Privacy Policy

Document Number:
QR-12
Edition: 5
Date: June 24, 2026

This Privacy Policy describes how Grafokett AB processes and protects personal data, as well as the rights you have in connection with such processing. We are committed to protecting your privacy and strive to ensure that all processing of personal data is carried out in a lawful, transparent, and responsible manner in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR).

1. Data Controller and contact information

Grafokett AB is the data controller for the processing of personal data described in this privacy policy, unless otherwise specified.

Questions regarding personal data, privacy, or the exercise of rights may be sent to Grafokett AB through our regular contact channels or to the company’s designated contact person for data protection matters.

2. Types of personal information we collect

Contact information

We may collect the following information:
– Name
– Address
– Email address
– Phone number

Usage data

We store data about which of our products and services you order and use, as well as how you use them, in order to provide you with the best possible service and support.

Support cases

When you contact our support team, we collect the information you provide to us so that we can assist you with your inquiry, provide relevant support, and follow up on your case.

3. Here’s how we collect personal information

We collect and process data such as:

  • the information you provide when you become a prospect or lead,
  • the information you provide when you become a customer,
  • the information you provide when you contact us, for example through notes, chat conversations, or email,
  • is created when you visit our website or log in to the customer portal,
  • is collected via cookies that record information about your browser and how you use the website.

4. Here’s what we use personal information for

Legal basis

In order for Grafokett to process personal data, at least one legal basis must apply:

  • the processing is necessary to fulfill a contract with you,
  • the processing is necessary to fulfill a legal obligation for Grafokett,
  • The treatment is in both your and Grafokett’s best interest,
  • You have given your consent to the processing in question.

In order for us to provide our services, we sometimes need to process personal data. Below, we describe how we use personal data and the legal basis for such processing.

Provision of services

We process personal data to identify you as a customer and to manage and provide the services you have ordered.

We also process the personal data necessary to handle billing and payment for the services you use.

Legal basis: Performance of a contract.

Communication and support

We use past data to provide you with better service.

Information about your services is also used for billing purposes and to communicate information about our products and services.

Legal basis: Balancing of interests, consent, and performance of a contract.

Development of services and products

We process personal data regarding how you use our services, as well as information from your interactions with us.

This information is used to help us improve your user experience and our services in general.

Legal basis: Balancing of interests and consent.

Marketing

To market relevant products and services, we may process information about which services you use and how you use them.

This helps us tailor our communications and offers to make them more relevant to you.

Legal basis: Balancing of interests and consent.

Safety and prevention of substance abuse

We process personal data to detect and prevent the following on our network:

  • substance abuse
  • attempted intrusion
  • attacks, such as viruses
  • violation of the law
  • use of our products and services that violates our terms and conditions

This helps us tailor our communications and offers to make them more relevant to you.

Legal basis: Performance of a contract and legal obligation.

Legal obligations

We process personal data to comply with the legal requirements imposed on Grafokett.

Legal basis: Legal obligation.

5. This is how long we retain personal data

We retain personal data only for as long as necessary for the purpose for which the data was collected, or for as long as we are required to retain the data by law, contract, accounting requirements, warranty obligations, or documented business and security reasons.

When the data is no longer needed, it is purged, anonymized, or deleted in accordance with Grafokett’s data retention policy.

 

Category
Storage principle
Customer and Contract Information Stored for the duration of the customer relationship and thereafter in accordance with legal requirements, contractual obligations, and documented business needs.
Support and Service Cases Stored for as long as the case needs to be followed up on, quality-assured, or handled for warranty, service, or security reasons.
Accounting and Invoicing Documentation Retained in accordance with applicable accounting laws.
Prospect and Marketing Information Stored for as long as there is a relevant and documented business interest, or until an objection is raised, the account is deactivated, or consent is withdrawn.

6. To whom do we disclose personal information?

In exceptional cases, personal data is disclosed to partners and subcontractors in order to troubleshoot and resolve technical issues with the equipment provided.

We have agreements with our partners that, among other things, specify what personal data is processed, the purpose of the processing, how the personal data is to be protected, and how long it may be processed.

The agreements also include instructions from the data controller to the data processor regarding how personal data may be processed.

We strive to never share more personal information with our respective partners than is absolutely necessary.

We take appropriate safeguards to ensure that personal data is handled in accordance with applicable laws regarding security and privacy. We impose equivalent requirements on our subcontractors.

Transfers outside the EU and the EEA

If personal data needs to be transferred to or processed in a country outside the EU or the EEA, Grafokett ensures that the processing is carried out in accordance with a valid transfer mechanism and appropriate safeguards.

Such safeguards may include, for example, the European Commission’s Standard Contractual Clauses, a decision on an adequate level of protection, or equivalent contractual and technical safeguards.

Cookies and similar technologies

Cookies and similar technologies are used only to the extent necessary for functionality, security, statistics, or an improved user experience.

When consent is required, it is obtained before processing begins. Consent may be modified or withdrawn in accordance with the cookie information provided on the website.

Partner or recipient
Personal information that is shared and why
Clickup Name, email address, phone number, company information, and information related to customer cases, projects, support, and tasks. The purpose is to plan, manage, follow up on, and document customer relationships, deliveries, support cases, and internal work processes.
LiveAgent Email address, phone number, company information, and contact name. The purpose is to handle support and troubleshooting in a secure and traceable case management system.
Suppliers Company names can be shared to link a prospect or a customer to a specific transaction.
Mailchimp Name, email address, company affiliation, and information regarding the receipt of and interaction with mailings. The purpose is to manage newsletters, marketing mailings, customer communications, and the tracking of consents, subscriptions, and communication preferences.
Service partners Company, email address, phone number, and contact person. The purpose is to handle service, primarily for hardware.
Oderland Company information and employee contact information. Oderland provides web hosting and virtual server hosting.
Tre Names, phone numbers, and email addresses of employees.
Microsoft User information required to use Cloudlabel. Microsoft is also used for Azure web hosting.
Government Agencies Grafokett may be required to disclose information to government agencies upon a valid request.

7. Here’s how we protect personal data

Technical protections

We store sensitive information—such as personal data, passwords, and company names—using standardized methods.

Examples of such methods include:

  • SSL/TLS,
  • VPN,
  • one-way hash algorithms.

The information is used to communicate effectively with customers, prospects, suppliers, and employees.

Systematic safety work

To ensure integrity, confidentiality, and availability, we employ a systematic approach and technical safeguards during implementation.

We have procedures and policies for:

  • incident management,
  • risk analysis,
  • internet use,
  • data management,
  • configuration and encryption of devices for secure data portability.

Confidentiality and authorization

Grafokett’s staff are bound by confidentiality agreements and process only the information necessary for each assignment.

Data breaches

Data breaches are handled in accordance with an established internal procedure and, if necessary, reported to the Data Protection Authority within 72 hours.

Affected data subjects are notified when the incident is likely to pose a high risk to their rights and freedoms.

8. You have control over your personal information

You have the right to:
  • get information about how your personal data is processed
  • request access to the information we process about you
  • request the correction of inaccurate information
  • request the deletion of data
  • request a restriction on the processing
  • request data portability
  • object to processing based on legitimate interests
  • object to processing for direct marketing purposes
Withdraw consent.

If the processing is based on consent, you have the right to withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of the processing that took place before consent was withdrawn.

Limitations on rights

Certain rights may be limited when continued processing is required by law, contract, or some other legal obligation, such as accounting laws.

How we process your request

A request to exercise your rights will be processed without undue delay and normally within one month at the latest.

If necessary, Grafokett may request additional information to verify the identity of the person making the request.

Complaints

If you believe that Grafokett is processing your personal data in violation of applicable data protection regulations, you have the right to file a complaint with the Swedish Data Protection Authority (IMY).

More information is available on the Swedish Data Protection Authority’s website.

Automated decision-making

Grafokett does not use personal data for automated decision-making that has legal consequences or similarly affects you in a significant way.

If such processing were to be introduced, specific information would be provided in advance.

9. When Grafokett acts as a data processor

In cases where the customer is the data controller and Grafokett processes personal data on the customer’s behalf, Grafokett acts as a data processor.

Such processing is governed by a separate data processing agreement and is carried out solely in accordance with the customer’s documented instructions.

.

10. When you are no longer a customer

When you close your account or when our partnership ends, we will delete personal data for which there is no longer a valid purpose or legal basis for continued processing.

Data that must be retained by law—such as under accounting legislation—or that is required to manage contracts, warranties, complaints, legal claims, or security, is retained only for as long as necessary.

When necessary, we notify the relevant partners and subcontractors that the data will be deleted or purged in accordance with applicable instructions and agreements.

Unless we are notified that the collaboration has ended, the amount of information in our systems is governed by Grafokett’s data retention policy. The data is deleted whenever possible. A separate data retention policy has been established.

.