Our
Privacy Policy
We at MOMENT GROUP value your personal privacy and are committed to processing your personal data responsibly. This Privacy Policy describes how we collect, use and protect your personal data, as well as the rights you have under applicable data protection legislation.
Data controller
MOMENT GROUP AB, organisation number 556301-2730, is the Data Controller and is responsible for the processing of all personal data processed about you in accordance with this Privacy Policy.
Golden Hits AB, organisation number 556451-0948, is part of the MOMENT GROUP corporate group (“MG”), which means that we cooperate with the other companies within the group to ensure secure and effective protection of your personal data. Regardless of which of our companies you interact with within the group, our objective is the same: to handle your data with the highest level of security and transparency. This means that all group companies undertake to protect your privacy and to ensure that your data is only used for legitimate purposes and in accordance with our common policies and principles. As part of MG, your data may in some cases be shared between the group companies, and in some situations all companies within the group may be joint controllers (where the group jointly determines the purposes and means of the processing).
If you have any questions about the use of your personal data in accordance with this information, please contact us at integritet@momentgroup.com.
The purpose of the Privacy Policy is to inform you about how we process your personal data, what we use it for, who may access it and under what conditions, as well as how you can exercise your rights. The Privacy Policy is based on applicable law, including but not limited to the EU General Data Protection Regulation (EU) 2016/679 (the “General Data Protection Regulation” / “GDPR”) and Swedish data protection legislation.
We collect information about you through the information you provide to us when you visit our website www.goldenhits.se, apply for a job with us, enter into agreements with us, purchase and use our services, or that you otherwise share in communication with us, for example via our newsletters or through our social channels, via our customer service and in support matters, as well as through information collected from third parties. We may collect information about you from third parties who lawfully may collect and pass on such data, e.g. for credit checks ahead of your purchase with us. The third parties may vary from time to time.
We continuously work to improve our operations, and the Privacy Policy may therefore be amended from time to time. We reserve the right to update the Privacy Policy as a result of changes in legal, technical or business developments. We recommend that you review this Privacy Policy regularly to stay informed about how we process your personal data. You can see when it was last updated by checking the date at the bottom of this Privacy Policy.
We will only process the personal data for as long as is necessary to fulfil the purposes of the processing or to comply with our legal obligations. Under the sub-headings below you can read more about the retention periods that apply for each respective purpose.
This Privacy Policy applies to information that we process about you. Some pages on our website www.goldenhits.se may contain links to third-party websites that we do not control, for example when you visit our partners’ websites that we refer to on our website. These websites have their own privacy policies and we are not responsible for their operations, information practices and compliance with regulations. We therefore recommend that you read through their own privacy policies when visiting their websites, regarding their processing of your personal data.
This Privacy Policy is structured as follows.
- Personal data processed when you visit our website www.goldenhits.se
- Personal data processed when you apply for a job with us
- Personal data processed when you enter into an agreement with us and purchase our products/services
- Personal data we process after you have entered into an agreement with us
- Personal data processed for direct marketing
- Personal data processed for profiling
- Personal data processed due to legal obligation or in order to assert legal claims
- With whom we share your personal data
- Transfers outside the EU/EEA
- How we protect your personal data
- Your rights
1. Personal data processed when you visit our website www.goldenhits.se
1.1 Processing in connection with your use of our website
- Personal data processed:
We process technical information such as your IP address as well as cookies. - Purpose:
We need to process certain technical data so that you can use our website www.goldenhits.se (enabling technical functionality and access to the website), to ensure that the website works correctly and to maintain security. We store a text file (a cookie) in your browser to collect information about the use of our website. - Legal basis:
The processing is based on our legitimate interest. We have a legitimate interest in enabling you and other persons interested in our products and services to use our website in order to access them, as well as to maintain a secure operating environment. - Retention period:
Your IP address and certain technical information are processed only during the time of your visit to our website. We therefore do not store IP addresses ourselves. Cookies are stored until you delete them from your browser or until their storage period expires. By deleting cookies or disabling the function in your browser, you can ensure that we no longer process the information.
1.2 Processing in connection with our use of Google Analytics 4 (GA4)
- Personal data processed:
Google LLC’s analytics tool GA4 places its own cookies on our website in order to function. Your usage data will be transmitted to and stored on Google’s servers in the EU (most often in Ireland). - Purpose:
We use Google’s analytics tool GA4 in order to measure what you as a visitor do (click on) when you visit our website. This information is used solely for the purpose of evaluating how the website is used. - Legal basis:
The processing is based on your consent. - Retention period:
The processing is based on consent. Cookies are only set after consent via our cookie banner. The cookies set by GA4 have a lifetime of two (2) years, but the retention in GA4 is set to fourteen (14) months.
2. Personal data processed when you apply for a job with us
2.1 Processing in connection with an advertised position
- Personal data processed:
Name, personal identity number, address, email address, telephone number, CV and other information you as an applicant provide when applying for a job with us or during the recruitment process. - Purpose:
We need this information in order to keep in touch with you and to assess your application based on the position you have applied for. We use your personal data to administer and process your application for employment, review CVs, cover letters, references, grades and certificates, and to communicate with you. - Legal basis:
The processing is based on legitimate interest. We have a legitimate interest in carrying out the necessary processing of personal data in order to evaluate your qualifications, personal characteristics and personal background, and to enable selection in connection with the recruitment/employment decision. - Retention period:
We will process this personal data until the position has been filled.
2.2 Processing in connection with a possible future position
- Personal data processed:
Name, personal identity number, address, email address, telephone number, CV and other information you as an applicant provide when applying for a job with us or during the recruitment process. - Purpose:
We need to process this information for future recruitment, and to enable us to contact you early on if a vacancy arises for which you would be suitable and of interest. - Legal basis:
The processing is based on consent. We obtain your consent in order to be able to keep your application for a period of time after the position has been filled, in case a vacancy or need for a similar position arises for which you would be suitable and of interest. You have the right to withdraw your consent at any time. - Retention period:
We will process this personal data for a period of one (1) year from the date the advertised position was filled, or until you withdraw your consent, whichever occurs first. Thereafter the data will be securely deleted, unless there is another legal basis for continued processing. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
2.3 Processing in accordance with the Discrimination Act
- Personal data processed:
Name, personal identity number, address, email address, telephone number, CV and other information you as an applicant provide when applying for a job with us. - Purpose:
We need to process this information in order to be able to defend any claims that may arise in connection with a recruitment process, in order to demonstrate that no discrimination has occurred when filling the position. - Legal basis:
The processing is based on legal obligation. The limitation period for bringing an action is two (2) years in accordance with the Swedish Discrimination Act (2008:567). - Retention period:
We will process this personal data for a period of two (2) years from the date the advertised position was filled, in accordance with the Discrimination Act.
2.4 Processing in connection with an unsolicited application
- Personal data processed:
Name, personal identity number, address, email address, telephone number, CV and other information you as an applicant provide when submitting an unsolicited application to us. - Purpose:
We need to process this information for future recruitment, and to enable us to contact you early on if a position arises that matches your profile. - Legal basis:
The processing is based on consent. We obtain your consent at the time you submit your unsolicited application to us in order to be able to keep your unsolicited application for a period of time, in case a vacancy or need for a position arises for which you would be suitable and of interest. You always have the right to withdraw your consent. - Retention period:
We will process this personal data for a period of one (1) year after you have given your consent, or until you withdraw your consent, whichever occurs first. Thereafter the data will be securely deleted, unless there is another legal basis for continued processing. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
3. Personal data processed when you enter into an agreement with us and purchase our products/services
3.1 To handle your order and your purchase online via our website www.goldenhits.se
- Personal data processed:
Name, address, email address, telephone number, personal identity number, payment information (including method of payment), product and/or service purchased and delivery details. - Purpose:
We need to process this information in order to receive and administer your order, to provide you with basic information about your purchases of our products and/or services and their functions on our website such as (non-exhaustive list) order confirmation, delivery information, cancelled performances/schedule changes and other relevant information that may be useful for you to know in advance of the performance, etc., to be able to deliver your purchases from our website or from a physical point of sale to your specified address, to handle payment, including invoicing, and to provide digital receipts and other purchase-related information. - Legal basis:
The processing is based on the performance of a contract. The processing is necessary in order for us to deliver products and services in accordance with the agreement entered into when you make a purchase. - Retention period:
We will process this personal data for a period of three (3) years from the date of purchase (in order to enable handling of complaints and warranties and to comply with consumer protection legislation).
4. Personal data we process after you have entered into an agreement with us
4.1 Processing in connection with support and customer service – to handle customer service matters
- Personal data processed:
Name, address, email address, telephone number, personal identity number, information about purchases and purchase history, as well as other information you provide in connection with your contact with us, for example the content of our correspondence. - Purpose:
We need to process this information in order to manage and administer our customer relationship with you, to be able to communicate with you as our customer regarding your customer service matters, to respond to your enquiries received via our customer service by telephone or in digital media, and to handle complaints and grievances connected with your purchases from us. - Legal basis:
The processing is based on our legitimate interest. We have a legitimate interest in providing functioning customer service, handling questions related to our products and services, and maintaining a good customer relationship. A balancing of interests has been carried out and shows that our processing is not incompatible with your rights and freedoms. - Retention period:
We will process this personal data for the duration of our customer relationship with you and for up to three (3) years thereafter, unless the data needs to be retained due to a legal obligation (e.g. the Swedish Bookkeeping Act or consumer protection legislation).
4.2 To provide a better and more coherent service
- Personal data processed:
Name, address, email address, telephone number, personal identity number, information about purchases and purchase history, as well as other information you provide in connection with your contact with us, for example the content of our correspondence. - Purpose:
In order to provide you with a better, more coherent and more efficient service experience, regardless of which of our subsidiaries or arenas you interact with, your personal data may be shared within our corporate group. This coordination of information enables us to manage customer relationships and business processes in a more uniform, service-oriented and efficient manner. - Legal basis:
The processing is based on our legitimate interest. We have a legitimate interest in being able to offer our customers a uniform and quality-assured service throughout the entire group. A balancing of interests has been carried out and shows that this processing does not infringe on your rights or freedoms as a data subject. - Retention period:
We will process this personal data for the duration of our customer relationship with you and for up to three (3) years thereafter, unless the data needs to be retained due to a legal obligation (e.g. the Swedish Bookkeeping Act or consumer protection legislation).
4.3 To evaluate, develop and improve our services, products and systems, as well as our communication and service
- Personal data processed:
Name, address, email address, telephone number, personal identity number, purchase history as well as feedback and views you provide regarding our services, products or support. - Purpose:
We need to process this information in order to be able to improve and further develop our services, products and systems, and in order to improve the user experience and online purchase flow on our website www.goldenhits.se, and to improve our communication and customer service. - Legal basis:
The processing is based on consent. We obtain your consent in order to use your personal data for the purposes mentioned above. - Retention period:
We will process this personal data for a period of three (3) years after you have given your consent, or until you withdraw your consent, whichever occurs first. You can withdraw your consent at any time by contacting customer service or via the unsubscribe link in the email sent to you. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Upon withdrawal, processing ceases and the data is deleted, unless it is required for another lawful purpose (e.g. accounting).
4.4 To keep the personal data accurate
- Personal data processed:
Name, address, email address and personal identity number. - Purpose:
We need to process this information in order for us to ensure the accuracy of the data we hold about you, to keep our customer registers updated with correct contact details – so that we send out information to the correct recipient address. - Legal basis:
The processing is based on consent. We obtain your consent in order to use your personal data for the purposes mentioned above. You always have the right to withdraw your consent. - Retention period:
We will process this personal data for a period of three (3) years after you have given your consent, or until you withdraw your consent, whichever occurs first. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
5. Personal data processed for direct marketing
- Personal data processed:
Name, address, email address and telephone number. - Purpose:
We need to process this information in order to be able to offer you, as our customer, relevant offers and information in the form of newsletters and/or information connected to your purchase from us. - Legal basis:
The processing is based on consent and/or legitimate interest. We obtain your consent when we process personal data for marketing purposes directed at individuals who are not already customers of ours and who are consumers. Consent is obtained, for example, when you register for our newsletter, in connection with your purchase from us, or in other contact with us. Your consent is given voluntarily and can be withdrawn at any time. For you who are an existing customer of ours, we process personal data for marketing purposes on the basis of our legitimate interest, for example to inform you about similar products or services to those you have already purchased or shown an interest in. If you have given your consent and/or if there is a legitimate interest, we may process your personal data for direct marketing, newsletters, customer surveys and statistical purposes. Communications may be sent by post, email, SMS and other digital channels. We also follow the guidelines of the Swedish Marketing Act, including the rules on advertising directed at children. - Retention period:
We will process this personal data for a period of three (3) years after you have given your consent and/or for as long as there is a legitimate interest, or until you withdraw your consent, whichever occurs first. You can withdraw your consent at any time by contacting customer service or via the unsubscribe link in the email sent to you and in the newsletter. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
6. Personal data processed for profiling
- Personal data processed:
Name, address, email address, telephone number, personal identity number, purchase history, behaviour on our and our subsidiaries’ websites, information about products you have shown an interest in or placed in your shopping cart, as well as other voluntarily provided preferences (e.g. interests or family situation). - Purpose:
We need to process this information in order to be able to carry out profiling (which is defined as any form of automated processing of personal data for the purpose of evaluating an individual’s personal characteristics in order to analyse or predict the individual’s work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements). This means that we analyse your purchase history and previous purchases, your purchasing behaviour and your behaviour on our website and our subsidiaries’ websites in order to gain a better understanding of you as a customer and of our customers in general, and to be able to improve our offers. For the same purpose, we may also process any personal wishes or preferences that you have voluntarily provided to us, e.g. information that you have children or are interested in a particular category of products. We do this by analysing what purchases you have previously made and what products you have viewed or placed in your shopping cart. Based on this information, we improve our offers, communication and user experience, and send more relevant and individually tailored marketing messages to you. - Legal basis:
The processing is based on consent and/or legitimate interest. We obtain your consent or rely on legitimate interest in order to use your personal data for profiling. You have the right to withdraw your consent at any time. - Retention period:
We will process this personal data for a period of three (3) years after you have given your consent and/or for as long as there is a legitimate interest, or until you withdraw your consent, whichever occurs first. You can withdraw your consent at any time by contacting customer service or via the unsubscribe link in the email sent to you. The withdrawal does not affect the lawfulness of processing carried out before it took place.
7. Personal data processed due to legal obligation or in order to assert legal claims
7.1 Processing in connection with bookkeeping
- Personal data processed:
Name, personal identity number (for individuals or sole traders), invoicing address or email address for invoices, and mobile number. - Purpose:
We need to process this information in order to keep accounts and invoice, take payment for purchases and transactions, and report our financial information. - Legal basis:
The processing is based on legal obligation in accordance with the Swedish Bookkeeping Act (1999:1078). - Retention period:
We will process this personal data until the end of the seventh year following the end of the calendar year in which the financial year ended (retention period) in accordance with the Bookkeeping Act. After this period, the data will be securely deleted or anonymised.
7.2 Processing in connection with the assertion of legal claims
- Personal data processed:
Personal data that has been processed as a result of you entering into an agreement with us, including but not limited to name, contact details and other relevant information arising during our contractual relationship. - Purpose:
We need to process this information in order to investigate and respond to any legal claims or disputes that may arise in connection with our contractual relationship, as well as to establish and defend our rights in disputes, including in preparation for legal action or court proceedings. - Legal basis:
The processing is based on our legitimate interest. We have a legitimate interest in being able to assert and protect our rights in any disputes relating to our contractual relationship. - Retention period:
We will process this personal data for the time necessary to handle and resolve the dispute. The processing continues until the legal claim has been determined and the decision/judgment has gained legal force.
8. With whom we share your personal data
In order for us to fulfil our legal obligations towards you, perform our agreement with you, and based on your consent or our legitimate interest, we will transfer to, or share information with, third parties – entities that process personal data on our behalf, so-called data processors. We disclose your personal data to the following third parties:
- Suppliers of IT systems and their cooperation partners within development and support. These companies provide services, technical solutions and platforms for MG’s customer relationship work.
- Suppliers of address data. MG uses an accredited supplier for the automatic retrieval and updating of your address data from the Swedish Population Register.
- Cooperation partners that handle payments. To handle payments made by MG’s customers, we use suppliers in order to guarantee secure payment solutions.
- Other cooperation partners. As a customer of MG, we also want to be able to offer you benefits at one of our cooperation partners. This means that, in order for you to have the opportunity to make use of offers and benefits at them, we may need to share certain of your personal data with them, such as name, email and telephone number.
In addition to sharing personal data with third parties, we also share your personal data within our corporate group based on our legitimate interest in being able to provide you with a better and more coherent service, regardless of which subsidiary or arena you interact with. This sharing also enables a more efficient handling of customer relationships and business processes. We ensure that all personal data is processed responsibly and that sharing only takes place to the extent necessary to fulfil these purposes.
The following companies are part of the Moment Group corporate group:
Moment Group AB (556301-2730), Wallmans Group AB (556326-9223), Wallmans Stockholm AB (556435-7373), Golden Hits AB (556451-0948), Kungsportshuset i Göteborg AB (556453-2058), Wallmans Salonger Oslo AS (981995120), Wallmans A/S (26694094), KPH Restaurang AB (559332-1796), 2Entertain AB (556436-0948), Hamburger Börs Aktiebolag (556515-0652), 2Entertain Sverige AB (556561-0556), Kommanditbolaget Lorensbergsteatern (916839-9054) (Lorensbergsteatern), Nöjespatrullen Showrestaurang AB (556348-7759) (which includes Intiman and Vallarnas friluftsteater), 2Entertain Norge AS (983569285), Oscarsteatern Aktiebolag (556027-6163) (which includes Oscarsteatern and China Teatern), Höga Kusten Friluftsteater i Lövvik AB (559341-1571), 2E Event AB (556740-2465), Minnesota Communication AB (556596-2619), Filmriding & Company Aktiebolag (556753-3269), Hansen Event & Conference AB (556405-0267), Kungsportsgruppen AB (556751-2099), Ballbreaker Kungsholmen AB (556728-5902), Conciliance AB (556647-5900) & Slice and Serve i Malmö AB (559404-6400).
Offers in cooperation with external partners will only be sent by subsidiaries/partners of MG, and the personal data provided to cooperation partners is only used so that you can identify yourself as a customer of MG.
As regards the sharing of personal data with public authorities and the judiciary, we may share your personal data when we, in good faith, consider it necessary to comply with legal obligations or to respond to legal claims. We may also share your personal data when we, in good faith, suspect that this is necessary with regard to national security, police or intelligence operations, or to avoid death or personal injury, provided that these interests are not overridden by your rights and freedoms relating to the protection of your personal data.
9. Transfers outside the EU/EEA
At present, we process your personal data only within the EU/EEA area. Should an exceptional situation arise in which we would need to process your personal data outside the EU/EEA area, we will take appropriate safeguards in accordance with the General Data Protection Regulation (“GDPR”), for example through a decision by the European Commission that the country in question ensures an adequate level of protection or through the use of so-called appropriate safeguards. These include, among other things, the use of standardised data protection clauses adopted by the Commission, so-called Standard Contractual Clauses (SCC), as well as various contractual arrangements or obtaining your explicit consent for the transfer.
10. How we protect your personal data
Your security is important to us. We have therefore taken appropriate technical, organisational and administrative security measures to protect your personal data from loss, misuse, disclosure, alteration, destruction, unauthorised access and other unlawful processing. We regularly analyse and evaluate the measures with the aim of making the protection of your data as secure as possible. We also continuously adapt our security measures in line with developments and advances in the technical field.
Access is strictly limited in order to ensure that personal data is handled responsibly and in accordance with applicable data protection legislation as well as internal security routines, with the aim of protecting your privacy and ensuring the correct processing of the information. Only those persons who have a clearly defined and legitimate need to handle your data, in accordance with their work duties, will be granted access to such data.
As part of MG’s security work, we train our employees in order to promote a strong culture of data protection.
We have established data minimisation routines in order to ensure that your personal data is not stored longer than necessary, only as long as required to fulfil the specific purpose, in order to comply with the General Data Protection Regulation.
11. Your rights
You are not obliged to provide personal data to us, but in cases where the processing is based on the performance of a contract, we need your data in order to be able to fulfil our obligations. If you do not provide your personal data, there is a risk that we will not be able to undertake obligations under a contract.
We may ask for your consent to process certain of your personal data. You are not obliged to give such consent if you do not wish your personal data to be processed for the specified purposes. You can withdraw your consent at any time by contacting us. If you withdraw your consent, the withdrawal is valid from the time of the withdrawal and does not affect any processing we carried out before the withdrawal took place.
When we process personal data about you, you as a data subject have several rights. You have the right to contact us at any time regarding these, and if you wish to exercise any of the rights described below, the easiest way to reach us is at integritet@momentgroup.com.
All communication and all measures that MG takes in response to your rights are provided free of charge. MG reserves the right, in the case of manifestly unfounded or excessive requests, to either charge a reasonable fee covering the administrative costs of providing the information or taking the action requested, or to refuse to comply with the request.
Under applicable legislation, you have the following rights:
Right to information – You have the right to obtain information about how we process your personal data.
Right of access – You have the right to contact us and request to know what personal data we process about you and to request a copy of such data (the right to request a register extract).
Right to rectification – You have the right to have inaccurate, incomplete or out-of-date data rectified and supplemented with correct information. As a general rule you also have the right to receive information about where we obtained the inaccurate data from.
Right to erasure – Under certain conditions you have the right to have your data deleted (the right to be forgotten). In some cases we cannot delete part of your data if there is a legal requirement to retain it, such as accounting rules.
Right to restriction of processing – Under certain conditions you have the right to request that the processing of personal data be restricted, for example while a rectification is being made.
Right to object – Under certain conditions you have the right to object to the processing of personal data carried out for the purpose of performing a task in the public interest, in the exercise of official authority, or following a balancing of interests.
Right to data portability – Under certain circumstances you have the right to obtain your personal data in a structured, commonly used and machine-readable format and to transfer the personal data that you have provided to us yourself to another business/data controller (where the processing has been carried out on the basis of consent or contract).
Right to withdraw consent – If our processing of your personal data is based on your consent, you always have the right to withdraw your consent at any time for the continued processing of personal data we process on that legal basis.
Right to lodge a complaint – You have the right to lodge a complaint with the supervisory authority if you consider that we are processing your personal data incorrectly. You therefore have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) (Sweden), Datatilsynet (Denmark), Datatilsynet (Norway) or another competent supervisory authority that supervises companies’ handling of personal data.
You can read more about this on the following websites:
- Sweden: IMY’s website https://www.imy.se/
- Norway: Datatilsynet’s website https://www.datatilsynet.no/
- Denmark: Datatilsynet’s website https://www.datatilsynet.dk/
- United Kingdom: ICO’s website https://ico.org.uk/
This Privacy Policy was last updated on 20 April 2026.