Privacy policy

1. Data controller

Söderfors Resort & Spa AB, company registration number 559448-9311, Söderfors Herrgård 1, 815 76 Söderfors, Sweden, is the controller for the processing described here.

You can reach us on +46 293 76 10 20 or at info@soderforsherrgard.com.

2. Personal data we process

For bookings and stays, we may process your name, telephone number, email and postal address, booking number, arrival and departure dates, booked services, billing details, correspondence and preferences you choose to provide.

Information about allergies, dietary requirements, accessibility needs or other sensitive matters is processed only when you provide it voluntarily and when it is needed to meet your request.

Payments may be handled by external payment providers. We do not normally store full card details, but may process the amount, date, payment method and confirmation that payment was completed.

When you use our website, we may collect your IP address, device and browser type, pages visited, usage data, referring site or advertisement and information from cookies. Non-essential cookies are used in line with your choices.

3. Why we process your personal data

We process data to enter into and perform contracts, administer bookings, deliver services, handle payments, invoices and refunds, and meet legal duties such as accounting requirements.

We also use data for customer service and important communication before, during and after your visit. The legal basis is our contract with you or our legitimate interest in providing good service.

Booking information, service use and guest feedback may be analysed to improve the business. We use anonymised or aggregated information where possible.

Newsletters and electronic marketing are sent with consent or, where the law permits, on the basis of legitimate interest. You can unsubscribe and object to direct marketing at any time.

With the required consent, data may be used for measurement and personalised advertising through services such as Google and Meta. We may also process data to protect guests, staff, systems and the business, and to prevent fraud and misuse.

4. Where the data comes from

We usually receive personal data directly from you. We may also receive it from a booking platform, tour operator, company or other partner.

When an external party arranges the booking, that party's privacy policy also applies to the processing for which it is responsible.

5. Who we share personal data with

We do not sell your personal data. We may share it with providers of hotel and booking systems, restaurant and spa bookings, payments, IT operations, support, email, accounting, web analytics, marketing and advertising.

Providers may process data only in accordance with the law and our agreements. We may disclose data to public authorities when required by law or an official decision.

6. Transfers outside the EU and EEA

Some providers may process personal data outside the EU or EEA. We ensure that there is a lawful transfer mechanism and appropriate protection, such as an adequacy decision or the European Commission's standard contractual clauses.

7. How long we keep personal data

We keep data only for as long as the purpose requires. Booking data is retained for the booking, customer service and later claims. Accounting records are retained for the period required by law.

Marketing data is kept while the processing remains relevant and permitted, or until you withdraw consent or object. Cookie data follows the periods stated in the cookie settings. Data is then erased or anonymised.

8. Cookies

Our website uses cookies and similar technologies. Essential cookies make the site work. Cookies for statistics, analytics and marketing are activated only after you consent.

You can change or withdraw consent at any time through the cookie settings, where purposes and retention periods are also described.

9. Your rights

You may request access to and a copy of your data, correction of inaccurate or incomplete data and, where the legal conditions are met, erasure or restriction of processing.

You may object to processing based on legitimate interests and always to direct marketing. Where the GDPR conditions are met, you may request data portability.

You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before it. Some rights are limited when the law requires us to retain data.

10. Complaints to the supervisory authority

Please contact us first if you believe that we have handled your data incorrectly. You also have the right to complain to the Swedish Authority for Privacy Protection, IMY, the Swedish data protection supervisory authority.

11. Security

We use technical and organisational measures to protect data against unauthorised access, loss, alteration and disclosure. Access is limited to people and providers who need the data for their work.

12. Changes to this policy

We may update this policy when our business, services or applicable rules change. The latest version is published at soderforsherrgard.se.

13. Contact us

Questions and requests concerning your rights can be sent to Söderfors Resort & Spa AB, Söderfors Herrgård 1, 815 76 Söderfors, Sweden.

Telephone: +46 293 76 10 20. Email: info@soderforsherrgard.com.