Privacy Policy
This Privacy Policy describes the processing of personal data by Solvigo AB in connection with visits to solvigo.ai, enquiries, recruitment and client relationships. It sets out the purposes and legal bases for processing, applicable retention periods and the rights of data subjects.
1. Data controller
Solvigo AB (org.nr 559529-3647), Valhallavägen 140, 114 59 Stockholm, Sweden is the data controller for the processing described here.
Solvigo has appointed a Data Protection Officer. Privacy enquiries, requests and complaints may be submitted to info@solvigo.ai for direct referral to the Data Protection Officer.
2. Enquiries
Contact form submissions, including name, email address and any company details, telephone number or message provided, are processed solely to respond to and follow up on enquiries. Processing is based on pre-contractual steps requested by the data subject (GDPR art. 6(1)(b)) and our legitimate interest in responding to enquiries (art. 6(1)(f)).
Submissions are stored in our own systems and in Google Workspace, both hosted within the EU, and are accessible only to Solvigo personnel on a need-to-know basis. Correspondence is retained for the duration of the enquiry and deleted when no longer required for that purpose.
3. Recruitment
If you apply for a position with us we process your application, CV, interview notes and any other information you choose to send. The legal basis is our legitimate interest in assessing candidates and taking steps prior to a possible employment contract (art. 6(1)(b) and (f)).
Recruitment data is retained for two years from the application date to allow consideration for suitable vacancies. Applicants may request earlier deletion at any time.
4. Client and business relationships
If you work for one of our clients, or we are in a commercial dialogue with your organisation, we process ordinary business contact details and our correspondence with you. The legal basis is performance of a contract (art. 6(1)(b)) or our legitimate interest in managing the client relationship (art. 6(1)(f)).
Contracts and related records are kept for the duration of the engagement plus ten years, under the Swedish Limitations Act. Invoices and other accounting records are kept for seven years, as the Swedish Bookkeeping Act requires.
5. Processing on behalf of clients
Where Solvigo develops or operates systems on behalf of a client, the client determines the purposes of processing and acts as data controller. Solvigo acts as processor in accordance with the client’s documented instructions and the applicable data processing agreement.
Processing carried out on behalf of a client is governed by that client’s privacy policy. Data subject requests should be addressed to the relevant controller. Requests received by Solvigo will be forwarded to the controller, whom we will assist in responding.
6. Cookies and analytics
Google Analytics 4 is used to analyse website usage, page views and traffic sources for the purpose of improving the website. Processing is based on consent (art. 6(1)(a)). Analytics is loaded only after consent is provided. Declining consent prevents Google Analytics from loading and setting analytics cookies, without affecting website functionality.
Consent preferences are retained for 12 months, after which consent is requested again. Consent may be changed or withdrawn at any time. Withdrawal stops analytics collection and deletes analytics cookies.
The website uses the following cookies and similar storage technologies:
| Name | Set by | Purpose | Duration | Requires consent |
|---|---|---|---|---|
| solvigo-analytics-consent | Solvigo (localStorage) | Remembers your cookie choice | 12 months | No, strictly necessary |
| solvigo-scroll:* | Solvigo (sessionStorage) | Restores your place on a page when you navigate back | Browser session | No, functional, no tracking |
| _ga | Google Analytics | Distinguishes visitors (random ID, not your identity) | 2 years | Yes |
| _ga_* | Google Analytics | Keeps session state for this site | 2 years | Yes |
We have configured Google Analytics conservatively: no advertising features, no Google Signals, no audience building, and user-level data retention set to the shortest period Google offers. Google acts as our processor for this data under the Google Ads Data Processing Terms; see Google’s privacy policy. We do not sell your data or use it for advertising.
7. Server logs
Website infrastructure records technical request logs, including IP address, timestamp, requested page and browser user agent. Logging is independent of analytics consent and is necessary to operate and secure the website.
The legal basis is our legitimate interest in the availability and security of our services (art. 6(1)(f)). These logs are not used to profile you and are not combined with analytics data. They are rotated automatically after 30 days.
8. Recipients
We do not sell personal data, and we do not share it for advertising.
The following service providers process personal data on our behalf under data processing agreements:
| Provider | What it is used for | Where |
|---|---|---|
| Google Cloud Platform | Cloud infrastructure, compute, storage, databases | EU (Stockholm) |
| Google Workspace | Email, documents, calendar | EU |
We engage further providers in delivering services to our clients. Clients receive an up-to-date sub-processor list on request, and at least 30 days’ notice before we engage a new sub-processor or materially change how an existing one is used.
Personal data is otherwise disclosed only where required by law.
9. International transfers
We process personal data primarily within the European Economic Area.
Analytics data is processed by Google LLC in the United States. Google is certified under the EU–US Data Privacy Framework, the European Commission’s adequacy decision for transfers to certified US companies, complemented by standard contractual clauses.
10. Retention periods
| What | How long |
|---|---|
| Contact form submissions and correspondence | Duration of the enquiry, followed by deletion |
| Job applications | 2 years from application |
| Client contracts and agreements | Duration of the engagement + 10 years |
| Invoices and accounting records | 7 years (Swedish Bookkeeping Act) |
| Analytics data | 2 months (Google Analytics user-level data) |
| Server and access logs | 30 days |
| Data in systems we run for clients | Duration of the contract + 30 days, then deleted or returned |
When a retention period expires, data is deleted securely. Data held in automated backup rotations is not individually purged; those backups expire on their own schedule within 30 days.
11. Security measures
We encrypt personal data at rest (AES-256) and in transit (TLS 1.3). Access is role-based and granted on a need-to-know basis, multi-factor authentication is required for remote access, and access to production systems is logged and reviewed periodically. Backups are encrypted.
All personnel are bound by confidentiality obligations and complete data protection training.
12. Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.
Our AI systems provide decision support. Recommendations are subject to human review before action is taken. Any change to this practice will be reflected in this policy before implementation, including the rights to obtain human intervention, express a point of view and contest a decision.
13. Data subject rights
Under the GDPR, data subjects may request access, rectification, erasure, restriction of processing and data portability. They may object to processing based on legitimate interests and withdraw consent at any time through the cookie settings or by email.
Write to info@solvigo.ai. Requests are answered within 30 days. For complex or extensive requests, this period may be extended by up to 60 days. Any extension and its reasons will be communicated within the initial 30-day period.
Identity verification may be required before a request is processed to prevent unauthorised disclosure. Where a request cannot be fulfilled, including due to statutory retention requirements, the scope and reasons for refusal will be provided.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.
14. Personal data breaches
We maintain an incident response plan. If a personal data breach occurs and it is likely to result in a risk to individuals, we notify the Swedish supervisory authority within 72 hours as required under art. 33, and we notify affected individuals directly where the risk is high (art. 34). Clients are notified without undue delay, within the timeframe specified in the applicable agreement.
15. Policy amendments
This policy will be updated to reflect changes to data collection or processing purposes. Where changes affect cookie consent, renewed consent will be requested.