Privacy Policy – Indivd

Indivd AB, 559169-7072 ("Indivd" or "we" in any form) is committed to protecting the personal data of the individuals whose personal data we process. This Privacy Policy describes how Indivd, in its capacity as a data controller, processes personal data in accordance with the General Data Protection Regulation (EU Regulation 2016/679) (hereinafter referred to as the "GDPR").

Note: Cookie and browser-storage lifetimes and your consent choices are described in our Cookie Policy.

This article contains the following topics:

1. Categories of personal data, processing purposes, and legal bases
Retention
Who do we share your personal data with?
International transfers of personal data
Data subject's rights
Cookies and other tracking technologies
Contact us

1. Categories of personal data, processing purposes, and legal bases

We generally collect personal data directly from you. Not providing your personal data may result in disadvantages for you, e.g. you may not be able to receive desirable information about us. However, unless otherwise specified, not providing your personal data will not result in legal consequences for you. We may also collect personal data from third-party sources.

1.1 Ongoing business partners

If you represent an organization that we do business with, we process personal data in order to facilitate our business relationship with the organization which you represent (including purchases), i.e. name and contact details such as e-mail address, telephone number, which organization you represent as well as correspondence. Our legal basis for the processing of personal data is our legitimate interest in conducting our business.

We will retain the personal data for as long as we have a business relationship.

1.2 Potential business partners

If you represent an organization that we consider to do business with, we process personal data in order to facilitate our potential business relationship with the organization which you represent, i.e. name and contact details such as e-mail address, telephone number, which organization you represent as well as correspondence. Our legal basis for the processing of personal data is our legitimate interest in conducting our business.

We will retain the data for as long as it may be relevant and up to one (1) year following the latest contact. Where the contacts have led to a business relationship, the personal data will be processed as described in the previous section, Ongoing business partners.

1.3 Customer support

In order to provide customer support, we process personal data regarding organizational belonging (if applicable), name, email address, phone number, device ID, location data, correspondence, matter number and information about the relevant inquiry. Our legal basis for processing personal data is our legitimate interest in conducting our business.

We will retain the data for up to six (6) months following the termination of the relevant service agreement.

1.4 Meeting data

We will process the name, email address and meeting times. The data will be retained for a maximum of five (5) years.

1.5 Correspondence with the public

Occasionally, we engage in correspondence with individuals in other matters than those accounted for above. This may be the case when individuals have general questions about our products. Our legal basis for processing personal data in this respect is our legitimate interests in conducting our business, including responding to queries from the public.

We will retain the data for as long as it may be relevant and up to one (1) year following the latest contact.

1.6 Newsletters

We process your name, contact information, organizational belonging title and email address in order to provide you with marketing and product information. Our legal basis for doing so is consent or legitimate interests. Where the legal basis is consent, this can be withdrawn at any time by contacting us at privacy@indivd.com. You can also opt out of each message by clicking on the opt-out link.

We will retain the data until you opt out or withdraw your consent or during two (2) years following your latest activity.

We will also process data for analytics purposes, i.e. when the newsletter has been opened, how long it has remained open and whether the receiver has clicked on links in the newsletter. We will retain such data for as long as it may be relevant and up to three (3) years following its collection.

1.7 Shareholders and corporate representatives

If you are a shareholder or if you represent a shareholder we process your contact information (name and contact details such as e-mail address, and telephone number), personal identity number, classes of shares, share pledging, transfer limitations, and meeting data.

If you hold a position as a corporate representative of Indivd, we will process your personal data in the course of communicating with the Swedish Companies Registration Office (Sw: Bolagsverket). Our legal basis for processing personal data in these respects is our legal obligations to fulfil the Companies Act and/or our legitimate interest in documenting that we have done so. The data will be processed as long as it is relevant and as a maximum during the life of the company.

1.8 Recruitment

We process personal data (name, email, phone number, application data, including CV, interview notes, publicly available social media data and search results from search engines) about persons applying for positions at Indivd. Our legal basis for handling recruitment is our legitimate interest in conducting our business.

The data is retained during the application process. With the candidate's consent, the data may also be processed for six (6) months for future recruitments.

We kindly ask you to not submit any sensitive personal data when applying for a position with us. Sensitive personal data include personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, and data concerning health or data concerning a natural person's sex life or sexual orientation.

1.9 Branding

We publish material containing personal data to inform about our activities on our website or on social media. Our legal basis for doing so is our legitimate interest in informing about our business for branding purposes.

The data will be processed as long as it is relevant and as a maximum during the life of the company.

1.10 Press releases

The data will be processed as long as it is relevant and as a maximum during the life of the company.

We use Facebook, LinkedIn, and Instagram to market and inform about our company. The legal basis is our legitimate interest in using such channels for marketing and information. In order to better understand visitors' activity on our social media pages, we are provided with analytics data.

The social media providers each inform about their privacy, including analytics practices and we encourage you to inform yourself thereof.

We process analytics data as long as it may be relevant and for a maximum during the time under which we hold the relevant social media account.

1.12 Handling Data Subject rights

We will process email address, name, correspondence and data about the request. Our legal basis for processing personal data is compliance with a legal obligation. The data will be retained as long as it may be relevant and for a maximum of ten (10) years.

1.13 Website analytics

We use Google Analytics to understand how visitors use www.indivd.com and to improve the website. This includes information about pages visited, visit times, traffic sources and interactions, together with online identifiers and browser and device information. IP addresses are processed when connecting to the service. Google states that, for visitors in the EU, Switzerland and the UK, it uses IP addresses to derive approximate location and then discards them before logging the data.

Our legal basis for personal-data processing through optional Google Analytics tracking is consent. You can withhold consent or withdraw it through Cookie settings on our website. Withdrawal applies to future processing and does not affect processing that took place lawfully before withdrawal.

Our Google Analytics property is configured to retain event data for 2 months and user data for 14 months. The user-data retention period resets on new activity, so continued use may extend that period. These controls do not apply to most standard reports based on aggregated data. Cookie and browser-storage lifetimes are described separately in our Cookie Policy.

Our website also uses Framer's built-in analytics to measure website traffic. Framer describes this service as operating without cookies or persistent visitor identifiers.

1.14 Website marketing and visitor insights

With your Marketing consent, we use LinkedIn Insight Tag, Influ2, Leadfeeder/Dealfront, Clay Web Intent and Adform on our website. These services support advertising measurement, retargeting and understanding visits from prospective customers. Leadfeeder and Clay help us understand which companies visit the website and which content interests them.

The information involved can include IP addresses, cookie and other online identifiers, browser and device information, page URLs, visit times and interactions. Depending on the service, website activity may be matched with advertising-platform information or company information held by the provider.

We rely on consent for the optional website tracking described here. You can reject Marketing in the banner or withdraw consent through Cookie settings. If you subsequently contact us or enter a business relationship with us, the relevant other sections of this policy explain that separate processing.

Retention

Your personal data will be retained as long as necessary to provide you with products, services or communication. In addition to retention for the foregoing purposes, we may also retain your personal data in order to comply with applicable laws, such as bookkeeping laws, or if we need your personal data to establish, exercise or defend legal claims. Where the data is only stored, it will be archived with highly limited access rights.

We use service providers for website hosting, analytics, marketing and technical support. For website activity, these include Framer, Google Analytics and Google Tag Manager, LinkedIn, Influ2, Leadfeeder/Dealfront, Clay and Adform. Depending on the service and purpose, a provider may process personal data on our behalf or determine some processing purposes itself. The applicable arrangements and privacy notices explain those roles. We request service providers processing personal data on our behalf to implement and apply appropriate security safeguards.

In addition to the foregoing, Indivd may transfer, in compliance with applicable data protection law, personal data to law enforcement agencies, governmental authorities, legal counsels, external consultants, or business partners. In the case of a corporate merger or acquisition, personal data may be transferred to the third parties involved in the merger or acquisition.

International transfers of personal data

Some of our service providers may process personal data outside the European Economic Area (EEA), including in the United States. Where such transfers take place, an applicable transfer mechanism is required in addition to a legal basis for the processing.

Transfers may rely on an adequacy decision adopted by the European Commission. For a US recipient, reliance on the EU-US Data Privacy Framework requires that the recipient is actively certified and the transfer is covered by that certification. Where no applicable adequacy decision covers the transfer, safeguards may include the European Commission's Standard Contractual Clauses, together with the required assessment and any necessary supplementary measures.

You can request information about our transfer arrangements and a copy of applicable safeguards by contacting privacy@indivd.com.

Data subject's rights

You have a number of rights in connection with the processing of your personal data, subject to certain conditions set out in the GDPR and local data protection laws, including the right to:

Request access to your personal data ("data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
Request the rectification of the personal data that we process about you. This enables you to have incomplete or inaccurate data we hold about you corrected.
Request the deletion of your personal data. This enables you to ask us to delete or remove personal data where there is no overriding reason for us to retain it.
Ask us to stop processing personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground.
Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example, if you want us to establish its accuracy or the reason for processing it.
Request the transfer of your personal data to another party.

If you have given your consent for the processing of your personal data and that consent has served as a legal basis for processing, you can withdraw this consent at any time with future effect by contacting us as stated in the Contact Us section below.

To exercise your rights please contact us as stated below.

You have the right to lodge a complaint with a data protection supervisory authority, particularly in the country where you live or work in the EU/EEA, or where you believe an infringement occurred. In Sweden, the supervisory authority is Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection.

More information: https://www.imy.se/en/individuals/forms-and-e-services/file-a-gdpr-complaint/

Cookies and other tracking technologies

Our website uses cookies, local storage, session storage and tracking scripts. Our Cookie Policy explains their purposes and lifetimes and how you can accept, reject or change your choices. Optional Analytics and Marketing tracking is activated only after the relevant consent.

Contact us

If you have concerns or questions regarding this Privacy Policy, please contact us at privacy@indivd.com.

Version: 1.4

Date: 16 September 2026