Privacy policy

1. Who is responsible for your data

The data controller is SWJTU Nordic AB (a Swedish limited company), organisation number 559609-8078, registered office in Mölndal, Sweden.

For any question about this policy or your data, contact info@swjtu-nordic.com.

2. What we process, why, and on what basis

Situation	Data	Purpose	Legal basis (GDPR Article 6)
Booking form	Name, email, phone (optional), the content of your enquiry	Answering your enquiry and arranging a conversation	Steps taken at your request before entering into a contract (Article 6(1)(b)); our legitimate interest in answering business enquiries (Article 6(1)(f))
NIS2 AI assistant	Your questions, the assistant’s answers, a session identifier	Providing the question-and-answer service you ask for; improving answer quality	Our legitimate interest in providing and improving the service (Article 6(1)(f))
Running and securing the website	IP address, browser type, time of access and similar technical logs	Keeping the website secure and preventing abuse (for example rate limiting)	Our legitimate interest in securing the website and services (Article 6(1)(f))
Visitor statistics	Aggregated data that does not identify you	Understanding how the website is used	No cookies that require consent, no individual profiles

Please do not enter sensitive personal data (such as health information) or confidential business information in the booking form or the AI assistant.

3. How long we keep it

• Booking form content: 12 months after our last contact, then deleted; if we enter into an agreement, as long as the contract and accounting law require. [Proposal, to be confirmed]
• NIS2 AI assistant conversations: 90 days, for troubleshooting and quality improvement, then deleted. [Proposal, to be confirmed]
• Technical logs: 30 days. [Proposal, to be confirmed]

4. Who can access your data

We do not sell your personal data. To run the website and services, the following providers process data on our instructions (data processors):

• Website hosting: a cloud provider in the EU (Sweden). The website, the booking form and the NIS2 AI assistant run on its servers;
• Email: our business email provider, which delivers booking requests to our company mailbox;
• AI model service: the large language model provider that the NIS2 AI assistant uses. The questions you type into the assistant are sent to this provider to generate answers. Where this provider is outside the EU/EEA, the transfer is based on [To be confirmed: for example standard contractual clauses agreed with the provider].

5. Your rights

Under the GDPR you have the right to:

• access the personal data we process about you;
• have inaccurate data corrected;
• have your data erased (“right to be forgotten”);
• restrict or object to our processing;
• receive a portable copy of the data you have provided.

To exercise these rights, contact us as described in section 1. We will reply within one month.

If you believe we process your data incorrectly, you can complain to the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY): www.imy.se.

6. Automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Answers from the NIS2 AI assistant are a first orientation only; see the AI notice.

7. Cookies

This website does not use cookies for tracking or advertising, and no statistics tools that require your consent. [To be confirmed: whether the NIS2 AI assistant’s chat window stores a session identifier in your browser]

8. Changes to this policy

We may update this policy when our services or the law change. The updated version will be published on this page with its date.