PRIVACY POLICY FOR SVENSKA MÄSSAN GOTHIA TOWERS

Svenska Mässan Gothia Towers AB, corporate identity no. 559080-8290, is responsible for the processing of your personal data. For us, it is natural to protect your privacy and safeguard your personal data in accordance with applicable law and industry regulations.

We at the Swedish Exhibition & Congress Centre Group and Gothia Towers want you to feel secure when we process your personal data. We process the information you provide to us in a responsible manner – regardless of whether you visit us to attend meetings, for dining and accommodation, to develop business opportunities, products and ideas, or when you contact us for any other reason.

In our Privacy Policy, you can read about how we process your personal data in different situations. We want to be clear about how we process your personal data; this is why our Privacy Policy contains a lot of information. Do not hesitate to contact us if you have any questions or want to exercise your rights. You will find our contact details below. You can use our summary here in the introduction and the table of contents below to click your way to the part of the text that is relevant to you.

Summary – why do we process your personal data?

You have the following rights: right to withdraw your consent, right of access, right to object, right to erasure, right to rectification, right to restrict processing of personal data, right to data portability and right to lodge a complaint with the Swedish Authority for Privacy Protection.

When we write “your organisation” in this Privacy Policy, we mean the company or other organisation that you represent when you contact us. The term “professional capacity” refers to all visitors at industry/specialist events, industry/specialist visitors at public events, and elected representatives.

Contents:

How can you contact us?

If you have questions about our processing of your personal data, or if you want to exercise any of your rights as set out below, do not hesitate to contact us. Our contact details:

  • Svenska Mässan Gothia Towers AB, SE-412 94 Gothenburg, Sweden
  • Email us via [email protected]
  • Contact us via form

Do you have to provide us with your personal data?

In order to visit us, make purchases, bookings, register and take part in exhibitions, seminars or conferences (“events”), you must provide us with certain personal data. The mandatory personal data is specified on the registration form when you make your booking, registration or purchase. If you do not provide the mandatory data, you will not be able to complete your booking, registration, purchase, etc.

We are required by law to collect certain data about you, e.g. when you check in to Upper House or Gothia Towers or when you unsubscribe to our marketing emails. You can read more about this in the tables below.

Where do we get your personal data from?

We get your personal data from you, e.g. when you purchase a ticket or when you contact us. In the following cases, we also get your personal data from other parties:

  • If someone else buys a ticket for you or registers you for an event, for instance, we get your personal data from the person who provides your data to us, e.g. your employer.
  • If you use our website or our digital services (e.g. Exhibitor Service Online), your personal data are collected from your device (e.g. your mobile phone, computer or tablet) when you use our website or digital services.
  • If you visit Upper House or Gothia Towers, we get your personal data from D&B Sverige personal address register (only applies to individuals over 18 years old), which gives us accurate information about you for the check-in.
  • We may also buy your personal data from public sources to market ourselves to you in your professional capacity.

Detailed information of how we process personal data

Do you want to know more about how we process your personal data? Below, you can read more about:

  • Why we process your personal data
  • What personal data we process about you
  • Our legal basis for processing your personal data in compliance with the General Data Protection Regulation (“GDPR”)
  • How long we process your personal data for
  • Whether it is mandatory for you to provide your personal data to us

Purchases, bookings, registration and visits

To manage purchases, bookings registration and your visit to us

If you make a purchase, a registration/booking, or visit us
Purpose:

  • To manage your purchase, booking or event registration, and to manage your visit to us, e.g. give you access to the event you want to take part in and complete the purchase.
  • To communicate relevant information to you. The information provided to you depends on the purpose of your visit to us. For example, we might need to send you booking confirmation, send you a seminar pass, inform you about updates to our terms and conditions or our privacy policy, or provide you with similar important information.
Personal data:

  • Information from registration/booking/purchase, your first and second name and contact details.
  • Payment information.
  • If you visit Upper House or Gothia Towers, we also need to process information about what country you are from, about your credit card number (to enable us to take payment for any additional expenses or for damage) and your national identity number (for safety reasons in the event of evacuation). This data is deleted after your visit.
  • If another person books your accommodation for you, that person registers this personal data about you.
 Retention time:

Personal data are retained during the time you carry out your purchase, and after that for the purposes stated in the table below, e.g. for accounting purposes.

Information about your payment will be retained for longer in order for us to comply with legislation regarding accounting.

If you have chosen to interact with exhibitors or other parties at an event you take part in, they may subsequently process your personal data as independent data controllers.
Legal basis:

  • If you visit us in a private capacity and book your visit yourself, it is necessary for us to process your data to perform our contract with you (Article 6.1.b of GDPR). However, if another person books your visit, we process your data on the basis of our legitimate interest in being able to administer our contract with the person who booked the visit on your behalf (legitimate interest under Article 6.1.f of GDPR).
  • If you visit us in a professional capacity and your organisation made the booking, processing is necessary on the basis of our legitimate interest in being able to process data about you in order to execute your participation and communicate with you as a contact for your organisation (legitimate interest under Article 6.1.f of GDPR).
To optimise your experience when you visit us

If you are going to visit us
Purpose:

  • To meet any dietary preferences or other requests stated by you in connection with your booking/registration.
  • To enable you to efficiently use parking space you have booked in our car park.
  • If you visit Upper House or Gothia Towers, we also process your personal data to check you in faster and with accurate information.
Personal data:

  • Information from your booking/registration.
  • Other information that you provide to us, e.g. messages you send prior to your stay at Upper House/Gothia Towers or requests you send to us, which may contain information about allergies, medical conditions or other information you choose to provide.
  • Your car registration number, if you have booked space in our car park and want to be granted entry immediately.
  • If you visit Upper House or Gothia Towers, accurate data about you that we obtain from the Swedish state personal address register (SPAR) and use for check-in.
 Retention time:
The data we get from the Swedish state personal address register (SPAR) are only retained during your hotel visit. Other personal data are erased regularly.
Legal basis:

  • If you visit us in a private capacity or communicate your personal preferences to us, processing is necessary in order for us to meet your requirements, i.e. to perform our contract with you (Article 6.1.b of GDPR).
  • If your employer or another person handles your booking/registration, we process your data on the basis of our legitimate interest in being able to administer our contract with the person we are in communication with (legitimate interest under Article 6.1.f of GDPR).
  • If you send sensitive personal information in messages to us, e.g. information about allergies or medical conditions, we process these personal data on the basis of your consent (Article 6.1.a and Article 9.2.a of GDPR).
  • If you stay at Upper House or Gothia Towers, we obtain accurate data from the Swedish state personal address register (SPAR), and the passport number of foreign guests is entered on the booking card on the basis of our legitimate interest in checking you in faster and with accurate information (legitimate interest under Article 6.1.f of GDPR).

 

To comply with legislation regarding accounting

If you appear in financial documentation
Purpose: To comply with legislation regarding accounting.
Personal data:

  • Your name, contact details and any other information included in accounting material (e.g. contracts, verifications).
  • Historic payments, transactions and other accounting material.
 Retention time:
We retain personal data in accounting material up to and including the seventh year after the end of the calendar year during which the accounting year ended.
Legal basis:
The processing is necessary to comply with the Book-keeping Act, i.e. to comply with a legal obligation (Article 6.1.c of GDPR). We suggest that you avoid unnecessarily including personal data in invoices and other accounting material. If your personal data needs to be included in certain documentation, you must provide us with your data to enable us to fulfil our legal obligations or to meet our interests or the interests of your organisation.
To publish images, videos and audio material from our events (marketing)

If you visit an event
Purpose:

  • To take photographs and videos during our events, which means you may be visible in pictures and videos or be heard in audio recordings during your visit, e.g. in pictures providing a general overview of the event, or of visitors mingling.
    However, we never take pictures that focus on you as a separate individual, unless you have given your prior consent.
  • Subject to your prior consent, use images, videos and audio material to provide information about our activities on our website, in printed material and in social media.
    We will inform you clearly before and during our events if we plan to take any pictures, videos and/or audio recordings. We never want you to be surprised about this happening. Do not hesitate to contact us if you have any questions or concerns about our images, videos and audio recordings
Personal data:
Images, videos and audio recordings in which you, as a visitor, may appear. 		Retention time:
The material will be deleted if you request for it to be removed, withdraw your consent or otherwise object to the processing of the data. If you have consented to the taking of pictures, videos or audio recordings, such material will be used for a maximum of five years.
Legal basis:

  • The use of overview pictures is necessary to meet our legitimate interest in providing information about our activities and marketing our business (legitimate interest under Article 6.1.f of GDPR). Do not hesitate to contact us if you want us to remove images or audio material in which you appear.
  • Images, videos and/or audio recordings that focus on you are processed on the basis of your consent (Article 6.1.a of GDPR). We may also choose to request your consent in accordance with GDPR in other contexts where we deem this suitable, depending on the situation.
  • We will always inform you if we plan to take pictures, videos or audio recordings, and request your consent in accordance with the Act on Names and Images in Advertising.

 

Marketing and surveys

To send you offers and other marketing content, if you have consented to this

If you have given your consent when registering for an event or in another place
Purpose:

  • To send newsletters and targeted marketing content about relevant offers related to the event you are attending, information about similar events, and other communications that we deem of relevance to you.
  • To send evaluations following your purchase, your booking/registration or your visit, in order for us to improve our service and offering. If you take part in a survey, we will process your responses as described below. We do not request personal data for questionnaire surveys carried out on site.

We analyse how you open and use our newsletters as described below..

Personal data:

  • Your name
  • Contact details
  • Information about what event you have registered for
 Retention time:
You will receive our mailings until the next similar event. This means you will receive mailings for two to four years after the event, depending on when the next similar event takes place. After that, you will receive an email where you have the option to consent to receiving further mailings.

You can unsubscribe from our mailings or object to marketing at any time, in which case we will retain your personal data as described in the table below.

Legal basis:
We process your personal data on the basis of your consent (Article 6.1.a of GDPR).

 

To send you marketing in your professional capacity

If we obtain your contact details from publicly available sources
Purpose:

  • To contact you by email and phone to inform you about our events that are deemed of relevance to you based on your professional capacity, e.g. because your company belongs to an exhibitor category relevant to our events, or to invite you to relevant seminars based on your professional capacity.
  • To send evaluations following your booking/registration or your visit, in order for us to improve our service and offering. If you take part in a survey, we will process your responses as described below. We do not request personal data for questionnaire surveys carried out on site.

We analyse how you open and use our newsletters as described below.

Personal data:

  • Your name
  • Email address and phone number
  • Information about your professional capacity or position that we have collected from external, publicly available sources or from third parties
  • If you visit us in your professional capacity, we also process information about the industry you operate in, your interests, your title, and information that you or your organisation provide (e.g. preferences regarding your booth)
 Retention time:
For four years.
You can unsubscribe from our mailings or object to marketing at any time, in which case we will retain your personal data as described in the table below..
Legal basis:
The processing is necessary on the basis of our legitimate interest in being able to send you marketing that we deem relevant to you, and send you emails about surveys that can give us feedback about your experience with us (legitimate interest under Article 6.1.f of GDPR).

 

To develop and improve our newsletters

If you receive our newsletters
Purpose:
To develop and improve our newsletters. We do this by using Lime/BizWizard, which analyses and compiles analyses of how recipients open and read our newsletters. The purpose is never to study your behaviour as an individual, but to obtain general information on which to base our decisions.
Personal data:

  • Email address
  • IP address
  • Information about how you open our newsletters and what you click on
 Retention time:
We analyse newsletters that we send to you for as long as you continue receiving them.
Legal basis:
The processing is necessary on the basis of our legitimate interest in developing and improving our newsletters and marketing (legitimate interest under Article 6.1.f of GDPR).

 

To comply with the Marketing Act

If you have unsubscribed to marketing
Purpose:
We retain your email address and phone number in an “unsubscribed contacts register” to ensure we do not send you marketing communications. We do not actively process such personal data. In other words, we do not look at your personal data or use them for any purpose other than to ensure you do not receive marketing from us.
Personal data:

  • Email address and/or phone number
  • Information that you no longer want to receive our newsletters
  • Time of unsubscribing
 Retention time:
Your email address will remain in our “unsubscribed contacts register” until you ask us to remove your email address from there.
Legal basis:
The processing is necessary for us to fulfil our obligations under the Marketing Act, in order to ensure that you do not receive mailings that you have requested not to receive, i.e. to comply with a legal obligation (Article 6.1.c of GDPR). You need to provide us with your personal data in order for us to ensure you stop receiving our mailings.

 

To improve our service and our offering

If you take part in one of our surveys
Purpose:
We process the personal data in order to collect and analyse the responses to surveys, so that we can improve our service and offering.
Personal data:
Information you provide in connection with the survey. The information we retain is anonymised. 		Retention time:
We always endeavour to anonymise your responses to prevent us from being able to see what you, as an individual, responded, or from being able to trace your responses back to you.
Legal basis:
The basis for the processing is our legitimate interest in being able to analyse and save the responses you provide in surveys (legitimate interest under Article 6.1.f of GDPR).

 

Website and digital services

To enable you to use our website and our digital services

If you use our website or digital services
Purpose:

  • To provide you with optimal service when you use our website and digital services, e.g. to enable you to register for events, log in as a member at our hotels, to remember your choices and settings, and to be able to use live-streamed seminars. In order for these to function, we need to process your personal data on our website and in our digital tools.
  • To maintain security, e.g. manage your password if you log in to Exhibitor Service Online, and identify you quickly and easily by scanning the bar code on your visitor badge, which contains your personal data.
  • If you scan your visitor badge or have chosen to post information about yourself on the digital platforms we offer, your personal data will be shared with exhibitors, sponsors, trade organisations, speakers or other parties participating in the event. You decide if you want to let someone scan your visitor badge, or to post information about yourself and thus provide information to third parties.

When you use our website, other personal data are also processed if you consent to this in our cookie banner. Read more about cookies here.
Personal data:

  • Your name
  • Information about your device, e.g. type of device, such as mobile phone, computer or tablet
  • Your password and user name in our services
  • Information you provide when you use our website and our digital services.
  • Information on your choices and settings
 Retention time:
We stop using the personal data collected using cookies to ensure the functionality of the website / digital service after 6 months.

If you choose to interact with exhibitors or other parties during the event, they may subsequently process your personal information as independent data controllers, e.g. if you choose for your badge to be scanned by exhibitors.

Legal basis:
The processing is necessary for us to perform our contact with you, e.g. for us to provide a well-functioning website/digital service and to enable you to use all the functions/services that we provide (Article 6.1.b of GDPR).

 

Communicating with you and managing questions, complaints

To communicate with you and manage various matters, such as complaints or other issues we need to discuss

If you contact us, or if we need to discuss something
Purpose:

  • To communicate with you and respond to your questions if you contact us, regardless of whether you contact us by email or social media. If you contact us via social media, we recommend that you also read the GDPR information provided by the social media platform you use
  • In the unlikely event that we have discussions, legal proceedings or claims in which you are involved, we will also need to process your personal data to process the case, e.g. to respond to your questions and manage any complaints or legal claims
Personal data:

  • Your name
  • Contact details, e.g. your email address and/or phone number
  • Information relevant to the case, e.g. regarding booking/registration and your visit
  • Your role and information about the company you represent
  • If you communicate with us on social media, we will also process information from your profile
  • Other information that you provide when we are in contact
 Retention time:
We regularly erase our communications with you if you are a customer, a representative of an organisation that is a customer, a supplier or a potential customer. Personal data processed for the purpose of responding to your questions and dealing with relevant matters are processed for as long as is needed to respond to the question and deal with the matter.

You can delete comments and communications on social media when you want to. We will delete posts and comments that violate the platform’s rules or law.

Legal basis:

  • The processing is necessary on the basis of our legitimate interest in being able to communicate with you and respond to your questions, as well as process complaints and defend ourselves or, if relevant, initiate legal proceedings (legitimate interest under Article 6.1.f of GDPR).
  • We are required by law to process your personal data in certain cases, e.g. if you exercise any of your rights under GDPR, or under consumer protection law. This means that certain processing of personal data is necessary to comply with a legal obligation (Article 6.1.c of GDPR). You may need to provide us with certain personal data in order for us to comply with our legal obligations.

 

Legitimate interest

For certain purposes, we process your personal data based on our legitimate interest. This means that by carrying out a balancing of interests, we have come to the conclusion that our legitimate interests in processing your personal data outweigh your interests and your fundamental right not to have your personal data processed. Our legitimate interests are described in the tables above.

Contact us if you want more detailed information about the balancing of interests that we have carried out.

Who gains access to your personal data?

As a general rule, your personal data are only processed by us at the Swedish Exhibition & Congress Centre. However, other companies and organisations that we collaborate with are made privy to your data if this is necessary in order for us to meet our obligations towards you as a visitor.
We share your personal data with IT providers, who only process personal data at our request to provide us with technical assistance, e.g. regarding the system we use to manage bookings/registrations, to scan tickets and for our hotel system. We have contracts in place to regulate how these IT providers are permitted to process your personal data at our instruction.
We also share your personal data as follows:

  • If you take part in an event organised by the Swedish Exhibition & Congress Centre in collaboration with Sweden MEETX AB, your personal data will be shared with Sweden MEETX AB in order for us to be able to organise and market the event.
    Sweden MEETX AB is part of the Swedish Exhibition & Congress Centre Foundation, as is the Swedish Exhibition & Congress Centre Group and Gothia Towers. When we organise events, we work together as joint data controllers for the processing of your personal data. If you have any questions about our processing of personal data, or if you want to exercise your rights, do not hesitate to contact us.
  • If you take part in an event that is jointly owned by the Swedish Exhibition and Congress Centre and another party, your personal data may also be processed by that party, in which case the party will also process your data in order to implement the event. This will be stated on each event’s website.
    For this type of event, we are joint data controllers for the processing of your personal data. If you have any questions about our processing of personal data, or if you want to exercise your rights, do not hesitate to contact us.
  • If you pay by invoice, we will share your personal data with the external party we use for processing invoice payments.
  • If you take part in one of our events, we will share your contact details with an external survey company, who will carry out the surveys according to our instructions. We share your contact details so that you can give feedback about your experiences.
  • If you have consented to it, we share your personal data with the partner involved in organising the event, so that our partner can send you relevant offers and marketing. You will be informed about this at the time when you register.
  • If you are visible in images/videos, or are audible in audio recordings from an event, the images, videos and audio recordings will be shared with exhibitors and partners if you have consented to this. Pictures providing a general overview of an event can be shared with exhibitors and partners without your consent, as well as published on our website, in printed material and in social media.
  • If you visit Upper House or Gothia Towers, we will collect your personal data from the Swedish state personal address register (SPAR), which provides us with accurate and up-to-date data about you. We do this because it is otherwise, in principle, impossible for us to handle so many guests checking in at the same time.
  • If you use a discount code when registering for an event, which you received from an exhibitor or a partner, we will share your contact details, e.g. your postal address, email address and mobile phone number, with the exhibitor or partner that gave you the discount code. We share these details to enable us to settle the payment with the exhibitor/partner.
  • If you receive emails from us, your personal data will be processed by Lime/BizWizard. We use the Lime/BizWizard service to enable us to send you newsletters safely and efficiently. Lime/BizWizard acts as our data processor, and thus only processes your personal data according to our instructions and at our request.

Do we share your personal data outside the EU/EEA?

As a general rule, the Swedish Exhibition and Congress Centre processes your information within the EU/EEA. However, in certain cases we may use providers outside the EU/EEA. We only transfer personal data outside the EU/EEA if we have a legal basis for doing so in accordance with GDPR.

  • When your personal data are transferred outside the EU/EEA to the US, this is done on the basis of an adequacy decision from the European Commission according to Article 4 of GDPR. This means that the EU deems a certain country to provide an adequate level of protection of your personal data. As a result of this, the EU and the US have entered into an agreement called the EU-US Data Privacy Framework.
  • With regard to recipients who are not certified according to the EU-US Data Privacy Framework, we may transfer your personal data outside the EU/EEA based on standardised data protection regulations adopted by the European Commission. We can also transfer your personal data to countries deemed by the European Commission to provide an adequate level of protection of personal data.

We have minimised the information that the external parties gain access to, and have taken several measures to reduce the risk of your personal data being transferred outside the EU/EEA. This is to make it as difficult as possible for parties outside the EU/EEA to interpret your personal data.

Please contact us if you would like detailed information about transfer outside the EU/EEA.

What are your rights to influence how we process your personal data?

You have certain rights in accordance with GDPR – see more information below.
If you have any questions about your rights or want to exercise any of your rights, do not hesitate to contact us using the contact details. above. The Swedish Authority for Privacy Protection also has more detailed information about when your rights apply and what exceptions exist. Swedish Authority for Privacy Protection also has more detailed information about when your rights apply and what exceptions exist.

  • Right to lodge a complaint – Article 77 of GDPR: You have a right to lodge a complaint with a competent supervisory authority if you believe your personal data has been processed in violation of GDPR. The competent authority in Sweden is the Swedish Authority for Privacy Protection.
  • Right to withdraw consent – Article 7.3 of GDPR:You have the right to withdraw your consent at any time by contacting us.
  • Right of access (”right to a copy of the information held about you”) – Article 15 of GDPR: You have the right to obtain confirmation as to whether or not we are processing your personal data. You can request this by contacting us. If we process your personal data, you also have a right to receive a copy of the personal data we hold about you and information about their processing, e.g the purpose of the processing and how long the data will be retained.
  • Right to object – Article 21 of GDPR: You have the right to object at any time to your personal data being processed for direct marketing (including profiling), and to processing of your data based on a legitimate interest (including profiling).
  • Right to rectification – Article 16 of GDPR:You have the right to have inaccurate personal data about you rectified without undue delay. You also have the right to have incomplete data completed.
  • Right to erasure (”right to be forgotten”) – Article 17 of GDPR: Under certain circumstances, you have the right to have your personal data erased by us without undue delay. This applies, for instance, if you withdraw your consent and there is no other legal basis for processing, or if your personal data are no longer necessary for the purpose they were collected or processed for.
  • Right to restrict processing – – Article 18 of GDPR: Under certain circumstances, you have the right to require that we restrict our processing of your personal data. This applies, for instance, if you contest the accuracy of the personal data, or if your data have been unlawfully processed and you oppose erasure and request restriction instead.
  • Right to data portability – Article 20 of GDPR: If we process your personal data on the basis of your consent or to perform a contract, you have the right to receive a copy of the personal data that regards you. You have a right to receive the data you have provided to us in a structured, commonly used and machine readable format. You also have the right to have these personal data transmitted to another controller, where technically possible.

    • This Privacy Policy was adopted by Svenska Mässan Gothia Towers AB on 30 March 2025.