Last updated 24 September 2026
Privacy policy
This policy explains what personal data Hagby Farm collects through this website and our events, why, and what your rights are.
Who is responsible
Hagby Farm (Hagby Gård), Hagbyvägen 41, 18770 Täby, Sweden, is the data controller. Contact us about anything in this policy at hello@hagbyfarm.com or +46 70 001 27 16.
What we collect and why
| Purpose | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Newsletter To send you news from the farm. | Email address. Proof of your consent: the date, the wording you agreed to, a one-way hash of your IP address, and your browser type. | Your consent (GDPR art. 6(1)(a)), confirmed by clicking the link in our confirmation email. | Until you unsubscribe. We keep proof of your consent, and the fact that you withdrew it, for as long as we may need to show we had it. |
| Expression of interest (Join page) To contact you when stable places open up. | Name and email address. | Steps at your request before a possible agreement (art. 6(1)(b)). | Up to 24 months, or until you ask us to delete it. |
| Event bookings and waitlists (including Test Kitchen) To handle your reservation or waitlist place, take the deposit, and prepare your meal safely. | Names, email address, mobile number, number of seats, payment status, and any dietary needs or allergies you tell us about. | To fulfil the reservation (art. 6(1)(b)). Allergy and dietary information can be health data. We use it only because you choose to give it to us, for preparing your meal (art. 9(2)(a)). | Dietary information is deleted automatically the day after the event. Payment records are kept for 7 years, as the Swedish Bookkeeping Act requires. Other booking details are kept for up to 24 months. |
| Website analytics To understand how the site is used. | Pages visited, device and browser information, and approximate location, collected by Google Analytics. | Your consent (art. 6(1)(a)), given in the cookie banner. Nothing is collected until you accept. | Up to 14 months in Google Analytics. |
| Contact with us To reply and keep track of our conversations with you. | Whatever you include when you email or call us, plus notes our team makes about the conversation. | Our legitimate interest in answering and following up enquiries (art. 6(1)(f)). | Up to 24 months after our last contact. |
Newsletter wording you agree to when signing up: “Email me news from Hagby Farm: yard updates, events, and first word when stable places open. You can unsubscribe at any time.”
Who we share it with
We don’t sell your data or use it for advertising. We use these service providers, who process data only on our instructions and under data processing agreements:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database for contacts and consent records | EU (Sweden) |
| Vercel | Website hosting | EU and US |
| Upstash | Spam protection (rate limiting) | EU and US |
| Resend | Sending email | US |
| Stripe | Deposit payments | EU and US |
| Website analytics (only with your consent) | EU and US |
Where data is handled outside the EU/EEA, the transfer is protected by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.
Cookies
We use a small number of essential cookies to run the site, including remembering your cookie choice and keeping staff signed in to the admin area. Google Analytics cookies are only set if you accept them. You can change your choice at any time with .
How we protect it
Data is encrypted in transit and at rest. Staff access needs a password and an authenticator app, and every account can see only what its role requires. Changes to personal data are logged.
Your rights
You have the right to:
- get a copy of the personal data we hold about you;
- have incorrect data corrected;
- have your data erased, unless we’re legally required to keep it;
- restrict or object to how we use it;
- receive your data in a portable format;
- withdraw your consent at any time, for example with the unsubscribe link in any of our emails. Withdrawing doesn’t affect anything we did before you withdrew.
Email hello@hagbyfarm.com to use any of these rights. We reply within one month.
If you’re unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.
Changes
If we change this policy we’ll update the date at the top. If a change affects something you consented to, we’ll ask again.