Who is responsible
Nordic Getaways (nordic-getaways.com) is run by Mojjo AB, org. no. 559477-3912, Häckenvägen 78, 443 92 Lerum, Sweden. Mojjo AB is the controller of the personal data described here. Questions go to [email protected].
What we collect and why
You book a stay
- What
- Name, email, phone (optional), dates, number of guests, messages to the host and your confirmation of the house rules. Card details go straight to Stripe; we never see your full card number.
- Why
- To handle the booking and payment and send your confirmation, arrival information and reminders. Basis: contract, and the Bookkeeping Act for payment records.
- How long
- Seven years, as the Swedish Bookkeeping Act requires for booking and payment records.
You order from the shop
- What
- Name, email, phone (if given), delivery address and what you ordered.
- Why
- To make, deliver and support your order. Printful prints and ships it. Basis: contract, and the Bookkeeping Act.
- How long
- Seven years (Bookkeeping Act).
You contact us
- What
- Name, email, phone (optional) and your message.
- Why
- To answer you. Basis: legitimate interest.
- How long
- As long as needed to answer and follow up.
You create an account
- What
- Email, password (stored encrypted) and any name, phone or profile details you add. Hosts also give business details and a Stripe payout account.
- Why
- To let you sign in and see your bookings; for hosts, to manage listings and payouts. Basis: contract.
- How long
- Until you ask us to delete the account. Records we must keep for accounting stay for seven years.
You write in a guestbook
- What
- Name, email, message, photo and rating. Name, message, photo and rating are shown publicly once approved; your email never is.
- Why
- To share guests' experiences. Basis: consent, which you can withdraw at any time.
- How long
- Until you ask us to remove it.
You pay or sign in
- What
- IP address and browser details when a payment is completed and for some account actions.
- Why
- To prevent fraud and misuse. Basis: legitimate interest.
- How long
- Only as long as needed for that purpose.
You open a booking email
- What
- Whether the email has been opened (a small image in the email).
- Why
- To know that important arrival information has reached you. Basis: legitimate interest. Turning off images in your email app stops it.
- How long
- With the booking.
Who we share it with
We never sell personal data. These providers help us run the service and only handle data on our behalf:
- Supabase – database, sign-in and file storage, on servers in Stockholm, Sweden
- Cloudflare – hosting and delivering the website
- Stripe – card payments and refunds, and payouts to hosts
- Resend – sending emails
- Printful – printing and delivering shop orders
- OpenStreetMap – map images and the place search; your browser sends them your IP address and any place you search for
The host of the property you book receives your name, contact details and booking details. Our calendar sync with Airbnb, Booking.com, Vrbo and Landfolk only shares which dates are booked, never names.
Transfers outside the EU
Some providers, such as Cloudflare, Stripe, Resend and Printful, may handle data outside the EU/EEA, mainly in the US. They do so under safeguards approved by the EU, such as the EU–US Data Privacy Framework or the EU standard contractual clauses.
Cookies and storage
We use no advertising or analytics cookies and no tracking scripts. Your browser stores what the site needs to work: your shopping cart, your session if you sign in, and whether you have closed a notice. Cloudflare may set a cookie that protects the site against bots. These are needed for the site to work, so they do not require consent.
Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and get the data you gave us in a format you can take elsewhere. Where we rely on consent you can withdraw it at any time. Email [email protected] and we will answer within a month.
If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY) at imy.se.
Changes
When this policy changes, we update the date at the top of the page.