Privacy Policy

1. Data Controller

The data controller responsible for the processing of your personal data is:

• Smultron Studio AB (559437-9751)
• Box 5, 414 52 Göteborg, Sweden
• Email: privacy@smultronstudio.com

2. Personal Data We Collect

We collect personal data in the following ways when you interact with our website, communicate with us, or become a client:

• Information you provide directly via our contact form (email address and message). Booking forms are handled by Cal.com under their own privacy policy.
• Information from communication via email and digital meetings.
• Client data needed for contracting, invoicing, and service delivery.
• Website usage data via self-hosted Umami (aggregate and pseudonymized analytics).
• Standard hosting logs from our hosting providers for security and operations.

3. Purpose and Legal Basis for Processing

• Respond to inquiries and communication (legitimate interest, Art. 6(1)(f)).
• Manage bookings and appointments (Art. 6(1)(b) and/or Art. 6(1)(f)).
• Follow up on business opportunities in CRM (legitimate interest, Art. 6(1)(f)).
• Deliver services to clients (contract performance, Art. 6(1)(b)).
• Issue invoices and keep accounting records (legal obligation Art. 6(1)(c) and contract performance Art. 6(1)(b)).
• Improve website and services through usage patterns (legitimate interest, Art. 6(1)(f)).
• Comply with legal and regulatory requirements (Art. 6(1)(c)).

4. Sharing Your Data

We may share personal data with trusted processors and service providers where needed for operations and service delivery:

• Cal.com (booking and scheduling).
• Miss Hosting AB and Cloudflare Inc (hosting and infrastructure).
• Google Workspace (email, meetings, and collaboration tooling).
• Stripe Inc (payment handling).
• SpeedLedger AB (invoicing and accounting).
• Professional advisors and authorities when legally required.
• Additional project-specific processors under separate Data Processing Agreements (DPAs) when needed.

5. International Data Transfers

Some third-party providers process data outside the EU/EEA. Where relevant, transfers are safeguarded through GDPR-compliant mechanisms such as Standard Contractual Clauses (SCCs).

6. Data Retention

• Inquiry and booking data that does not become a client relationship may be stored up to 18 months unless earlier deletion is requested.
• Client data is retained during the business relationship and thereafter according to legal and contractual obligations.
• Accounting data is retained according to Swedish accounting laws.
• Website analytics data is retained according to configuration focused on aggregate analysis.

7. Your Data Protection Rights

Under GDPR, you have the right to:

• Access your personal data.
• Request rectification of inaccurate or incomplete data.
• Request erasure under applicable conditions.
• Request restriction of processing.
• Object to processing based on legitimate interest.
• Request data portability under applicable conditions.
• Withdraw consent where processing is consent-based.

8. Cookies and Tracking Technologies

We use self-hosted Umami analytics focused on aggregate website usage statistics.

We do not use analytics or marketing cookies requiring explicit consent. Any cookies in use are limited to technically necessary website functionality.

We store your language preference (Swedish or English) in your browser's localStorage under the key "smultron.locale". This data is stored locally on your device only and is not transmitted to our servers.

9. Security Measures

We implement appropriate technical and organizational measures to protect personal data from unauthorized access, disclosure, alteration, and destruction.

10. Changes to This Privacy Policy

We may update this Privacy Policy to reflect operational or legal changes. Updates are published on this page and reflected in the Last Updated date.