Privacy Policy

Who is answerable

The controller for the personal data described here — the party that decides why and how it is processed — is the entity named below.

Write to us about anything on this page at the address given, and we will answer within one month, as the GDPR requires. We have not appointed a data protection officer: our processing is small, occasional, and involves no large-scale monitoring, so the criteria in Art. 37 are not met.

What we collect

The partnership form asks for your name, company, country, email address and message. Nothing on that form is inferred, enriched or bought in from elsewhere — you see exactly what we receive.

Every visit reaches us through Cloudflare, which sees your IP address in order to deliver the page and keep attacks out. Our own server holds the address of anyone submitting the form for fifteen minutes, in memory only, purely to count requests and stop a script hammering it. It is written to no database, no log file and no disk.

If, and only if, you allow analytics, Google Analytics records how you move through the site and assigns you a random identifier. It never receives your name, your company or anything you typed into the form.

Why, and on what basis

We use what you send through the form to answer you and to take the steps you asked for ahead of any agreement between us — Art. 6(1)(b) — and, where you are writing on behalf of a company rather than as an individual, on our legitimate interest in responding to a business approach, Art. 6(1)(f).

We keep the form usable by limiting how often it can be submitted. That rests on our legitimate interest in a service that is not overwhelmed by automation, Art. 6(1)(f).

Analytics rests on your consent alone, Art. 6(1)(a). It is never claimed as a legitimate interest, and nothing analytical loads until you have said yes.

Cookies

Two cookies are essential and cannot be switched off, because refusing them would break what you asked for: one records the choice you make about cookies, and one remembers the language you selected. Neither identifies you, and neither is read by anyone but this site.

The analytics cookies are set by Google and only after you allow them. Withdraw that permission and we both stop the tag and delete what it stored — a refusal that left the identifier in place would not be a refusal at all.

You can reopen the choice at any time, from the link below or from the footer of any page.

Who else sees it

The site is delivered through Cloudflare, which protects it and carries every request to us. Cloudflare processes your IP address and the technical details of each request on our behalf, as our processor, and keeps its logs for a short period.

Your message reaches us as email through Google Workspace, which means Google processes it on our behalf and it rests in a mailbox we control.

If you consent to analytics, Google Ireland Limited receives the data that service collects, including your IP address, and acts as our processor for it.

We sell nothing to anyone, and we share nothing for advertising. Beyond the services above, personal data leaves us only where a law obliges us to hand it over.

Data leaving Europe

Cloudflare and Google are both American companies, so the services above may involve transfer to the United States. Those transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework, under which both are certified, together with the Commission's standard contractual clauses as a fallback should that decision be withdrawn.

You may ask us for a copy of the safeguards that apply.

How long it stays

Correspondence is kept while the conversation is live and for two years afterwards, so that we recognise you if you return. After that it is deleted.

The rate-limiting record expires after fifteen minutes. The cookies we set expire after twelve months, at which point you are asked again — a consent nobody has revisited for a year is not a current one.

Analytics data is retained by Google for fourteen months and then removed.

What you can require of us

You may ask for a copy of what we hold about you, have it corrected, have it deleted, have our use of it restricted, or receive it in a portable form. Where we rely on legitimate interest, you may object, and we will stop unless we can show compelling grounds that override your rights.

Where we rely on consent, you may withdraw it at any time, and doing so is as easy as giving it was. Withdrawal does not make what happened beforehand unlawful.

Ask by writing to the address in the first section. We will not charge you, and we will not ask why.

If we get it wrong

Tell us first, and we will try to put it right. You are also entitled to complain to a data protection authority — the one where you live, where you work, or where you believe the problem occurred. Ours is named below.

If this policy changes, the date at the top changes with it. Where a change affects what you have already consented to, we will ask you again rather than assume the old answer still stands.

Swedish Authority for Privacy Protection (IMY)

Every cookie, by name