Privacy policy

1. Controller and contact details

Stockholms Oktoberfest AB, Swedish company registration number 556842-5432, is the controller for the processing described in this policy. Registered address: Im Hafengiesser 2, 88662 Überlingen, Germany. Email: info@stockholm-oktoberfest.se. Telephone: +46 (0)76 746 50 09.

2. Data we process, purposes and legal bases

• Enquiries: name, email address, optional telephone number, subject and message when you use our contact form or contact us directly. We use this data to answer you and manage the matter. The legal basis is taking steps at your request before entering into a contract or our legitimate interest in handling enquiries.
• Bookings and event administration: contact, booking and ticket details needed to administer a purchase, admission, customer service, complaints or refunds. The legal bases are performance of a contract, legal obligations and, where relevant, our legitimate interest in establishing or defending legal claims. A ticket or payment provider may collect payment details directly; its own privacy notice also applies.
• Website operation and security: IP address, date and time, requested page, browser/device information and technical error or security data may be recorded in server logs. We use this information to deliver, maintain and protect the website. The legal basis is our legitimate interest in secure and reliable operation.
• Photography and filming at the event: overview images may contain identifiable guests and may be used for documentation, reporting and promotion based on our legitimate interests. We obtain consent where required, particularly for clearly identifiable staged close-ups. You can object by speaking to the photographer or contacting us.

If we ask for consent for another purpose, you may withdraw it at any time. Withdrawal does not affect processing carried out before it was withdrawn.

3. Where the data comes from

We normally receive data directly from you. We may also receive the booking and contact information needed to administer your visit from the ticket or payment provider you use.

4. Recipients and processors

Access is limited to people who need the data for their work. We may share relevant data with hosting, IT, email, ticketing and payment service providers acting as processors or independent controllers, as well as professional advisers and public authorities where required by law. We require processors to protect the data and act only on documented instructions.

5. Transfers outside the EU/EEA

Some technology providers may process data outside the EU/EEA. Where this happens, we use a lawful transfer mechanism, such as an adequacy decision or the European Commission’s standard contractual clauses, together with supplementary safeguards where required. Contact us if you would like information about the safeguards used for a particular transfer.

6. How long we keep data

• Closed contact enquiries are normally deleted or anonymised within 24 months after the last contact, unless the matter continues or the data is needed for a legal claim.
• Booking and contract data is kept for as long as needed to perform the agreement and handle complaints or claims. Accounting records are retained for the period required by law.
• Routine server logs are normally retained for no longer than 90 days, unless a security incident requires longer investigation or legal retention applies.
• Event images are reviewed periodically and removed when they are no longer relevant for the purpose for which they were taken, or earlier where an objection must be upheld.

We may retain limited information for longer where necessary to comply with law or establish, exercise or defend legal claims.

7. Your rights

Subject to the conditions in the GDPR, you may request access to and a copy of your data, correction, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests and withdraw consent at any time. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or another competent supervisory authority.

Send a request to info@stockholm-oktoberfest.se. We may need to verify your identity and will respond within the time required by law.

8. Automated decisions

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

9. Cookies, fonts, maps and external links

The website may use cookies that are necessary for functions such as language selection and site administration. Optional analytics or marketing cookies will only be used with consent where consent is required. Pages containing Google Maps and remotely hosted fonts may connect to those providers and disclose technical data such as your IP address. Their own privacy notices apply. Links to ticketing, outfit and social-media services lead to external websites whose operators are responsible for their own processing.

10. Changes to this policy

We may update this policy when our processing or legal requirements change. The current version and update date will always be published on this page.