Please read the following privacy policy (“Privacy Policy”) to understand how we use and protect the personal data that you provide to us, or we receive and collect when you use our services, including what we collect, how we collect it, and what we do with it, as well as some of the steps we take to safeguard your personal information. This Privacy Policy is applicable to any person (“User”) who accesses, browses, and or uses this website (www.spacetown.se) or purchases, intends to purchase, or enquires about any service(s) made available by Space Town through any of its customer interface channels including this website & offline sales channels such as call centers, agents and branch offices (collectively referred herein as "Sales Channels"). For the purpose of this Privacy Policy, wherever the context so requires "you" or "your" shall mean the User and the term “Space Town”, "we", "us", "our" shall mean Space Town Tours & Travel HB, Rissneleden 110174 57 Sundbyberg, Stockholm, Sweden, which is acting as the data controller and is committed to processing of your personal data in compliance with applicable laws (EU’s General Data Protection Regulation (2016/679 GDPR) and The Data Protection Act (SFS 2018:218)

Information collected when you use our Website, enquire or make a booking: We will collect certain information from you when you use our website, make an enquiry, create a user account or make a booking/reservation with us, such as: • Your full name, date of birth, gender, home address, phone number, email address, name of the people traveling with you, and any preferences that you may have for your travel service/trip (such as dietary or accessibility requirements) • In some cases, we may also ask you for passport details (including nationality, city of birth, issuing date and expiry date), travel insurance details, driver’s license or other ID proofs depending on the service being booked and requirements of the service provider. • Any additional information you provide during the booking process depending on the service being booked, which may include other personal information. • We also collect information from you when you reach out to our customer service support or reach out to our other Sales Channels, whether to provide us with feedback or asking for assistance or raising your grievances, if any. • We also process and store records of the products/services you have enquired about or booked with us, as well as collect and process information relevant to your booking (such as details of flights, accommodation/hotels, airport transfers, taxi reservations and other travel services or any other bookings made through us) including where such information is passed to us through our offline Sales Channels. • If we are assisting you in obtaining travel insurance from third parties, you may be asked to provide additional information, including for example, your occupation, your parent’s personal information, marital status, your spouse’s personal information, your children’s personal information, employment, financial and education history, as per the requirements of the insurance company. • If you create a user account on our website, we will also store your personal settings, uploaded photos, details of previous bookings, and reviews of previous bookings, if any. This saved data can be used to help you plan and manage future bookings/reservations. You can also choose to add details from your identification documents or other personal information to your user accounts, if such option is provided by us, so you don’t have to submit this information for future reservations/bookings. • In case you link your user account to a social media/email account (e.g. Facebook or Twitter or Gmail etc.) you may exchange information between us and that social media/email provider, though you can choose not to share that data through the user preferences on your account. • We also collect your data when you use or view our website via your browser’s cookies. We collect your technical identity data (including IP addresses, browser type and versions, other technology on the device that you use to access our websites, the date and time you accessed our services, the hardware, software, or internet browser you used, and information about your computer’s operating system like application versions and your language settings, most of which is collected automatically) as well as information about your usage of our website as you browse our website (Please see our separate “Cookies” policy as available on our Website for more information). Please note that if you are providing us with the personal information of another person, you must ensure that you inform these persons of the information that you intend to provide to us, and that those you represent are aware of the content of our Privacy Policy and consent to your acting on their behalf. Financial Information: We also integrate or deal with third party service providers/payment gateways/payment partners (such as Stripe Trustly; Swish Payment; ApplePay; Svea Bank; Payex) to facilitate payments made by you for your bookings, and your financial/payment information is shared with them to process your payments so that we can manage your bookings. For making online payments, you should either use the secure online booking engine on the relevant website or payment gateway or platform that you are using or you should call your booking agent directly. We ask that you do not email or send in writing your payment card details to us or any of our agents at any time. Also, in some cases, your financial information may be collected and recorded by us for the purposes of processing of refunds only. Otherwise, we do not store your card information on our website. We are not responsible for the privacy practices of third-party vendors and providers, including the aforesaid payment service providers, so you should review any privacy policy of third party vendor or providers to satisfy yourself as to how they protect and handle your personal information. Information shared on calls: Any calls with us, if any, with your consent, may be recorded, and/or monitored for quality control, coaching and/or training and customer service purposes that assist in addressing your inquiries. We may collect information such as the identity of the caller, the date and time of the call and the subject and resolution of the issue. Marketing etc.: We may collect the following personal information from you for marketing purpose: • when you subscribe to our newsletter/promotions/special offers, if any, we will collect your full name, country and email address. • via our preference centre, if any, we may collect your phone number, date of birth, postcode/zip code, residential state and your travel preferences. • if you request a brochure, we will collect your full name and postal address • if you enter a competition directly with us, or via one of our external partners, or click through on an advertisement given by us, we may collect your full name, country, zip code, email address and phone number, as well as your travel preferences. • when you click on an advertisement given by us via a third party, some of this information may pre-populate from an account you may have with that third party. Feedback/Reviews: In case there is an option to give feedback or reviews, and you write one, we will collect any information that you have included, along with your display name and pictures (if you have added the same). We may also collect data when you voluntarily complete a customer survey or provide feedback on any of our message boards or via email, as applicable. We may also contact you to seek your interest in taking part in surveys feedbacks and interviews. As part of this, we may collect your full name, email address, booking reference/numbers and travel service details. Where you have provided the relevant details, we may also contact you in response to your feedback to discuss your comments. Information received from other sources/channels: We may also receive information about you from our offline Sales Channels, and anything we receive from these sources may be combined with information provided by you. Service providers (e.g. airlines/accommodation/hotel, taxi/vehicle operators, and other third party service providers of the services booked by you) may also share personal information about you with us, for example, to ensure fulfilment/utilization of your reservation/booking, or if you have support questions about a booking/reservation, or if any complaints or disputes arise regarding your reservation/booking including in relation to any cancellations/re-scheduling thereof. We also collect information when we receive a complaint about you from a third-party service provider.

We use, collect, hold and handle your personal data/information for a variety of business purposes as given below: 1. Reservations/Bookings: We use your personal data to facilitate, complete and administer your booking/reservation for services/products as listed on our website or other Sales Channels. This includes sending you communications that relate to your bookings/reservations, such as booking confirmations/vouchers, payment confirmations, modifications and such other information as we deem relevant. We may also collect and process your personal data to enable online check-in with the service provider or to process any cancellations/refunds or claims of third parties. If you are a business partner, supplier or agents of ours, we collect and use data to manage our business relationship with you. 2. Account Management: We use your personal data to manage/administer your user account settings (if you open an account with us), and to generally administer and manage our customer relationship with you and to enable you to have an improved experience of our services. 3. Customer Service: We also provide you with customer service and support through our customer support team/call centre, and therefore we may share relevant details of your reservations/booking and your user account with our customer service representatives which allows us to respond when you seek any assistance from us. 4. Communications: We also use your data to contact you (including by email, by mail, by phone, text or such other means as available with us) and process your communications with us, for example, to respond to your requests, queries or complaints, to respond to and handle any requests, queries or complaints made by the provider of your booked service or to send you information that we deem relevant or important (such as material related to your booking/reservations, administrative messages, security alerts etc.) or invite you to complete a booking that you may have started but not finished (which also allows you to complete the booking/reservation without having to search/enter your service provider/ reservation details again) or to seek feedback/reviews from you. 5. Improve our services and your user experience: We may also use your data to generally improve our products and services and your user experience with us. For instance, we may use your data for testing and troubleshooting purposes or for generating statistics about our business, so as to understand how our services are performing and being used. This helps us to improve our Website and other sales channels for your use. As much as possible, we strive to use anonymized personal data for this analytical work. 6. Marketing Activities: We may use your data for marketing activities, including: o To identify and tell you about other services that we think may be of interest to you and using your contact information to send you regular news about such products and services. You can opt out of receiving further marketing communications through emails by following the opt out instructions mentioned in such communications. For example, you can unsubscribe from email marketing communications quickly, easily, and anytime. All you need to do is click the "Unsubscribe" link included in each newsletter or other communication, or manage your preferences via your account settings. o To tell you about deals, discounts and promotions available on the services listed on the Website/Sales Channels. o Based on your information, individualized offers might be shown to you on our website (or sites of our business partners), and the content of the site displayed to you might be personalized. o If you participate in any promotional activities of ours, certain personal information may be used to administer these promotions o Personal information may also be used to process review/feedback forms and other similar communications. 7. Legal Purposes: Your data may be used to comply with our legal obligations; assist/address requests of government and law enforcement agencies or regulators; address/resolve legal claims and disputes and to enforce our terms and conditions which are applicable to your bookings/reservations. Our purpose and legal basis to collect, hold, use, share and process your information differs depending on the nature of your interaction with us and the information that we collect and process, as discussed below: Necessary for the performance of a contract: As applicable, for purposes 1 and 2 above, when you make an enquiry or make a booking/reservation with us or seek customer support, we rely on the legal basis that the processing of your personal information is necessary for the performance of your contract with us and provision of services to you which includes facilitating, administering and processing your booking/reservation and providing customer service/support as may be available. While, it is your choice to share your personal data or not with us, however, please note that we may not be able to process or complete your booking/reservation or provide you with required customer service/support, without you providing us with the required personal information. Legitimate Interest: Our legitimate interest means your information has a commercial business purpose and is necessary in order to provide a product or service to you and does not override your rights and freedoms as an individual. For example, since you are a customer, we need to collect your contact details including your phone number and/or email address for the purpose of communicating with you about the service you’re enquiring or booking. We also rely on our legitimate interests to improve our products and services, and to prevent fraudulent activity or other illegal acts on our Website and accounts. When using personal data to serve our or a third party's legitimate interest, we will always balance your rights and interests in the protection of your personal information against our rights and interests or those of the third party, including by using your information in a way which is proportionate and respects your privacy. Therefore, for purposes 3 to 6 above, we rely on our (or third parties’) legitimate interest, to provide and improve services and to prevent fraud and other illegal acts (as set out more specifically under point 3 to 6 above). Legal Obligations: For purpose 7 above, we rely, where applicable, on compliance with legal obligations, as in certain circumstances we will need to use your information to comply with our legal obligations (such as law enforcement requests). Consent: Additionally, where required by applicable laws, we will obtain your prior consent prior to processing your personal information, including for email marketing purposes or as otherwise required by law. You can always withdraw your consent or object/opt out. If you wish to object to the processing of your information and no opt-out mechanism is available to you directly (for example, in your account settings or in our communications), please contact us as per the details given in our ‘Contact Us’ section below.

Your information is collected by us in many ways such as when you: • provide information directly to us on our Website or through our other Sales Channels or when you use our Website, or make a booking/reservation with us or otherwise communicate with us via email, phone, text, letter, web chat or in person. • you may also provide us with your information by opening a user account with us, while making a reservation/booking with us, whiling filling any other online or printed form, giving feedback/review, completing a customer survey, or subscribing to a newsletter or a promotional loyalty program, if any. • your information may also be provided to us by a third person/friend/family member who is making a booking on your behalf or by third party service providers in relation to your booking/reservation and any issues, complaints, cancellations or refunds in relation thereof.

In certain circumstances, we share your personal data with third parties, as discussed below:
 Enquiry/Bookings: In order to address your enquiry/requests or to facilitate and administer your booking/reservation or to address any complaints or disputes raised by you or a third party service provider in relation to your booking, we may share your personal information with the following parties:
• our employees, sales agents or customer support staff;
• our branch offices/travel agents or business partners;
• third party service providers (e.g. airlines, carrier/operator of airlines, hotel/accommodation provider, provider of taxi/car rental services, taxi drivers, vehicle operators, provider of any other travel service/activity etc.);
• other suppliers and service providers/operators (e.g. insurance companies, mailing houses, payment processors, payment gateways etc.);
• in some cases, Government or regulatory authorities (e.g. for any legal compliances or law enforcement requests)

To give an example, when you book a flight or hotel or taxi or any other service through us, your relevant personal information (including your name and contact details, details of other travellers accompanying you, your preferences, and other required personal information etc.) will be provided to the applicable airline/carrier/hotel/taxi owner/driver/service provider. We also share your personal information with any service providers or third-party suppliers for the purpose of processing your payments, improving services and experiences, and to investigate complaints and/or disputes, where necessary.

 Support Services: We may share your personal information with third parties that help us operate, provide, improve, integrate, customize, support and market our products/services and the Website. This includes:
• IT Service Providers: We work with third-party service providers who undertake website and application development, hosting, maintenance, backup, storage, virtual infrastructure, support and troubleshooting, payment processing, analysis and other services for us, which may require them to access or use information about you.
• Marketers/Customer Support: We may work with third parties to help us market and promote our services (for example, provision of customer services, sending of marketing material for us, for generating leads and promotion of our services).
• Research: We may use third parties to assist us with research and analytics, including surveys, interviews and other data gathering, in which case may share your information with these partners in connection with their services.
• Fraud detection and prevention (including anti-fraud screening): We may share your data with financial institutions or regulatory authorities for fraud detection and prevention and may send your data to, and also use the resulting information from, credit reference agencies to prevent fraudulent transactions.
• We may share in aggregate, statistical form, non-personal information regarding the visitors to our website, traffic patterns, and website usage with our advertisers.

However, we do seek to ensure that your information is protected at all times including that these third parties have agreed confidentiality restrictions and only use any personal information we share with them or which they collect on our behalf solely for the purpose of providing the contracted service to us.

 Other Professionals/Advisors: In certain cases (such as disputes or legal claims or as part of auditing activities), we may need to share your personal data with professional advisors. These advisors include parties such as law firms or auditors. We only share your personal data to the extent that is necessary and such third parties process this data in line with their own professional obligations including confidentiality restrictions.

 Regulatory/Government Authorities: We may disclose personal data to law enforcement, if required by law or as is necessary for the prevention, detection, or prosecution of criminal acts and fraud. We may need to further disclose personal data to competent authorities to comply with a legal obligation, to protect and defend our rights or properties, or the rights and properties of our business partners.

As mentioned earlier, we may need to share your information with our sales partners/agents, customer service staff, employees, third party service providers and other third party suppliers/providers, who may be located in other countries, for the purposes stated in previous paragraphs including so as to administer and complete your booking/reservation and to handle any requests/issues raised in relation thereto. When we transfer your information overseas, we therefore seek to ensure appropriate privacy, confidentiality and security measures are in place, so that we comply with all data protection and privacy laws applicable to us including by putting in place appropriate safeguards, wherever applicable, such as EU approved standard contractual clauses, and by imposing specific technical and organizational security measures and by such other, or that we are able to rely on an appropriate derogation under applicable privacy and data protection laws. You have a right to request access to any safeguard which we use to transfer your personal information outside of the EEA. You can ask us for more information about the safeguards we have put in place and ask to see a copy of our implemented safeguards (where possible). Please refer to our ‘Contact Us’ section below this regard.

Spacetown would like to make sure you are fully aware of all of your data protection rights. Subject to certain exemptions and applicable data protection/privacy laws, you are entitled to certain rights over your personal information, which include the following:
• Right to Rectification: You can request us to correct/update any information we hold about you which you believe is inaccurate, incomplete or out-of-date information. You can make some of these changes yourself, online, if you have a user account,
• Right to Access: You can request us for copies of your personal data that we hold. We may charge you a small fee for this service.
• Right to Erasure: You may request that we erase/delete any/all information we hold about you, under certain conditions.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• Right to object to Processing: You have the right to object to our processing of your personal data, under certain conditions.
• Right to data portability: You have the right to request us to transfer the data that we have collected to another organization, or directly to you, under certain conditions.
• Where we use your personal data on the basis of your consent, you’re entitled to withdraw that consent at any time, subject to applicable law.
Where possible and required by law we will comply with your request, however, there may be instances where there will be consequences if we were to fulfil your request. We will always communicate with you about any consequences before going forward, or give you written reasons for any refusal, subject to applicable laws. We may also charge you a fee where permitted by law for handling your requests, for instance if your request is manifestly unfounded or excessive.

You can exercise any of these rights at any time by contacting us (see the Contact Us section) or your relevant privacy or data protection authority.

We retain and store most information about you in computer systems and databases operated by either us or our external service providers. Some information about you may be recorded in paper files that we store securely. We will retain your personal information for as long as necessary to fulfil the purposes we collected it for and to enable you to use our services or to provide our services to you (including maintaining your user accounts and processing of your bookings/reservations and related requests). In some circumstances we may store your personal information for longer periods of time, for instance where we are required to do so in accordance with legal, regulatory, tax or accounting requirements, or to resolve any disputes or claims or complaints and otherwise to allow us to conduct our business, including to detect and prevent fraud and/or other illegal activities.

We observe reasonable procedures to prevent unauthorized access to and the misuse of personal data and use appropriate business systems and procedures to protect and safeguard your personal data and reduce the risk of loss and misuse, and from unauthorized access, modification, disclosure and interference. We have put in place adequate procedures to deal with any actual or suspected personal information breach and will notify you and any applicable regulator of any data breach where we are legally required to do so.

Whilst we take all reasonable steps to ensure that your personal information is secure, we would ask you to be aware that the internet is inherently insecure, so please take precautions when disclosing any personal information online to us.

Only natural persons above 18 years of age can place bookings on our Website/Sales Channels and we don’t collect data of minors below 18 years of age unless it’s provided by (and with the consent of) a parent or guardian. However, we may need to collect the personal data of children under 18 years old in certain specific circumstance, including where children are included in the reservations being placed by their parent/guardian, in relation to insurance claims or in other exceptional circumstances (such as features/services addressed to families). In these cases, this information will only be used and collected as provided by a parent or guardian and with their consent.

Our website use a standard technology called ‘cookies’ and web server log. Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. When you visit our websites, we may collect information from you automatically through cookies or similar technology. To find out more about the cookies we use, please see our Cookies Policy.

Our Website may contains links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.

We keep our privacy policy under regular review and place any updates on this webpage. You are responsible for reviewing this Privacy Policy periodically and informing yourself of any changes to this Privacy Policy.

If you have any questions about this Privacy Policy or are concerned about how we have handled your personal information, or would like to exercise any of your data protection rights, please contact our Data Protection Officer at haidar@spacetown.se.

You will be contacted within a reasonable time frame after receiving your enquiry or request to verify who you are in order to locate your accounts or bookings or ask any follow up questions to better understand your enquiry.

After we have completed our enquiries, we will contact you, usually in writing, to advise the outcome and invite a response to our conclusions about the complaint. If we receive a response from you, we will assess it and advise if we have changed our view. If you are unsatisfied by our final response, you may escalate your complaint to the relevant regulatory body.

Should you wish to report a complaint or if you feel that we have not addressed your concern in a satisfactory manner, you may contact your local data protection authority. We would ask that you first contact us to seek to resolve the concern or complaint in the first instance.

If you are in the EU, please follow this link to locate the data protection authority most relevant to you: https://edpb.europa.eu/about-edpb/board/members_en

The data protection authority in Sweden is IMY (Integritetsskyddsmyndigheten)/ Swedish Authority for Privacy Protection. For contact details and further information, please see their website: https://www.imy.se/.