Privacy Policy

Smooth Pirates AB, trading as Smooth Aurora Travels, is the data controller for the personal data described here.

• Company: Smooth Pirates AB
• Registration number: 559382-1225
• VAT number: SE559382122501
• Registered address: Smooth Pirates AB, Siklöjevägen 11, 135 31 Tyresö, Sweden
• Area of operation: Kiruna and the surrounding area, Swedish Lapland
• Email: info@smoothaurora.com

Contact form. Your name, email address and the content of your message, so we can answer you.

Booking interest form. Your name, email address, preferred dates, group size and any notes you add, so we can check availability and reply with an offer.

After a confirmed booking. Once a booking is confirmed we ask you by email for winter clothing sizes, dietary requirements, allergies and any medical conditions relevant to the activities. Allergies and medical conditions are special category health data. We ask for them only so that your week can be run safely, we collect them on the basis of your explicit consent, we share only the minimum with the specific guide or venue that needs it, and we delete them once your trip is over.

Website use. Standard technical data such as IP address and browser type is processed by our hosting provider to keep the site secure and working.

We rely on contract (Article 6.1.b) to plan and deliver a booked package, legitimate interest (Article 6.1.f) to answer enquiries and keep the website secure, explicit consent (Article 9.2.a) for health and allergy information, and legal obligation (Article 6.1.c) for accounting records.

To deliver your trip we pass the minimum necessary information to the local partners involved: the hotel, the transfer drivers, and the dog sledding, snowmobile, Sámi culture and ICEHOTEL operators. They receive names, dates, group size and only the dietary, allergy or medical details relevant to what they deliver.

We also use service providers who process data on our behalf under data processing agreements:

• Lovable Cloud, which provides the website hosting and the database (built on Supabase, running on Amazon Web Services). It stores the form submissions described above and processes standard technical data such as IP address and browser type when you load the site.
• Resend, which delivers our email. It processes your name, your email address and the content of the messages we send you and the notifications we send ourselves.
• Cloudflare, whose Web Analytics beacon produces aggregate visit statistics. It sets no cookies and stores no personal data and no identifier for you.
• Sentry, which records technical error reports when something on the site breaks, so that we can fix it. It is configured not to collect personal data, and we do not send it the contents of any form.

We never sell your data and we never share it for third-party advertising.

We choose EU regions wherever our providers offer them. Our database is hosted in the EU (Paris, eu-west-3) and our email sending domain is configured in the EU (Ireland, eu-west-1).

Both providers are US companies, so we cannot rule out that some processing, such as support access or the routing of an API request, takes place outside the EEA. Where that happens it is covered by the data processing agreements we hold with them and by the European Commission's standard contractual clauses. We do not make a broader claim than that, because we cannot verify one.

Enquiries and booking interest that do not lead to a booking: 24 months, then deleted. Booking and payment records: seven years, as required by the Swedish Accounting Act. Clothing sizes, allergies and medical information: deleted within 30 days of the end of your trip.

Two categories, and only two. Strictly necessary covers what the site needs to work and to stay secure, including the small first party cookie that remembers your choice below. It is always on and cannot be switched off. Analytics is off until you accept it, and nothing in it runs before you do.

If you accept analytics we record, for one browser session at a time: the pages you visit, how far down a page you scroll, which departure weeks you click, whether the enquiry form was opened and which field was filled last if you left it, and whether an enquiry or a message was sent. Alongside that we store the page you arrived on, the website or campaign that sent you, your device type, browser, operating system, window width, language and a two letter country code derived from the connection.

We do not store your IP address, we do not record what you type, we do not track mouse movement or keystrokes, and we do not build advertising profiles or follow you across other websites. The session label is a random value that is not tied to your name unless you choose to send us an enquiry, in which case we can see which channel brought you to us. Behavioural records are deleted after fourteen months.

With your consent we also use Cloudflare Web Analytics, a cookieless traffic beacon, and Microsoft Clarity, which shows anonymised page interaction. Neither runs on the "necessary only" setting. The legal basis for the analytics category is your consent, which you may withdraw at any time with no effect on anything already done.

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to processing, to receive your data in a portable format, and to withdraw consent at any time without affecting processing already carried out.

To exercise any of these rights, write to info@smoothaurora.com. We reply within one month. If you are not satisfied with how we handle your data you may complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se, or to the supervisory authority in your own country.

Our terms and conditions explain the booking, payment and cancellation rules that sit behind the data we collect from you.