Privacy notice

Controller and contact

Operator: Vincent Lacek, a private individual — not a business, no registration number. Address: Pilegårdsvag 24, 436 35 Askim, Sweden. Cabin: Flodavägen 58, Hindås, Sweden. Privacy contact: nordicstuga1965@gmail.com.

Information and purposes

We collect your name, email, arrival and departure dates and numbers of adults, children aged 2–17 and infants under 2, plus the extra-bed selection. Phone and message are optional. Required information is needed to handle the inquiry. We do not request children’s names, identity documents or sensitive information in this form.

Responding, checking dates and preparing or fulfilling a booking rely on GDPR Article 6(1)(b), steps before a contract and its performance. Statutory records rely on legal obligations (c); necessary security records and legal claims rely on legitimate interests in protecting the service and legal rights (f). We do not use inquiry details for marketing or request marketing consent.

Storage, email and recipients

The inquiry is saved in private management in Lovable Cloud and emailed to nordicstuga1965@gmail.com through Lovable email delivery. The owner accesses the mailbox; hosting, storage and email providers, including Google/Gmail, process data technically. Confirmation is manual by email or Instagram. Bank transfer or Revolut is arranged after confirmation; this site does not collect card details.

Google, Meta/Instagram or their subprocessors may transfer data outside the EEA. Exact locations and safeguards (such as adequacy decisions or standard contractual clauses) are not yet verified; contact us for details. Social links do not contact those services until opened.

IP country and decisions

Infrastructure processes IP and browser information to deliver and secure the service. We use IP-derived country only to choose the owner notification language: CZ → Czech, SE → Swedish, others → English, unknown → Czech. IP addresses are not saved in the inquiry record; providers may maintain operational logs. Guest messages are not translated. There is no profiling or automated booking decision.

Retention criteria

Pending inquiries remain until resolved and communication closes. Declined or expired inquiries are retained thereafter only where necessary for a specific dispute or claim for as long as it can be pursued. Confirmed stays are kept for contract performance, then only necessary records for statutory accounting or legal claims. Deletion is not automatic: the owner must remove unneeded records from management and email; backups follow provider cycles. Applicable legal periods and backup arrangements still need confirmation based on the operator’s legal status.

Your rights

Email us to request access, correction, erasure, restriction and, where applicable, portability. You may object to legitimate-interest processing. Any consent-based processing can be withdrawn. Rights are subject to legal exceptions, including mandatory record retention. We normally respond within one month and explain any lawful extension. You may complain to Sweden’s IMY (imy.se), to the Czech Office for Personal Data Protection (ÚOOÚ, uoou.cz) in the Czech Republic, or to the authority where you habitually live, work or where an alleged infringement occurred.