Review before publishing
This document is a draft for legal review and is not yet in force.
Privacy policy
How we handle personal data on our websites and in TrustDesk and AccessWatch.
Version 0.9-draft · Last updated
This policy explains how Obsecure AB (SE559313-738201, Nejlikevägen 42, SE 125 55, Älvsjö) handles personal data on our websites and in TrustDesk and AccessWatch.
1. Our role
- Controller: we decide how personal data is used for our websites, user accounts, billing, security, our affiliate and partner program, and communication with you.
- Processor: for content our customers put into the services (Customer Data, for example documents, questionnaires, staff names in training records, vendor contacts or scanned websites), the customer is the controller and we process it on their instructions under our Data Processing Agreement. Questions about that data should go to the customer first.
2. What we collect and why
| Data | Examples | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Account data | Name, email address, password hash, two-factor settings, organization memberships | Providing the services and signing you in | Contract (Art. 6(1)(b)) |
| Security logs | Sign-ins, changes, downloads, IP address, browser user agent | Protecting accounts and investigating misuse | Legitimate interest (Art. 6(1)(f)) |
| Billing data | Company name, billing contact, address, VAT ID, invoices (payment details are held by our payment provider) | Invoicing and accounting | Contract; legal obligation (Art. 6(1)(c)) |
| Product events | Sign-up, activation and upgrade events in our own database | Understanding and improving the product | Legitimate interest |
| Trust page visitors | Name, email, company and a keyed hash of the IP address when someone requests access to a customer's documents | Handling the request for the customer | Processor for the customer |
| Free accessibility scans | The address scanned, the result and a keyed hash of the IP address | Running the scan and enforcing limits | Legitimate interest |
| Affiliates and partners | Name, email, company, payout details (IBAN or PayPal), referral clicks with a keyed hash of the IP address | Running the program and paying commission | Contract; legal obligation |
| Support and email | Messages you send us | Answering you | Contract or legitimate interest |
We do not use third-party analytics or advertising trackers, and we do not sell personal data.
3. AI features
When AI features are switched on, short excerpts of Customer Data are sent to our AI provider to draft text, with company names and personal data masked where we can detect them. The provider is bound not to use them to train its models. [TO CONFIRM: confirm against the AI provider's current terms] Organizations can switch AI features off.
4. Who receives the data
We use the subprocessors listed on our subprocessor page for hosting, backups, email delivery, payments and, where enabled, AI and error reporting. They may only use the data to provide their service to us. We may also disclose data when the law requires it.
5. Transfers outside the EEA
We store data in the EU. Where a subprocessor processes data outside the EEA (for example our payment provider's or AI provider's affiliates in the USA), the transfer is protected by the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
6. How long we keep data
| Data | Retention |
|---|---|
| Account and organization data | While the account exists; deleted 30 days after you delete it |
| Database backups | 30 days |
| Security and audit logs | [TO CONFIRM: retention period]; when an account is deleted, the person's details in audit entries are removed |
| Invoices and accounting records | 7 years (Swedish Accounting Act) [TO CONFIRM: confirm] |
| Affiliate payout records | 7 years (accounting) |
| Free scan results | [TO CONFIRM: retention period] |
7. Your rights
You can access, correct or delete your data, object to processing based on legitimate interest, restrict processing and receive your data in a portable format. Account holders can export their data and delete their account in their profile settings. For other requests, email privacy@rongu.app. You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se.
8. Cookies
See our cookie notice.
9. Security
See our security pages and the technical and organizational measures in our Data Processing Agreement.
10. Changes
We will post changes here and tell account holders about material changes by email.
11. Contact
Obsecure AB, Nejlikevägen 42, SE 125 55, Älvsjö. Email: privacy@rongu.app. [TO CONFIRM: whether a data protection officer must be appointed, and contact details if so]