Privacy policy
- Last updated
- 2026-07-16
- Version
- 1.0
1. Summary
Nyttio Demo AB respects your privacy and processes personal data responsibly, securely, and transparently.
This privacy policy explains:
- what personal data we process,
- why we process it,
- the lawful basis for each processing activity,
- who may receive the data,
- how long the data is retained,
- whether data is transferred outside the EU/EEA,
- the rights available to you.
The policy applies to customers, prospective customers, users, business customer contacts, suppliers, job applicants, and website visitors.
2. Data controller
The controller responsible for the processing described in this policy is:
- Company name
- Nyttio Demo AB
- Registration number
- 556799-1234
- Postal address
- Storgatan 1
111 22 Stockholm - Email
- privacy@example.com
- Phone
- 08-123 45 67
- Website
- https://example.com
- Privacy contact
- privacy@example.com
If several companies jointly determine the purposes and means of processing, their responsibilities as joint controllers must be described in this section or a separate appendix.
3. What are personal data and processing?
Personal data means any information relating directly or indirectly to an identified or identifiable natural person. Examples include names, contact details, customer numbers, IP addresses, images, user data, and information about how a person uses a digital service.
Processing means any operation performed on personal data, including collection, recording, organisation, storage, use, disclosure, compilation, erasure, or anonymisation.
4. What personal data do we process?
Depending on your relationship with us, we may process the following categories of personal data.
4.1 Identity data
Names, usernames or customer numbers, dates of birth, national identification numbers where justified and lawful, and information about authority or signatory rights.
4.2 Contact details
Email addresses, telephone numbers, postal and delivery addresses, company names, job titles, and workplaces.
4.3 Customer, contract, and order data
Quotations, orders, contracts, subscriptions, product and service history, delivery details, complaints, returns, warranty cases, and communications concerning the customer relationship.
4.4 Payment and financial data
Invoice information, payment status, transaction references, bank or account details, credit information, and information required for bookkeeping and accounting. We do not normally store complete payment card details where payment is handled by an external payment provider.
4.5 Communication and support data
Emails, support cases, contact form submissions, chat messages, telephone notes, feedback, questions, and complaints. If telephone calls are recorded, the purpose, lawful basis, and retention period must be clearly stated.
4.6 Account and usage data
Login information, account settings, roles and permissions, usage history, consents and choices, and activity in our services. Passwords must be stored securely and never in plain text.
4.7 Technical data
IP addresses, device and browser information, operating systems, timestamps, logs, session identifiers, error reports, security events, and information about use of the website or service.
4.8 Marketing data
Communication preferences, subscription status, campaign history, opened messages, clicked links, objections to direct marketing, areas of interest, and customer segments.
4.9 Supplier and partner data
Names, job titles, employers, contact details, contract-related communications, permissions, and delivery information.
4.10 Job applicant data
This section should be removed if the business does not process recruitment data. Examples include names, contact details, CVs, cover letters, education and work experience, references, work samples, interview notes, salary expectations, and other information supplied by the applicant.
4.11 Special category personal data
We do not normally request special category data, such as information about health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, biometric data, or sexual orientation. If such data is processed, the categories, purpose, and applicable Article 9 GDPR condition must be stated explicitly.
4.12 Criminal offence data
If information about offences, allegations, convictions, or security incidents is processed, this must be described separately. Such processing requires specific legal authority and must not be included routinely.
4.13 Business-specific processing
Customer administration, quotations, orders, support, invoicing, website operations, security, marketing, and recruitment.
5. Why do we process personal data?
The table must be adapted to reflect the business's actual processing activities.
5.1 Legitimate interests
Where we rely on legitimate interests, we assess whether the interest is legitimate and clearly defined, whether the processing is necessary, and whether the data subject's interests, rights, and freedoms override that interest.
5.2 Consent
Where processing is based on consent, providing consent is voluntary and it may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
6. Where do we obtain personal data?
We may collect personal data directly from you; from the organisation or employer you represent; from people acting on your behalf; from customers, suppliers, or partners; from payment, delivery, or identity providers; from public registers and publicly available sources; from credit reference agencies; through use of websites, apps, or digital services; and through cookies, logs, and similar technologies.
Where data is not collected directly from you, we provide information in accordance with applicable rules, normally no later than the first communication or within the GDPR time limit.
7. Are you required to provide personal data?
Some personal data is required to enter into or perform a contract, deliver a product or service, administer payment, comply with a legal obligation, or create and protect a user account. If you do not provide this data, we may be unable to provide the service, complete the order, enter into the contract, or handle the matter.
8. Who may access personal data?
Access is restricted to people who need the data to perform their duties.
8.1 Processors acting on our behalf
These may include providers of hosting and cloud services, customer and case management systems, email and communications, accounting, backups, IT security, support, system maintenance, analytics, marketing, printing, and distribution. Processors may act only on our documented instructions and under a data processing agreement.
8.2 Independent controllers
These may include banks and payment providers, carriers, credit reference agencies, insurers, auditors, legal advisers, debt collection companies, authorities, and courts.
8.3 Authorities and legal recipients
We may disclose personal data where required by law or authority decision, where necessary to prevent or investigate crime, or to establish, exercise, or defend legal claims.
8.4 Corporate transactions and reorganisations
In connection with a merger, financing, reorganisation, sale, or transfer of all or part of the business, relevant personal data may be disclosed to advisers, potential purchasers, and other affected parties.
9. Our main suppliers
Providers of cloud hosting, email, CRM, accounting systems, payments, support, analytics, backups, and IT security.
An up-to-date list of processors may be obtained by contacting us or through the website stated in this policy.
10. Transfers outside the EU and EEA
We aim to process personal data within the EU/EEA. Some suppliers or sub-processors may be located in or access data from countries outside the EU/EEA. We ensure that a valid transfer mechanism is used, such as an adequacy decision, the European Commission's Standard Contractual Clauses, Binding Corporate Rules, or another permitted mechanism.
We aim to process personal data within the EU/EEA. Where a third-country transfer occurs, the recipient, country, data, transfer mechanism, and supplementary safeguards must be stated.
11. Cookies and similar technologies
Necessary cookies are used for core functions. Analytics, preference, or marketing cookies are used only where legally supported and, when required, with consent.
Our website or digital service may use cookies, local storage, pixels, SDKs, and similar technologies. Necessary technology may be used without consent where required for a service expressly requested by you. Consent is obtained for analytics, personalisation, advertising, and other non-essential purposes where required.
You must be able to accept or reject non-essential technology, make category choices where relevant, change or withdraw your choice, and obtain information about providers, purposes, and retention periods. Cookie choices are available through the cookie settings and further information is provided in our cookie policy.
12. Direct marketing
We may use personal data to send relevant information, offers, and other direct marketing by email, SMS, telephone, or post. Processing is based on consent or legitimate interests depending on the relationship, channel, and applicable rules.
You have an unconditional right to object to direct marketing. You may unsubscribe through an electronic message, account settings, or by contacting privacy@example.com.
13. Profiling and personalisation
If profiling is not used, this should be stated. Where limited profiling is used, we may analyse customer history, interests, or service usage to tailor information, select relevant content, identify customer segments, and improve services. Profiling must not itself produce legal or similarly significant effects unless specifically described.
14. Automated decision-making
We do not normally make decisions based solely on automated processing that produce legal or similarly significant effects. If such decision-making occurs, the decision, data, lawful basis, logic, significance, consequences, and safeguards must be described.
15. Use of AI-based services
If AI-based services process personal data, the specific purposes, lawful basis, provider role, international transfers, human oversight, and whether data may be used for model training must be described. Remove this section if AI services do not process personal data.
16. How long do we retain personal data?
We do not retain personal data longer than necessary for each purpose. Retention depends on the duration of contracts and customer relationships, administration needs, statutory archiving requirements, limitation and complaint periods, legal claims, security and fraud risks, consents, and objections.
Customer and contract data is retained during the customer relationship and afterwards according to legal requirements, complaint periods, and limitation rules. Accounting records are retained in accordance with applicable accounting rules.
When data is no longer required, it is securely deleted or anonymised. Backups are subject to separate rotation and deletion procedures.
17. How do we protect personal data?
We use appropriate technical and organisational measures based on the nature, scope, context, purposes, and risks of processing. Measures may include access controls, strong authentication, encryption, logging, security monitoring, backups, vulnerability management, training, confidentiality commitments, supplier reviews, incident management, and secure deletion procedures.
18. Personal data breaches
A personal data breach may involve accidental or unlawful destruction, loss, alteration, disclosure of, or access to personal data. We maintain procedures to detect, report, contain, investigate, and document incidents and, where required, notify the competent authority and affected individuals.
19. Your rights
Your rights depend partly on the lawful basis and the circumstances of the processing.
19.1 Right to information
You have the right to clear information about how we process personal data.
19.2 Right of access
You may request confirmation of whether we process your personal data and obtain access to the data and information about the processing.
19.3 Right to rectification
You may request correction of inaccurate data and completion of incomplete data.
19.4 Right to erasure
You may request erasure in certain circumstances. This right is not absolute, and data may need to be retained for legal obligations or claims.
19.5 Right to restriction
You may request restriction in certain circumstances, for example while accuracy is verified or an objection is assessed.
19.6 Right to data portability
Where processing is automated and based on consent or contract, you may have the right to receive data in a structured, commonly used, machine-readable format.
19.7 Right to object
Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. The right to object to direct marketing is unconditional.
19.8 Right to withdraw consent
Where processing is based on consent, you may withdraw consent at any time.
19.9 Rights concerning automated decisions
If you are subject to a significant decision based solely on automated processing, you may have the right to human intervention, to express your view, to receive an explanation, and to challenge the decision.
20. How to exercise your rights
Send requests to:
- Email
- privacy@example.com
- Postal address
- Storgatan 1
111 22 Stockholm - Subject
- Personal data request
Describe the right you wish to exercise and provide enough information for us to identify the relevant processing and handle the request. We may request further information to verify your identity. We normally respond without undue delay and within one month. This period may be extended for complex requests in accordance with the GDPR.
21. Complaints to a supervisory authority
Please contact us first if you have questions or concerns. You also have the right to lodge a complaint with the competent data protection authority. In Sweden, the supervisory authority is the Swedish Authority for Privacy Protection (IMY).
22. Children's personal data
Our services are not normally directed to children, and we do not knowingly collect children's personal data without an applicable lawful basis. If children may use the service, age limits, parental consent flows, and specific safeguards must be described.
23. Links and external services
Our website or service may contain links to external websites or integrated third-party services. We are not responsible for processing carried out by an external party acting as an independent controller.
24. Changes to this privacy policy
We may update this policy when processing activities change, new services or features are introduced, suppliers or transfer mechanisms change, or laws and regulatory guidance are updated. The current version is always available at https://example.com. We will provide appropriate notice of material changes.
25. Contact
Questions about this privacy policy or our processing of personal data may be sent to:
- Company name
- Nyttio Demo AB
- Registration number
- 556799-1234
- Postal address
- Storgatan 1
111 22 Stockholm - Email
- privacy@example.com
- Phone
- 08-123 45 67
- Website
- https://example.com
- Privacy contact
- privacy@example.com
