Privacy Policy

This policy explains how Skeppsudden, a retreat and event centre at Östra Stenby, Norrköping, Sweden, collects and uses personal data through this website. For the purposes of the EU General Data Protection Regulation (GDPR), Skeppsudden is the data controller.

If you have any questions about this policy or your data, contact us at connect@skeppsudden.com.

We only collect the data we need to run the site, respond to you, and keep the service secure.

• Enquiry & volunteer forms. When you send a booking enquiry or a volunteer submission, we collect your name, email address, the category you choose, and your message, so we can read and reply to it. These messages are delivered to our team by email. Legal basis: your consent and our legitimate interest in responding to you.
• Newsletter. If you sign up, we collect your email address to send you news about our events and gatherings. Legal basis: your consent. You can unsubscribe at any time.
• Website feedback tool. This optional, anonymous widget lets you flag something without an account. It records the page and the on-screen element you point to, plus the note you write. Please don’t include personal data in that note. Legal basis: our legitimate interest in improving the site.
• Technical data. Like any website, our server automatically processes your IP address, browser type, and the pages you view, in order to deliver the site and protect it from abuse. Legal basis: our legitimate interest in a secure, working website.

We use only the essential cookies needed to run the site, such as remembering your language preference. We do not use advertising or third-party tracking cookies, and we do not run analytics that build a profile of you.

We never sell your personal data. We share it only with the service providers that help us operate the site, and only as far as needed:

• Hosting. Our website and database run on dedicated servers in the European Union (Hetzner, Finland).
• Email delivery. Form submissions and newsletter confirmations are sent through an email delivery provider.
• Abuse protection. To keep our forms and feedback tool free of spam, we may use Cloudflare Turnstile, a privacy-friendly bot check that processes your IP address and limited browser information.

Your data is stored on servers within the European Union. Where a provider (such as Cloudflare) processes limited technical data outside the EU, it does so under appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

We keep enquiry and volunteer messages for as long as we need them to handle your request and any ongoing relationship, then delete them. Newsletter subscriptions are kept until you unsubscribe. Technical logs are kept for a short period for security and then rotated out.

Under the GDPR you have the right to:

• Access — ask for a copy of the personal data we hold about you.
• Rectification — ask us to correct data that is wrong or incomplete.
• Erasure — ask us to delete your data ("right to be forgotten").
• Restriction — ask us to pause our use of your data.
• Portability — receive the data you gave us in a portable format.
• Objection — object to processing based on our legitimate interests.
• Withdraw consent — withdraw consent at any time, for example by unsubscribing from the newsletter.

To exercise any of these, email connect@skeppsudden.com. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY, imy.se) if you believe we have handled your data improperly.

We protect your data with encrypted (HTTPS) connections, EU-based hosting, and access controls that limit who on our team can see it.

This website is intended for adults. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will remove it.

We may update this policy as our website and services evolve. When we do, we will change the “Last updated” date at the top of this page.