Privacy Policy

1. Who is responsible for your data?

Wiklex AB (Swedish company registration number 559331-4031), Varuvägen 9, 125 30 Älvsjö, Sweden, is the controller for the processing described here.

Contact info@wiklex.com with any privacy questions or requests to exercise your rights.

2. What information do we process?

Please do not send sensitive personal data through our public forms unless necessary and we have agreed on a secure way to handle it.

• Contact enquiries: name, email, and any company, telephone number, website address and message you choose to provide.
• Meeting bookings: name, email, optional telephone number, preferred date and time, discussion topics and optional notes.
• Customer relationships: business contact details, company details, quotations, contracts, project correspondence and invoicing details.
• Website operation and security: IP address, technical device and browser information, request timestamps and information contained in operational or security logs.
• Correspondence: information shared through email, telephone and other business communication channels.

3. Purposes and legal bases

• Responding to enquiries and preparing quotations: legitimate interests in handling business enquiries, or steps before entering into a contract where applicable (GDPR Article 6(1)(f) or (b)).
• Arranging meetings and sending calendar invitations: legitimate interests or pre-contractual steps (Article 6(1)(f) or (b)).
• Providing services, customer support and account management: performance of a contract where you are the contracting party, or legitimate interests in managing a business relationship (Article 6(1)(b) or (f)).
• Invoicing, accounting and statutory compliance: legal obligation (Article 6(1)(c)) and, where applicable, contract.
• Maintaining security and resolving technical issues: legitimate interests in operating a secure website (Article 6(1)(f)).
• Following up relevant business relationships or providing information about our services where permitted: legitimate interests (Article 6(1)(f)) or consent where required. You can always object to direct marketing.

4. Where do we obtain information?

We mainly obtain information from you or the organisation you represent. For relevant business outreach, we may also use publicly available professional contact details, such as company websites and professional networks, where legally permitted.

5. Who receives the information?

Access is limited to those who need it for their work. We use service providers to operate the website and manage enquiries, including:

• Vercel for website hosting and delivery.
• Supabase for storing enquiries and bookings.
• Twilio SendGrid for email notifications about enquiries and bookings.
• Google Calendar and Google Meet for scheduled meetings and invitations.
• Accounting and other necessary providers involved in our customer relationships.

We may also disclose information when legally required. We do not sell personal data to advertisers.

6. Transfers outside the EU/EEA

Some providers operate internationally, so personal data may be processed or accessed outside the EU/EEA. Such transfers require a valid mechanism under the GDPR, for example an adequacy decision or the European Commission's standard contractual clauses, together with supplementary safeguards where necessary.

Contact us for more information on transfers and the safeguards relevant to a particular activity.

7. How long do we retain data?

• Enquiries and bookings that do not lead to a customer relationship are kept only for necessary follow-up and are normally deleted or anonymised within 24 months of the last relevant contact.
• Customer and project records are kept during the engagement and afterwards as required for follow-up, warranty obligations or legal claims.
• Accounting records are kept as required by Swedish law, generally for seven years after the end of the calendar year in which the financial year ended.
• Technical logs are retained for limited periods according to operational and security needs and the relevant providers' retention practices.

When a purpose ends and there is no other lawful reason to retain information, we erase or anonymise it.

8. Your rights

You may request access to your data, correction of inaccurate information and, where applicable, erasure, restriction or data portability. You may object to processing based on legitimate interests. We always respect objections to direct marketing.

If processing is based on consent, you may withdraw it at any time without affecting past lawful processing. We normally respond within one month and may need to verify your identity.

9. Security and automated decisions

We use appropriate technical and organisational measures according to the sensitivity of the data and the risks involved. No internet service can guarantee absolute security.

We do not make decisions about website visitors solely through automated processing that produce legal or similarly significant effects.

10. Data processed on behalf of clients

When developing or supporting client websites, systems or AI solutions, we may process personal data on our clients' instructions. In those cases, the client is generally the controller and Wiklex the processor. This is addressed by a separate data processing agreement where required and is not fully covered by this policy for our own website.

11. Questions, complaints and changes

Email info@wiklex.com with privacy questions or requests. You also have the right to lodge a complaint with Sweden's data protection authority, Integritetsskyddsmyndigheten (IMY), at www.imy.se.

We update this policy when necessary, for example when our services or processing activities change. The date above indicates the latest revision.