Controller Art. 13(1)(a)
Creedcon AB, organisation number 559604-9170, with its registered seat in Stenungsund, is the controller for the processing described here. You can reach us at hey@creedcon.se or by post at Åregren 303, 444 95 Ödsmål, Sweden.
What we process and why Art. 13(1)(c)
| Activity | Data | Purpose | Legal basis |
|---|---|---|---|
| Visiting the website | Technical data such as IP address and browser in the hosting provider’s server logs | Deliver the website and protect it from abuse | Legitimate interest (Art. 6(1)(f)) |
| Error reports from browsers | The kind of problem, the page address and the blocked file, without query strings; no IP address or browser details are stored | Find and fix faults in the website and detect attempts to tamper with it | Legitimate interest (Art. 6(1)(f)) |
| Page views | The page address without query strings, the domain of the website you came from and the country your request comes from; no cookies, IP address or browser details are stored, and browsers that send Global Privacy Control are not counted | Know which pages are read and how visitors find the website | Legitimate interest (Art. 6(1)(f)) |
| Contact by email | Name, email address, employer and the content of the message | Reply to the enquiry and prepare a possible engagement | Pre-contractual steps and legitimate interest (Art. 6(1)(b) and (f)) |
| The booking calendar on the contact page | IP address and technical data your browser sends to Koalendar when the calendar loads | Show the booking calendar so you can book a meeting directly | Legitimate interest (Art. 6(1)(f)) |
| Booking a meeting | Name, email address, the time you choose and what you write in the booking | Book and hold the meeting and prepare a possible engagement | Pre-contractual steps and legitimate interest (Art. 6(1)(b) and (f)) |
| Consulting engagements | Contact details of the client and its contact persons, contract data | Perform the engagement, invoice | Contract (Art. 6(1)(b)), legal obligation for bookkeeping (Art. 6(1)(c)) |
| Account in Qimbas™ | Name, email address, organisation, role, sign-in credentials, sign-in times | Provide access to the service, security and traceability | Contract (Art. 6(1)(b)), legitimate interest in security (Art. 6(1)(f)) |
| Billing | Billing details, payment history | Invoice and meet bookkeeping requirements | Contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)) |
The website uses no trackers of its own and sets no cookies. Page views are counted on the server from the request your browser makes for the page; nothing is read from your device. The exception is the contact page, which shows Koalendar’s booking calendar. It is loaded from Koalendar when you open the page, and your browser then sends your IP address and technical data to Koalendar and to services the calendar loads content from. The calendar also stores data in your browser. That is governed by Koalendar’s privacy policy, and we do not receive what is stored in your browser. See the cookies page.
Recipients Art. 13(1)(e)
The data is handled by Creedcon AB. We use providers that process data on our behalf, for example for hosting the website, email, booking meetings, operating Qimbas™ and bookkeeping. Current providers: Cloudflare, Inc. (hosting of the website), Microsoft Ireland Operations Limited (email and calendar in Microsoft 365), Koalendar Inc. (booking meetings) and Arcim Technology AB with its service Accounted (bookkeeping and invoicing). For Qimbas™ there is a list on the Subprocessors page. We do not disclose data to others unless required by law.
Transfers outside the EU/EEA Art. 13(1)(f)
We aim to process data within the EU/EEA. If a provider transfers data to a country outside the EU/EEA, this is done under the European Commission’s standard contractual clauses or an adequacy decision, such as the EU–US Data Privacy Framework. Providers concerned: Cloudflare, Inc. in the USA, under the EU–US Data Privacy Framework with standard contractual clauses as a fallback; Microsoft, where Microsoft Corporation in the USA and its subprocessors may access data, under the EU–US Data Privacy Framework and standard contractual clauses; Koalendar Inc. in the USA, under standard contractual clauses; and Accounted, whose emails with invoices are sent through a provider in the USA under the EU–US Data Privacy Framework.
How long we keep data Art. 13(2)(a)
- Email correspondence and meeting bookings that do not lead to an engagement: deleted no later than twelve months after the last contact.
- Data in consulting engagements: for the duration of the engagement and thereafter as long as required for warranty, complaints and bookkeeping.
- Accounts in Qimbas™: for the contract term, deleted no later than 30 days after the contract ends unless the customer requests earlier deletion.
- Accounting records: seven years under the Swedish Accounting Act.
- Page view and error report counts: three months, after which the hosting provider deletes them automatically.
Your rights Art. 13(2)(b)–(c)
You have the right to request access to, rectification of and erasure of your personal data, to request restriction of processing, to object to processing based on legitimate interest, and to receive data you have provided in a machine-readable format. Contact us at hey@creedcon.se. We reply within one month.
Complaints Art. 13(2)(d)
You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, SE-104 20 Stockholm, imy.se. If you live in another EU/EEA country you may also lodge a complaint with the supervisory authority there.
Data in Qimbas™ on a customer’s behalf Art. 28
When a customer connects its log sources to Qimbas™, Creedcon AB processes the data in those logs as a processor on the customer’s behalf. The customer is the controller. That processing is governed by the data processing agreement, not by this policy. Questions about such data should be directed to the customer.
Automated decision-making Art. 13(2)(f)
We make no decisions about you based solely on automated processing.
Changes
We update this policy when the processing changes. The date at the top shows when the text was last changed.