Privacy Policy (Sweden)

This policy explains how REXOR GROUP LLC, which offers its products under the brand Lodgeyard, processes personal data in connection with the pages of lodgeyard.com intended for Sweden, quote requests, the chat window, business correspondence and business-to-business prospecting: which data, why, on what legal basis, with whom, where, for how long, and how you can exercise your rights.

Version 2.1 of 28 October 2026. A Swedish version is available at /se/juridiskt/integritetspolicy.

In short: we use the information in your request to assess your project and reply to you. We do not sell your data or rent it out, and you can ask us to delete it at any time.

Article 1. Scope of this Policy

1.1 This privacy policy (the "Policy") describes the processing of personal data carried out by REXOR GROUP LLC as controller:

when you visit the pages of the Website intended for Sweden;
when you request a quote, in particular through the quote request form;
when you write in the chat window of the Website;
when you correspond with us by email;
when we contact campsites, cabin villages and similar businesses for the purposes of business-to-business prospecting;
when you, or the organisation that you represent, become our customer.

1.2 This Policy provides the information required by Articles 13 and 14 of the GDPR. It is written in a structured and detailed manner so that each processing operation can be identified.

1.3 Our offer is aimed at businesses. The personal data that we process are mainly those of the representatives and employees of businesses and other organisations, and those of sole traders.

1.4 This Policy does not apply to the websites of third parties to which the Website may link, or to the processing carried out by the Installation Partner named in our quotes, which processes the data it receives as an independent controller under its own rules once it has received your contact details (Article 10.5).

Article 2. Definitions

2.1 In this Policy:

"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), supplemented in Sweden by the Act containing supplementary provisions to the EU General Data Protection Regulation (lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning);
"personal data", "processing", "controller", "processor" and "recipient" have the meanings given in Article 4 of the GDPR;
"we", "us" and "our" refer to REXOR GROUP LLC, which offers its products under the brand Lodgeyard;
"you" refers to the natural person whose personal data are processed;
"Website" means the website lodgeyard.com, in particular its pages intended for Sweden;
"Chat Window" means the chat window of the Website and the automated replies given in it;
"Installation Partner" means the independent undertaking named in our quote that offers to carry out the installation of the units;
"IMY" means the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten);
"EEA" means the European Economic Area.

Article 3. Controller and contact details

3.1 The controller is REXOR GROUP LLC, a limited liability company registered in the State of New Mexico, United States of America, 8206 Louisiana Blvd NE, Ste A #9493, Albuquerque, NM 87113, USA. Lodgeyard is a brand of REXOR GROUP LLC and is not a separate legal person: the controller of all the processing described in this Policy is REXOR GROUP LLC.

3.2 For any question about this Policy or the processing of your personal data, you can write to contact@lodgeyard.com or to the postal address above.

3.3 We are established in the United States. The GDPR applies to our processing of personal data relating to persons in the European Union where that processing is related to the offering of our products to businesses in the Union, in accordance with Article 3(2) of the GDPR.

3.4 We are not required to designate a data protection officer under Article 37 of the GDPR and have not designated one. Requests concerning personal data are handled by the persons responsible for the matter within our company, at the address in Article 3.2.

Article 4. Persons concerned

4.1 This Policy concerns in particular the following categories of persons:

visitors to the Website;
persons who request a quote or ask us a question;
persons who write in the chat window;
representatives, employees and other contact persons of prospects and customers;
sole traders who request a quote or become customers;
persons who read a generic business email address to which we send a prospecting message, where that address relates to an identifiable person;
persons who receive the units on delivery;
persons who exercise their rights or object to our messages.

4.2 Information relating only to a legal person, such as its name, its organisation number or a generic address that does not relate to an identifiable person, does not constitute personal data. We nevertheless handle such information with the same care.

Article 5. Personal data we process and their sources

5.1 When you request a quote

5.1.1 We process the information that you enter in the quote request form:

name;
campsite, establishment or business;
email address;
telephone number;
town and municipality of the site;
number of units and model concerned;
desired timing;
description of the project, for example the ground, access for the truck and crane, seasonal or year-round use, and your questions.

5.1.2 The fields marked as optional in the form are optional. The other fields are necessary for us to prepare a quote.

5.1.3 We then process the content of our exchange of emails with you.

5.1.4 To limit misuse of the form, our hosting provider counts the submissions made from the same IP address over one minute. The address is not stored.

5.1.5 If you send your request by email instead of using the form, the same processing applies to the information contained in your email.

5.2 When you correspond with us

5.2.1 We process your identity and contact details, your position, the organisation that you represent, the content of your messages and of their attachments, such as photographs or plans of the site, and the content of our replies.

5.3 When you write in the chat window

5.3.1 We process:

your messages and the replies of the Chat Window;
the contact details that you choose to provide, such as an email address or a telephone number;
your IP address, which our hosting provider processes in order to transmit the conversation. To limit misuse, we keep only a keyed fingerprint of it, which cannot be converted back into the address (Article 8.6).

5.3.2 Our team may use the content of the conversation to prepare your quote and follow up your request.

5.3.3 Article 8 describes this processing in detail.

5.4 When we contact a business first

5.4.1 When we write to a campsite or a cabin village without having been asked to do so, we use the name of the establishment and the generic email address that it publishes on its own website, for example an address beginning with info or bokning. We record the source of the address and the date on which it was collected, the dates of our messages and any reply or objection. Article 9 describes this processing in detail.

5.4.2 To verify that the operator of the establishment is a company or another legal person, we consult public company registers. The information obtained, such as the legal form and the organisation number of a legal person, generally does not constitute personal data.

5.5 When you or your organisation become a customer

5.5.1 We process the identity, position and contact details of the contact persons of the customer; the name and telephone number of the person who receives the units on delivery, where the customer provides them; the quote, the order, the invoices and the payments, including the name of the payer and the amounts and dates of bank transfers; the correspondence relating to manufacture, inspection, carriage, delivery and any notice of lack of conformity, including the photographs exchanged.

5.5.2 We do not collect payment card data. Payments are made by bank transfer only.

5.6 When you browse the Website

5.6.1 When you browse the Website, our hosting provider processes the technical data necessary to deliver the pages and protect the Website, in particular your IP address, the address of the page requested, the date and time of the request and information on your browser. We do not use these data to identify you.

5.6.2 We measure traffic with an audience measurement service that uses no cookies or identifiers: page views are counted in aggregate, without following a person from one visit to the next.

5.6.3 When you arrive on the home page, we direct you to the version of the Website for your country, based on the country of your connection. This country is neither recorded nor kept. If you choose a country or a language yourself in the menu, a functional cookie named "pays" remembers that choice for 12 months.

5.6.4 The cookie policy describes the cookies and similar technologies used on the Website.

5.7 Data that we do not collect

5.7.1 The pages of the Website do not request access to the location, camera or microphone of your device; their security policy disables these functions. We do not use cookies or other technologies to track you across other websites or to build an advertising profile.

5.8 Sources

5.8.1 We obtain personal data directly from you; from the organisation that you represent, for example when a colleague gives us your contact details for an order; and from public sources, namely the website of the establishment concerned and public company registers.

Article 6. Purposes and legal bases

6.1 We process personal data for the following purposes, on the following legal bases:

Purpose	Data	Legal basis
Assessing your project, preparing a quote and replying to you	Quote request, correspondence	Steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) where you request the quote in your own name, in particular as a sole trader; otherwise our legitimate interest in replying to the requests of businesses and of their representatives (Article 6(1)(f))
Answering your questions in the chat window and preparing your quote	Chat messages, contact details provided	Same legal bases as above
Performing the order if you place one	Customer data	Performance of the contract (Article 6(1)(b)) where you are a party to it; otherwise our legitimate interest in performing the contract concluded with the organisation that you represent (Article 6(1)(f))
Limiting misuse of the chat window and of the form	IP address, keyed fingerprint	Our legitimate interest in protecting the service (Article 6(1)(f))
Presenting our accommodation units to businesses in camping and tourism (business-to-business marketing)	Name of the establishment, generic email address, dates of messages	Our legitimate interest in making our offer known (Article 6(1)(f))
Taking account of an objection and not writing to you again	Email address, date of the objection	Compliance with Article 21(3) of the GDPR (Article 6(1)(c)) and our legitimate interest in demonstrating that we comply with it (Article 6(1)(f))
Operating and securing the Website	Technical data	Our legitimate interest in providing a secure website (Article 6(1)(f))
Measuring the audience of the Website in aggregate	Page views counted in aggregate	Our legitimate interest in knowing how the Website is used (Article 6(1)(f))
Remembering the country or language that you have chosen	"pays" cookie	Our legitimate interest in providing the version of the Website that you have chosen (Article 6(1)(f))
Keeping accounting, tax and customs records	Invoices, payments, order data	Compliance with legal obligations to which we are subject (Article 6(1)(c)) where they arise under Union or Member State law; otherwise our legitimate interest in complying with the laws that apply to us (Article 6(1)(f))
Establishing, exercising or defending legal claims	Data relevant to the claim	Our legitimate interest in protecting our rights (Article 6(1)(f))
Handling requests to exercise rights	Data relating to the request	Compliance with our obligations under Articles 12 to 22 of the GDPR (Article 6(1)(c))

6.2 We do not rely on your consent for the processing described in this Policy. If we were to ask for your consent for a specific processing operation, you could withdraw it at any time, without affecting the lawfulness of the processing carried out before the withdrawal.

6.3 We do not process special categories of personal data within the meaning of Article 9 of the GDPR, or personal data relating to criminal convictions and offences. Please do not provide such data in the form, by email or in the chat window.

6.4 We do not use your personal data for purposes that are incompatible with those set out above.

6.5 In all our processing, we apply the principles set out in Article 5 of the GDPR. In particular, we process personal data lawfully, fairly and in a transparent manner; we collect them for specified, explicit and legitimate purposes; we limit them to what is necessary for those purposes; we take reasonable steps to keep them accurate and up to date; we keep them for no longer than necessary; and we protect them by appropriate security measures. We are responsible for compliance with these principles and must be able to demonstrate it.

6.6 Where you provide us with personal data relating to other persons, such as colleagues or the person who will receive the units on delivery, please inform them of this Policy and provide only the data that are necessary for the purpose concerned.

6.7 Please inform us of any change in your contact details, so that the data we hold remain accurate. You can ask us at any time to correct data that are inaccurate.

Article 7. Our legitimate interests

7.1 Where we rely on our legitimate interests, we have weighed those interests against your interests and fundamental rights and freedoms.

7.2 Replying to businesses and performing contracts with them requires us to communicate with their representatives and employees. These persons can reasonably expect that their professional contact details will be used for that purpose.

7.3 For business-to-business prospecting, we limit ourselves to the generic addresses that establishments operated by legal persons publish on their own websites, we send no more than two messages, we identify ourselves clearly, and we stop at the first objection. In those circumstances, we consider that your interests do not override our interest in making our offer known.

7.4 The security of the Website and of the chat window, and the aggregated measurement of the audience, involve limited data that are not used to identify you.

7.5 You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Article 21(1) of the GDPR). We then stop the processing unless we demonstrate compelling legitimate grounds for it that override your interests, rights and freedoms, or unless the data are needed for the establishment, exercise or defence of legal claims. Your right to object to direct marketing is unconditional (Article 14).

7.6 You can obtain information on the balancing of interests carried out by writing to us.

Article 8. The chat window and its automated replies

8.1 The chat window on our pages connects you to our artificial advisor: an artificial intelligence system, not a person. The window identifies it as such.

8.2 This information is given in line with the transparency requirements applicable to artificial intelligence systems intended to interact directly with natural persons (Article 50(1) of Regulation (EU) 2024/1689, the Artificial Intelligence Act).

8.3 The Chat Window answers your questions about our units, the applicable rules and the course of a project, and helps prepare your quote. Its replies are provided for information. They do not bind us and do not form part of a contract (website terms of use, Article 8).

8.4 To generate the replies, your messages are transmitted through our hosting provider to providers of artificial intelligence services established in the United States, which write and review the replies on our instructions, as processors. We exclude providers that store or reuse the data.

8.5 The conversations are stored in a database located in the Asia-Pacific region. They are deleted automatically 12 months after the last message.

8.6 To limit misuse, the Chat Window may end a conversation that tries to divert it from its purpose. If such attempts are repeated three times within 24 hours, the chat window is blocked for 30 days for the connection concerned. For that purpose we keep only a keyed fingerprint of the IP address, which cannot be converted back into the address. The block does not prevent you from contacting us through the quote request form or by email.

8.7 If you ask to speak to a person, or if you provide your contact details, our team receives them together with a transcript of the conversation, through the internal messaging service that it uses, in order to reply to you.

8.8 Please do not enter in the chat window any special categories of personal data, bank details or personal data relating to third parties. We never ask for bank details in the chat window.

8.9 The chat window sets no cookies and keeps no messages in your browser. Nothing is written in your browser before you open the chat window by clicking on it. After that, it uses session storage, which is deleted when you close the tab: on lodgeyard.com, it stores its display settings and whether it is open or closed; on the separate domain that displays the window, rexorcloser.com, it stores the texts and display settings of the window. Once you have sent a first message, it also keeps the identifier of your conversation in local storage, on lodgeyard.com and on rexorcloser.com, for 12 months after your last message, as long as the conversation itself is kept (Article 8.5), so that the conversation can pick up where it left off when you come back. This identifier is used for nothing else: no advertising, no tracking from one website to another. You can also erase it from the chat window, with the "New conversation" link. The cookie policy describes these operations, their duration and how to delete them. They are used only to provide the conversation that you open.

8.10 You can ask us to delete a conversation before the end of the retention period by writing to us and stating its date and, where possible, the contact details given in it, so that we can find it.

Article 9. Business-to-business prospecting

9.1 We may write to campsites, cabin villages and similar establishments without having been asked to do so, to present our accommodation units to them.

9.2 We write only to the generic addresses of establishments operated by a company or another legal person, as published on their own websites. We never write to a personal address or to a sole trader.

9.3 We send no more than two messages: a first message and one reminder. If you do not reply, we delete the address 12 months after our last message.

9.4 Each message states that it is marketing and identifies us as the sender. Each message contains a valid address to which you can send a request that the marketing should stop, as well as an unsubscribe link, in accordance with sections 9 and 20 of the Swedish Marketing Act (marknadsföringslagen (2008:486)).

9.5 Where a generic address is read by an identifiable person, the GDPR applies to the processing of that address. The first message indicates the source of the address and the date on which it was collected, refers to this Policy and informs you of your right to object.

9.6 Before sending a message, we check in public company registers that the operator of the establishment is a legal person, and we exclude addresses hosted by free email services as well as personal addresses.

9.7 If you reply to one of our messages, we process your reply in order to handle your request, and the retention periods applicable to quote requests and correspondence apply.

9.8 Article 14 explains how to object to these messages.

Article 10. Recipients of personal data

10.1 Within our company, personal data are accessible only to the persons who need them to perform their tasks.

10.2 We use technical service providers that act on our instructions, as processors, under contractual terms that require them to protect the data. These are the following categories of providers:

a provider of hosting, content delivery and storage services: hosting of the Website and of the chat window, storage of quote requests and conversations, and forwarding of email;
an email service provider;
providers of artificial intelligence services established in the United States: writing and reviewing the replies of the Chat Window, with the exclusion of providers that store or reuse the data, and helping us to draft and sort our correspondence;
an internal messaging service used by our team, for contact requests made in the chat window.

10.3 The following table specifies, for each category of processor, its function and the data concerned:

Category of processor	Function	Data concerned
Hosting, content delivery and storage provider	Delivering the pages of the Website and of the chat window, protecting them, storing quote requests and conversations, forwarding email, counting page views in aggregate	Technical data, quote requests, conversations, emails forwarded
Email service provider	Sending, receiving and storing our email	Contact details and content of the correspondence
Providers of artificial intelligence services	Writing and reviewing the replies of the Chat Window; helping to draft and sort our correspondence	Content of the conversations and of the correspondence submitted to them
Internal messaging service of our team	Alerting our team to contact requests made in the chat window	Contact details provided and transcript of the conversation

10.4 The list of our processors is available on request at contact@lodgeyard.com.

10.5 We also disclose personal data to the following recipients, who process them for their own purposes or as required by law:

manufacturers: to obtain prices, we send them the technical characteristics of the project, without your contact details;
the Installation Partner: to obtain the price of installation and connection, we send it the locality of the site and the characteristics of the project; we provide your contact details to it only once you have accepted the quote;
carriers, forwarders and the customs representative, where the performance of an order so requires: the delivery address and the name and telephone number of the person who receives the units;
banks and payment service providers, for the bank transfers made under an order;
public authorities, courts and the Swedish Enforcement Authority (Kronofogdemyndigheten), where the law requires it or where it is necessary for the establishment, exercise or defence of legal claims;
in the event of a restructuring, merger or transfer of all or part of our business, the acquirer, which will be bound by the commitments of this Policy for the data transferred.

10.6 Our processors may use sub-processors only under obligations that are equivalent to their own, in accordance with Article 28(4) of the GDPR.

10.7 Once you have concluded the installation contract with the Installation Partner, the Installation Partner is responsible for the processing of personal data in your exchanges with it.

10.8 We do not sell your personal data or rent them out.

Article 11. Processing outside the European Economic Area

11.1 Your personal data are processed outside the European Union and the EEA:

in the United States, where our company and its service providers are located;
in the Asia-Pacific region, where the database containing the conversations of the chat window is located;
in the Philippines, where the management of our company works.

11.2 As our company is established in the United States, the data that you send us are received directly by us outside the EEA. The GDPR nevertheless applies to our processing in accordance with Article 3.3.

11.3 The Philippines is not covered by a decision of the European Commission finding an adequate level of protection.

11.4 Transfers to our service providers are covered by the standard contractual clauses adopted by the European Commission (Commission Implementing Decision (EU) 2021/914 of 4 June 2021) and, for our hosting provider, by the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023).

11.5 Standard contractual clauses are contractual commitments, adopted by the European Commission, by which the recipient undertakes to provide protection essentially equivalent to that guaranteed in the European Union. The Data Privacy Framework allows transfers to United States companies that have certified their adherence to its principles; it applies only to the extent of that certification.

11.6 If we start using service providers in other countries, we update this Policy accordingly.

11.7 You can obtain a copy of these safeguards by writing to us at contact@lodgeyard.com. Commercially sensitive passages may be removed from the copy provided.

Article 12. Retention periods

12.1 We keep personal data for no longer than is necessary for the purposes for which they are processed, and in particular for the following periods:

Data	Retention period
Generic address of an establishment that we have contacted and that has not replied	Deleted 12 months after our last message
Address of a person or establishment that has objected to our messages	Kept in a suppression list, used only to ensure that we do not write again, for at least three years
Conversations in the chat window	Deleted automatically 12 months after the last message
Quote requests and correspondence, if you do not become a customer	Three years from your last contact with us
Data of customers and of their contact persons	For the duration of the business relationship and three years thereafter, subject to the statutory retention periods for accounting information
Counter of form submissions per IP address	One minute; the IP address is not stored
Keyed fingerprint of the IP address used to limit misuse of the chat window	For the time needed to apply the limits described in Article 8.6
Technical data processed by our hosting provider	For the time needed to deliver the pages and protect the Website

12.2 Where personal data are needed for the establishment, exercise or defence of a legal claim, they may be kept, notwithstanding the periods above, until the claim has been finally settled.

12.3 These periods have been set having regard to the time needed to reply to a request and follow up a project, which may extend over several seasons, to the duration of the business relationship and of the warranties, and to the time limits within which claims may be brought.

12.4 At the end of these periods, the data are deleted or irreversibly anonymised.

Article 13. Your rights

13.1 Under the GDPR, and within the limits and conditions it lays down, you have the following rights:

right of access (Article 15): to obtain confirmation as to whether we process personal data relating to you and, where we do, a copy of those data and information on the processing;
right to rectification (Article 16): to have inaccurate data corrected and incomplete data completed;
right to erasure (Article 17): to have your data deleted, in particular where they are no longer necessary, where you have objected to the processing and there are no overriding legitimate grounds, or where the processing is unlawful; this right does not apply where the processing is necessary, for example, for compliance with a legal obligation or for the establishment, exercise or defence of legal claims;
right to restriction of processing (Article 18): to have the processing of your data restricted, in particular while the accuracy of the data or an objection is being examined;
right to data portability (Article 20): to receive the data that you have provided to us in a structured, commonly used and machine-readable format, and to have them transmitted to another controller, where the processing is based on a contract or on consent and is carried out by automated means;
right to object (Article 21): to object to processing based on our legitimate interests, on grounds relating to your particular situation, and to object at any time, without having to give reasons, to processing for direct marketing purposes.

13.2 A copy provided under the right of access contains, in particular, the purposes of the processing, the categories of data concerned, the recipients or categories of recipients, the retention period or the criteria used to determine it, the source of the data where they were not collected from you, and information on your other rights. The first copy is free of charge; for any further copy, we may charge a reasonable fee based on administrative costs (Article 15(3) of the GDPR).

13.3 You also have the right to be informed of the processing of your data, which this Policy is intended to provide, and the right to lodge a complaint with a supervisory authority (Article 16).

13.4 Where processing is restricted, we store the data concerned and process them otherwise only with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another person or for reasons of important public interest (Article 18(2) of the GDPR).

13.5 Where we rectify or erase data or restrict their processing at your request, we inform each recipient to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort (Article 19 of the GDPR). We tell you who those recipients are if you so request.

Article 14. Objecting to direct marketing

14.1 You can at any time, without giving reasons and free of charge, object to receiving our marketing messages:

by replying "STOPP" (or "STOP");
by clicking the unsubscribe link at the bottom of our message;
or by writing to contact@lodgeyard.com.

14.2 You receive a confirmation within 48 hours.

14.3 We then keep your address in a suppression list, used only to ensure that we do not write to you again, for at least three years.

14.4 An objection to direct marketing does not prevent us from replying to a request that you send us later or from performing a contract concluded with you or with your organisation.

Article 15. How to exercise your rights

15.1 To exercise your rights, write to contact@lodgeyard.com or to the postal address in Article 3.1. Please state which right you wish to exercise and, where possible, the processing concerned.

15.2 Exercising your rights is free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may charge a reasonable fee or refuse to act on it, in accordance with Article 12(5) of the GDPR.

15.3 We reply without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of requests; we then inform you of the extension, and of the reasons for it, within one month of receipt.

15.4 Where we have reasonable doubts about the identity of the person making the request, we may ask for the additional information necessary to confirm it (Article 12(6) of the GDPR). We do not ask for more information than is needed for that purpose.

15.5 We reply in the form in which the request was made, normally by email, unless you ask otherwise. Where you request a copy of your data electronically, we provide it in a commonly used electronic form.

15.6 You may exercise your rights through a representative. In that case, we may ask for proof of the representative's authority.

15.7 If we do not act on your request, we inform you without delay, and at the latest within one month, of the reasons and of your right to lodge a complaint and to seek a judicial remedy.

Article 16. Complaints and remedies

16.1 If you consider that your rights are not respected, you can lodge a complaint with the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY) (imy.se), or with the supervisory authority of the Member State of the European Union where you live or work or where the alleged infringement took place (Article 77 of the GDPR).

16.2 You also have the right to an effective judicial remedy against us (Article 79 of the GDPR) and the right to receive compensation for damage suffered as a result of an infringement of the GDPR (Article 82).

16.3 We invite you to contact us first, so that we can try to resolve the matter. This invitation does not affect your right to lodge a complaint directly.

Article 17. Security of processing

17.1 We implement technical and organisational measures appropriate to the risk, in accordance with Article 32 of the GDPR, in particular:

encryption of communications between your browser and the Website (HTTPS), with a policy requiring browsers to use only secure connections;
access to personal data limited to the persons who need it;
replacement of the IP address by a keyed fingerprint for the purpose of limiting misuse of the chat window;
automatic deletion of conversations at the end of the retention period;
contractual obligations of confidentiality and security imposed on our processors;
a security policy for the pages of the Website that restricts the scripts and content they may load to identified sources;
the display of the chat window from a separate domain, isolated from the pages of the Website.

17.2 If you discover a security vulnerability on the Website, please report it to contact@lodgeyard.com.

17.3 No transmission or storage of data is entirely free of risk. In the event of a personal data breach, we notify the competent supervisory authority where the GDPR requires it (Article 33), and we inform you without undue delay where the breach is likely to result in a high risk to your rights and freedoms (Article 34).

Article 18. Automated decision-making

18.1 We take no decisions about you based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 of the GDPR.

18.2 The replies of the Chat Window are generated automatically but are provided for information only. The automatic limitation of the chat window in the event of misuse (Article 8.6) applies only to that window and does not prevent you from contacting us by other means.

18.3 Quotes and any decision to conclude a contract are prepared and taken by our team.

Article 19. Mandatory and optional information

19.1 You are under no legal obligation to provide personal data to us.

19.2 Without the information that the quote request form does not mark as optional, we cannot prepare a quote. Using the chat window, and providing your contact details in it, is optional.

19.3 If you or your organisation place an order, the contact and delivery details are necessary for the performance of the contract.

Article 20. Children

20.1 The Website is intended for businesses and is not directed at children. We do not knowingly process personal data relating to children. If you believe that a child has provided personal data to us, please contact us so that we can delete them.

Article 21. Cookies and similar technologies

21.1 The Website uses no cookies for audience measurement or advertising.

21.2 We measure traffic without cookies or identifiers. Our hosting provider may set a technical cookie that is strictly necessary for the security of the Website. If you choose a country or a language yourself, the functional "pays" cookie remembers that choice for 12 months. The chat window uses the session storage of your browser only once you open it and, once you have sent a first message, keeps the identifier of your conversation in the local storage of your browser for 12 months after your last message, as described in Article 8.9.

21.3 The cookie policy describes these technologies in detail, the rules that apply to them under Chapter 9, section 28 of the Swedish Electronic Communications Act (lag (2022:482) om elektronisk kommunikation), and how you can manage them.

Article 22. Links to other websites

22.1 The Website may contain links to websites of third parties, such as the website of IMY. We are not responsible for the processing of personal data carried out by those websites, which are governed by their own policies.

Article 23. Changes to this Policy and language versions

23.1 We may amend this Policy, in particular to reflect a change in our processing or in the applicable law. The amended version is published on the Website with its version number and date. Where a change materially affects you, we inform you by appropriate means. Previous versions are available on request.

23.2 This Policy is published in English and in Swedish. In the event of a discrepancy, the English version prevails. This rule does not limit any right that you have under the GDPR.

23.3 The other documents that apply to the Website are listed on the legal information page, in particular the terms of sale, the website terms of use, the cookie policy and the legal notice.

Version 2.1 of 28 October 2026.