Privacy Policy

Last updated: 22 May 2026. This policy applies to all pages of coldcation.se.

Coldcation.se is an independent travel guide covering Sweden, operated from Sweden. This policy explains what data we collect when you visit the site, how it is used, who it is shared with, how long it is kept, and what rights you have under the General Data Protection Regulation (GDPR) and applicable Swedish law.

We have tried to write this in plain English rather than legal boilerplate. If anything is unclear, contact us directly at privacy@coldcation.se.

1. Who We Are

The data controller for coldcation.se is Coldcation, an independent editorial operation based in Sweden. Our contact address for privacy matters is privacy@coldcation.se. We do not have a formal Data Protection Officer, as we are a small publisher that does not process personal data at a scale requiring one under Article 37 of GDPR.

2. What Data We Collect and Why

2.1 Data collected automatically when you visit

When you visit coldcation.se, your browser sends standard information to our servers. This includes your IP address, browser type and version, operating system, the page you came from, the page you requested, and the time of the request. This data is handled by Vercel, our hosting provider, and is used solely for operational purposes (ensuring the site works correctly and diagnosing errors). It is not used for advertising or tracking. Vercel's privacy policy is available at vercel.com/legal/privacy-policy.

2.2 Analytics (Google Analytics 4) — only with your consent

We use Google Analytics 4 to understand how visitors use the site — which articles are read, where traffic comes from, how long people spend on pages. This helps us produce better content. We do not use this data for advertising.

Google Analytics is only activated if you accept analytics cookies in our consent banner. If you decline, no analytics data is sent to Google. If you accept and later change your mind, you can withdraw consent at any time by visiting the cookie settings link in our site footer.

When Analytics is active, your IP address is anonymised before transmission. The data is processed by Google LLC in the United States under the EU–US Data Privacy Framework. Google's data processing terms are available at business.safety.google/gdprprocessorterms. You can also opt out of Google Analytics entirely using the Google Analytics opt-out browser extension.

Legal basis: Consent (Article 6(1)(a) GDPR).

2.3 Advertising (Google AdSense) — only with your consent

Coldcation displays advertisements served by Google AdSense. Advertising is only personalised — meaning ads shown to you based on your interests — if you explicitly consent to advertising cookies in our consent banner. If you decline advertising cookies, you will still see ads but they will not be targeted based on your personal data or browsing history.

Google AdSense sets cookies to measure ad performance and prevent fraud. When advertising consent is granted, Google may use your data across sites and apps where Google advertising is present. For full details on how Google uses data in advertising, see policies.google.com/technologies/ads. You can manage your Google ad settings at adssettings.google.com.

Legal basis: Consent (Article 6(1)(a) GDPR).

2.4 Affiliate links

Some links on coldcation.se are affiliate links — when you click them and make a purchase or booking, we may receive a commission at no extra cost to you. Affiliate links are clearly marked throughout the site. The third-party services linked to (Booking.com, GetYourGuide, Rentalcars.com, Skyscanner) have their own privacy policies governing how they handle your data once you arrive on their sites. We do not receive any personal data from affiliate conversions.

2.5 Contact form and email

If you contact us via the contact form or by email, we collect your name, email address and the content of your message. This is used solely to respond to your enquiry. We do not add contact form submissions to any mailing list, and we do not share your details with any third party. Email correspondence is retained for 24 months and then deleted.

Legal basis: Legitimate interest in responding to enquiries (Article 6(1)(f) GDPR).

3. Cookies

We use a consent management banner on your first visit to explain what cookies we set and give you control over them. The categories are:

• Necessary cookies: Required for the site to function. These include the cookie that stores your consent choice. No consent required for these.
• Analytics cookies: Set by Google Analytics 4 if you accept. Used to measure traffic and content performance. No personal data is shared with advertising networks from these cookies.
• Advertising cookies: Set by Google AdSense if you accept. Used to serve and measure advertisements. May be used to personalise ads across sites where Google advertising appears.

Your consent choice is stored in a browser cookie named cc for 12 months. You can change your preferences at any time by clearing this cookie or clicking the cookie settings link in our footer.

4. Third-Party Services

Coldcation uses the following third-party services. Each has its own privacy policy:

• Vercel (hosting): vercel.com/legal/privacy-policy
• Google Analytics 4: policies.google.com/privacy
• Google AdSense: policies.google.com/privacy
• Google Fonts: Fonts are loaded from Google's servers. Google may log the request (IP address, browser type). See developers.google.com/fonts/faq/privacy.
• Pexels (images): Images are served from Pexels CDN. Pexels may log requests. See pexels.com/privacy-policy.

5. Data Transfers Outside the EU/EEA

Google Analytics and Google AdSense process data in the United States. These transfers occur under the EU–US Data Privacy Framework and Google's standard contractual clauses, which provide equivalent protection to EU data protection law. Vercel processes data within the EU/EEA where possible. No other international data transfers occur.

6. How Long We Keep Data

• Server logs retained by Vercel: up to 30 days, then deleted.
• Google Analytics data: retained for 14 months (the minimum available in GA4 settings).
• Email and contact form submissions: retained for 24 months, then deleted.
• Consent records (the cc cookie): 12 months, stored in your browser.

We do not retain personal data longer than necessary for the purpose for which it was collected.

7. Your Rights Under GDPR

If you are located in the EU/EEA, you have the following rights regarding any personal data we hold about you:

• Right of access: You can request a copy of the personal data we hold about you.
• Right of rectification: You can ask us to correct inaccurate data.
• Right to erasure: You can ask us to delete your personal data ("right to be forgotten"), subject to certain legal limitations.
• Right to restriction: You can ask us to restrict how we process your data in certain circumstances.
• Right to data portability: You can ask for a copy of your data in a machine-readable format.
• Right to object: You can object to our processing of your data where we rely on legitimate interest as a legal basis.
• Right to withdraw consent: Where we rely on consent (analytics, advertising), you can withdraw it at any time via our cookie settings.

To exercise any of these rights, contact us at privacy@coldcation.se. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), at imy.se.

8. Children

Coldcation.se is a general-audience travel information site. We do not knowingly collect data from children under 16. If you believe a child has provided personal data through contact with this site, please contact us and we will delete it promptly.

9. Links to External Sites

Coldcation contains links to external websites (hotel booking platforms, ferry operators, airline booking sites, attraction websites). Once you leave coldcation.se, this privacy policy no longer applies. We are not responsible for the privacy practices of external sites. We recommend reading the privacy policy of any site you visit.

10. Changes to This Policy

We may update this privacy policy when our data practices change, when new laws take effect, or when the services we use change. The date at the top of this page shows when it was last updated. Significant changes will be noted on the homepage for 30 days after they take effect. Continued use of the site after a policy update constitutes acceptance of the new terms.