Privacy Policy
Moumo Scandinavia AB
Last updated: November 12, 2026
1. Introduction
Moumo Scandinavia AB (“Moumo”, “we”, “us”, or “our”) is committed to protecting your privacy and handling your personal data responsibly.
This Privacy Policy explains what personal data we collect, why and how we process it, who we may share it with, how long we retain it, and what rights you have under the EU General Data Protection Regulation (GDPR).
This policy applies to our website, mobile application, facilities, and services, including climbing, yoga, gym facilities, memberships, classes, courses, children's activities, competitions, events, restaurant and café services, retail operations, corporate bookings, marketing, and recruitment.
2. Data Controller and Contact Information
Moumo Scandinavia AB is the data controller responsible for determining the purposes and means of processing personal data in connection with our services.
Moumo Scandinavia AB
Company registration number: 559182-3942
Götgatan 78
118 30 Stockholm
Sweden
Email: [email protected]
Website: https://www.moumo.se
If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us using the information above.
3. Personal Data We Collect
Depending on your relationship with Moumo and the services you use, we may collect and process the following categories of personal data.
Identity and Contact Information
Name
Email address and telephone number
Postal address, where necessary
Date of birth and, where necessary, Swedish personal identity number
Contact information for parents, guardians, or emergency contacts
Membership and Customer Information
Customer and membership identification numbers
Membership type, status, and contractual details
Bookings, cancellations, waiting lists, and attendance
Visit and check-in history
Purchase history and payment status
Invoicing and direct debit information
Training and Activity Information
Participation in classes, courses, competitions, and events
Training history and statistics
Participation in children's and youth activities
Digital and Technical Information
Account details and user identifiers
Device and application information
Usage statistics and technical error reports
Push notification preferences and device permissions
Information relating to social features and connections with other users
Other Information
Customer service inquiries and correspondence
Photographs and videos
Incident reports, including information about injuries where relevant
Business contact information
CVs and recruitment-related correspondence
We aim to collect only the personal data necessary for the relevant purpose.
4. Memberships and Customer Administration
We process personal data to register and administer memberships, manage customer accounts, provide access to our facilities, and fulfil our contractual obligations.
This includes processing information relating to memberships, bookings, payments, and customer communications.
Legal basis: Performance of a contract under Article 6(1)(b) GDPR.
We retain membership information throughout the customer relationship and thereafter where necessary to comply with legal obligations, manage outstanding matters, or establish, exercise, or defend legal claims.
5. Bookings, Training, and Activities
When you book or participate in activities at Moumo, we process personal data to administer your participation.
This includes climbing courses, yoga classes, gym activities, competitions, events, children's activities, and corporate bookings.
We use this information to manage bookings, cancellations, waiting lists, attendance, and communications about activities.
We may also process training and visit history to provide account features, training statistics, and relevant services.
Legal basis: Performance of a contract. Certain operational and safety-related processing may rely on legitimate interests under Article 6(1)(f) GDPR.
6. Facility Access and Visit History
Our access control systems may record information about when customers enter or visit our facilities.
We use this information to verify access permissions, administer memberships, provide visit statistics, and maintain security.
Legal basis: Performance of a contract or legitimate interests, depending on the purpose.
7. Children and Young People
Moumo provides activities for children and young people.
We may process children's names, ages or dates of birth, booking details, participation information, and parent or guardian contact details to organise and administer these activities.
Where required by law, we obtain consent from a parent or guardian.
We obtain permission from parents or guardians before publishing identifiable photographs of children.
8. Payments, Restaurant, and Retail Operations
When you purchase products or services from Moumo, we may process information necessary to complete the transaction, administer payments, and fulfil accounting obligations.
This may include purchase history, payment status, invoicing information, and contact details associated with bookings or orders.
Legal basis: Performance of a contract and compliance with legal obligations.
Accounting records are retained in accordance with Swedish bookkeeping legislation, generally until the end of the seventh year following the calendar year in which the financial year ended.
9. Corporate Customers and Business Partners
We process contact information relating to corporate customers and business partners to manage inquiries, quotations, bookings, agreements, invoicing, and business relationships.
In some cases, corporate customers provide personal information about employees participating in activities or receiving membership benefits.
We may contact business representatives with information about our services and offers where permitted by applicable law.
Legal basis: Legitimate interests, performance of a contract, or compliance with legal obligations, depending on the circumstances.
You may object to direct marketing at any time.
10. The Moumo Mobile Application
The Moumo mobile application is developed and technically provided by BRP Systems on behalf of Moumo.
Moumo is the data controller for personal data processed in connection with our customer relationships and services. BRP Systems acts as a data processor when processing such information on our behalf.
The application allows customers to access and manage various Moumo services, including:
Managing memberships and account information
Booking and cancelling classes, courses, and activities
Managing waiting lists and viewing upcoming bookings
Checking in and accessing our facilities
Viewing training history and statistics
Connecting with other users through social features
Receiving notifications about bookings and activities
To provide these services, the application processes personal data associated with your Moumo customer account.
Push Notifications
The application may send push notifications relating to bookings, activities, schedule changes, and other relevant information.
You can manage notification permissions through your device settings.
Social Features
The application includes features that allow users to connect with other users.
When you use these features, certain profile information, connections, and activity-related information may be processed and, depending on the functionality and privacy settings, displayed to other users.
Camera Access
The application may request access to your device's camera when required for specific functionality.
Camera permissions can be managed through your device settings.
Analytics and Technical Information
Technical information may be processed to maintain the application's functionality, identify errors, troubleshoot problems, and improve the user experience.
The specific technical data collected depends on the application's configuration and the services used by BRP Systems.
Account Deletion
You may request deletion of your Moumo account and associated personal data.
Where the account deletion feature is available in your version of the application, you can initiate account deletion directly within the app:
Open Profile.
Select Account and Security.
Scroll to Delete Account.
Select Delete Account and follow the instructions.
Active subscriptions or future bookings may need to be resolved before the deletion process can be completed.
Following a valid deletion request, the account may be marked for anonymisation or deletion in accordance with the applicable technical procedures and legal requirements.
You may also request account deletion by contacting [email protected].
Certain personal data may need to be retained where required by law or necessary to establish, exercise, or defend legal claims.
Deleting the mobile application from your device does not automatically delete your Moumo customer account.
11. Website, Cookies, and Analytics
Our website is hosted on Squarespace.
We use Google Analytics and Google Tag Manager for website analytics and technical management of website services.
Our website uses cookies and similar technologies for essential functionality and, where applicable, analytics and statistics.
We provide a cookie consent banner that allows visitors to accept or reject non-essential cookies.
Non-essential cookies requiring consent are intended to be used only after the necessary consent has been provided.
You can manage your cookie preferences through the cookie controls on our website.
12. Marketing and Communications
We may use personal data to communicate information about Moumo's services, activities, events, courses, and offers.
Communications may be delivered through email, newsletters, push notifications, or other digital channels.
Legal basis: Consent or legitimate interests, where permitted by applicable law.
You may object to direct marketing at any time.
You can unsubscribe from marketing emails using the instructions included in the message or by contacting us.
Important communications relating to existing memberships, bookings, and contractual obligations may still be sent after you have opted out of marketing communications.
13. Photography, Video, and Social Media
We may photograph or film activities at Moumo, including classes, competitions, events, and other activities.
Photographs and videos may be used on our website, social media channels, newsletters, advertisements, and in internal communications.
We obtain permission from parents or guardians before publishing identifiable photographs of children.
For portraits, close-up photographs, and advertising, we normally obtain permission from the individuals concerned.
Legal basis: Consent or legitimate interests, depending on the purpose and circumstances.
Where processing is based on consent, you may withdraw that consent at any time.
If you wish to request removal of a photograph or video featuring you, please contact [email protected].
We will assess your request in accordance with GDPR and our internal procedures.
Original photographs and videos are stored in Google Drive, with access restricted to authorised individuals.
14. CCTV Monitoring
Moumo uses CCTV monitoring in certain areas of our facilities to maintain a safe and secure environment.
Cameras are located in climbing areas, reception, gym facilities, restaurant areas, children's areas, and the shop.
The purposes of CCTV monitoring include:
Protecting visitors and staff
Preventing theft and property damage
Identifying and responding to safety incidents
Supporting safety-related operations
Cameras are used for live monitoring, including continuous display and access by authorised personnel when necessary.
CCTV footage is not recorded or stored.
Live camera feeds may also be accessed remotely by authorised individuals.
Access is restricted to authorised management personnel, reception staff, security functions, and other specifically authorised individuals.
Legal basis: Legitimate interests under Article 6(1)(f) GDPR, subject to an assessment of necessity and proportionality.
Information about CCTV monitoring is also provided through signage at our facilities.
You may contact us for additional information or to object to the processing of your personal data through CCTV monitoring.
15. Accidents, Incidents, and Safety
We may prepare incident reports following accidents, security incidents, or other relevant events.
These reports may contain names, contact details, descriptions of incidents, and, where necessary, information about injuries or medical conditions.
We use this information to document and investigate incidents, improve safety, and comply with applicable legal obligations.
Legal basis: Legitimate interests or compliance with legal obligations, depending on the circumstances.
Where incident reports contain health information or other special categories of personal data, an applicable exception under Article 9 GDPR is also required.
Incident reports are stored in Google Drive and are accessible only to relevant authorised individuals.
Reports are generally retained for one to three years, depending on the circumstances. Longer retention may be necessary where legally justified.
16. Recruitment
When you apply for employment at Moumo, we process the personal data you provide.
This may include your name, contact details, CV, cover letter, and other information submitted as part of your application.
We use this information to administer recruitment, communicate with applicants, and evaluate qualifications.
Legal basis: Legitimate interests under Article 6(1)(f) GDPR, where applicable.
As a general rule, we aim to delete applications from unsuccessful candidates within six months after the recruitment process has concluded, unless a specific lawful reason justifies longer retention.
Information may be retained longer where necessary to establish, exercise, or defend legal claims.
If we wish to retain your application for future recruitment opportunities, we may request your consent.
17. Employee Personal Data
We process employee personal data to administer employment relationships and fulfil our obligations as an employer.
This may include contact information, Swedish personal identity numbers, bank details, salaries, working hours, schedules, absence records, personnel administration, and system access permissions.
We use systems including Personalkollen, BRP Systems, and Google Workspace.
Legal basis: Performance of employment contracts, compliance with legal obligations, or legitimate interests, where applicable.
Information about sick leave may constitute special-category personal data and is processed only where an appropriate legal basis and applicable exception exist.
Access to employee information is restricted to authorised management and HR personnel and relevant external payroll and accounting service providers.
Additional information about employee data processing may be provided through internal communications.
18. External Service Providers and Data Recipients
We use external service providers to support our operations.
These include:
BRP Systems: Membership management, bookings, customer administration, and mobile application services
Squarespace: Website hosting and management
Google Workspace: Communication and document management
Google Analytics and Google Tag Manager: Website analytics and technical tag management
Personalkollen: Personnel administration
Payment, banking, and accounting service providers
Other relevant IT and operational service providers
These providers may process personal data on our behalf where necessary to deliver their services.
Where a provider acts as a data processor, the processing must be governed by an appropriate data processing agreement.
In certain circumstances, personal data may be shared with independent data controllers, such as public authorities, banks, or payment providers.
We do not sell personal data.
19. International Data Transfers
Some of the digital services we use may involve personal data being processed or made accessible outside the European Union or European Economic Area (EU/EEA).
Where personal data is transferred outside the EU/EEA, we require an appropriate legal basis for the transfer under GDPR.
Such transfers may rely on an adequacy decision issued by the European Commission or appropriate safeguards, such as Standard Contractual Clauses, together with supplementary measures where necessary.
You may contact us for further information about applicable international transfers and safeguards.
20. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected or as required by applicable law.
Retention periods depend on the type of information and the purpose of processing.
Examples include:
Membership information: Throughout the membership and thereafter where necessary for outstanding obligations or legal claims.
Booking and training information: For as long as necessary to administer and provide relevant services.
Accounting records: In accordance with Swedish bookkeeping legislation.
Recruitment information: Generally no longer than six months after the recruitment process concludes, subject to justified exceptions.
Incident reports: Generally one to three years, depending on the circumstances.
CCTV footage: Not recorded or stored.
Marketing information: For as long as processing remains lawful and necessary, taking into account withdrawn consent and objections.
Photographs and videos: For as long as necessary for their intended purposes and where a valid legal basis exists.
When personal data is no longer required, it is deleted or anonymised.
21. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, and unlawful disclosure.
These measures are adapted to the sensitivity of the information and the risks associated with its processing.
Access to personal data is restricted to individuals and service providers who require it to perform their responsibilities.
22. Your Rights
Under GDPR, you have the following rights, subject to applicable legal conditions and limitations.
Right of access: You may request information about the personal data we process about you.
Right to rectification: You may request correction of inaccurate or incomplete personal data.
Right to erasure: You may request deletion of personal data where the legal requirements for erasure are met.
Right to restriction: You may request that the processing of your personal data be restricted in certain circumstances.
Right to object: You may object to processing based on legitimate interests. You always have the right to object to direct marketing.
Right to data portability: In certain circumstances, you may request your personal data in a structured, commonly used, and machine-readable format.
Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise your rights, please contact [email protected].
We normally respond to requests within one month. Where necessary, we may request additional information to verify your identity.
23. Complaints to the Supervisory Authority
If you believe that we are processing your personal data unlawfully, you are welcome to contact us.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).
Website: https://www.imy.se
24. Changes to This Privacy Policy
We may update this Privacy Policy when our services change or when required by applicable legislation.
The latest version will be published on our website.
Where changes are significant, we will inform affected individuals through appropriate channels.
25. Contact Us
If you have questions about this Privacy Policy or how we process personal data, please contact:
Moumo Scandinavia AB
Company registration number: 559182-3942
Götgatan 78
118 30 Stockholm
Sweden
Email: [email protected]
Website: https://www.moumo.se