Privacy notice for Nyttio
This notice explains in plain language when TellMeTellus is responsible for personal data itself and when we only handle it on behalf of a customer business.
1. Controller for the website and account
TellMeTellus AB, company registration number 559066-3703, is responsible for personal data needed for Nyttio's website, accounts, customer contact, operations and security. When we process personal data that a customer places in its Nyttio business environment, we normally do so as a processor on the customer's instructions.
2. Data we may need
- Account and contact data, such as name, email address, username and company details.
- Information needed to grant access, provide support, prevent misuse and resolve technical faults.
- Content a customer or its users choose to add to the service, such as business records and documents.
- Limited technical data needed for security and troubleshooting. We must not use document content or secrets in logs.
3. Why we need data
| Purpose | Example | Legal basis in this draft |
|---|---|---|
| Provide your account and service | Sign-in, permissions and features you request | Contract or steps before a contract |
| Security and operations | Protect accounts, detect abuse and correct technical faults | Legitimate interests and, where required, legal obligation |
| Customer service | Answer questions and handle a case | Contract and legitimate interests |
| The customer's own content | Store and process content the customer chooses to use in Nyttio | Customer instructions under the data processing agreement |
4. Who may receive data
Only people at TellMeTellus who need the information for their work may access it. We may also use subprocessors for operations or a function the customer expressly chooses. The open, current list is available on the Subprocessors page.
AWS is approved by TellMeTellus for Nyttio's staging environment for Invoice inbox. The function is not enabled for real customer data until contract checks, a retention decision and technical controls are completed. Until then, only synthetic test data is used.
5. Where data is processed
Nyttio's planned infrastructure selects European regions for services that process customer data. The exact region and protections for each provider are shown in the subprocessor register. If a transfer outside the EU/EEA ever becomes relevant, it must be assessed and documented before use.
6. How long data is kept
We keep data for as long as it is needed for the purpose, to fulfil an agreement or to meet legal obligations. When a user closes an account, access ends immediately; the account can be restored for 30 days and is then pseudonymised. Company material follows the company's own retention and deletion assessment. A dedicated plan for raw Invoice inbox email and quarantine is not yet established, which is why those areas are not used with real customer data.
7. Your rights
You may, among other things, request access, correction, erasure or restriction, and object to processing based on legitimate interests. You can download your personal account data in account settings. If data is in a customer business's Nyttio account, contact that business first. TellMeTellus will help the customer under the data processing agreement.
You may also lodge a complaint with the Swedish Authority for Privacy Protection. A way to contact TellMeTellus must be added here before publication.
- Swedish Authority for Privacy ProtectionInformation about rights under data-protection rules.
8. Cookies and similar technology
This version uses a necessary local language preference. No analytics cookies are configured. If this changes, the cookie information must be updated before the new technology is used.