Privacy Policy

Last updated 2026-07-21. This policy applies to Stockholm Private Guide, owned by Bulgheroni Staudt AB.

We care about your privacy. You should feel secure when entrusting your personal data to us. That is why we have implemented this policy. It is based on current data protection legislation and specifies how we work to respect your rights and your privacy.

The purpose of this policy is to inform you about how we process your personal data, what we use it for, who can access it, and under what conditions, as well as how you can exercise your rights.

Stockholm Private Guide, with organization number 559414-8453 (Bulgheroni Staudt AB) and address: Magnus Ladulåsgatan 39, 118 65 Stockholm, is responsible for the personal data concerning you. Therefore, Stockholm Private Guide is responsible for your personal data.

We process your personal data to provide you with our services and products, i.e., to enter into or fulfill a contract with you as a customer. We also use limited first-party, cookieless site measurement to understand the usefulness and performance of our public pages and improve the path to an inquiry. During a temporary comparison test, we separately process limited technical and interaction data on public pages through Contentsquare and Microsoft Clarity to evaluate usability and performance. Both tools may remain active when you reject optional Analytics; Clarity receives your actual Consent v2 choice and then uses its cookieless mode, as described below.

We strive to process the least amount of personal data possible about you. This means we do not collect more personal data than necessary to enter into or fulfill contracts with you. To conclude and execute a contract with you, we need information such as your first name, last name, email address, address, and other contact information. Except for the limited first-party site measurement, optional website analytics, and technical connection-origin data described below, we receive this personal data only when you provide it to us.

If you have not given us your consent, we do not use your personal data for marketing purposes.

When you submit a form and allow advertising measurement, we may use the email address or telephone number you provided for enhanced conversion measurement.

When you submit a contact, tour-planning, or reservation form, our server also records the IP address from which the request originated and the approximate country associated with that connection. We use these technical details to protect the form service, prevent abuse, diagnose delivery problems, and administer your request. Within our application, the stored values are displayed only in our restricted administration area. We do not include them in public pages, email or SMS notifications, advertising-measurement payloads, or optional-analytics payloads.

On our public pages, we operate a limited first-party backend measurement system to understand which pages, tours, and articles are useful and where visitors leave the journey to an inquiry. It records page views, foreground engagement time and maximum scroll depth; whether a form was viewed, first used, submitted, or encountered a technical submission error; and whether an inquiry was durably saved as a conversion. It also records clicks on identified contact or booking calls to action and on telephone or email links. It does not record link text or any value entered into a form.

For acquisition and general audience reporting, the system may record only an external referrer's hostname, sanitized campaign source, medium, and campaign labels, and whether an advertising click identifier was present. The identifier itself is not retained. It also records the approximate connection country and derives a broad device category, browser family, and operating-system family. The analytics records do not retain a raw IP address, the full user-agent string, a full referring URL, a page query string, or form contents. This is separate from the connection-origin data stored with a submitted inquiry for security and delivery administration, as described above.

A random visit identifier connects events only within the current page session. It is held in page memory and is discarded when the page session ends. This measurement does not set analytics cookies, use localStorage or sessionStorage, fingerprint the device, or create a profile intended to recognize a returning person on a later day.

Results are available only in our restricted administration area as private, aggregated reports, such as daily traffic, popular content, funnel stages, acquisition source, country, device, browser, and operating system. Raw site-measurement events are retained for 90 days and then deleted.

This first-party measurement is distinct from Google and from the external Contentsquare and Microsoft Clarity comparison described below. It does not enable those vendors’ tags, cookies, advertising measurement, or session replay. During the temporary comparison test, Contentsquare and Clarity may remain active separately as described below; optional storage and Clarity cross-page continuity continue to follow your choice.

During the current temporary comparison test, we load Contentsquare and Microsoft Clarity on public pages to compare their usability and performance analytics and session replay. Both tools may remain active even when you reject optional Analytics. Neither tool is loaded on the private /auth or /admin pages. You can change your storage choice at any time through Manage Consent.

We send Microsoft Clarity your actual choice through Consent v2. When you reject Analytics, Clarity uses its supported cookieless mode: it does not use Clarity analytics cookies or link activity across pages, and Microsoft treats each page view as a separate session. If you allow Analytics, Clarity may use first-party analytics cookies and provide continuous cross-page sessions. Optional Google analytics and advertising storage also continue to follow your choice.

Contentsquare is configured to fully mask page content in its session replays. Clarity uses Relaxed masking, so normal page content may be visible in Clarity recordings. Microsoft still masks input fields and dropdowns in every masking mode. The tools may process technical and interaction data such as device and browser information, public page addresses, clicks, scrolling, layout interactions, and navigation events.

Your security is important to us. That is why we have implemented appropriate technical, organizational, and administrative security measures to protect your personal data against unauthorized access and illegal processing. We regularly analyze and evaluate these measures to ensure your data is as secure as possible.

We do not disclose your data to other companies or organizations unless required by law or necessary to fulfill our legal or contractual obligations to you.

We may disclose your personal data to one of our partners, suppliers, or subcontractors, but only if it is necessary for us to fulfill our obligations to you as a customer. We never disclose more personal data than is necessary.

When required by law, we may be obliged to disclose your data to authorities and other organizations. We may also need to disclose your data if necessary to establish, exercise, or defend our legal rights.

With your consent, we share normalized email or telephone data with Google as our advertising measurement provider. The Google tag hashes this data before transmission and uses it to match a website request to a prior ad interaction. Google does not share this data with other advertisers. We do not use it for personalized advertising unless you separately allow personalization.

During the temporary comparison test, Contentsquare and Microsoft process the limited analytics and session-replay data described above on our behalf as website-experience analytics providers. If you allow Analytics, Clarity may also process first-party analytics identifiers that provide continuity across pages.

We process the personal data we need to provide our services or deliver our products when we enter into or fulfill a contract with you. We base the temporary replay-comparison collection that continues after an Analytics rejection on our legitimate interests in testing usability and performance and detecting technical faults. Optional analytics storage and Clarity cross-page continuity are based on your consent and remain disabled unless you allow Analytics. We separately assess any rules requiring consent for access to information on a device; a legitimate interest under the GDPR does not override such a consent requirement.

The server-side processing of a form request’s IP address and approximate network country is based on our legitimate interests in protecting the form service, preventing abuse, diagnosing delivery problems, and administering requests. This essential operational processing does not depend on optional cookie consent.

We base the limited first-party, cookieless site measurement on our legitimate interests under the GDPR in understanding the performance of our public website, improving content and the inquiry journey, and detecting technical failures, balanced against the limited and short-lived data described above. You have the right to object to this processing. We assess separately any applicable rules on access to or storage of information on a device; legitimate interest under the GDPR is not treated as overriding a consent requirement under such rules.

We retain the data concerning you as a customer for the duration of your contract with us and for a reasonable period thereafter. This means that, in the vast majority of cases, we will not retain your personal data for more than one year from the end of the contract, but under certain conditions, we may retain your data for a longer period. This applies, for example, when required by law or when the data may be necessary to establish, exercise, and defend legal rights.

Connection-origin data is retained with the associated inquiry only for as long as reasonably necessary under the same retention principles, including to investigate security or delivery incidents and meet legal obligations.

Raw first-party site-measurement events are retained for 90 days. This period is separate from the retention of an inquiry and its associated operational records.

When we process personal data concerning you, you have several rights as a data subject. You have the right to contact us at any time about this, and if you wish to exercise any of the rights described below, you can easily reach us at sara@stockholmprivateguide.com.

We reserve the right to take appropriate protection and security measures to ensure that you are indeed the person you claim to be when you contact us. If you cannot reliably prove your identity, we may not be able to fulfill your request.

You have the right to know what personal data we process about you. If you wish to know, you can obtain from us an extract from the register containing the personal data we process about you.

If we process your personal data incorrectly or if we no longer need the data, you have the right to have it deleted. If the data is incomplete, you have the right to have it completed. Please note that we may not be able to provide you with our services if you request the deletion of your personal data.

In certain circumstances, you have the right to obtain the data we process about you in a general, written, machine-readable, and structured format. You have the right to the personal data you have provided to us and that we process based on your consent or when the personal data is necessary to conclude or execute a contract with you.

In certain conditions, you have the right to request that we limit our processing of your data. This means that we mark the data so that we only process it in the future for specific purposes. We may not be able to provide you with our services if we limit the processing of your personal data.

When we process your personal data on the basis of our legitimate interests, including the technical connection-origin data and limited first-party site measurement described above, you have the right to object on grounds relating to your particular situation. We will stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

You have the right to lodge a complaint with the Data Protection Authority if you believe that we process your personal data incorrectly. You can learn more about this on the website of the Data Protection Authority Integritetsskyddsmyndigheten.se.

You can contact us at any time by writing to sara@stockholmprivateguide.com or by calling us at +46 73 873 50 75 if you would like to know more about how we process your personal data. You can also learn more about us on our website Stockholmprivateguide.com.