Privacy Policy

Privacy Policy

Last updated: 11 October 2026

At Nicolai Bed & Breakfast we care about your privacy. This page explains which personal data we process when you visit our website, contact us or book accommodation, why we do so, and what rights you have.

1. Data controller

Nicolai Bed & Breakfast is the controller of your personal data.
Gamla Stadens Torg 4, 531 32 Lidköping, Sweden
Organisation number: 559501-2971
Email: info@nicolaibb.com
Phone: +46 510 664 30

2. What data we process, why and for how long

The contact form. If you send an enquiry through the form, we process your name, email address and phone number. The purpose is to answer your enquiry. The legal basis is our legitimate interest in being able to reply to you (Article 6(1)(f) GDPR) or, if your enquiry is about a booking, taking steps at your request before entering into a contract (Article 6(1)(b)). We keep the data for as long as needed to handle your enquiry and for a reasonable time afterwards. If the enquiry leads to a booking, the booking rules below apply.

Email, phone and WhatsApp. If you contact us in any of these ways, we process the details you give us, such as your name, contact details and message, in order to reply to you. The basis and retention are the same as for the contact form. If you write to us on WhatsApp, the data is also processed by WhatsApp (Meta) under its own terms.

Booking and stay. Bookings are made through the booking system Sirvoy. When you book, the data needed to carry out the booking and the payment is processed, for example name, contact details, arrival and departure dates, number of guests and any requests. The legal basis is performance of a contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)), for example the Swedish Accounting Act. Accounting records are kept for seven years under the Swedish Accounting Act. Other booking details are kept for as long as needed for the booking and for us to meet our legal obligations.

Spam protection on the form. To protect the form against automated submissions we use a hidden field, a timestamp and a limit on the number of attempts. Your IP address is then not stored in plain text but only as a one-way hash, which cannot be converted back into your IP address, together with the times of your recent attempts. The data is used only to count attempts during the last 24 hours. The legal basis is our legitimate interest in protecting the website against abuse.

Server logs. As part of its operation, our web host may log technical data, such as IP address, time and browser, for security reasons.

3. Cookies and content from other providers

The website uses a single cookie of its own, acceptCookies, which remembers that you have read the cookie notice. It is stored for 60 days. We do not use analytics or advertising cookies.

The website does, however, load content from other providers: the map from Google Maps, fonts from Google Fonts, icons from jsDelivr and the booking tool from Sirvoy. When such content loads, the provider may receive your IP address and information about your browser, and may set cookies of its own. Please read Google's privacy policy at policies.google.com/privacy and each provider's own policy.

4. Who we share your data with

We never sell your personal data. We share it only with providers that process it on our behalf, and only as far as necessary:

• Strato AG (Germany), which provides our email, where form messages are delivered
• Sirvoy, for bookings
• our web host
• Google and jsDelivr, for the map, fonts and icons described above
• WhatsApp (Meta), if you contact us there
• our accounting firm or auditor, if applicable
• authorities, where the law requires it

Some of these providers, for example Google and Meta, may process data outside the EU/EEA, including in the United States. This is done with appropriate safeguards such as the EU–U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

5. Your rights

You have the right to:

• find out what data we hold about you and receive a copy,
• have inaccurate data corrected,
• ask for your data to be erased,
• ask us to restrict the processing,
• object to processing based on legitimate interest,
• receive your data in a structured format (data portability), and
• withdraw any consent you have given at any time.

Contact us using the details above and we will reply within one month.

6. Complaints

If you believe we process your personal data in breach of data-protection rules, you have the right to complain to the supervisory authority, the Swedish Authority for Privacy Protection (IMY), www.imy.se.

7. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss and misuse.

8. Changes to this policy

We may update this policy when needed. The latest version is always on this page, with the date of the last update at the top.