Privacy policy

01 When you make an enquiry

The enquiry form asks for your name and your e-mail address and, if you want to give them, your company, your phone number and what you are planning: the kind of event or space, dates, guests, a budget and a message. We also note the time and the page you wrote from. We use this to answer you, to give you a price or set up a conversation, and, if we start working together, to give you a client login.

Legal basis: our legitimate interest in answering the people who contact us, or, when you ask for a price, the steps before an agreement. After 12 months we remove your name, company, e-mail address, phone number and message; what remains is that an enquiry came in, when and about what. Messages our spam checks hold back are deleted after 30 days. The enquiry is e-mailed to us when it arrives, and a copy goes to you.

02 When you have a client login

If your company books with us, we give you a login: your name, your e-mail address, your company and a password that only you know (we store it encrypted and can never read it). When you send a booking request, we store your answers: the package, the music, the date, time and number of guests, the people involved at the client, the venue and any agency or production company, and the sound and equipment. Everyone with a login at your company can see the company's requests.

Legal basis: the agreement with your company, and our legitimate interest in handling its bookings. A booking request is kept while your company is our client. The names and e-mail addresses of the people involved in a request are removed 12 months after the date of the event. A login that is switched off is deleted after 12 months.

03 When you ask about your data

The data request form asks for your e-mail address, what you want (to see, correct or erase your data) and, if you like, a message. We send a link to that address to make sure the request is yours.

Legal basis: our legal obligation to handle your request and to be able to show that we did. A request that is never confirmed is deleted after 30 days; for the others, your e-mail address and message are removed after 24 months.

04 Your cookie choice

When you choose in the cookie banner, we record the choice with a random consent ID (the same one kept in your browser), the categories you accepted, the version of the cookie text and the time. We never store your IP address or anything else about you with it.

Legal basis: our legal obligation to be able to show that consent was given. Each record is deleted after 24 months.

05 Statistics and marketing, only with your consent

If you accept analytics, Google Analytics records how the site is used: the pages you visit, roughly where you are, and the kind of device and browser. Google states that it does not log or store IP addresses from users in the EU. Nothing is sent to Google Analytics before you accept, and you can change your mind at any time. The client area is never measured.

Legal basis: your consent. Google keeps the data for 14 months.

If you accept marketing, Google Ads and Meta (Facebook and Instagram) record that you visited the site, so our ads can reach you on other sites and we can see how well they work. They see which pages you visit and that you sent an enquiry, never what you write in it. Nothing is sent to them before you accept, and you can change your mind at any time. The client area is never measured.

Legal basis: your consent. Our ad audiences remember a visit for at most 180 days. Google and Meta keep what they receive under their own privacy policies (Google, Meta).

06 Keeping the site running and safe

Like every website, the servers log each request: your IP address, your browser, the page and the time. These logs are kept for 30 days to find faults and stop misuse. If the site itself has an error, a report goes to our error monitoring with personal data removed before it leaves the site; reports are kept for 90 days.

Legal basis: our legitimate interest in a secure, working website.

07 Cookies and storage in your browser

A cookie is a small file the site keeps in your browser. Necessary cookies are set without asking, because the site does not work without them, or because you asked for what they do. The others are set only if you accept them.

In the client area, the booking form keeps your answers in the browser tab (session storage) while you fill it in, so moving between steps or reloading the page does not lose them. They are deleted when you send the request, log out or close the tab, and they never leave your browser until you send.

You can change your choice at any time under "Cookie settings" at the bottom of every page. If you switch analytics or marketing off, their cookies on this site are deleted. Google and Meta can also keep cookies of their own on their own sites, such as doubleclick.net and facebook.com; those follow their own cookie policies.

08 Who else handles the data

A few suppliers run parts of the website for us and handle data only on our instructions:

• Our web agency builds and runs the site.
• Google Cloud hosts it in Sweden (Stockholm).
• Postmark sends its e-mails, such as the copy of your enquiry or booking request.
• Sentry receives error reports, with personal data removed.
• Google Analytics measures visits, only if you accept it.

If you accept marketing, Google and Meta also receive data from the site, as described above. They are not our suppliers: they decide themselves how they use it, and for collecting it on our site we share the responsibility with them.

Some of them are in the United States. Where data goes there, they are certified under the EU–US Data Privacy Framework, and their agreements also include the EU's standard contractual clauses.

09 Your rights

You can ask to see the personal data we hold about you, to have it corrected or erased, to restrict how we use it, and to object to it; where we rely on your consent, you can withdraw it at any time. Use the data request form or write to info@palagosound.com. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

10 Good to know

You do not have to give us any personal data, but without a name and an e-mail address we cannot answer an enquiry. We make no automated decisions about you and build no profiles ourselves; ad audiences exist only at Google and Meta, and only if you accept marketing. The website is served over an encrypted connection, and only the people who need the data can reach it. When this policy changes, we update the date at the top; when the cookie text changes, the banner asks you again.