Privacy policy

1. Who we are

River Valley Travels AB (organisation number 559385-0463), Råneå, Sweden, is the data controller for the personal data described in this policy. This means we decide how and why it is used, and we are responsible for handling it correctly.

For any question about your personal data, email info@rivervalleytravels.com or call +46 70 404 77 78.

2. The data we collect

About travellers:

• name and number of travellers in the group
• phone number for contact on the day
• pickup and drop-off locations, dates and times
• flight, train or ferry details needed to time a pickup
• luggage details and special requests
• age and weight of children, where needed to provide the correct child seats
• information about medical conditions or reduced mobility, only where it affects how we deliver the journey (see section 5)

About agents, partners and other business contacts:

• name, company, job title, email address and phone number
• booking, invoicing and payment details
• messages you send us
• login details for our agent portal

About website visitors:

• information about how the website is used, such as pages visited, approximate location, device and browser type, collected through Google Analytics only if you accept analytics cookies (see section 10)

We do not ask for more than we need to carry out the journey safely.

3. Where the data comes from

Most traveller data is sent to us by the travel agent, tour operator or partner who books the journey on the traveller's behalf, as part of arranging the trip. The agent handles its own relationship with the traveller under its own privacy policy. This policy explains how we handle the details once we receive them. Some data comes directly from travellers, for example when they contact our driver on the day or contact us by email or phone.

4. Why we use personal data, and on what legal basis

• To plan and carry out the booked journey, and to stay in touch with travellers on the day. Legal basis: performance of the contract with the agent or traveller, and our legitimate interest in delivering the service safely and on time.
• To send quotes and confirmations, invoice and receive payment. Legal basis: performance of the contract.
• To keep accounting records and meet other legal requirements, for example tax and transport rules. Legal basis: legal obligation.
• To manage our relationships with agents and partners, including access to our agent portal, and to answer questions. Legal basis: legitimate interest.
• To handle complaints, claims or disputes. Legal basis: legitimate interest and, where relevant, legal obligation.

We do not sell personal data, and we do not use it for automated decision-making or profiling.

5. Information about health or mobility

Sometimes we need to know about a medical condition, allergy or reduced mobility to deliver a journey safely, for example to plan extra stops, assistance or suitable seating. We only use this information for that purpose and share it only with the driver carrying out the journey. It is kept as part of the booking record for the same period as other booking details (see section 8), and is not used for anything else. We process it on the basis of the traveller's explicit consent, which is given when the traveller or their agent chooses to share it with us for this purpose. A traveller can withdraw consent at any time, although this may affect how we can adapt the journey.

6. Who we share data with

We only share personal data where it is needed for the purposes above:

• our drivers, and where a journey is carried out by a trusted partner or subcontractor, that partner
• hotels, lodges and other properties, where needed to coordinate a pickup or drop-off
• the agent or partner who made the booking
• service providers who help us run the business: Google (email, document storage and website analytics), Lovable (hosting of our website and agent portal), and our accounting software provider and accounting firm
• authorities, where the law requires it, for example the Swedish Tax Agency or the Swedish Transport Agency

Every service provider that handles personal data on our behalf is bound by an agreement to protect it and to use it only on our instructions.

7. Transfers outside the EU and EEA

Our accounting providers are based in the EU. Google and Lovable may process data in the United States. These transfers are protected by the European Commission's standard contractual clauses and, for Google, also by the EU-US Data Privacy Framework.

Journeys to Norway are covered by the same rules, as Norway is part of the EEA.

8. How long we keep data

• Accounting records, including invoices: seven years, as required by the Swedish Bookkeeping Act.
• Booking details and messages about a journey: up to 24 months after the journey, to handle questions, claims and repeat bookings. Where the same details are part of our accounting records, they are kept for seven years as above.
• Information about health or mobility: kept as part of the booking record for up to 24 months after the journey, then deleted together with the rest of the booking details.
• Agent and partner contact details and portal accounts: for as long as we work together, and up to 24 months after the last contact.

9. Your rights

You have the right to:

• ask for a copy of the personal data we hold about you
• ask us to correct inaccurate data
• ask us to delete your data, where we are not required to keep it
• ask us to limit how we use it, or object to our use of it
• receive your data in a common digital format, where this applies
• withdraw consent you have given, at any time

To use any of these rights, email info@rivervalleytravels.com. We will reply within one month.

If you are unhappy with how we handle your data, please contact us first so we can put it right. You also have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at www.imy.se, or to the data protection authority in the country where you live.

10. Our website, cookies and agent portal

Our website uses two kinds of cookies:

• Necessary cookies, which the website needs to work and to remember your cookie choice. These do not need your consent.
• Analytics cookies from Google Analytics, which help us understand how visitors use the website so we can improve it. These are only set if you click "Accept" in the cookie banner. The main ones are _ga and _ga_ followed by an ID, which are kept for up to two years.

We do not use advertising or marketing cookies. You can change your choice at any time through the "Cookie settings" link at the bottom of every page, or by clearing cookies in your browser. Declining analytics cookies does not affect how the website works.

The agent portal requires a login. We use the account details only to give access, keep the portal secure and manage bookings.

11. Changes to this policy

We may update this policy when our services or the law change. The date at the top of this page shows when it was last updated.

12. Contact

River Valley Travels AB
Råneå, Sweden
info@rivervalleytravels.com
+46 70 404 77 78

Full company details are listed in section 2 of our terms and conditions.