Privacy Policy
How Human Syntax processes data about website visitors, contacts and in marketing.
Introduction
Human Syntax AB
Human Syntax AB (“Human Syntax”, “we”, “us”) cares about your personal privacy. This Privacy Policy describes how we collect, use and protect personal data when you visit our websites, contact us or use our services.
This policy applies to Human Syntax AB’s own processing of personal data where we are data controllers. When we process personal data on a customer’s behalf as a data processor, our Data Processing Agreement with the customer applies instead.
1Data controller
| Field | Value |
|---|---|
| Company name | Human Syntax AB |
| Registration number | 559316-1853 |
| Address | Rönnowsgatan 8C, 252 25 Helsingborg, Sweden |
| Contact | privacy@humansyn.tax |
Human Syntax is not required to appoint a Data Protection Officer under Article 37 GDPR. Contact for data protection matters is via privacy@humansyn.tax.
2What personal data we process
Depending on your relationship with us, we may process the following personal data:
2.1Visitors to our websites
- IP address, browser type, operating system
- Time of visit, pages visited, referrers
- Any information you provide in contact forms
2.2Contact persons at customers and prospects
- Name
- Email address, phone number
- Company name, role
- Communication with us (email, meeting notes, support cases)
2.3Users of our services
- Name, email address
- User ID, login data
- Usage data within the service (logs, activity)
2.4Invoice recipients
- Company information, billing address
- Payment history
2.5Recipients of our campaigns
- Name and email address
- Mobile number (where applicable)
- Engagement data (opens, clicks, unsubscribes)
- Professional role and company affiliation (where available)
3How we collect personal data
We collect personal data primarily in the following ways:
- Directly from you when you register, contact us or use our services
- Automatically via cookies and similar technologies when you visit our websites (see our Cookie Policy)
- From public company registers (e.g. allabolag.se) to find and verify B2B contacts
- From professional networking sites (e.g. LinkedIn) for targeted B2B prospecting, where we may save professional contextual information about relevant contact persons to our own contact database. Processing is based on legitimate interests (Article 6(1)(f) GDPR) and you have the right to object (see §8). At first contact we inform the recipient about the processing and refer to this policy.
4Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Provision of our services under contract | Contract (Article 6(1)(b) GDPR) |
| Invoicing and payment handling | Contract and legal obligation (Bokföringslagen / Swedish Accounting Act) |
| Support and customer communication | Contract and legitimate interests (Article 6(1)(f)) |
| Marketing of our services to business contacts | Legitimate interests (Article 6(1)(f)) |
| Web analytics and improvement of the website | Consent for non-essential cookies, otherwise legitimate interests |
| Security and prevention of abuse | Legitimate interests |
| Compliance with laws (e.g. accounting, tax) | Legal obligation (Article 6(1)(c)) |
For marketing based on legitimate interests, you always have the right to object (see §8 below).
5Retention periods
We retain personal data only for as long as necessary for the purpose for which the data is processed:
| Category | Retention period |
|---|---|
| Contract and customer data during active customer relationship | For the duration of the agreement |
| Contract and customer data after termination of the agreement | Up to five (5) years for after-sales support and defence against potential claims, after which it is erased or anonymised (with the exception of accounting material) |
| Accounting material (invoices, receipts) | 7 years under Bokföringslagen (Swedish Accounting Act) |
| Marketing contacts (prospects) | Ongoing evaluation, removed when no longer current |
| Support cases | 2 years after case closure |
| Web log (server logs, IP addresses) | 6 months |
6Recipients and transfers
6.1Subprocessors and recipients
We share personal data with:
- Hosting provider: Oderland Webbhotell AB (Sweden) — operation of our systems
- Email delivery providers: AC PM LLC (operator of Postmark, subsidiary of ActiveCampaign) and Amazon Web Services EMEA SARL (Amazon SES) — sending of email for our own campaigns
- SMS provider: 46elks AB (Sweden) — SMS delivery. 46elks is a Swedish telecommunications operator acting as an independent data controller under the ePrivacy Directive and the Swedish Electronic Communications Act (LEK), not as a data processor
- Accounting and invoicing: Bokio AB (Sweden) — operation of accounting and invoice handling
- Office tools (email, document storage, collaboration): Microsoft Ireland Operations Limited (Microsoft 365) — operation of internal email (Exchange/Outlook), file storage (OneDrive/SharePoint) and collaboration tools where personal data from our operations may occur
- CRM for LinkedIn prospecting: Leaddelta — management of professional contacts from LinkedIn for B2B outreach
6.2Third country transfers
We use subprocessors both within and outside the EU/EEA (see §6.1 above). For transfers to third countries (USA), the EU-U.S. Data Privacy Framework applies primarily, and Standard Contractual Clauses under EU Commission Decision 2021/914 as backup. Otherwise our primary processing takes place within the EU/EEA.
6.3Authorities
We may disclose personal data to authorities where required by law.
7Security
We take appropriate technical and organisational measures to protect your personal data against loss, alteration, unauthorised access or unauthorised disclosure. Measures include, among others, encryption in transit, access control, secure hosting environments and regular backups.
8Your rights
Under GDPR you have the following rights:
- Right of access to the personal data we process about you
- Right to rectification of incorrect data
- Right to erasure in certain circumstances (“the right to be forgotten”)
- Right to restriction of processing
- Right to data portability for data you have provided and that we process based on consent or contract
- Right to object to processing based on legitimate interests, including direct marketing
- Right to withdraw consent when processing is based on consent
To exercise any of these rights, contact us at privacy@humansyn.tax. We respond to your request without undue delay and at the latest within one month.
If your request is particularly complex or extensive, the response time may be extended by up to two months. In that case we will inform you of the extension and the reasons for it within one month from when we received your request.
9Complaints to the supervisory authority
If you believe that we are processing your personal data in violation of applicable data protection legislation, you have the right to lodge a complaint with the supervisory authority. In Sweden, this is Integritetsskyddsmyndigheten (IMY / Swedish Authority for Privacy Protection): imy.se.
10Changes to this policy
We may update this Privacy Policy from time to time. The current version is always published on our website with a clearly stated update date, and for significant changes we mark this visibly on the website for a period. Material changes are also communicated to existing customers and, where appropriate, to other affected persons.