PRIVACY PROTECTION AND PERSONAL DATA PROCESSING

Privacy Policy shall apply to the use of www.dibtravel.com and other websites and applications of “Search Pages” which belong to DIB Services AB, Box 6067, 102 31 Stockholm, org.no.559036-8758, “DIB”. DIB Travel is a branch of the company DIB Services AB.

1 GENERAL RULES OF PERSONAL DATA PROCESSING

1.1 When the User performs booking through DIB, he/she is required to submit certain personal data (name, e-mail address, telephone number, address, sex/age). Those data are stored and used in order to enable the User to book a hotel, for the purpose of communication with the User and, if required, for sending newsletters of DIB.

1.2 DIB records the purchases made by the Buyer so that the Buyer can see an overview of past purchases when logging into the User Account. In addition, DIB uses such data for statistical purposes and in order to improve user experience on the website.

1.3 DIB also uses cookies for collecting the information on visits to the website by the User as described below.

2 PERMITTED MARKETING

2.1 The User agrees to receive newsletters, offers and information on purchases, sale and mediation related to goods and services. This can be performed electronically (ex. via e-mail, sms messages, push notifications through applications) or by telephone and regular mail, and it can be sent by, for example, dibtravel.com and business partners. Therefore, DIB can transfer internally collected User data (name, e-mail address, telephone number, sex, age, area of interest, past purchases and sales, etc.).

2.2 The User can withdraw his/her consent related to marketing at any time by sending an e-mail to [email protected].

DISCLOSURE OF PERSONAL DATA

3.1 Personal data of Users shall only be given to the companies such as, for example, business partners, transportation firms, IT suppliers and providers of payment services to DIB and only to the extent required for processing the purchase orders and in order to ensure the undisturbed functioning of websites as well as for mediation services. This means, for example, that personal data of Users shall be transmitted to the hotels with which DIB cooperates.

4 SECURITY

4.1 All personal data communicated by the User to DIB shall be kept in a safe database with dibtravel.com and shall be treated as confidential. When the User purchases through DIB websites, all information related to such transactions are encrypted.

5 INSPECTION, AMENDMENTS AND CLOSURE OF USER ACCOUNT

5.1 The User can, at any time, inspect the registered personal data by accessing his/her User Account. The User can also make possible changes to data. For security reasons the User may not change name or surname. If the User wishes to change his/her name, the User is required to directly contact DIB via e-mail [email protected]. If the User no longer wishes to be a client of dibtravel.com, he/she can announce that at any time through his/her User Account or via e-mail to [email protected].

6 INFORMATION GATHERING AND USAGE

6.1 When you register for Dib Services AB we ask for information such as your name, email address, billing address, or payment information. Members who only sign up for the account are not required to enter any payment details.

6.2 Dib Services AB uses collected information for the following general purposes: products and services provision, billing, identification and authentication, services improvement, contact, and research.

7 COOKIES

7.1 DIB uses cookies in order to provide the best possible experience to the User during the visit to the Search Page. Cookies are small textual files stored in the hard disk of a computer, smartphone or other IT equipment. This enables recognition of the computer / IP address and collection of information on visited websites and used functionalities.

7.2 If the User does not want to use cookies, cookies can be disabled in the browser. Please note that in this case certain services and functionalities cannot be used for reason that they use cookies for memorizing your activities.

7.3 DIB uses cookies to provide better experience on the website, to memorise the User’s activities during the use of DIB’s website and for ongoing improvement of the content and functions of the website. DIB also uses cookies in order to make the marketing suitable for its needs and for statistical data on the use of the website.

7.4 Some cookies are deleted when the browser is closed, while others are kept for a longer period of time.

7.5 DIB also uses independent cookies, i.e. those set by others. Those are, for example, the companies which help us estimate, analyse and create our offers, advertisements and contents.

8 DATA STORAGE

8.1 Dib Services AB uses third-party vendors and hosting partners to provide the necessary hardware, software, networking, storage, and related technology required to run Dib services. Although Dib Services AB owns the code, databases, and all rights to the Dib Services AB application, you retain all rights to your data.

9 EU AND SWISS

9.1 If you choose to provide Dib Services AB with your information, you consent to the transfer and storage of that information on our servers located in Germany.

9.2 For European Union and Swiss residents, any questions or concerns regarding the use or disclosure of your information should be directed to Dib Services AB by sending an email to [email protected] . We will investigate and attempt to resolve complaints and disputes regarding use and disclosure of your information in accordance with this Privacy Policy. For complaints that cannot be resolved, and consistent with the Safe Harbor Enforcement Principle, we have committed to cooperate with data protection authorities located within Switzerland or the European Union (or their authorized representatives).

10 GENERAL DATA PROTECTION REGULATION (GDPR)

10.1 If you are located in the European Union, you are entitled to the following rights with regard to your personal information and data:

10.1.1 Right of access to your personal data, to know what information about you we hold

10.1.2 Right to correct any incorrect or incomplete personal data about yourself that we hold

10.1.3 Right to restrict/suspend our processing of your personal data

10.1.4 Right to complain to a supervisory authority if you believe your privacy rights are being violated

10.1.5 Additional rights that may apply to you in certain instances:

10.1.5.1 Right of data portability (if our processing is based on consent and automated means)

10.1.5.2 Right to withdraw consent at any time (if processing is based on consent)

10.1.5.3 Right to object to processing (if processing is based on legitimate interests)

10.1.5.4 Right to object to processing of personal data for direct marketing purposes

10.1.5.5 Right of erasure of your personal data from our system (“right to be forgotten”) if certain grounds are met

10.1.5.6 To exercise your privacy rights, you can email us at the address given below in the ‘Questions’ section of this Privacy Policy

11 CHANGES

11.1 Dib Services AB may periodically update this policy. We will notify you about significant changes in the way we treat personal information by sending a notice to the primary email address specified in your Dib Services AB primary account holder account or by placing a prominent notice on our site.

12 CONTACT

12.1 If you need more information or if you have any questions please contact us at [email protected].

PRIVACY NOTICE DIB TRAVEL

Last updated: May 2026.

In this privacy notice, we describe what personal data about you that we use and why, including your rights under the General Data Protection Regulation (GDPR).

This privacy notice applies to the DIB Travel Group, including:

DIB Services AB

Company reg. no. 559036:8758
Box 6067, 102 31 Stockholm

DIB Professionals AB

Company reg. no. 559309-9616
Box 6067, 102 31 Stockholm

DIB Denmark ApS

Company reg. no. 42929557
Nymøllevej 50
DK-2800 Kongens Lyngby

DIB Services Balkan D.O.O.

Company reg. no. 21247545
Prilepska 1
11040 Beograd

DIB Norge AS

Company reg. no. 936 953 158
Postboks 146 Vinderen, 0319 Oslo

When referring to "DIB", "we", "us" or "our", this means the relevant DIB company or companies that are responsible (either as separate controllers or joint controllers) for the processing of your personal data. For more information, see the section "Responsibility for the use of your personal data" below.

This privacy notice covers you who:

Visit and interact with our website and other digital channels.
Represent or are a contact person of a customer that we do business with.
Represent or are a contact person of a prospective customer.
Make bookings or otherwise interact with DIB's travel portal through our website or app as a user, as well as guests included in bookings.
Represent or are a contact person of a supplier or a partner that we do or intend to do business with (such as IT and travel service providers, online travel agencies, and providers of global distribution systems (GDS)).
Otherwise interact with us, for example if you register for an event or otherwise communicate with us.

In this privacy notice, "website" means dibtravel.com and app.dibtravel.com.

When referring to "travel portal", this means DIB's travel portal available for users via app.dibtravel.com or the "DIB Travel" app

User of the travel portal

If you are a user of the travel portal and DIB Services AB has a business relationship with the organisation that you represent, DIB Services AB is responsible (as controller) for the processing of your personal data.

If you are a user of the travel portal and DIB Denmark ApS has a business relationship with the organisation that you represent, DIB Denmark ApS and DIB Services AB are responsible together (as joint controllers) for the processing of your personal data.

If you are a user of the travel portal and DIB Norge AS has a business relationship with the organisation that you represent, DIB Norge AS and DIB Services AB are responsible together (as joint controllers) for the processing of your personal data.

DIB has entered into an Intra-Group Data Transfer Agreement (IGDTA), including an arrangement under article 26 of the GDPR, that sets out the roles and responsibilities of each DIB entity when processing your personal data. You have the right to obtain the essence of this arrangement upon request. This privacy notice also reflects the key elements of that arrangement.

Visitors of our website and digital channels

If you visit our website, app or other digital channels, DIB Services AB is responsible (as controller) for the processing of your personal data collected through cookies and other tracking technologies.

Main principles for other scenarios

The DIB company that is responsible (as controller) for the processing of your personal data under this privacy notice is normally the DIB company:

that has, or is seeking, a business relationship with the organisation that you represent or for which you are a contract person; or
with which you otherwise interact or communicate.

In the below table we describe what categories of personal data that we process with examples of types of personal data covered by each category.

Categories of personal data	Examples of types of personal data
Account details	Username, password, user profile
Background check data	Results from background checks, for example KYC checks
Communication data	Content in e-mail and other forms of communication
Contact information	Address, e-mail address, phone number
Event data	Type of event, participants, preferences
Feedback data	Feedback, opinions, answers from surveys
Identity data	Name, personal identity number, signature
Organisational data	Title, position and the company or organisation that you work for
Payment data	Payment card details, payment method, amount
Picture, video and audio material	Video, photos, audio recordings
Technical data	Type of device, IP address, version of web browser and operating system
Travel and logistics data	Travel itinerary, hotel or other accommodation details, travel preferences, including dietary preferences and allergies, as well as accessibility needs and health related requirements
Travel documentation	Personal data included in passports, visas and national ID cards (for example full name, passport/visa number, nationality, date and place of birth, sex, photo and signature, type of visa, duration of stay/validity period), as well as travel tickets (for example booking reference, destination and other itinerary details) and loyalty travel data
User generated data	Click and visit statistics on the website, user preferences, interactions when using the website and other digital channels

The personal data that we collect about you is mainly collected directly from yourself when you provide your personal data to us, for example when you contact or otherwise communicate with us, use our travel portal or visit our website or other digital channels.

We also collect, where necessary, personal data from other sources as described below.

Group companies, which have collected your personal data and shared them with us, for example in connection with communication and to conduct our business in general.
The company or organisation that you work for, for example if someone else in the company or organisation you work for makes a booking in DIB`s travel portal involving you.
Social network platforms if you follow or interact with us on social media.
Partners that we collaborate with, for example travel service providers and partners to carry out events or similar activities.
Global distribution system (GDS) providers, to handle bookings.
External persons that we communicate with for the purposes described in this privacy notice.

We collect and use personal data for various purposes. The purposes for which we in practice process your personal data may, however, vary depending on your relationship with us or how you interact with us.

To read more about which personal data, which legal basis that we rely on for the processing of your personal data for each purpose and for how long your personal data is stored in relation to the relevant categories of individuals, please see our detailed information on our use of personal data.

Transfer of personal data to other external recipients (controllers)

We share your personal data with external recipients where necessary for the purposes described in this privacy notice. These recipients act as controllers for their own processing of your personal data, unless stated otherwise.

For more details on the purposes for which we share your data and the legal bases for such sharing, please see our detailed information on our use of personal data, which outlines the external recipients associated with each processing purpose.

Transfer of personal data to service providers (processors)

We also transfer personal data to service providers that we have engaged (including group companies) when necessary for the purposes for which we process personal data as described in this privacy notice.

These service providers (including group companies) provide, for example, IT, financial and other administrative services, development services and communication services to us. The service providers which process personal data on our behalf and in accordance with our instructions act as data processors in relation to us. These service providers may not process your personal data for their own purposes and are legally and contractually obligated to protect your personal data.

Where we process your personal data

As a main rule, we store your personal data within the EU/EEA. However, in certain cases, we transfer your personal data to recipients located in third countries outside the EU/EEA, for example to service providers engaged by us.

To ensure an essentially equivalent level of protection for your personal data when transferred (or otherwise made available) to service providers in third countries which do not provide an adequate level of protection, we generally rely on the EU Commission's adopted standard contractual clauses for international transfers according to decision 2021/914 and implement supplementary measures as necessary to ensure an essentially equivalent level of protection for your personal data as provided under the EU GDPR.

We also rely upon adequacy decisions issued by the EU Commission where personal data is transferred to countries and recipients covered by such decisions (i.e. where the EU Commission has determined that such country and/or recipient provides an adequate protection). By way of example, this includes the EU-US Data Privacy Framework for transfers to the United States.

Moreover, where relevant, we rely on specific provisions in Article 49 of the GDPR, such as where the transfer is necessary for the performance of a contract between us and you or is necessary to conclude such contract.

Rights in relation to the use of your personal data

You have the following rights in relation to your personal data under the GDPR:

Article 15

Access to and receive a copy of your personal data

Article 16

Rectify or supplement your personal data

Article 7

Withdraw your consent to a processing of your personal data

Article 17

Delete your personal data

Article 21

Object to a processing of your personal data

Article 18

Restrict a processing of your personal data

Article 20

Obtain a copy of your personal data and have your personal data transferred to an external recipient (data portability)

Automated individual decision-making

We do not carry out any automated individual decision-making which have legal effects or similar significant effects on you.

Further information on your rights

Please note that each right above comes with certain caveats and exemptions. This means that these rights only may be successfully exercised in certain situations. For more information on your rights and when they apply, see for example the information provided by the Swedish Authority for Privacy Protection available on their website.

Exercise your rights

If you wish to exercise your rights at any time, please contact us on the contact details under section 8 "If you have any questions" below.

If possible, we would grateful if you use the e-mail address that you have registered with us or used when you have previously been in contact with us. This would make it easier for us to manage your request.

Right to lodge a complaint

You have the right to lodge a complaint with your supervisory authority. Contact details to the data protection authorities in the EU/EEA can be found here.

Please contact us by e-mail at [email protected] if you have any questions about this privacy notice, how we use your personal data or if you wish to exercise your rights.

You can also find contact details to each DIB entity here: https://dibtravel.com.

Introduction

In this detailed information on our use of personal data, we explain the purposes for which we use personal data, the categories of personal data processed for each purpose, our legal basis for the use, for how long we store personal data and with which external recipients (in their role as controllers) that we share your personal data for each purpose.

Visitors of our website and digital channels

Follow up on and evaluate the use of our website and digital channels

What we do: We process your personal data to better understand how our website and digital channels are used, for example by analysing numbers of visitors and activities on our webpages. This is carried out by using cookies and similar technologies which allow us to analyse visitor and user statistics.

Categories of personal data

User generated dataTechnical data

Legal basis

Consent (Article 6.1 (a) of the GDPR). The processing relies on the consent that you provide by accepting the use of cookies and similar technologies for the same purpose.

Storage period / External recipients

Personal data is stored during the period stated in our cookie information available on the website.

Improve the user experience on our website and in our digital channels

What we do: We process your personal data to provide a more personalised and user-friendly experience when visiting our website and digital channels. This is carried out by using cookies and similar technologies which inter alia allow us to remember user preferences such as language, screen and device settings.

Categories of personal data

User generated dataTechnical data

Legal basis

Consent (Article 6.1 (a) of the GDPR). The processing relies on the consent that you provide by accepting the use of cookies and similar technologies for the same purpose.

Storage period / External recipients

Personal data is stored during the period stated in our cookie information available on the website.

Provide marketing and tailored content on our website and in our digital channels

What we do: If you visit our website or digital channels, we collect your personal data by using cookies and similar technologies to provide you with marketing and other tailored content which we believe are of interest to you, for example based on your interactions with our digital channels, including our website (such as browsing behaviour and websites visited).

Categories of personal data

User generated dataTechnical data

Legal basis

Consent (Article 6.1 (a) of the GDPR). The use of your personal data relies on the consent that you provide by accepting the use of cookies and similar technologies for the same purpose.

Storage period / External recipients

Personal data is stored during the period stated in our cookie information available on the website.

External recipients: Social media providers

Ensure functionality on our website and in our digital channels

What we do: We process your personal data to ensure necessary technical functionality and security on our website and in our digital channels, for example by using strictly necessary cookies and other technologies on these platforms.

Since the cookies and similar technologies are necessary in order to provide our website as intended, your consent to our use of cookies and similar technologies is not needed.

Categories of personal data

Technical data

Legal basis

Legitimate interest (Article 6.1 f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of ensuring technical functionality on our website and in our digital channels.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, given the purpose of the processing as such and that only basic personal data is processed for this purpose.

Storage period / External recipients

Personal data is stored during the period stated in our cookie information available on the website.

Contact persons of customers

Manage the business relationship with customers

What we do: We process your personal data to manage the customer relationship, for example to communicate with you as a contact person or representative of such organisation, register you as a contact person as well as manage orders and invoices.

Categories of personal data

Communication dataContact informationIdentity dataOrganisational data

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest in managing the business relationship with our customers and thereby fulfil our rights and obligations under relevant contracts.

Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, since we otherwise would not be able to manage the relationship.

Storage period / External recipients

Personal data is stored for this purpose as long as there is an active relationship with the customer.

External recipients: Group companies

Follow up on and evaluate sales and campaigns

What we do: We process your personal data to follow up on and evaluate our sales and campaigns that we carry out, for example to compile statistics of orders and in general to better understand what services that are used by our customers and how. This in order for us to obtain a better understanding and insight in our customers' behaviours and patterns, to allow us to develop and improve our business for the benefit of our customers.

We do not carry out any profiling activities in relation to your personal data for this purpose, since analyses are made on an aggregated level. We are not interested in your specific behaviour, but instead our customers' behaviours on an aggregated level.

Categories of personal data

Communication dataFeedback dataIdentity dataOrganisational data

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of follow up on and evaluate our sales and campaigns that we carry out.

Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since reports and statistics only are saved on an aggregated level and that the information therefore cannot be related to you.

Storage period / External recipients

Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice.

Provide offers and marketing

What we do: We process your personal data to provide you offers and marketing in different channels, for example via e-mail, regarding our services. Such communication may also include newsletters and other business-related communication, which necessarily are not tailored to your profile.

No profiling will take place in connection with this processing. However, we may tailor which target groups that shall receive a certain offer or marketing communication on an organisation level, for example based on where the customer is established geographically, on previous orders and your position/role, to ensure that the communication is relevant for you.

We will only send you communication for marketing purposes if you have not objected (opted out) to such communication.

Categories of personal data

Contact informationIdentity dataOrganisational data

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of providing you with relevant offers and marketing.

Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since you always may decline or unsubscribe to such communication for this purpose and since we have a professional relationship to you.

Storage period / External recipients

Personal data is stored for this purpose as long as we have an active customer relationship with the customer that you represent and for a period of twelve (12) months thereafter.

You can always unsubscribe from the relevant communication by clicking on the unsubscribe link in the e-mail or similar communication field or by contacting us.

Communicate about us and our services

What we do: We process your personal data to send you communications about us and our services in different channels, for example via e-mail. This to, for example, provide you with updates regarding our business, information about new features in and changes to our services.

Categories of personal data

Identity dataContact informationOrganisational data

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of communicating about us and our services.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since we only will provide you with important updates and news regarding our services and business.

Storage period / External recipients

Personal data is stored for this purpose as long as we have an active customer relationship with the customer that you represent and for a period of twelve (12) months thereafter.

Carry out surveys to improve and develop our services

What we do: We process your personal data to improve and develop our services. By way of example, this involves carrying out customer surveys, including determining to which target group we shall send a survey, which questions to be asked in a survey, sending out the survey and collecting and analysing the results from a survey. Your opinions about our business are important to us.

You can always unsubscribe from our communication about surveys by clicking on the unsubscribe link in the e-mail or similar communication field or by contacting us.

Categories of personal data

Communication dataContact informationFeedback dataIdentity data

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of carrying out surveys in order to obtain your opinions of our business.

Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since it is voluntary to participate in surveys.

Storage period / External recipients

Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice.

Contact persons of prospective customers

Communicate with you regarding our services and products

What we do: We process your personal data to communicate with you about our services, for example if you represent or is a contact person of an organisation that has shown interest in our services by interacting with us or if we otherwise have reasons to believe that the relevant organisation is interested in our services.

We will only use your personal data for marketing purposes where permitted by applicable law, including where you have provided consent or have not objected (opted out) to such communications.

Categories of personal data

Communication dataContact informationIdentity dataOrganisational data

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The use of your personal data is necessary to satisfy our legitimate interest of communicating with you about our services.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since only limited personal data would be used for this purpose and that you can always opt-out from the processing.

Storage period / External recipients

Personal data is stored for this purpose for a period of 24 months from the collection or the last communication with you concerning our services for this purpose.

You can always unsubscribe from the relevant communication by clicking on the unsubscribe link in the e-mail or similar communication field or by contacting us.

Carry out sales meetings and demos

What we do: We process your personal data to carry out sales meetings and demos of our services, including communicating with you for the same purpose.

Categories of personal data

Picture, video and audio materialIdentity dataCommunication dataContact informationOrganisational data

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The use of your personal data is necessary to satisfy our legitimate interest of carrying out sales meetings and demos.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, given the limited impact that the processing of personal data may have.

Storage period / External recipients

Personal data is stored for this purpose during the period the meeting or activity is carried out.

Users of the travel platform

Manage your user account and access to the travel portal

What we do: We process your personal data to manage your user account for the travel portal, for example to set up your user account and provide you with access to our services while logged in to the travel portal.

Categories of personal data

Identity dataAccount detailsOrganisational dataContact information

Legal basis

Performance of the agreement with you (Article 6.1 (b) of the GDPR). The processing of your personal data is necessary to fulfil the agreement with you according to our terms and conditions.

Storage period / External recipients

Personal data is stored for this purpose for as long as your user profile is deemed active.

Mediate business travel reservations and bookings

What we do: We process your personal data to manage travel reservations and bookings via our platform, for example when transportation (such as airline tickets and rail transport services) and accommodation (such as hotels) are reserved/booked. For example, this includes to transmit the reservation/booking (including travel documents) to relevant global distribution system (GDS) providers and travel service providers, issue booking confirmations, as well as enable cancellations, refunds and changes.

Travel reservations and bookings may also be made by us manually outside the platform (directly on the supplier's website), depending on the type of travel request made by you or the organisation you represent.

Normally, DIB will also process your personal data to manage payments (for example when issuing invoices to the organisation you represent) and to manage refunds.

DIB will act as an intermediary/agent for the reservations and bookings on behalf of the travel service provider in question. This means that the organisation who you represent will enter into a contact with the relevant travel service provider when a reservation/booking is made.

Categories of personal data

Identity dataAccount detailsOrganisational dataTravel documentationTravel and logistics dataContact information

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The use of your personal data is necessary to satisfy our legitimate interest in fulfilling the agreement with the organisation you represent regarding travel reservations and bookings.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose. Otherwise, we would not be able to manage your reservations and bookings.

Explicit consent (Article 9.2 (a) of the GDPR). If you have submitted any special categories of personal data in connection with the reservation or booking, such as allergies or accessibility needs (health data), we will obtain your explicit consent to process and transmit such information to the relevant travel service provider.

Storage period / External recipients

Personal data is stored for this purpose until the reservation/booking has been completed.

External recipients: Travel service providers (such as accommodation providers, airlines and other transportation companies), GDS providers

Manage private travel reservations and bookings

What we do: If you have signed up as a user via the organisation you work for, you are also able to make private travel reservations and bookings via our travel portal. We will process your personal data in a similar way as described under the processing activity "Mediate business travel reservations and bookings".

In these situations, we will also process your payment data (such as payment card details and payment method) related to you as an individual.

Categories of personal data

Identity dataAccount detailsOrganisational dataTravel documentationTravel and logistics dataPayment dataContact information

Legal basis

Performance of the agreement with you (Article 6.1 (b) of the GDPR). The processing of your personal data is necessary to fulfil the agreement with you according to our terms and conditions.

Storage period / External recipients

Personal data is stored for this purpose until the reservation/booking has been completed.

External recipients: Travel service providers, GDS providers

Ensure your safety while travelling (duty of care)

What we do: Duty of care refers to an organization's choice and responsibility to protect travellers from hazards and threats. As part of the services provided to Dib Travel's customers, this includes traveller tracking and risk alerts.

To provide this service, we process your personal data in order to:
- send you communications regarding ongoing incidents,
- share relevant location information with your employer, according to the preferences configured for this service.

This enables us, for example, to provide you with updates about critical events and to help your employer support you and other travellers in affected areas in an appropriate manner.

This service does not involve the processing or storage of any additional personal data beyond the travel reservations and bookings described above.

Categories of personal data

Identity dataAccount detailsOrganisational dataTravel documentationTravel and logistics dataContact information

Legal basis

Performance of the agreement with you (Article 6.1 (b) of the GDPR). The processing of your personal data is necessary to fulfil the agreement with you according to our terms and conditions.

Storage period / External recipients

Communicate about us and our services

What we do: We process your personal data to send you communications about us and our services in different channels, for example via e-mail or in the travel portal. This to, for example, provide you with updates regarding our business, information about new features in and changes to our services, including the travel platform. Certain content in the platform may be tailored to you based on your position/role.

Categories of personal data

Identity dataAccount detailsContact information

Legal basis

Storage period / External recipients

Personal data is stored for this purpose for as long as your user profile is deemed active.

Follow up on and evaluate the use of our travel platform

What we do: We process your personal data to better understand how our travel platform is used, for example by analysing numbers of users and how they interact with the platform. This is carried out by using cookies and similar technologies which allow us to analyse visitor and user statistics.

Categories of personal data

User generated dataTechnical data

Legal basis

Consent (Article 6.1 (a) of the GDPR). The processing relies on the consent that you provide by accepting the use of cookies and similar technologies for the same purpose.

Storage period / External recipients

Personal data is stored during the period stated in our cookie banner available on the user platform.

Carry out analysis for user and customer insights

What we do: We process your personal data to carry out analyses for user and customer insights on an aggregated level. Mainly this is done to better understand how you are using are services, for example means of travel, booking patterns, preferences (such as type of accommodation and destinations). This in order for us to obtain a better understanding and insight in our users' and customers' behaviours and patterns, to allow us to develop, tailor and improve our business, but also to provide users with relevant features and content on the platform.

The aggregated statistics are also compiled for the benefit of our users and customers, for example to allow them to receive recommendations on popular travel arrangements but also to provide customers with insight on how you and other users (on an aggregated level) are using the services.

We do not carry out any profiling activities in relation to your personal data for this purpose, since analyses are made on an aggregated level. We are not interested in your specific behaviour, but instead users' behaviours on an aggregated level.

Categories of personal data

Travel and logistics dataIdentity dataUser generated dataTechnical dataOrganisational dataAccount details

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of carrying out analyses for customer insights. This in order for us to develop and improve our business for the benefit of DIB and our customers.

Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, since reports and statistics only is saved on an aggregated level and that the information therefore cannot be related to you.

Storage period / External recipients

Personal data is stored for this purpose during 24 months from the date of collection.

Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice.

External recipients: Group companies

Follow up on and evaluate the business

What we do: We process your personal data to compile reports and statistics on an aggregated level to follow-up and analyse the business, for example on reservations and bookings to better understand how our travel platform and business perform. We do not profile your personal data for this purpose.

Categories of personal data

Travel and logistics dataIdentity dataOrganisational dataAccount details

Legal basis

Legitimate interest. The processing is necessary in order to satisfy our legitimate interest of follow-up on and analysing the business.

Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since reports and statistics only are saved on an aggregated level and that the information therefore cannot be related to you.

Storage period / External recipients

Follow up on and evaluate sales and campaigns

What we do: We process your personal data follow up on and evaluate our sales and campaigns that we carry out, for example to compile statistics of reservations and bookings and in general to better understand what features and services that are used by users and how. This in order for us to obtain a better understanding and insight in our users' behaviours and patterns, to allow us to develop and improve our business, including the travel platform, for the benefit of our customers and you as a user.

We do not carry out any profiling activities in relation to your personal data for this purpose, since analyses are made on an aggregated level. We are not interested in your specific behaviour, but instead our users' behaviours on an aggregated level.

Categories of personal data

Travel and logistics dataIdentity dataOrganisational dataAccount details

Legal basis

Storage period / External recipients

Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice.

Contact persons of suppliers and partners

Manage the relationship with suppliers and partners

What we do: We process your personal data to manage our business relationship with the company or organisation that you work for or represent, for example to register you as a contact person, manage invoices and to communicate with you.

We also process your personal data where necessary to register orders for products and services, respond to requests for proposals (RFPs) and communicate with you for the same purpose.

Categories of personal data

Communication dataContact informationIdentity dataOrganisational data

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of managing the business relationship with our suppliers and partners.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since we otherwise would not be able to manage the relationship with the company or organisation that you represent.

Storage period / External recipients

Personal data is stored for this purpose as long as there is an active business relationship with the company or organisation that you work for or represent.

External recipients: Group companies

Follow up and evaluate the supplier and partner relationship

What we do: We process your personal data to evaluate the relationship with the company or organisation that you work for or represent, for example by generating statistics on orders of our services. This to better understand how the relationship is working between us and the relevant supplier or partner.

Categories of personal data

Communication dataContact informationIdentity dataOrganisational data

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of following up and evaluating the supplier or partner relationship.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since reports and statistics only are saved on an aggregated level and that the information therefore cannot be related to you.

Storage period / External recipients

Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice.

All individuals above and other external persons

Respond to questions and provide customer service

What we do: We process your personal data to respond to questions when you contact us to provide customer service, for example if you have questions about our business and services in your role as a contact person of a customer, supplier or partner to us.

Categories of personal data

All personal that you provide to us and is necessary to assist you in the matter.

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of responding to questions and to provide customer service.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially when you yourself have reached out to us.

Storage period / External recipients

Personal data is stored for this purpose as long as necessary to respond to and manage the matter.

External recipients: Group companies

Recordings of phone calls for safety, quality and training purposes

What we do: If you contact our travel support, we may record the conversation with you for safety and quality purposes, for example to ensure that we provide accurate information, handle your request correctly, and maintain a high level of customer service.

The recordings may also be used for internal training of our staff, for example where we review conversations to identify areas for improvement, enhance service quality, and ensure consistent handling of customer requests.

You will be informed in advance that the call may be recorded before any recording takes place. If you do not wish to be recorded, we ask you to contact us through other means than phone, for example via e-mail.

Categories of personal data

All personal data that you provide to us during the travel support conversation and that is recorded.

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest in ensuring service quality, improving our customer support, and providing training to our staff.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially as you are informed in advance, the recordings are used in a controlled manner, and retained for a limited period.

Storage period / External recipients

Personal data in recordings is stored for this purpose for a period of twelve (12) months from when the recording was made.

External recipients: Group companies

Carry out meetings, events and similar activities

What we do: We process your personal data to carry out meetings, events and similar activities, for example to register your participation, carry out the activity and to communicate with you about the activity.

Categories of personal data

Picture, video and audio materialCommunication dataContact informationIdentity dataOrganisational dataEvent data

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The use of your personal data is necessary to satisfy our legitimate interest of carrying out meetings, events and similar activities.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially if you have voluntarily signed up for or participates in the activity.

Storage period / External recipients

Personal data is stored for this purpose during the period the meeting, event or activity is carried out.

External recipients: Partners, Group companies

Follow up and evaluate activities carried out

What we do: If you have participated in an activity that we have carried out, for example a meeting, a demo, or an event, we process your personal data to follow up and evaluate the activity, for example to compile statistics of the number of participants and to plan for future activities.

Categories of personal data

Picture, video and audio materialCommunication dataContact informationIdentity dataOrganisational data

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of following up and evaluating activities carried out.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since it concerns harmless personal data.

Storage period / External recipients

Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice.

Document the business

What we do: We process your personal data to document the business and activities relating to our business, for example in connection with company milestones, events, including personal data in legal documents and other material which we deem are of interest for the business to keep.

Categories of personal data

Relevant categories of personal data as are necessary for the purpose.

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of documenting the business.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose.

Storage period / External recipients

Personal data is stored for this purpose until further notice.

External recipients: Group companies

Develop and improve the business

What we do: We process your personal data to develop and improve the business, including our services and products. By way of example, this includes to draft reports, analyses and compile statistics of various activities and events (such as sales, results and partnerships).

Categories of personal data

Relevant categories of personal data as are necessary for the purpose.

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of developing and improving the business.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose.

Storage period / External recipients

Reports and results on an aggregated level which do not contain any personal data, including statistics, are stored until further notice.

Manage sales and restructuring of all or parts of the business

What we do: If all or parts of the business would be sold, or in any other way transferred or restructured, we process your personal data where necessary for this purpose. Should the business be transferred to a buyer, your personal data would also be transferred and disclosed to the buyer. The buying company would in such case be responsible (data controller) for your personal data and the processing that takes place for the same purposes as stated in this privacy notice, unless you receive any other information in connection with the sale.

Categories of personal data

Relevant categories of personal data as are necessary to manage the sale or restructuring of all or parts of the business in each case.

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of managing a sale or restructuring of all or parts of the business.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose if the buyer carries out the same or similar type of business that we do.

Storage period / External recipients

Personal data is stored for this purpose for the period that is necessary to manage the sale or the restructuring.

External recipients: Buyers/investors, Potential buyers/investors, External advisors, Group companies, Public authorities

Manage, defend and exercise legal claims

What we do: We process your personal data where necessary to manage, defend and exercise legal claims in an individual case, for example in connection with a dispute or a court proceeding.

Categories of personal data

Relevant categories of personal data needed for managing and defending a legal claim in the individual case.

Legal basis

Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of managing, defending and exercising legal claims.

It is our assessment that our legitimate interest clearly outweighs your interest of not having your personal data processed for this purpose.

Storage period / External recipients

Personal data is stored for this purpose for the period as necessary to manage, defend and/or exercise the legal claims.

External recipients: Counterparty, Courts, Debt collecting companies, External advisors, Insurance companies, Relevant authorities

Fulfil our legal obligations

What we do: We process your personal data where necessary to fulfil our legal obligations, for example accounting obligations and obligations under applicable data protection laws.

Categories of personal data

Relevant categories of personal data that are necessary to fulfil the specific legal obligation.

Legal basis

Fulfil legal obligation (Article 6.1 (c) of the GDPR). The use of your personal data is necessary to fulfil our legal obligations.

Storage period / External recipients

Personal data is stored for such period that is necessary in order for us to fulfil the specific legal obligation. By way of example, personal data in accounting material is stored for seven (7) years calculated from the end of the calendar year when the relevant fiscal year ended according to the Swedish Accounting Act (1999:1048).

External recipients: Relevant authorities

Ensure technical functionality and security in our IT systems

What we do: We process your personal data to ensure necessary technical functionality and security in our IT systems, for example in connection with backups, access controls and troubleshooting.

Categories of personal data

All categories of personal data that are stated in relation to the purposes of processing your personal data.

Legal basis

Legitimate interest (Article 6.1 f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of ensuring technical functionality and security of our IT systems.

It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose.

Storage period / External recipients

Personal data is stored for the same period as stated in relation to each relevant purpose of the processing.

Respond to legal requests

What we do: We process your personal data to respond to legal requests from authorities, for example law enforcement, tax authorities or any other authorities.

Categories of personal data

All categories of personal data as necessary to respond to and evaluate the request in each case.

Legal basis

Fulfil legal obligation (Article 6.1 (c) of the GDPR). The processing of your personal data is necessary to fulfil our legal obligations.

Legitimate interest (Article 6.1 f) of the GDPR). If there is no explicit legal obligation requiring that we respond to the legal request, but we consider that we and the public authority have a legitimate interest (which outweighs your privacy interest), we rely on this legitimate interest for the use of your personal data for this purpose.

Storage period / External recipients

Personal data is stored for this purpose for the period that is necessary to respond to the specific legal request and thereafter for the period as necessary to document the request and our response to the request.

External recipients: Relevant authorities