)
- Contact details (e.g. e-mail address, telephone number, address)
- Customer service issues (e.g. form data, content of the message, previous contact with customer service, complaints)
- Purchase information (e.g. order history, product selection, amount)
Treatment - Identifying the individual who contacts us
- Managing and responding to the case
- Follow up the case if necessary
Legal basis Legitimate interest - We have a legitimate interest in responding to enquiries and providing customer service.
Recipients Service providers, e.g. e-mail provider, telephone operator and business system provider.
Storage period Customer service cases are normally stored for up to 3 years after the last contact in the case to ensure follow-up and improved service. Data can be stored for longer if it is justified by an ongoing case or legal obligation.

7.5. Customer surveys and feedback
We may send out surveys after your booking to collect feedback that is used to improve our products, services and customer experience.
Purpose To send surveys to collect customer feedback and improve offers and services.
Personal data - Contact details (e.g. e-mail address)
- Feedback (e.g. survey responses, judgements)
- Booking references (e.g. order number)
Processing - Send survey by e-mail
- Analysing responses to improve service offerings and customer experience
Legal basis Legitimate interest - We have a legitimate interest in improving our business through customer feedback.
Beneficiaries Survey services, customer research platforms, analysis tools.
Storage period Personal data is stored for up to 1 year after collection. The results of the survey are stored in aggregated or anonymised form after thinning.

7.6. Newsletter to subscribers
We process personal data in order to send newsletters to those who have actively subscribed.
Purpose To send newsletters to subscribers who have signed up themselves.
Personal data - Identifying information: first name, surname
- Contact details: e-mail address
Treatment - Send email newsletters
- Managing subscriptions and cancellations
Legal basis Consent - The processing is based on your active consent when you actively sign up for our newsletter.
Recipients Providers of email services and newsletter platforms.
Storage period Personal data is stored for as long as you are a subscriber. You can withdraw your consent at any time by clicking on the unsubscribe link at the end of each mailing. When you unsubscribe, your data will be deleted without undue delay.

7.7. Marketing to existing or former customers and handling of cancellations
We process personal data to communicate relevant offers and marketing to existing or former customers, and to ensure that unsubscribed recipients do not receive further mailings.
Purpose Marketing to former or existing customers and handling cancellations.
Personal data - Identifying information: first name, surname
- Contact details: e-mail address, telephone number
- Marketing preferences (e.g. preferred channels)
- Purchase history and areas of interest
- Deregistration status (block list)
Processing - Send targeted offers by email, phone or social media
- Store email address in block list
- Analyse purchase history for personalisation
Legal basis Legitimate interest - We have a legitimate interest in marketing our services to existing customers and honouring unsubscriptions.
Recipients Marketing platforms, email services, analytical tools.
Retention period Personal data is processed for up to 3 years after last contact.

If you choose to unsubscribe, your email address will be stored in a separate block list. Email addresses in blocklists are stored for up to 5 years to ensure that you do not receive any more mailings by mistake. You can request that they be removed earlier.

7.8. Market and user analyses
We process personal data to produce statistics and insights about our customer groups, in order to develop our services and communication. The results of the analyses may be presented in aggregated or anonymised form and do not contain identifying data
Purpose To carry out aggregated market and user analyses and statistics, in order to understand target audiences, improve our services and make informed business decisions.
Personal data - Identifying information (e.g. first name and surname)
- Contact details (e.g. e-mail address, telephone number)
- Purchase information (e.g. purchase date, product category, purchase amount)
- Behavioural data (e.g. how you use our services or website)
- Feedback and customer surveys
Treatment - Analysing behaviours and preferences
- Segmenting customer groups
- Producing statistics
- Evaluate and improve existing services and offers
Legal basis Legitimate interest - We have a legitimate interest in analysing and understanding our customers' needs and behaviours in order to improve our services.
Beneficiaries IT and analytical service providers that provide statistical tools and analytical platforms.
Retention period Personal data is stored for the time required for the purposes of analysis. At most, personal data is stored for 3 years after collection, unless longer storage is required by another legal basis. The results of analyses are stored in aggregated or anonymised form after thinning.

7.9. Handling of requests for statutory rights
When you contact us to exercise your rights under applicable law, such as your rights under the GDPR, we process your personal data to handle and document your request. Information on your rights under the GDPR can be found in section 11 below.
Purpose Handling of requests to exercise legal rights (e.g. right of complaint, GDPR rights).
Personal data - Identifying information (e.g. first name, surname)
- Contact details (e.g. e-mail address, telephone number)
- Customer service issues (e.g. communication regarding requests)
Processing - Verify the identity of the person making the request
- Managing and documenting the request
- Ensure proper handling and fulfilment of legal requirements
Legal basis Legal obligation - The processing is necessary to fulfil obligations under the GDPR and other applicable law.
Recipients Authorities in case of legal requirements, IT providers and systems used for processing the request.
Retention period Data related to requests for the exercise of legal rights are normally retained for 3 years after the case has been finalised, based on limitation periods.

7.10. Management of accounting records
We are required by law to process and store accounting records that may contain personal data, such as invoices, receipts and other supporting documents.
Purpose Processing of personal data to fulfil statutory accounting and bookkeeping requirements.
Personal data - Identifying information (e.g. first name, surname, customer number)
- Contact details (e.g. e-mail address, telephone number, address)
- Purchase information (e.g. order history, product selection, amount)
- Payment details (e.g. payment method, transaction information)
- Delivery details (e.g. delivery address)
Processing - Storing and archiving invoices, receipts and payment details
- Comply with the requirements of the Accounting Act and the Swedish Tax Agency
- Providing evidence in case of review or audit
Legal basis Legal obligation - The processing is necessary to fulfil our obligations under the Accounting Act (SFS 1999:1078) and the requirements of the Swedish Tax Agency.
Recipients Accounting and auditing firms, financial systems, tax authorities and other authorities where required by law.
Storage period Accounting documents are stored for up to 7 years from the end of the calendar year in which the financial year ended, in accordance with the Accounting Act (SFS 1999:1078).

8. How long we store personal data
We process personal data only for as long as necessary to fulfil the purposes for which they were collected, including any legal requirements, in accordance with the principle of storage minimisation.
The exact retention period depends on the type of personal data and the purpose of the processing. For detailed information on retention periods for specific processing operations, please refer to the relevant tables in Section 7 of this Privacy Notice.
Please note the following:
- If we are required to retain personal data by law (for example, the Accounting Act, the Money Laundering Act or the Consumer Sales Act), the data will be retained for as long as required by applicable law.

- If legal proceedings are ongoing, relevant personal data may be retained until the end of the proceedings or the expiry of the limitation period, whichever is later.

- In the event of legal disputes, government investigations or other legal claims against us, we may retain the personal data until the case is finalised or until the applicable limitation period has expired.

- In cases related to warranty, claims or an ongoing dispute, personal data may be stored for a longer period in accordance with applicable legal requirements.

- If you request that your personal data be deleted, we may still need to retain certain data to fulfil our contractual, statutory or regulatory obligations.

- Some data, such as email addresses in block lists, may be kept for up to 5 years to ensure that no unsolicited mailings are sent by mistake.
When personal data no longer needs to be stored, it will be deleted or anonymised in accordance with our internal deletion procedures and applicable legislation (e.g. GDPR and the Accounting Act).

9. Where we process personal data
We aim to always process personal data within the European Union (EU) or the European Economic Area (EEA). However, in some cases, personal data may be transferred and processed outside the EU/EEA. To ensure adequate protection of your personal data during such transfers, we take appropriate safeguards. This may include using standard contractual clauses approved by the European Commission.

10. Recipients of personal data
We treat personal data with care and the sharing of personal data is done in accordance with applicable data protection legislation.
1. authorities: We may disclose personal data if we are legally obliged to do so, for example under tax legislation or in the case of an official investigation (e.g. to the Swedish Tax Agency or the police). Legal basis: Legal obligation. We may also share data if it is necessary to prevent or investigate criminal offences or to protect our business against fraud. Legal basis: Legitimate interest.
2. suppliers and data processors: we co-operate with service providers who process personal data on our behalf, such as IT suppliers, payment services and accounting firms. They act as our data processors and may only process the data according to our instructions. All data processors enter into a data processing agreement with us, in accordance with Article 28 of the GDPR. The data sharing is based on the following legal basis:
- For contract management: Personal data is shared with, for example, payment service providers and booking systems to fulfil our contract with you. Legal basis: Contract.
- Where required by law: We share personal data with, for example, accounting firms to help us fulfil the requirements of the Accounting Act. Legal basis: Legal obligation.
- To operate and protect our business: We share personal data with IT service providers for system maintenance and security services to prevent cyber-attacks on our business. Legal basis: Legitimate interest.

11. rights of data subjects under the GDPR
As a data subject under the GDPR, you have the following rights:
Right to information: You have the right to receive clear information about how we process your personal data, including the purposes, categories of data and possible recipients. This information can be found in this privacy notice.
Right of access: You can request a copy of your personal data that we process and obtain information about the processing, including any cross-border transfers and safeguards.
Right to rectification: If your personal data is inaccurate or incomplete, you have the right to have it rectified. In such cases, we will inform the relevant recipients of your personal data, if this is possible and not too burdensome for us. You also have the right to be informed of the identity of the recipients.
Right to erasure ("right to be forgotten"): Under certain circumstances, you can request that we delete your personal data, for example if it is no longer needed for the purpose for which it was collected or if you withdraw your consent. However, legal obligations may require continued storage. If we delete your personal data, we will inform the relevant recipients of your personal data, if this is possible and not too burdensome for us. You also have the right to be informed of who the recipients are.
Right to restriction of processing: You can request that we restrict the processing of your personal data, for example if you contest its accuracy or if the processing is unlawful but you oppose its erasure. In case of restriction, we may only store the data, process it with your consent or for the establishment, exercise or defence of legal claims. We will inform you when the restriction ends.
Right to data portability: If we process your personal data based on consent or contract as a legal basis, you have the right to receive it in a structured, machine-readable format and to have it transferred to another controller, where technically feasible.
Right to object: You can object to our processing of your personal data if it is based on legitimate interest as a legal ground. We may only continue processing if we can demonstrate legitimate grounds that override your interests. However, you always have the right to object to processing for direct marketing purposes, which means that we must immediately cease such processing.
Right not to be subject to automated decision-making: You have the right not to be subject to decisions based solely on automated processing, including profiling, if the decisions significantly affect you. Exceptions apply if the decision is necessary for a contract or required by law. In such cases, you have the right to request human review of the decision. We do not make automated decisions, with or without profiling.

12. How to exercise your rights
You can contact us via the contact details provided at the end of the Privacy Notice if you wish to exercise any of your rights under the GDPR. Exercising your rights is free of charge, unless your request is repetitive, unfounded or unreasonable, in which case we have the right to charge a reasonable fee or refuse the request.
To ensure that we process your request correctly, we may need to verify your identity. We will respond to your request within one month, but in the case of complex cases or heavy workloads, the response time may be extended by up to two months. In such cases, we will inform you of the extension within the first month.
Please note that some rights are limited under the GDPR and only apply under specific conditions. If we cannot fulfil your request, we will inform you of the reasons, in accordance with applicable law.

13. changes to this privacy notice
We update this privacy notice as necessary to keep the information accurate and up-to-date. You are responsible for reading the latest version which is always available on our website. If we make material changes that affect the way we process your personal data, we will inform you if required by law.

14. questions or complaints
If you have any questions about this privacy notice or our processing of your personal data, please contact us using the following contact details:
Hypersports Paintball & Event Sweden AB:
- Telephone: 08-39 11 77
- E-mail address: [email protected]
- Postal address: Mårbackagatan 31, 123 43 Farsta

GAMES2U Event Sverige AB:
- Telephone: 08-39 11 77
- E-mail address: [email protected]
- Postal address: Fryksdalsbacken 10, 123 43 Farsta

We do not have a Data Protection Officer as this is not required by the GDPR.
If you are dissatisfied with our processing of your personal data, you can lodge a complaint with the Swedish data protection authority, the Swedish Authority for Privacy Protection (IMY):
- Telephone: 08-657 61 00.
- E-mail: [email protected].
- Postal address: Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm.
If you are resident in another EU/EEA country, you can also contact the supervisory authority in your country of residence. A list of Member State supervisory authorities can be found here: https://edpb.europa.eu/about-edpb/about-edpb/members_en