Privacy policy

Controller

Företagsnamn is the controller. You can reach us at info@example.se.

What we collect

When you send the contact form we store:

• your name and email address
• your phone number and company name, if you provide them
• which service it concerns and your message
• language, which page you sent it from and when you gave consent

Your IP address is used temporarily to limit abuse of the form and is not stored with your message.

If you create an account

The account is optional. We store your name and email address, an encrypted (hashed) password that we can never read, and when the account was created and when you last logged in. Login is handled by Supabase Auth within the EU.

With the account you can see enquiries you sent while logged in or from your confirmed email address, and message us about them. The messages are stored with the enquiry and deleted under the same rules. You can delete the account yourself under My account; the login is then deleted immediately. The enquiries themselves are kept according to the rules below.

We use two strictly necessary cookies for login (they cannot be read by the page's scripts) and one cookie that only says you are logged in. None of them are used for tracking.

Why, and on what legal basis

We use the data to reply to your enquiry, prepare a quote and follow up. The legal basis is steps prior to a possible contract (Article 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Article 6(1)(f)). The account is based on the agreement you enter into when creating it (Article 6(1)(b)).

Protection against automated abuse (CAPTCHA and per-IP rate limiting) is based on our legitimate interest in keeping the service secure.

How long we keep the data

Enquiries that don't lead to a project are deleted or anonymised no later than 24 months after they arrived. If you become a customer we keep the data for the duration of the agreement and then as long as the Swedish Accounting Act requires.

Processors

We use the following suppliers, which process data on our behalf under data processing agreements:

• Supabase – the database where enquiries are stored (Stockholm region, EU)
• Amazon Web Services (SES) – sends the enquiry to our inbox (Stockholm region, EU)
• Google (Gmail) – our email, where the enquiry is received
• Cloudflare – the CAPTCHA (Turnstile) that protects the form from bots

Google and Cloudflare may process data outside the EU. Such transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

Cookies and analytics

The website uses no tracking or marketing cookies and no analytics that identify you. Login cookies are only set if you log in (see above). The CAPTCHA service may use strictly necessary storage to tell whether the form is being sent by a human.

We keep anonymous visitor statistics with Umami, which runs on our own server. It uses no cookies, stores nothing on your device and shares no data with third parties. We see which pages are visited, which website the visitor came from, browser, operating system, device type, language and approximate location (country and city). Your IP address and browser type are turned into an anonymous ID that changes every month, so unique visitors can be counted. The IP address itself is not stored. Statistics are never collected on logged-in pages. If your browser sends Do Not Track, your visit is not counted. Legal basis: legitimate interest in improving the website.

Your rights

You have the right to request access to, correction or erasure of your data, to request restriction, to object to processing and to receive your data (data portability). Write to info@example.se.

You can also lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.