Privacy Policy

Data controller: Lenvik AB

• Email: info@lenvik.se
• Website: https://lenvik.se

If you have questions about how we process your personal data, please contact us by email.

Depending on how you use the website and our services, we may process, among other things:

• contact details (name, email address, phone number);
• booking and order data (accommodation, activities, products, payment-related information needed to perform the contract);
• messages you send to us via forms or email;
• technical and usage data (IP address, browser type, device information, pages visited, timestamps) as well as cookies and similar technologies where permitted.

If you do not provide data that is necessary to perform a contract or request, we may in some cases be unable to provide the requested service.

We process personal data in order to:

• manage bookings, orders and customer service;
• give you access to information, products and services on https://lenvik.se;
• comply with legal obligations (e.g. accounting and tax rules);
• improve the website, security and user experience;
• send relevant information about our products and offers where a lawful basis exists (e.g. consent or legitimate interest). You may opt out of marketing messages at any time by writing to info@lenvik.se with the subject “Unsubscribe from marketing”.

Processing is based on one or more legal bases under Article 6 GDPR, including:

• contract — where processing is necessary to enter into or perform a contract with you;
• legal obligation — where we must process data by law;
• legitimate interest — e.g. to operate and improve the website, prevent misuse and communicate with you to a reasonable extent, provided your interests do not override;
• consent — where we expressly ask for your consent (e.g. for certain cookies or newsletters). Consent may be withdrawn at any time.

We keep personal data only as long as needed for the purpose for which it was collected, and thereafter for as long as required by law (e.g. Swedish bookkeeping rules) or until you withdraw consent.

• Data related to contracts is kept during the contract term and thereafter for the period needed for complaints, claims and legal requirements.
• Marketing data based on consent is kept until consent is withdrawn.
• Technical logs are kept for a limited time needed for operations and security.

When the retention period expires, the data is deleted or anonymised.

Data may be shared with providers that help us run the website and services (e.g. hosting, IT, payment, email), under contract and with appropriate safeguards. Data is also disclosed when required by law or by an authority.

If personal data is transferred outside the EU/EEA, this is done only where a valid GDPR transfer mechanism exists (e.g. an adequacy decision by the European Commission or standard contractual clauses) together with necessary safeguards.

The website may use cookies and similar technologies to provide the service, remember settings and — where allowed — analyse usage. You can control cookies in your browser settings. Blocking necessary cookies may affect some features.

Under the GDPR, and subject to the conditions set out in the law, you have the right to:

• obtain confirmation of whether we process your data and access that data;
• request rectification of inaccurate data;
• request erasure (“right to be forgotten”);
• request restriction of processing;
• object to processing based on legitimate interest, including direct marketing;
• receive your data in a structured, commonly used and machine-readable format (data portability) where applicable;
• withdraw consent without affecting the lawfulness of earlier processing;
• lodge a complaint with the supervisory authority.

To exercise your rights, contact us at info@lenvik.se. We will respond without undue delay and within one month at the latest, unless a longer period is allowed under the GDPR.

Supervisory authority in Sweden: Swedish Authority for Privacy Protection (IMY) — imy.se.

We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure and destruction, in accordance with Article 32 GDPR.

We may update this policy. The current version is always published on this page. Where material changes require new consent, we will obtain it before continuing processing on the new basis.

Last updated: 2026-03-24