Privacy Policy

Data controller

Sebstah IT AB (Swedish company reg. no. 559427-3145) is the controller for the processing described here.

Address: Vagnmakarevägen 150, 254 77 Fleninge, Sweden. Email: info@sebstah.com. Phone: +46 73 516 07 88.

When you contact us

When you use the contact form, a package form (Starter, Scale or Enterprise) or email us, we process the details you provide: name, company, email address, phone number, current website, how you want to be contacted, your message and any inspiration links and logo files.

We use these details to answer your request, prepare a proposal and quote, and stay in touch with you.

Legal basis: our legitimate interest in answering requests and communicating with you (Article 6(1)(f) GDPR) and, when the request concerns an assignment, taking steps before entering into a contract (Article 6(1)(b) GDPR).

The forms send your details to us by email. They are not stored in a database on the website.

When you become a client

If you or your company becomes a client, we process contact and billing details to perform the contract (Article 6(1)(b) GDPR) and to comply with Swedish bookkeeping law (Article 6(1)(c) GDPR).

When we handle personal data on a client's behalf, for example data submitted through forms on a website we host, we act as a processor and follow the client's instructions under a data processing agreement.

When you visit the website

Our hosting provider Vercel processes technical data such as IP address, browser and which pages are requested. This is needed to deliver the website and protect it against abuse and attacks (legitimate interest, Article 6(1)(f) GDPR).

We measure the website's performance with Vercel Speed Insights. This works without cookies and without identifying you – we only see aggregated metrics such as load times, page, device type and country (legitimate interest, Article 6(1)(f) GDPR).

If you use our speed test, the web address you enter is sent to Google PageSpeed Insights to measure the page. The test runs from our server, so your IP address is not sent to Google. Please don't enter personal data in the field.

Analytics with Google Analytics

If you allow analytics in the cookie banner, we use Google Analytics 4 to understand how the website is used, for example which pages are visited and for how long, device and browser type, and approximate location (country and city). Google Analytics 4 does not store your IP address.

Google Analytics only loads after you have given your consent (Article 6(1)(a) GDPR). You can change or withdraw your consent at any time with the “Cookie settings” button at the bottom left of the page. If you withdraw it, we remove the analytics cookies and stop measuring your visit.

Cookies

Cookies are small text files stored in your browser. Under Swedish law we may only use cookies that are not strictly necessary if you have consented. We use the following:

CookieConsent (necessary, set by us): stores your cookie choices for 150 days.

_ga (analytics, set by Google Analytics): distinguishes visitors in the statistics. Kept for 2 years.

_ga_<ID> (analytics, set by Google Analytics): keeps track of your visit in the statistics. Kept for 2 years.

We do not use cookies for marketing or advertising. If that changes, we will update this policy and ask for your consent first.

Who we share data with

We never sell your data. We only share it with providers that help us run the website and the business and that process the data on our behalf:

Vercel Inc.: hosting and performance measurement.

Resend Inc.: delivers messages from the forms to our inbox.

Google: Google Analytics (if you have consented) and PageSpeed Insights.

Email and accounting system providers: for correspondence and invoicing.

We may also need to disclose data to authorities when required by law.

Transfers outside the EU/EEA

Vercel, Resend and Google are US companies, so data may be transferred to the United States. Transfers rely on the European Commission's adequacy decision for companies certified under the EU-U.S. Data Privacy Framework, or on the European Commission's standard contractual clauses.

How long we keep data

Requests and correspondence: for as long as we are in contact and then at most 24 months, unless you become a client.

Client data: for the duration of the contract and then for as long as needed to handle any claims.

Accounting records, such as invoices: seven years under Swedish bookkeeping law.

Statistics in Google Analytics: at most 14 months. Cookies: as listed in the cookies section.

Your rights

Access: you can find out what data we hold about you and get a copy of it.

Rectification: you can have inaccurate data corrected.

Erasure: you can ask us to delete your data, for example when it is no longer needed.

Restriction: you can ask us to temporarily restrict the processing.

Objection: you can object to processing based on our legitimate interest.

Data portability: you can receive data you have provided in a machine-readable format.

Withdrawing consent: you can withdraw consent at any time, without affecting processing before that.

Contact us at info@sebstah.com to exercise your rights. We reply within one month.

If you are unhappy with how we process your data, you can lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se, or the data protection authority where you live.

Automated decisions

We make no decisions based solely on automated processing and do no profiling.

Security

The website uses an encrypted connection (HTTPS), and only people who need the data for their work have access to it.

Changes

We update this policy when we change how we process personal data, for example if we start using a new service. The date at the bottom shows when it was last changed.

Contact

Questions about privacy and personal data: info@sebstah.com.