Privacy Policy.

1. Introduction.

This Privacy Policy describes how Regweaver AB, reg. no. 559526-9704, (“we”, “us” or “our”), processes personal data relating to individuals who register to test our software-as-a-service platform (the “Service”). This Privacy Policy is intended for private individuals acting on behalf of, or otherwise affiliated with, a company or other organisation that is evaluating the Service for business purposes.

We care about your privacy and process personal data in accordance with applicable data protection legislation, including Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and supplementary national legislation.

2. Categories of Personal Data We Process.

When you register to test the Service, we may collect and process the following personal data about you: a) name; b) email address; c) telephone number, including country code; d) company name; e) IP address and other technical identifiers; and f) usage data relating to your interaction with the Service.

We may also collect additional information provided by you or your organisation in connection with the registration or use of the Service. Such information may relate primarily to the company where you work, your role, business needs, intended use cases, or other non-personal or business-related information. To the extent any such information directly or indirectly identifies you, it will be treated as personal data in accordance with this Privacy Policy.

3. Purposes of Processing.

We process your personal data for the following purposes: a) to register your interest in, and provide you with access to, the Service; b) to administer and manage the testing, trial or evaluation of the Service; c) to communicate with you regarding onboarding, support, product functionality, updates and follow-up relating to the Service; d) to understand how the Service is used and evaluated in order to develop, improve and secure the Service; e) to maintain records relating to prospective and current business relationships; and f) where permitted by applicable law, and based on our legitimate interest in keeping in touch with professional representatives of organisations that have expressed interest in the Service, to send you limited business-to-business communications about features, updates or other offerings from Regweaver that are likely to be relevant to your professional role. We will not use your personal data for marketing that is unrelated to your professional interest in the Service, and we will not share it with third parties for their own marketing purposes. You have an absolute right to object to this processing at any time, free of charge and without having to give a reason. Once you object, we will stop using your personal data for marketing. You can object by using the unsubscribe link in any marketing email or by contacting us at privacy@regweaver.com (see also Section 9).

4. Legal Bases for Processing.

We process your personal data on the following legal bases: a) performance of a contract or taking steps prior to entering into a contract, where the processing is necessary to provide access to the Service or respond to your request to test it; b) our legitimate interests (Article 6(1)(f) GDPR). In each case, we have weighed our interest against your rights and freedoms and concluded that our interest is not overridden. The specific legitimate interests we rely on are: (i) running our trial programme and managing the relationship with the organisation you represent; (ii) staying in contact with professional representatives of prospective and current business customers so we can answer enquiries, run evaluations and follow up after meetings; (iii) analysing how the Service is used so that we can keep it secure and continue to develop and improve it; (iv) keeping internal records of business contacts and evaluations for ordinary commercial administration; (v) sending the limited business-to-business marketing communications described in Section 3(f); and (vi) establishing, exercising or defending legal claims. You can ask us for more information about the balancing assessment behind any of these interests by contacting us using the details in Section 11; and c) compliance with legal obligations, where processing is required to comply with applicable law.

Your right to object to direct marketing is absolute and may be exercised free of charge at any time, without giving any reason. For details of how to object and the limits of our marketing activities, see Section 3(f) above.

5. Source of Personal Data.

We generally collect personal data directly from you when you register or otherwise communicate with us. In some cases, we may also receive information from your employer, colleagues, or other representatives of your organisation in connection with the company’s interest in testing the Service.

6. Retention.

We keep your personal data only for as long as is necessary for the specific purpose for which it was collected. We apply the following retention periods:

a) Trial and evaluation data (including access credentials, onboarding communications and usage data tied to an identifiable individual): kept for the duration of the trial or evaluation and then deleted or anonymised no later than twelve (12) months after the trial ends, unless a business relationship with your organisation is established, in which case paragraph (c) below applies instead.

b) Business-development contact records (names, business contact details and internal notes about meetings or evaluations where no contract is concluded): kept for up to twenty-four (24) months from our last meaningful interaction with you, after which they are deleted or anonymised unless you have asked to stay in contact.

c) Contract and transaction records (where a business relationship with your organisation is established): kept for the duration of the contract and for up to ten (10) years afterwards, to comply with the Swedish Bookkeeping Act (Bokföringslagen) and to preserve evidence during the general limitation period under the Swedish Limitations Act (Preskriptionslagen).

d) Records necessary to establish, exercise or defend legal claims: kept for the duration of the applicable limitation period.

e) Personal data that we are required by law to keep (for example, tax and accounting records): kept for the period required by the relevant law, and no longer.

Once the applicable retention period has expired, we delete or anonymise the personal data. We do not retain personal data indefinitely.

7. Recipients of Personal Data.

We may share your personal data with: a) our affiliated companies; b) service providers that provide hosting, IT operations, analytics, customer support, communication tools or other services on our behalf (an up-to-date list of our main sub-processors is available upon request); c) professional advisers, such as legal, accounting or insurance advisers; and d) public authorities or other third parties where required by law or where necessary to establish, exercise or defend legal claims.

All recipients will only have access to personal data to the extent necessary for the relevant purpose.

8. Transfers Outside the EU/EEA.

If we transfer personal data to a country outside the EU/EEA that does not provide an adequate level of protection according to the European Commission, we will ensure that appropriate safeguards are in place, such as the European Commission’s standard contractual clauses, the EU-U.S. Data Privacy Framework where applicable, or other lawful transfer mechanisms.

9. Your Rights.

Subject to applicable law, you have the right to: a) request access to the personal data we process about you; b) request rectification of inaccurate or incomplete personal data; c) request erasure of your personal data; d) request restriction of processing; e) object to processing based on our legitimate interests; f) receive your personal data in a structured, commonly used and machine-readable format, where applicable; g) not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you; and h) lodge a complaint with the competent supervisory authority — in Sweden, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, imy@imy.se, www.imy.se.

We do not make decisions about you that are based solely on automated processing, including profiling, and that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

If you wish to exercise your rights, please contact us using the contact details set out below.

10. Security.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or other unlawful processing, taking into account the nature of the data and the risks involved.

11. Contact Details.

If you have any questions about this Privacy Policy or our processing of your personal data, or if you wish to exercise your rights, please contact us at:

Regweaver AB, reg. no. 559526-9704, Karl Gustavsgatan 15, 411 25 Göteborg, Sweden, privacy@regweaver.com

12. Changes to this Privacy Policy.

We may update this Privacy Policy from time to time. The latest version will be made available in connection with the Service or on our website, as applicable.