Privacy and cookie policy

When you fill in the contact form we process the name, email address, company and message you provide. We use the information to respond to your enquiry and, where there is interest, to take the next step in a possible project conversation.

Our hosting provider (Vercel) logs IP address, user-agent, timestamp and the requested URL for each visit. The logs are used solely for secure operation, troubleshooting and abuse protection.

When you email info@sunsurf.se or any of our addresses, we process your email address, name and the content of the message in order to respond to you.

Legitimate interest (Article 6(1)(f)). We have a legitimate interest in being able to respond to you and assess whether we can deliver a solution that fits your business.

Legitimate interest (Article 6(1)(f)). We have a legitimate interest in keeping the site secure, available and free from abuse.

Consent (Article 6(1)(a)). PostHog is loaded and activated only after you have agreed via the cookie banner. You can withdraw consent at any time by clearing local storage in your browser — the banner will reappear and you can choose again.

The site does not set any non-essential cookies without your consent. Your choice in the cookie banner is stored in your browser's localStorage under the key "sunsurf-consent-v1" — this is technically necessary so that we remember your decision and does not require consent under Swedish telecom law (LEK) or the GDPR.

When you have accepted analytics, we activate PostHog. PostHog sets cookies / localStorage entries to assign you an anonymous distinct_id and a session id, so we can see how pages are used without linking the data to an identifiable person. We collect pageviews and the explicit events instrumented in code (contact form submitted, FAQ expanded, locale switched, mobile menu opened). Session Replay is not enabled.

You can block or delete cookies via your browser settings. To change your analytics consent specifically: clear the localStorage key "sunsurf-consent-v1" in dev tools — the banner will reappear on the next page load.

The site runs on Vercel infrastructure. Vercel processes server logs and technical data. EU Standard Contractual Clauses (SCC) apply to any transfers to third countries.

Resend is used to send and receive email from the contact form. Resend processes sender and recipient data along with message content. SCCs apply to transfers outside the EEA.

We use PostHog for web analytics. Requests go through a proxy at sunsurf.se/ingest to PostHog's EU host (eu.i.posthog.com) and are processed within the EU/EEA. PostHog acts as a data processor under a data processing agreement. Session Replay is not enabled — we collect pageviews and the events instrumented in code (contact form submitted, FAQ expanded, locale switched, mobile menu opened).

Retained for the duration of the conversation and typically up to 24 months thereafter, unless the material transitions into a customer or supplier agreement with longer retention requirements (typically Swedish accounting law, seven years).

Technical logs at Vercel are deleted or anonymised in line with their policy, typically within 30 days.

Event and session data is retained in PostHog according to their retention policy — for PostHog Cloud (EU), this is typically 7 years for events and 1 year for Session Replay (we do not use Session Replay). The PostHog distinct_id stored in your browser has a one-year lifespan and is refreshed on each visit.

You have the right to know what data we hold about you and to request that incorrect data is rectified.

You can request that data is erased or that processing is restricted, if the data is no longer needed or the processing is incorrect.

You have the right to object to processing carried out on the basis of legitimate interest, and to receive your data in a structured, commonly-used format.

If you believe we are processing your data incorrectly, you have the right to complain to the Swedish Authority for Privacy Protection (IMY) — imy.se.