Privacy Notice

1. Who is responsible for your personal data?

Welcome 2 Sweden AB, trading as VIP Sweden ("VIP Sweden", "we", "us" or "our"), is the data controller for the processing described in this notice unless we expressly state otherwise.

2. Scope of this notice

This notice applies to personal data processed in connection with:

• our website and online enquiry forms;
• concierge and lifestyle-management enquiries;
• travel, accommodation, transport and aviation arrangements;
• security, childcare, household staffing and personal-assistance services;
• dining, catering, events and experiences;
• corporate, supplier and partner relationships;
• marketing communications where permitted; and
• recruitment and job applications.

Third-party websites and services linked from our website operate under their own privacy notices. We are not responsible for their independent processing.

3. Personal data we may collect

Depending on your relationship with us and the service requested, we may collect:

• Identity and contact data: name, title, postal address, email address, telephone number, nationality and preferred language.
• Client and service data: requests, preferences, itineraries, reservations, guest lists, accompanying travellers, household or family requirements and communications with us.
• Travel and identification data: passport or identity-document details, date of birth, visa information, loyalty-programme details and other information required by travel suppliers or authorities.
• Payment and transaction data: billing details, payment status, purchase history and records required for accounting. Payment-card data may be processed directly by a payment provider rather than stored by VIP Sweden.
• Security and logistics data: arrival and departure information, access instructions, emergency contacts, security requirements and location information voluntarily supplied for a service.
• Technical and website data: IP address, browser and device information, pages viewed, referring page, security and abuse-prevention data, and diagnostic logs. The website application may use hashed network identifiers for rate limiting and duplicate-send prevention. Hosting and communications providers may process raw request data under their own controlled logging arrangements.
• Business data: company, role, professional contact information and correspondence.
• Recruitment data: CV, qualifications, work history, references, right-to-work information and other material supplied with an application.

Please avoid sending more personal data than is necessary. If you provide data about another person, you should be authorised to do so and, where appropriate, make this notice available to them.

4. How we collect personal data

We collect personal data directly from you, from a person acting on your behalf, through our website and communications, and while delivering our services. Where relevant, we may also receive data from family offices, employers, travel organisers, hotels, transport providers, event organisers, security providers, recruitment contacts, public professional sources and other suppliers involved in a request.

5. Why we process personal data and our legal bases

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing carried out before consent was withdrawn.

6. Sensitive personal data and information about children

Some concierge, travel, dining, security or childcare requests may require information concerning health, accessibility, allergies, dietary requirements, religious requirements or other sensitive circumstances. We request and use this information only when necessary and when an additional legal condition applies, normally your explicit consent or another condition permitted by law.

We may process information about children when a parent, guardian or authorised client asks us to arrange services for a family. We limit this information to what is necessary for the child's travel, care, safety or requested service and apply enhanced confidentiality and access controls.

7. Who may receive personal data?

We may disclose personal data only when necessary and proportionate to:

• hotels, villas, airlines, private-aviation operators, transport companies and destination partners;
• restaurants, venues, event organisers, chefs and experience providers;
• security providers, nannies, household staff and other personnel involved in the requested service;
• payment, banking, accounting, insurance and professional advisers;
• website hosting, IT, communications, CRM, form, storage and analytics providers;
• government bodies, regulators, courts, law-enforcement authorities or other recipients when required by law; and
• a purchaser or successor in connection with a genuine corporate transaction, subject to appropriate confidentiality.

Recipients receive only the information reasonably required for their role. Service providers acting on our behalf are subject to contractual confidentiality and data-protection obligations where required. Independent providers, such as hotels and airlines, may act as separate data controllers under their own privacy notices.

8. International data transfers

Because our services can involve international travel and suppliers, personal data may need to be transferred outside Sweden and the European Economic Area. The level of data protection in a destination country may differ from that in the EEA.

Where GDPR requires a transfer safeguard, we use an applicable European Commission adequacy decision, approved Standard Contractual Clauses with any required supplementary measures, or another lawful transfer mechanism. In limited cases, a transfer may be necessary to perform a contract or arrange a service requested by you.

You may contact us for more information about the safeguards relevant to a particular transfer.

9. Cookies, analytics and similar technologies

The public website is designed not to set cookies or use local browser storage during ordinary browsing or form submission. If Plausible Analytics is activated, it operates without cookies but processes limited page, referral, device and network metadata to provide aggregate website statistics.

A short-lived, strictly necessary access cookie may be used only for authorised editorial preview. It is not used for ordinary public browsing. We do not use advertising or marketing cookies on the initial website launch.

Further details are provided in our Cookie Policy. If we later introduce non-essential cookies or similar technologies, we will update the policy and obtain consent before activating them where required.

10. How long we keep personal data

We retain personal data only for as long as necessary for the relevant purpose, taking account of contractual commitments, safety, limitation periods and legal requirements. Typical periods are:

• uncompleted general enquiries: normally up to 24 months after the last meaningful contact;
• client and service records: for the duration of the relationship and thereafter for as long as needed for claims, compliance and legitimate business records;
• invoices and accounting documentation: seven years, or longer if required by applicable law;
• marketing records: until you unsubscribe or object, subject to a limited suppression record so that we can respect your choice;
• unsuccessful recruitment applications: normally up to two years after the recruitment process, unless a different period is agreed or required; and
• website analytics and technical logs: for the periods stated in the Cookie Policy or the relevant provider settings.

When data is no longer required, we delete or anonymise it, unless continued storage is required by law or necessary for legal claims.

11. How we protect personal data

We use technical and organisational measures appropriate to the nature and risk of the processing. These may include access restrictions, confidentiality obligations, authentication controls, secure systems, supplier review, staff guidance, backups and incident-response procedures.

No method of transmission or storage is completely secure. Please do not send passport copies, payment details, medical information or other highly confidential material through an unapproved channel. Contact us if you need a suitable way to share sensitive documents.

12. Your data-protection rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• receive information about our processing and obtain access to your personal data;
• have inaccurate or incomplete data corrected;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests and object at any time to direct marketing;
• receive certain data in a portable format;
• withdraw consent at any time; and
• lodge a complaint with a competent supervisory authority.

To exercise a right, email privacy@vipsweden.com. We may need to verify your identity. We normally respond within one month, although the law permits an extension for complex or numerous requests.

We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects on you.

13. Contact and complaints

Questions, requests and privacy complaints may be sent to:

You may also lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at www.imy.se, or with the data-protection authority in the EEA country where you live or work or where you believe an infringement occurred.

14. Changes to this notice

We may update this notice when our services, systems or legal obligations change. The current version will be published on our website with its updated date. Where appropriate, we will provide additional notice of material changes.