--- title: "Privacy Policy" canonical_url: "https://seatwirl.com/privacy-policy/" date: 2026-09-08 author: "thomas" --- # Privacy Policy # Privacy Policy This page describes how SeaTwirl processes personal data in connection with the website and our business contacts – what is collected, for what purpose, how long it is kept and what rights you have. This policy covers the whole website, both the corporate pages and the investor pages. SeaTwirl AB (publ), registration number 556890-1135, Lilla Bommen 1, 411 04 Göteborg, is the controller of the personal data described here. You can reach us at [info@seatwirl.com](mailto:info@seatwirl.com) or by post at the address above. How the website uses cookies and similar technologies, and how we count visits, is described in our [cookie policy](https://seatwirl.com/cookie-policy/). ## What we process, why, and for how long ### When you visit the website The web servers record the IP address of your device, together with the time and the page requested, in a log we use to keep the website secure and available: to detect faults, overload and abuse. The legal basis is our legitimate interest in keeping the website secure and available (Article 6(1)(f) GDPR). Logs are deleted after 30 days. The website is operated by Kntnt Sweden AB, with server infrastructure from Hetzner Online GmbH. The privacy settings on the corporate pages are loaded from the investor pages’ server, so it also records the IP address of your device and the time when you visit the corporate pages. ### Statistics on visits We use Matomo to see how many people visit the website and which pages they read. Without your consent, Matomo stores nothing in your browser and reads nothing from it beyond what your browser sends with every page view anyway. Matomo then receives the address and title of the page you visit and the time, which site you came from, any campaign parameters, the kind of browser, operating system and device you use, your language, your IP address, and your downloads and clicks on links to other websites. Your IP address is shortened by two bytes before it is stored, and your country and region are worked out from the shortened address. Matomo links the page views of one visit but cannot recognise you on a later visit. The legal basis is our legitimate interest in knowing how the website is used, so that we can improve it (Article 6(1)(f) GDPR). Counting continues even if your browser sends a Global Privacy Control or Do Not Track signal, but you can object to it; see *Your right to object*. If you allow statistics, Matomo also uses cookies, which let your browser be recognised for up to 13 months, and reads a few more details from your browser, such as your screen size and how long pages take to load. The legal basis is then your consent (Article 6(1)(a) GDPR). Raw data on visits is deleted after 25 months. More on the counting and the cookies is in our [cookie policy](https://seatwirl.com/cookie-policy/). ### Videos from YouTube The player for videos from YouTube loads only if you allow YouTube, with the button in the video box, with *Accept all* or in the privacy settings. Once the player loads, Google Ireland Limited receives data about your visit and may store data in your browser, even before the video starts playing. Under the judgment of the Court of Justice of the European Union in Fashion ID (C-40/17), SeaTwirl and Google are joint controllers for collecting your data and transmitting it to Google when the player loads. Google alone is responsible for what it does with the data afterwards. The legal basis is your consent (Article 6(1)(a) GDPR), because the player loads only once you have allowed it. How Google uses the data is set out in [Google’s privacy policy](https://policies.google.com/privacy?hl=en). ### When you contact us We process your name, your contact details and whatever your message contains, in order to answer your enquiry. The legal basis is our legitimate interest in answering the enquiries we receive (Article 6(1)(f) GDPR). We delete the correspondence 12 months after the matter is closed. ### When you apply for a job with us If you send an application or a question about a job to [career@seatwirl.com](mailto:career@seatwirl.com), we process what you send us, for example your name, your contact details and your application, in order to handle the recruitment. During the recruitment, the legal basis is steps you have asked for before entering into a contract (Article 6(1)(b) GDPR), which also covers speculative applications. We keep the data during the recruitment and delete it two years after the recruitment has ended, taking into account the time limits in the Swedish Discrimination Act. During those two years, the legal basis is our legitimate interest in being able to defend ourselves against legal claims (Article 6(1)(f) GDPR). ### When you do business with us If you are a supplier, customer or potential customer of ours, or a contact person at one, or have given us your business card, we process your name, phone number, email address and postal address. - We process data about suppliers and customers in order to enter into and perform agreements and to be able to provide products and services. If the agreement is with you personally, the legal basis is the agreement (Article 6(1)(b) GDPR). If you are a contact person at a company, it is our legitimate interest in being able to enter into and perform the agreement with that company (Article 6(1)(f) GDPR). - We process data about potential customers in order to be able to enter into agreements with them. The legal basis is our legitimate interest in being able to enter into agreements with new customers (Article 6(1)(f) GDPR). If you have asked us yourself for something such as a quote, the basis is instead steps you have asked for before entering into an agreement (Article 6(1)(b) GDPR). - We process data from a business card in order to stay in touch with you. The legal basis is our legitimate interest in maintaining business contacts (Article 6(1)(f) GDPR) or, if we have asked for it, your consent (Article 6(1)(a) GDPR). - We also process personal data to meet our legal obligations, for example in our accounts (Article 6(1)(c) GDPR). We delete data about a supplier when the agreement with the supplier has been performed, and data about a customer when it is no longer needed to provide the product or service. We delete data about a potential customer when it is no longer relevant, and at the latest 24 months after our last contact. We delete data from a business card when the contact is no longer relevant to us. We keep data that the law requires us to keep, for example in our accounts, for as long as the law requires. ### Information we publish about people As a company listed on Nasdaq First North Growth Market we publish information about identifiable people on the website: - **Transactions by persons discharging managerial responsibilities.** Name, position and the details of each notified transaction: instrument, nature, date, volume and price. The information comes from the public insider register kept by Finansinspektionen (the Swedish Financial Supervisory Authority). The record stays on the website for as long as the company’s shares are admitted to trading. - **Our largest shareholders.** Name and holding as at the most recent record date, from the public share register and public nominee list kept by Euroclear Sweden AB. The table shows the most recent snapshot and is replaced when a new one is published. - **Our board of directors and management.** Name, role, background and photograph, for as long as the person holds the position. Press releases and reports in the disclosure archive also name people where the news did – an executive quoted, a nominee proposed – and remain part of the market’s record. The legal basis for these publications is our legitimate interest in giving shareholders and the market the transparency expected of a listed company (Article 6(1)(f) GDPR). ## Who receives your personal data SeaTwirl engages Kntnt Sweden AB as processor to operate and administer the website and its services on SeaTwirl’s behalf. Kntnt Sweden AB in turn engages Hetzner Online GmbH as sub-processor for server infrastructure. For the statistics we engage InnoCraft Limited (Matomo Cloud) as processor. InnoCraft stores the data with Amazon Web Services in Frankfurt, Germany, with backups in Dublin, Ireland. The processors handle the data under our instructions. If you allow videos from YouTube, Google Ireland Limited receives data about your visit when the player loads. SeaTwirl and Google are joint controllers for collecting and transmitting the data, and Google alone is responsible for what it does with the data afterwards. How Google uses it is set out in [Google’s privacy policy](https://policies.google.com/privacy?hl=en). Other suppliers and partners that help us are given personal data only to the extent they need to perform their services for us. We also disclose data to public authorities where the law requires it. We never sell personal data. InnoCraft is based in New Zealand, which the European Commission has decided provides an adequate level of protection for personal data. Google may transfer data to the United States, relying on the European Commission’s adequacy decision for the EU-US Data Privacy Framework and on standard contractual clauses. If any of our other suppliers or partners is located outside the EU and EEA, we take the measures required for the transfer to be lawful and secure and for the data to remain protected under the GDPR. You can ask which safeguards we use, and get a copy of them, by emailing [info@seatwirl.com](mailto:info@seatwirl.com). ## How we protect your personal data We take appropriate measures to reduce the risk of unauthorised access to your personal data and of its misuse. ## Your rights You have the right to: - **access** – ask whether we process personal data about you, and receive a copy of it; - **rectification** – have inaccurate data about you corrected; - **erasure** – have your data deleted, for instance when you have revoked your consent or the data is no longer needed; - **restriction** – have the processing restricted, for example while we check whether the data is accurate or consider your objection; - **objection** – set out separately in the next section, as the law requires; - **data portability** – receive the data you have given us in a machine-readable format, where we process it on the basis of your consent or a contract, and have it transmitted to another controller. To exercise any of these rights, email us at [info@seatwirl.com](mailto:info@seatwirl.com). It costs nothing, and we reply within a month. ## Your right to object **Because we base some processing on legitimate interest, you have the right to object to it at any time, on grounds relating to your particular situation.** If you object, we stop the processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms. Object by emailing us at [info@seatwirl.com](mailto:info@seatwirl.com). **You can instead [object](https://seatwirl.com/privacy-policy/#konzilo-consent-objection)object to the counting of visits directly here**, or in the privacy settings under Statistics. We cannot tell from an email which visits are yours. The option to object appears only when you have not allowed statistics, because once you have allowed statistics, they are based on your consent. Once you have confirmed your objection, the website sends no information about your visits to Matomo. Your objection is saved in the cookie that holds your choice, and it applies to the whole website for 12 months. You can lift it with the link *Undo your objection*, which then appears here, by allowing statistics or with *Revoke consents*. More on the objection is in our [cookie policy](https://seatwirl.com/cookie-policy/). You have objected to the counting of visits, so yours are not counted. This applies to the whole website for 12 months, or until you allow statistics or revoke your consents. [Undo your objection](https://seatwirl.com/privacy-policy/#konzilo-consent-objection) If we process your personal data for direct marketing, you can object to that at any time, and we will then stop processing it for that purpose. ## Revoking your consent Where we process your personal data on the basis of your consent, you can revoke it at any time. To revoke the consents you have given on the website – to statistics with cookies and to videos from YouTube – use *Revoke consents* at the bottom of every page. This also lifts any objection to the counting of visits. To revoke any other consent, email us at [info@seatwirl.com](mailto:info@seatwirl.com). Revoking your consent does not affect the lawfulness of the processing that took place before you revoked it. ## Complaints If you think we are handling your personal data wrongly, you have the right to complain to a supervisory authority. In Sweden that is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), [www.imy.se](https://www.imy.se). You can also complain to the supervisory authority in the EU or EEA country where you live or work, or where you think the infringement took place. ## Changes to this policy Last updated: 10 November 2026