Privacy policy

This Privacy Policy describes how Niranda Hotel AB, company registration number 556564-1288, processes personal data in connection with bookings, digital check-in, hotel stays, communication with the hotel, and the use of the hotel's digital services. This policy has been prepared to provide clear information about how personal data is collected, used, stored, and protected in accordance with the General Data Protection Regulation (GDPR).

Data Controller
Niranda Hotel AB, company registration number 556564-1288, is the data controller responsible for processing personal data under this Privacy Policy. The hotel's contact details are: Arena Inn Hotel, Bogårdsvägen 32, 128 62 Sköndal, Sweden, Email: hello@arenainn.se

2. When Personal Data Is Processed
Personal data may be processed when a guest or other contact person:
– Books a room or another service.
– Completes digital check-in.
– Stays at the hotel.
– Contacts the hotel by email.
– Contacts the hotel by telephone, or another digital form.
– Represents a company or another organisation booking a stay.
– Uses the hotel's website or other digital services.

3. Types of Personal Data That May Be Processed
The hotel may process the following categories of personal data:
– Name,
– Telephone number,
– Email address,
– Postal address,
– Booking details,
– Arrival and departure dates,
– Payment and billing information,
– Company details for corporate bookings,
– Information provided when contacting the hotel,
– Technical information related to digital check-in and the use of the hotel's digital system.

As a general rule, the hotel does not request sensitive personal data. If a guest voluntarily provides information about, for example, health conditions, allergies, or special requirements, such information will only be processed to the extent necessary to accommodate the guest's requests and fulfil the hotel's obligations in accordance with applicable regulations.

4. How Personal Data Is Collected
Personal data is primarily collected directly from the data subject in connection with bookings, digital check-in, payments, or communication with the hotel. Information may also be obtained from third parties, such as booking platforms, employers, travel agencies, or other individuals making a reservation on behalf of the guest.

5. Purposes of Processing
The hotel processes personal data for the following purposes:
– To administer bookings and hotel stays,
– To facilitate digital check-in and verify guests' identities,
– To manage payments, invoicing, and customer service,
– To communicate with guests before, during, and after their stay,
– To handle enquires, complaints, support request, and security-related incidents,
– To fulfil legal obligations,
– Where applicable, to send information or marketing communications when such processing is permitted by law or based or consent. 

6. Legal Basis for Processing
Personal data is processed on the basis of one or more of the following legal grounds:

– Contract – when processing is necessary to fulfil a booking or provide the hotel accommodation. 

– Legal obligation – when the hotel is required to process or retain information by law, for example under accounting regulations. 

– Legitimate interests – when the hotel has a legitimate need to manage customer service, security, administration, or limited business performance monitoring, provided that the data subject's interests or fundamental rights and freedoms do not override those interests.

– Consent – when processing is based on freely given consent, for example in certain cases involving marketing. Consent may be withdrawn at any time.

7. Booking System and Digital Check-In
Arena Inn Hotel uses Mews as its booking system and as part of the hotel's digital guest management services. Personal data may therefore be processed in the systems used for bookings, digital check-in, stay administration, communication, and payment processing, to the extent necessary to provide the service.

8. Data Retention Period
Personal data is not retained for longer than necessary for the purposes for which it was collected. As a general rule, Arena Inn Hotel applies a retention period of two years for information relating to guest relationships, bookings, and stays, unless a longer retention period is required by law or necessary to handle a legal claim, complaint, or other legitimate matter. Information that must be retained under accounting legislation or other mandatory legal requirements will be kept for the period stipulated by the applicable law.

9. Recipients of Personal Data
Personal data may be shared with data processors and other recipients who require the information for the hotel to conduct its business. These may include providers of booking systems, payment solutions, IT operations, technical support, and communication services. Personal data may also be disclosed to public authorities when required by law, regulation, or an official decision.

10. Transfers Outside the EU/EEA
If personal data is processed by providers or subcontractors located outside the EU/EEA, such transfers may only take place in accordance with the GDPR and subject to appropriate safeguards, such as the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

11. Security
The hotel implements appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, destruction, alteration, or unlawful disclosure. These safeguards are adapted to the nature of the processing and the risks that such processing may pose to the rights and freedoms of the data subject.

12. Personal Data Breaches
If a personal data breach occurs, it will be handled in accordance with applicable data protection regulations. Where a breach is subject to a reporting obligation, it will be reported to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), and affected individuals will be informed when required by law. Examples from the hotel industry indicate that incidents are documented and, where necessary, reported within 72 hours.

13. Your Rights
Under the GDPR, individuals whose personal data is held by the hotel have the right to:
- Request access to information about the personal data being processed.
- Request the correction of inaccurate information.
- Request the deletion of personal data in certain circumstances.
- Request the restriction of processing in certain circumstances.
- Object to processing based on legitimate interests.
- In certain circumstances, receive their personal data in a structured, commonly used, and machine-readable format.
- Withdraw previously given consent.
- Lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

Requests to exercise these rights should be sent to hello@arenainn.seThe hotel may request additional information to verify the individual's identity before processing a request.

14. Cookies and Website
If the hotel's website uses cookies or similar technologies for functionality, statistics, or marketing, information about their use must be provided on the website. Consent should be obtained before using cookies that are not strictly necessary, in accordance with applicable regulations.

15. Changes to This Policy
Arena Inn Hotel reserves the right to update this Privacy Policy when necessary. The latest version will be made available on the hotel's website or provided upon request.

16. Contact
Questions about this Privacy Policy or the hotel's processing of personal data may be directed to:
Niranda Hotel AB
Arena Inn Hotel
Bogårdsvägen 32
128 62 Sköndal
E-mail: hello@arenainn.se

Anyone who believes that their personal data has been processed incorrectly has the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).