Privacy policy

At Venga Travel, we take the protection of personal data seriously.

We organise academic study trips, group trips, Erasmus+ stays and international educational programmes for schools and educational institutions.

In order to plan and carry out our trips, we process various personal data about our customers, contact persons and trip participants.

In this privacy policy, we explain what data we process, why we process it, who we may share it with, and what rights you have.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Danish data protection legislation.

The data controller for the processing of your personal data is, as a general rule:

Venga Travel Danmark ApS
CVR no.: 34898510
Address: Vissemosevej 10, 4673 Rødvig
Email: jesper@venga.dk
Phone: +34 603 759 349

For trips and activities where other companies take part in the delivery, responsibility for the processing of personal data may be divided between several parties.

This applies, for example, to cooperation with foreign partners, schools and suppliers. The specific allocation of responsibility depends on who determines the purposes and means of the processing.

We only collect and process personal data that is relevant and necessary for the specific purposes.

Depending on the content of the trip, the data may include:

Such data is processed only when there is a valid legal basis for the processing, including a relevant basis under Article 9 GDPR, and when the data is necessary for the specific purpose.

We restrict access to the data and share it only with relevant recipients.

We process personal data for the following purposes:

Depending on the purpose, our processing of ordinary personal data takes place on the following legal bases:

• Article 6(1)(b) GDPR: Where the processing is necessary for the performance of a contract with the data subject or in order to take steps prior to entering into a contract.
• Article 6(1)(c) GDPR: Where the processing is necessary for compliance with a legal obligation.
• Article 6(1)(f) GDPR: Where the processing is necessary for the purposes of a legitimate interest, and this is not overridden by the rights of the data subject.
• Article 6(1)(a) GDPR: Where the processing is based on valid consent.

When processing sensitive personal data, we additionally rely on a relevant basis under Article 9 GDPR.

The specific legal basis depends on the purpose of the processing, the contractual relationship and the data concerned.

When we receive data from a school, the school may be an independent data controller for its collection and disclosure of the data. Venga Travel's role is assessed separately for the processing operations we carry out.

Venga Travel offers a digital travel portal where the school's contact persons can follow the planning and manage practical matters relating to the trip.

Among other things, the portal can be used for:

• Communication between the school and Venga Travel
• Collection and management of participant data
• Planning of room allocation
• Access to travel programmes and practical information
• Coordination of activities and travel services

Data in the travel portal is processed for the purpose of managing and carrying out the trip in question.

Access to personal data is restricted according to the users' roles and relevant work tasks.

In order to carry out a trip, it may be necessary to share relevant personal data with our partners.

These may, for example, be:

• Airlines, coach companies and train operators
• Hotels, hostels and other accommodation providers
• Local activity providers and guides
• Language schools and educational institutions
• Companies and organisations offering work placements
• Insurance companies and assistance providers
• IT and system suppliers
• Public authorities, where required by law

We share only the data that is necessary for the service in question or for another lawful purpose.

Some recipients process data as independent data controllers, while others process data on our behalf as data processors.

Where a supplier acts as a data processor, we ensure that a relevant data processing agreement is in place.

Venga Travel also organises trips to destinations outside the EU/EEA.

In connection with such trips, it may be necessary to disclose personal data to, for example, hotels, carriers, educational institutions or local partners.

Where the transfer is covered by the GDPR rules on transfers to third countries, we ensure that a valid transfer basis is in place.

This may, for example, be a relevant adequacy decision from the European Commission, approved standard contractual clauses with the necessary supplementary measures, or a specifically applicable derogation under Article 49 GDPR.

We do not retain personal data for longer than necessary for the purposes for which it was collected, unless the law requires longer retention.

The retention period depends on, among other things:

• Whether the data is necessary for an upcoming or ongoing trip
• Whether the data is necessary for subsequent documentation
• Whether the data is subject to statutory retention requirements
• Whether the data is necessary to handle a specific dispute or legal claim

Data is deleted or anonymised when there is no longer a lawful need to retain it.

All data is deleted after the trip has been completed and evaluated.

We use appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, alteration and unlawful disclosure.

Among other things, we work with access restrictions, confidentiality and secure handling of data.

The security measures are adapted to the nature of the data and the risks associated with the processing.

Under data protection legislation, you have a number of rights, including:

• The right of access to the personal data we process about you
• The right to have inaccurate data rectified
• The right, in certain cases, to have data erased
• The right, in certain cases, to have the processing restricted
• The right to object to certain processing
• The right to data portability, where the conditions are met
• The right to withdraw consent, where the processing is based on consent

The rights apply subject to the limitations and conditions laid down by law.

If you wish to exercise your rights, you can contact us using the contact details in section 2.

You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) via www.datatilsynet.dk.

Our website may use cookies and similar technologies for technical functionality, statistics and, where applicable, marketing.

We provide separate information about the specific technologies, their purposes, providers and retention periods in our cookie policy.

Where the law requires consent, we obtain it before the technologies are used.

You can change or withdraw your cookie consent at any time via the website's cookie settings.

We may update this privacy policy when necessary as a result of changes in our processing of personal data, our services or applicable legislation.

The latest version will be available on our website, stating the date of the update.

If you have any questions about our processing of personal data or wish to exercise your rights, you are welcome to contact:

Venga Travel Danmark ApS
Email: Jesper@venga.dk
Phone: +34 603 759 349