Privacy policy

The policy is valid for people who come into contact with Explore Archipelago or its owners, either through their own volition or by us contacting them.

You are always welcome to contact us with any questions about privacy and data protection!

Key concepts

Personal data is information that can be directly or indirectly linked to a physically living person. Examples of personal data are name, address, telephone number and e-mail address. In certain circumstances, data such as IP numbers or other data combined together may also constitute personal data.  

Processing of personal data includes all handling of personal data, such as collection, registration and storage. 

The data controller is the person who, alone or together with others, determines the purposes and means for the processing of personal data. 

The purpose of the processing of personal data

Explore Archipelago markets destinations and activities in the archipelagos between Stockholm and Turku. We work closely with companies and other institutions as well as organizations, municipalities and authorities.

When and what personal information do we collect?

Information that you provide to us. For example, when you interact with us on social media or contact us by email or phone: 

• Personal and contact information - name, e-mail address, telephone number, role and online ID. 

Information we collect about you. If you are, for example, a public figure, journalist or working as a contact person for a company or a visitor to one of our websites, we may actively collect the following information about you: 

•  Personal and contact information - name, e-mail address, mobile phone number, photo, online ID. 

•  Information on how to interact with our websites - how to use our websites. 

• Device information - such as IP address, language settings, browser settings, time zone, operating system, platform and screen resolution. 

What do we do with your personal information?

Purpose of the treatment - Legal basis for the treatment

Administer and develop digital communications; for example, communicate on social media, write press releases to journalists and conduct international and national marketing - Fulfilment of agreements and legitimate interests.  

Conduct surveys and analyze; ongoing statistics, external monitoring and customer satisfaction surveys - Legitimate interests.   

Manage external dialogue; respond to comments and grievances - Legal obligation.         

Collaborate with the business community in Stockholm, Turku or other areas - Fulfilment of agreements and legitimate interests.  

Provide tourist services; for example, by answering questions by e-mail or telephone - Fulfilment of agreements, legitimate interests and legal obligations.     

Nurture and manage the brand; for example, by marketing the archipelago areas or by inviting foreign press and travel agencies to get to know them - Fulfilment of agreements and legitimate interests.  

Who can we share information with?

Personal data assistants

Sometimes it is necessary for us to share your personal information with other organizations in order to provide our services. A personal data assistant is a company that processes the information on our behalf according to our instructions. We have personal data assistants who help us with:

•  IT services (companies that handle the necessary operation, technical support and maintenance of our IT solutions).

•  Marketing (print and distribution, social media, media agencies or advertising agencies).

Organizations that are independently responsible for personal data

•  Government agencies (police, tax authorities or other agencies) if we are obliged to share it by law or in case of suspicion of crime. 

• Partners (industry organizations or other actors in the business community, such as hotels and restaurants). The activities of the Stockholm Archipelago Foundation and the City of Turku include promoting collaboration both nationally and internationally, and may therefore convey some of your tasks to promote and facilitate such collaboration. 

Where do we process your personal data?

We always strive to process your data within the EU / EEA. However, in some situations data may be transferred to, and processed in, countries outside the EU / EEA by a supplier or subcontractor.

How long do we store your personal information?

We never store your personal information beyond what is necessary for the respective purpose or for what is required to fulfill the statutory storage times that exist or for what is necessary for other legitimate interests. Other than due to law, this is determined by the relationship we have with you, for example, an ongoing relationship through industry organization or event coordination.

What are your registered rights?

Right of access (so-called register extract). You have the right to access the information we process about you and can request a copy of this. (Information is provided in the form of a register extract stating the purpose, categories of personal data, categories of recipients, storage periods, information about where the information was collected from and the existence of automated decision-making).

To ensure that you are the one who has the right to request the information in accordance with the Data Protection Ordinance, we may ask you for additional information.

Right to rectification. You have the right to correct incorrect or incomplete information about you within the purpose for which it is processed.

Right to erasure ("the right to be forgotten"). You have the right to request that we delete the personal data we process about you if:

• The data is no longer necessary for the purposes for which it was collected or processed.

• You object to a balance of interests we have made based on the legal basis of legitimate interest and your reason for objection outweighs our legitimate interest.

• You object to processing for direct marketing purposes.

•  Personal data has been processed illegally.

• The personal data must be deleted in order to fulfill a legal obligation to which the Group is subject.

•   The personal data has been collected about a child (under 13 years of age) for whom you have parental responsibility and the collection has taken place in connection with the provision of information society services (eg social media).

Be aware that there may be legal obligations that prevent us from immediately deleting parts of your data. These obligations come from, among other things, the Public Access to Information and Secrecy Act, the Archives Act, the Administrative Procedure Act and accounting and tax legislation.

Right to restriction. Under certain circumstances, you have the right to request that our processing of your personal data be restricted. For example, if you were to question whether the information is correct or if we no longer need it for our purposes but you need it to be able to establish, assert or defend legal claims. This means that you can request that we not delete your information. 

If you object to a processing we carry out with reference to balancing the interests of a legitimate interest, you can request that we limit the processing for the time we need to check whether our legitimate interests outweigh your interests in having the information deleted. 

If the processing is limited as above, we may not do anything with your personal data, other than the storage itself, other than to establish, assert or defend legal claims or to protect someone else's rights unless we request your specific consent.

The right to object to a certain type of treatment. You always have the right to avoid direct marketing (for example, when an organization makes direct contact with a customer via e-mail, SMS or newsletter. Marketing measures where a customer himself has actively chosen to use a service or otherwise visited an organization to find out more about its services do not count as direct marketing.) and to object to any processing of personal data based on a balance of interests. 

In order to continue to process your data when you have objected to a balance of interests, we must be able to show a compelling justified reason for the processing that outweighs your interests. Otherwise, we may only process the data to establish, exercise or defend legal claims.

Right to data portability. If your personal data, on the legal basis of consent or performance of agreements, is processed automatically, you also have the right to request these provided that it does not affect anyone else's rights or freedoms.

Submit complaints to the Data Inspectorate. The Data Inspectorate is a supervisory authority that is responsible for monitoring the application of privacy legislation. If you believe that an organization is handling personal data incorrectly, you can file a complaint with them.

For more information, please read the Archipelago Foundation's privacy policy and the City of Turku's privacy policy