Privacy Policy

1. Who we are

Staysion (staysion.com) is a travel price-comparison and affiliate site operated from Sweden. We help travellers discover and compare hotels, resorts, and lodges worldwide. For data-protection purposes, Staysion acts as the data controller for personal data processed through this website.

Contact: [email protected]

2. Data we collect

We collect only the data necessary to operate and improve the site:

• Usage data — pages visited, time on site, clicks, referring URL, browser type, and approximate IP-derived location. Collected automatically by Google Analytics 4 when you consent.
• Consent preference — your cookie consent choice is stored in your browser's localStorage under the key staysion_consent. This is not transmitted to our servers.
• Contact form data — if you send us a message via the contact page, your name, email address, and message are transmitted to us via email.
• Affiliate click data — when you click a booking link, affiliate partners (Travelpayouts, Booking.com, Agoda, Expedia, Trip.com) may set their own tracking cookies. We do not control this data.

3. How and why we use your data

• Analytics (legitimate interest / consent) — we use Google Analytics 4 to understand how visitors use the site. GA4 is only activated after you give explicit consent via the cookie banner.
• Site performance — Cloudflare processes request metadata (IP address, headers) to serve pages securely and efficiently. This is necessary for the operation of the site (legitimate interest).
• Communication — if you contact us, we use your details solely to respond to your enquiry.

4. Legal basis for processing (GDPR)

• Consent (Art. 6(1)(a)) — analytics cookies and GA4 tracking are only activated after you accept via the cookie banner. You may withdraw consent at any time.
• Legitimate interest (Art. 6(1)(f)) — security and infrastructure processing by Cloudflare is necessary to operate the site safely.
• Contract performance (Art. 6(1)(b)) — if you contact us with an enquiry, we process your data to respond.

5. Third-party data processors

We use the following third-party services. Each acts as a data processor under our instructions and/or as an independent controller:

6. Data transfers outside the EEA

Some of our processors (Google, Cloudflare) may transfer data to servers outside the European Economic Area. Where this occurs, it is covered by Standard Contractual Clauses (SCCs) approved by the European Commission, or the processor participates in an approved adequacy framework.

7. Data retention

• Google Analytics 4 data: 14 months (Google's default retention period).
• Contact form messages: retained in our email inbox until no longer needed, then deleted.
• Consent preferences: stored locally in your browser until you clear site data.

8. Your rights under GDPR

If you are in the EU/EEA, you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — ask us to correct inaccurate data.
• Right to erasure — ask us to delete your data (“right to be forgotten”).
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interest.
• Right to withdraw consent — you can change your cookie preferences at any time by clearing your browser's site data or by using the cookie banner again.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

9. Cookies and tracking technologies

We use cookies and browser storage to improve functionality and, with your consent, to analyse site usage. For full details, see our Cookie Policy.

10. Affiliate links

This website contains affiliate links to third-party booking platforms. When you click an affiliate link and complete a booking, Staysion may receive a commission from the partner at no extra cost to you. Prices and availability are determined solely by the booking platforms — Staysion does not influence them.

11. Right to lodge a complaint

If you believe your data has been processed unlawfully, you have the right to lodge a complaint with a data-protection supervisory authority. In Sweden, the relevant authority is Integritetsskyddsmyndigheten (IMY).

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the site after an update constitutes acceptance of the revised policy.