Privacy Notice

1. About this notice

We publish this notice to comply with our information obligations under Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR") and equivalent laws. It applies to fdeploy.com, docs.fdeploy.com, and any other website or service we operate that links to it. Words like "personal data", "controller", "processor", and "data subject" have the meaning given in the GDPR.

We have not appointed a Data Protection Officer. The criteria in Article 37 GDPR for mandatory appointment do not apply to us: we are not a public authority, our core activities do not require regular and systematic monitoring of data subjects on a large scale, and our core activities do not consist of large-scale processing of special categories of data.

2. Who we are and how to contact us

The controller of the personal data described in this notice is:

• SVEA IKT AB (publ)
• Organisation number 559399-4246
• Registered office: Trångsund, Sweden
• Email: [email protected]

For any privacy-related question, including to exercise the rights described in Section 9, please email [email protected].

3. Personal data we process, purposes, and legal bases

We process personal data about four broad groups of people. For each group we explain the categories of data, why we process it, and the legal basis on which we rely.

3.1 Visitors to our websites

We operate fdeploy.com and docs.fdeploy.com on infrastructure we control. Cloudflare sits in front of our websites as a content delivery network and security layer. When you visit either site, we and Cloudflare record server-log data including the IP address from which the request originates, the URL requested, the date and time, the HTTP status code, the user agent string, and the referring URL. We use this data to operate the websites, to investigate technical issues, and to detect and prevent abuse (such as denial-of-service, credential-stuffing, or scraping attempts).

We do not use analytics, tracking pixels, behavioural advertising, fingerprinting, or third-party marketing tags on our websites. We self-host all fonts and assets. The only cookies set on our websites are strictly necessary cookies set by Cloudflare for security and bot mitigation (such as __cf_bm) — see Section 11.

Legal basis: our legitimate interest (GDPR Art. 6(1)(f)) in operating and securing the websites.

3.2 Customers and customer contacts

When your organisation orders fDeploy or registers a Community-tier instance, we process the personal data of the individuals at your organisation who act as billing, technical, legal, notice, or licence-administration contacts. This typically includes name, work email address, work telephone number, job title, and the role they play in the customer relationship. We use this data to:

• process orders, issue invoices, and collect payment;
• provide and administer the licence (including issuing and verifying licence files);
• provide technical support;
• send service messages, renewal reminders, security advisories, and notices of changes to our terms or sub-processors;
• comply with our legal obligations (including accounting, tax, sanctions, and anti-money-laundering law).

Legal basis: performance of the contract between us and your organisation (GDPR Art. 6(1)(b)) for ordering, support, and renewal communications; our legitimate interest (Art. 6(1)(f)) in administering the customer relationship and protecting the Software from misuse; legal obligation (Art. 6(1)(c)) for accounting, tax, sanctions, and anti-money-laundering compliance.

3.3 People who contact us

When you email us at [email protected], fill in a contact form, or otherwise correspond with us, we process the personal data you choose to send us — typically your name, email address, the organisation you represent, and the contents of your message. We use this data to respond to your enquiry, to provide support if you are a customer, and to keep a record of business correspondence.

Legal basis: our legitimate interest (GDPR Art. 6(1)(f)) in handling enquiries and supporting customers; performance of the contract (Art. 6(1)(b)) where the correspondence relates to a Subscription you have or are about to enter into.

3.4 Subscribers to our updates list

When you subscribe to our updates mailing list — for example as part of placing an order, or by signing up to be notified of changes to our terms or sub-processors — we process your name (where you provide it), email address, and your subscription preferences. We use this data to send you the updates you have requested.

Legal basis: our legitimate interest (GDPR Art. 6(1)(f)) in keeping existing customers informed about changes to the service and to our terms; your consent (Art. 6(1)(a)) for any optional or marketing communications you separately opt into. You can unsubscribe from optional communications at any time using the link in each message or by emailing us.

4. Where we get personal data from

We collect personal data directly from the data subject in almost every case — from your browser when you visit our websites, from you when you order or contact us, and from you when you sign up to our updates list. We may receive contact details for a colleague of yours from someone else at your organisation (for example, where you are listed as a billing contact on an order placed by your colleague). Where we receive personal data from a source other than the data subject, we will provide the information required by Article 14 GDPR within a reasonable time, and in any event no later than one month after receipt.

5. Who we share personal data with

We share personal data only as needed for the purposes described in Section 3, and only with the following categories of recipient:

• Cloudflare, Inc. (United States; with EU entity Cloudflare Germany GmbH) — content delivery, DDoS protection, and bot mitigation for our websites. Cloudflare receives the HTTP request data described in Section 3.1.
• Microsoft Ireland Operations Limited (Ireland) — Microsoft 365 services, including the business email account that receives and sends correspondence to and from [email protected], and the Outlook mailbox we use to maintain and send our updates list (Section 3.4) for as long as that list is small enough to manage manually.
• Stripe Payments Europe, Limited (Ireland) — payment processing, billing, and tax determination (Stripe Tax) for paid Subscriptions. Stripe acts as our processor for the payment-processing service we buy from it, and as an independent controller for its own anti-money-laundering, fraud-prevention, and regulatory obligations. Its data-protection terms are published at stripe.com.
• Our external accountant and auditors — for bookkeeping, tax filing, and audit support, as required by Swedish accounting law (bokföringslagen).
• Professional advisers (lawyers, insurers, debt-collection agents) — where we need to take or defend legal action, recover debts, or obtain professional advice.
• Public authorities and courts — where we are required to disclose personal data by law, court order, or a binding request from a competent authority.
• An acquirer of our business — in the event of a merger, acquisition, corporate restructuring, or sale of all or substantially all of our assets.

We do not sell personal data, and we do not share personal data with advertisers or data brokers. We will update this Section if we engage additional third-party providers.

6. International transfers

We are established in Sweden, and the servers on which we operate fdeploy.com, docs.fdeploy.com, and our supporting systems are located in Sweden. Some of our service providers may transfer personal data to entities outside the European Economic Area ("EEA"):

• Cloudflare operates a global network and may route traffic through datacentres outside the EEA. Transfers to its US parent (Cloudflare, Inc.) are protected by the European Commission's Standard Contractual Clauses.
• Microsoft applies its EU Data Boundary commitment to core Microsoft 365 services, under which customer data of EU customers is processed and stored within the EU/EEA. Limited categories of data may still be transferred outside the EEA — those transfers are protected by Standard Contractual Clauses.
• Stripe may transfer payment-related data to its US affiliate (Stripe, Inc.) under Standard Contractual Clauses.

Where required, the Standard Contractual Clauses are supplemented by additional contractual, organisational, and technical safeguards. Copies of the relevant transfer mechanisms can be obtained from [email protected].

7. How long we keep personal data

• Server logs — typically retained for up to 90 days for security and operational analysis, then deleted or aggregated into non-personal statistics.
• Customer and customer-contact data — for the duration of the Subscription and for as long thereafter as is necessary for accounting, tax, audit, and legal-defence purposes. The Swedish Bookkeeping Act (bokföringslagen) generally requires accounting records to be retained for seven (7) years after the end of the financial year to which they relate.
• Email correspondence — retained for as long as is necessary to handle the matter to which the correspondence relates, and ordinarily no longer than twenty-four (24) months after the matter is closed.
• Mailing-list records — retained for as long as you remain subscribed, and we keep a minimal record of your unsubscribe (email address and date) to honour your decision.
• Records relating to legal claims — retained until the relevant limitation periods have expired and any actual or threatened claim has been resolved.

8. Security

We implement technical and organisational measures appropriate to the personal data we process and the risks involved, including encryption in transit, access control on a least-privilege basis, multi-factor authentication for accounts with access to personal data, logging of administrative access, and a documented incident-response process. We review these measures periodically.

9. Your rights

To the extent provided by the GDPR, you have the following rights in relation to personal data we hold about you:

• Access (Art. 15) — to obtain a copy of the personal data we hold about you, together with information about the processing.
• Rectification (Art. 16) — to have inaccurate personal data corrected and incomplete data completed.
• Erasure (Art. 17) — to have personal data deleted where the conditions in Article 17 are met.
• Restriction (Art. 18) — to have processing restricted in the circumstances described in Article 18.
• Data portability (Art. 20) — to receive personal data you have provided to us in a structured, commonly used, and machine-readable format, and to have it transmitted to another controller, where the conditions in Article 20 are met.
• Objection (Art. 21) — to object to processing carried out on the basis of our legitimate interests, on grounds relating to your particular situation. We will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or that the processing is needed for the establishment, exercise, or defence of legal claims.
• Withdrawal of consent (Art. 7(3)) — where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Complaint to a supervisory authority (Art. 77) — see Section 10.

These rights are not absolute and may be subject to conditions or exceptions under the GDPR or other applicable law.

10. How to exercise your rights and complain

To exercise any of the rights in Section 9, please email [email protected]. We will respond without undue delay and in any event within one (1) month of receipt, although we may extend that period by a further two (2) months where necessary, taking into account the complexity and number of requests. We may need to verify your identity before responding, in order to protect your personal data from unauthorised disclosure.

You also have the right to lodge a complaint with a supervisory authority. The Swedish supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, "IMY"), Box 8114, SE-104 20 Stockholm, Sweden. Email [email protected]. Web www.imy.se. You may also lodge a complaint with the supervisory authority in the EU member state of your habitual residence, your place of work, or the place of the alleged infringement.

11. Cookies and similar technologies

The only cookies set on fdeploy.com and docs.fdeploy.com are strictly necessary cookies set by Cloudflare for security purposes (in particular the __cf_bm cookie used for bot detection, with a typical lifetime of 30 minutes; some plans may also set __cflb for load balancing). These cookies are set without consent under the exception in Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive) for cookies strictly necessary for the provision of a service requested by the user. We do not use analytics, advertising, or marketing cookies, and we do not load third-party trackers.

If we introduce a feature that requires non-essential cookies (for example, an embedded payment form), we will publish a separate cookie notice and, where the law requires, request your consent before those cookies are set.

12. Children's data

fDeploy is a business-to-business product. Our websites and services are not directed at children under 16, and we do not knowingly collect personal data from children. If you believe we hold personal data about a child, please contact us so that we can investigate and, where appropriate, delete it.

13. Automated decision-making

We do not make decisions about you based solely on automated processing — including profiling — that produce legal effects concerning you or similarly significantly affect you. Where Stripe applies automated fraud-detection rules to a payment, that processing is governed by Stripe's own terms and notices.

14. Changes to this notice

We may update this Privacy Notice from time to time. The version and effective date at the top of this page show when it was last changed. For material changes that affect how we use personal data we already hold about you, we will notify you in advance where we are required to do so or where it is reasonable to.