Friends of ESS
When you are a Friend of ESS we at ESS Hotel Group AB (”ESS”, “we”, ”our” and ”us”) process your personal data to:
- administer your membership;
- simplify your booking, visit and/or purchase by storing information about your visits and preferences; and
- send offers to you as a member through marketing communication based on information we have about you.
You can choose to unsubscribe from our newsletters at any time. In that case we will store your information in an “unsubscribe-list”.
Here you can find all our privacy policies which describe how we process personal data in other situations, e.g. if you visit our website, stay with us or otherwise are in contact with us.
Below you can read more about:
Which company is responsible for the processing of your personal data?
Detailed description on how we process your personal data
Who can gain access to your personal data and why?
Where are your personal data processed?
Which company is responsible for the processing of your personal data?
ESS Hotel Group AB (Swedish registration number 556710-8047), is responsible for the processing of your personal data when you are a Friend of ESS.
If you wish to know more on how personal data is shared within our corporate group, you can find more information here.
Please contact us via our e-mail address privacy@essgroup.se, or give us a call on +46 775-553 553 if you have any questions regarding our processing of your personal data or if you wish to exercise any of your rights. Our postal address is ESS Hotel Group AB, VDrakegatan 10, 412 50 Gothenburg, Sweden.
Detailed description on how we process your personal data
We collect your personal data directly from you when you create your membership. If you use your national identification number to autofill your information, we will gather such information from a third party service.
To provide your membership to you
What processing we perform
What personal data we process
Our lawful basis for the processing
- Administrate your membership, e.g. store your contact details
- Communicate with you regarding your membership, e.g. send updated information about the terms for membership and send you any updates to this privacy policy
- Name
- Home address
- E-mail address
- Phone number (membership number)
- Birthdate
Performance of contract
The processing is necessary for us to fulfil the contract concerning your membership in Friends of ESS.
If you don’t provide such personal data to us, you cannot be a member.
- Enable you to securely identify yourself as a member
If you choose to sign up using your national identification number:
- Enable you to autofill your personal data when you sign up as a member, i.e. provide a faster way to sign up as a member
- Provide your national identification number to the service provider which gives us information to conclude your membership
- Phone number
- National identification number (if you choose to provide it when signing up. We will store your national identification number encrypted)
Performance of contract
The processing is necessary for us to fulfil the contract concerning your membership in Friends of ESS.
If you don’t provide your phone number to us, you cannot be a member.
Legitimate interest
Your national identification number is processed based on our legitimate interest to provide a faster way to sign up as a member.
You are free to choose if you want to provide your national identification number to us.
Storage period: We process your personal data and send you e-mails/sms for as long as you are a Friend of ESS. If you have been passive for three years we will check if you want to continue being a Friend of ESS and end the membership if you wish us to do so.
We stop sending these types of e-mails/sms if your membership ends or if you object to receiving such marketing. In such case we will continue to store your personal data to comply with marketing legislation as stated below.
Any national identification number will be encrypted after you have signed up as a member.
To simplify your bookings and purchases and provide you with the Friend of ESS-experience when you visit us
What processing we perform
What personal data we process
Our lawful basis for the processing
- To enable you to view information about your present and previous bookings, purchases and stays
- Store information about your preferences, to provide a Friends of ESS-experience when you visit us
- Information about bookings and previous visits
- Information regarding your preferences
Performance of contract
The processing is necessary for us to fulfil the contract concerning your membership in Friends of ESS, i.e. simplify your bookings, purchases and visits as a membership benefit as well as to provide you with the promised Friends of ESS-experience.
If you don’t provide the personal data to us, we cannot simplify your bookings, purchases and/or visits and provide you with a Friends of ESS-experience.
Storage period: We process your personal data for as long as you are a Friend of ESS.
To send relevant offers to you as a member through marketing communication
What processing we perform
What personal data we process
Our lawful basis for the processing
- Send newsletters/sms containing offers and information relevant to you based on information we have about your previous bookings/purchases/stays (so called profiling*)
After a stay you receive information from ESS Home about how to buy interior design found at the destination
We only send you newsletters/sms if you not previously have objected to receiving them
– Via display marketing show you offers and information relevant to you based on information we have about your previous bookings/purchases/stays (so called profiling*).
We only show you display marketing if you not previously have objected to receiving it
- Name
- E-mail address
- Phone number
- Information from your previous bookings, purchases and/or stays
- Information about the hotels you want to receive information and updates about
Performance of contract
The processing is necessary for us to fulfil the contract concerning your membership in Friends of ESS. If you don’t provide the personal data to us, we cannot provide you with relevant offers.
You will receive information which we believe you are interested in based on the information we have about you. We clearly inform about this when you choose to become a member.
- Improve and develop our newsletters by analysing how you open them and what you click on in the newsletters
Do you want to read more about this type of analyse? You find a more detailed description of this in our information about cookies.
- Information about how you open our newsletters and what you click on
- IP-address
- E-mail address
Consent
The personal data will be processed based on your consent. You can withdraw such consent at any time.
If you sign up using your national identification number:
- Gather information about your gender and birthday to customize the offers, invitations and news you receive from us
- Use information about your birthday to be able to celebrate it
- National identification number, which gives us information about your gender and birthday
Legitimate interest
Our legitimate interest to process your birth date to be able to celebrate your birthday by sending offers and/or gifts on that day as well as to customize marketing based on your gender.
You are free to choose if you want to provide your national identification number to us.
Storage period: You can choose to unsubscribe to newsletters/sms/display at any time. If you object to receiving marketing from us, we keep track of this in our “unsubscribe-list” to avoid sending you any further marketing material.
Any national identification number will be encrypted after you have signed up as a member, but information about your gender and birthday is stored for as long as you are a Friend of ESS.
* Profiling: We use so called profiling to be able to show you offers that are relevant to you and to provide you with customized marketing. We use profiling because without it, you would instead receive offers and information which you probably not are interested in. You have the right to object to profiling as described below under the section explaining your rights.
If you object to receiving marketing from us
We will store information about you who have chosen to object to receiving marketing communication from us.
To comply with marketing legislation
What processing we perform
What personal data we process
Our lawful basis for the processing
- If you have stated that you do not wish to receive marketing communication from us we will store such information in a “unsubscribe-list” to make sure we do not send any marketing to you
- Name
- E-mail address
- Phone number
Legal obligation
The processing is necessary to comply with legal obligations to which we are subject, i.e. marketing law which require us to not send marketing material to individuals who have objected to receiving such marketing.
We cannot make sure you will not receive marketing from us without processing your personal data for this purpose and you are therefore required to provide your personal data to us.
Storage period: You will be listed in our “unsubscribe-list” until further notice.
Who can gain access to your personal data and why?
Your personal data is initially collected and processed by us as controllers and we do not sell your personal data. This means that your personal data will be handled by our employees, but only personnel who need such access to conduct their work.
We also use processors that carry out processing on our behalf to conduct our business, such as suppliers and partners which therefore will process your personal data. We are responsible for any sharing of your personal data to such suppliers or partners and to make sure your personal data is safe when shared with third parties as set out below. We only use processors providing sufficient guarantees that the processing will meet all legal requirements and ensure the protection of the rights of the data subject.
We will share your personal data with the following recipients:
- We will share your personal data with our IT suppliers who will process these on our behalf and on our instructions to ensure good and secure IT operations. We only share your personal data with our IT suppliers if it is necessary for them to fulfil their obligations towards us according to the contract that we have with them.
- The company which provides a service to faster fill in your information when you become a member by using your national identification number will get access to your national identification number and provides us with other information about you.
- – When you receive our marketing communication we will share your personal data with the company which provide the marketing services we use.
- To handle your membership in the most efficient way we share your personal data within the company group.
Where are your personal data processed?
As a main rule we only process your personal data in the EU/EEA and choose suppliers based within the EU/EEA. The use of our suppliers will however in some instances mean that your personal data is transferred outside of the EU/EEA.
We only transfer your personal data outside of the EU/EEA if we can make the transfer according to the data protection rules. This means that the transfer either is governed by an adequacy decision or that we rely on Standard Contractual Clauses and supplementary measures to provide a safe transfer of your personal data.
If you want to know more about who we share your personal data with, please feel free to contact us. Our contact information can be found at the beginning of this privacy policy.
What are your rights when we process your personal data?
You have certain rights that you can exercise to affect how we process your personal data. You can read about what those rights are below. Contact us if you want to exercise any of your rights.
- Right to lodge a complaint with a supervisory authority
You always have the right to lodge a complaint with a supervisory authority. You may do this in the EU/EEA member state where you live, work or where an infringement of applicable data protection laws is alleged to have occurred.- The supervisory authority in Sweden is the Swedish Data Protection Authority (Integritetsskyddsmyndigheten, the IMY).
- The supervisory authority in Denmark is the Danish Data Protection Agency (Datatilsynet).
- The supervisory authority in Norway is the Norwegian Data Protection Authority (Datatilsynet).
- Right to withdraw your consent and object to processing
You have a right to withdraw any consent you have given us, partly or completely.For example you always have a right to withdraw your consent and object to our processing of your personal data when the processing is performed for marketing purposes, such as display marketing/newsletters/SMS.
- Right to information and access
You have the right to obtain confirmation as to whether we are processing personal data about you or not. If we do process your personal data, you also have a right to obtain a copy of the personal data processed by us as well as information about how we process your personal data.
- Right to rectification
You have a right to correct any inaccurate personal data concerning you that we may be processing and to ask us to have incomplete personal data completed.
- Right to erasure (“the right to be forgotten”) and restriction of processing
You have a right to request that we delete your personal data. We will delete the personal data for example if you have withdrawn your consent and there is no other lawful basis for processing.You also have a right to request that we restrict our processing of your personal data. We will do so for example when the accuracy of the personal data is contested by you, or the processing is unlawful, and you do not want us to delete your personal data but instead you request that we restrict our use of them.
- Right to data portability
Under certain circumstances, you have a right to receive your personal data from us in a structured, commonly used and machine-readable format and, where technically feasible, have your personal data transferred to another company (“data portability”). This applies to personal data that you have provided to us in a structured, commonly used and machine-readable format, if our processing of your personal data is carried out by automated means and the lawful basis for our processing is based on the performance of a contract or consent.
Balancing of interests assessments when processing personal data based on the lawful basis “legitimate interests”
As we state above, for some purposes, we process your personal data based on our “legitimate interest”. By carrying out a balancing of interests assessment concerning our processing of your personal data, we have concluded that our legitimate interest for the processing outweighs your interests or rights which require the protection of your personal data.
If you want more information in relation to our balancing of interests assessments, please do not hesitate to contact us.
This policy was adopted on 2022-06-21.
Last updated 2023-04-18.
