Privacy policy

1. Controller and contact details

Stockholms Oktoberfest AB, Swedish company registration number 556842-5432, is the controller for the processing described in this policy. Registered address: Im Hafengiesser 2, 88662 Überlingen, Germany. Email: info@stockholm-oktoberfest.se. Telephone: +46 (0)76 746 50 09.

2. Data we process, purposes and legal bases

• Enquiries: name, email address, optional telephone number, subject and message when you use our contact form or contact us directly. We use this data to answer you and manage the matter. The legal basis is taking steps at your request before entering into a contract or our legitimate interest in handling enquiries.
• Bookings and event administration: contact, booking and ticket details needed to administer a purchase, admission, customer service, complaints or refunds. The legal bases are performance of a contract, legal obligations and, where relevant, our legitimate interest in establishing or defending legal claims. A ticket or payment provider may collect payment details directly; its own privacy notice also applies.
• Website operation and security: IP address, date and time, requested page, browser/device information and technical error or security data may be recorded in server logs. We use this information to deliver, maintain and protect the website. The legal basis is our legitimate interest in secure and reliable operation.
• Photography and filming at the event: overview images may contain identifiable guests and may be used for documentation, reporting and promotion based on our legitimate interests. We obtain consent where required, particularly for clearly identifiable staged close-ups. You can object by speaking to the photographer or contacting us.

If we ask for consent for another purpose, you may withdraw it at any time. Withdrawal does not affect processing carried out before it was withdrawn.

3. Where the data comes from

We normally receive data directly from you. We may also receive the booking and contact information needed to administer your visit from the ticket or payment provider you use.

4. Recipients and processors

Access is limited to people who need the data for their work. We may share relevant data with hosting, IT, email, ticketing and payment service providers acting as processors or independent controllers, as well as professional advisers and public authorities where required by law. We require processors to protect the data and act only on documented instructions.

5. Transfers outside the EU/EEA

Some technology providers may process data outside the EU/EEA. Where this happens, we use a lawful transfer mechanism, such as an adequacy decision or the European Commission’s standard contractual clauses, together with supplementary safeguards where required. Contact us if you would like information about the safeguards used for a particular transfer.

6. How long we keep data

• Closed contact enquiries are normally deleted or anonymised within 24 months after the last contact, unless the matter continues or the data is needed for a legal claim.
• Booking and contract data is kept for as long as needed to perform the agreement and handle complaints or claims. Accounting records are retained for the period required by law.
• Routine server logs are normally retained for no longer than 90 days, unless a security incident requires longer investigation or legal retention applies.
• Event images are reviewed periodically and removed when they are no longer relevant for the purpose for which they were taken, or earlier where an objection must be upheld.

We may retain limited information for longer where necessary to comply with law or establish, exercise or defend legal claims.

7. Your rights

Subject to the conditions in the GDPR, you may request access to and a copy of your data, correction, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests and withdraw consent at any time. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or another competent supervisory authority.

Send a request to info@stockholm-oktoberfest.se. We may need to verify your identity and will respond within the time required by law.

8. Automated decisions

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

9. Cookies, fonts, maps and external links

The necessary so_cookie_consent cookie records your privacy choices for six months. If you allow Analytics or Marketing, permitted campaign and advertising-click parameters can be retained for the browser session and added to links to the Stockholm Pretix ticket shop. Meta Pixel only loads after Marketing consent and may then use cookies such as _fbp and _fbc for up to 90 days. The embedded Google Map only loads after External media consent. You can change or withdraw these optional choices at any time through “Cookie settings” in the footer.

Google Fonts loads as part of the website presentation and requests font resources from Google, which may disclose technical data such as your IP address and browser information to Google. Provider privacy notices apply. Links to ticketing, outfit and social-media services lead to external websites whose operators are responsible for their own processing.

10. Changes to this policy

We may update this policy when our processing or legal requirements change. The current version and update date will always be published on this page.