Privacy Policy

1. Who is responsible for your personal data?

WILTOR by Sweden AB, trading as Baby Wiltor, is the data controller for the processing described in this Privacy Policy.

2. Scope of this Policy

This Policy applies to the informational and lead-generation Website, contact forms, newsletter sign-up and related communications before any client engagement. A separate privacy notice may apply if you later enter into a service relationship or ask us to coordinate information with an independent provider.

3. Personal data we collect

• Contact and enquiry data: name, email address, telephone number, country, preferred language, the content of your message and communication history.
• Newsletter data: email address, subscription choice, consent record and unsubscribe status.
• Technical and usage data: IP address, device/browser information and security or server logs, to the extent processed by the Website’s hosting and security systems.
• Information you voluntarily provide when communicating with us.

Providing information through Website forms is not a statutory requirement or a requirement under an existing contract. Fields marked with * are required so that we can process and respond to your request and, where applicable, take steps at your request before a possible contract. If you do not provide the required fields, we may be unable to process your request. All other fields are optional.

Please do not send health or genetic records, fertility records, passport or identity-document copies, criminal-offence data, or personal data about a child through an ordinary Website form. If sensitive information is genuinely required later, we will provide an appropriate notice and secure channel and identify the applicable legal basis under Articles 6 and 9 GDPR before collecting it.

4. Why we use personal data and our legal bases

• To receive and answer enquiries and, where you request it, take steps before a possible contract — Article 6(1)(b) GDPR.
• To operate, secure and improve the Website, prevent misuse, maintain records and establish or defend legal claims — our legitimate interests under Article 6(1)(f) GDPR.
• To comply with legal obligations and lawful authority requests — Article 6(1)(c) GDPR.
• To send newsletters or other electronic marketing — consent under Article 6(1)(a) GDPR. You may withdraw consent at any time.

Where we rely on legitimate interests, we consider the necessity of the processing and balance our interests against your rights and reasonable expectations.

5. Who receives the data?

Access is limited to authorised Baby Wiltor personnel and contractors who need the data for the purposes above. We may use vetted providers of hosting, email, forms, IT support and security as data processors under appropriate agreements. Professional advisers and public authorities may receive data where necessary or legally required.

We do not sell personal data. We disclose enquiry data to an independent clinic, lawyer or other provider only when you ask us to make that introduction, authorise the disclosure, or another lawful basis applies. That provider may act as an independent controller under its own privacy notice.

Some recipients are unavoidable rather than chosen: delivering a page necessarily discloses your IP address to whoever serves its content. The providers involved, each acting under its own terms, are:

• Vercel Inc. — hosting and content delivery for every page.
• flagcdn.com — the small country flag images shown beside testimonials, on the Testimonials page only.
• Synthesia Ltd, served through Amazon Web Services — the video files used across the site, requested only after you press play.
• Google Ireland Limited (YouTube) — one video, on the Mexico programme page, requested only after you press play.
• Calendly, WhatsApp and Instagram — only if you follow a link to them; they open separately and their own terms apply from that point.

These providers receive your IP address because that is how the internet delivers content, not in order to profile you.

On some pages, selecting “Schedule via Calendly” also sends us the name of the consultant shown and the time of the click, so that your enquiry is not lost if you do not return to complete a form. That record is kept on our own systems.

6. International transfers

Some providers or requested contacts may be located outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we use a lawful transfer mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where required. GDPR Article 49 derogations are used only in exceptional situations, not as a routine transfer mechanism. You may contact us for information about the applicable safeguards.

7. How long do we keep the data?

The personal data may only be retained for as long as necessary for the purpose for which it was collected.

• Newsletter data: until you unsubscribe or withdraw consent; we may retain minimal suppression information to respect your choice.
• Security and server logs: normally up to 12 months, unless a longer period is needed to investigate an incident.
• Records required for legal compliance or legal claims: for the applicable statutory or limitation period.

We delete or anonymise data when it is no longer needed for the stated purpose, subject to legal retention requirements.

8. Cookies and electronic marketing

The Website may use technologies that are strictly necessary to operate and secure it. It does not currently use optional analytics or marketing cookies. If this changes, optional technologies will not be activated before any consent required by applicable law has been obtained, and this Policy will be updated.

One exception applies to the paragraph above. If you press play on the single video hosted on YouTube, the player loads from YouTube’s privacy-enhanced domain (youtube-nocookie.com), and YouTube (Google) may then store cookies or similar data on your device under its own terms. Nothing is loaded from YouTube or stored before you press play, and no other provider stores anything on your device. A separate Cookies page on this Website describes this in plain language, together with the date it was last checked.

Electronic marketing

We send electronic marketing only where legally permitted. Every marketing message will provide a simple way to unsubscribe.

9. Security, children and automated decisions

We use proportionate technical and organisational safeguards to protect personal data. No online transmission or storage system is completely secure, so please use the designated channel and avoid sending unnecessary sensitive information.

The Website is intended for adults. We do not knowingly collect personal data directly from children through lead forms. We do not use Website data for solely automated decisions that produce legal or similarly significant effects.

10. Your rights

Subject to the GDPR and applicable conditions, you may request access, correction, erasure, restriction or portability of your data; object to processing based on legitimate interests; object at any time to direct marketing; and withdraw consent without affecting earlier lawful processing. You may also lodge a complaint with a supervisory authority.

Send requests to hello@babywiltor.com. We may need to verify your identity. We normally respond within one month; the GDPR permits an extension in complex cases, in which case we will inform you within the first month.

You may complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), https://www.imy.se, or another competent EEA supervisory authority.

11. Changes and contact

We may update this Policy to reflect legal, technical or operational changes. The current version and revision date will be published on the Website. A new purpose that requires consent will not be treated as accepted merely because you continue to use the Website.

For privacy questions or requests, contact hello@babywiltor.com or write to us at Bergakungen 2, Lgh 1204, 793 32 Leksand, Sweden.