How we handle your personal data

Last updated 2 November 2026

This notice explains what we receive through the contact form, how we count visits to the website, and what you can ask of us.

Who is responsible

Under Protection, Stockholm, Sweden, is responsible for the personal data described here. You can reach us at team@under-protection.se.

What we receive through the contact form

When you send a message, we receive your name, organization, email address, phone number if you give one, and your message.

We use these details only to answer you and to continue the conversation you started. The legal basis is our legitimate interest in answering inquiries, or steps you ask us to take before a possible agreement (Article 6(1)(f) and 6(1)(b) of the GDPR).

Where your message goes

The form sends your message to our own mailbox by email. The form service does not store messages. The website and the form run on a server in Stockholm, Sweden, and our email is hosted by an email provider in Switzerland, a country the EU recognizes as protecting personal data adequately.

We do not sell your details or share them with anyone else.

How long we keep it

We keep your message for as long as we need it to handle your inquiry and any follow-up, and then delete it.

Cookies and visitor statistics

We count visits anonymously on our own server in Stockholm, with no cookies and no stored IP addresses. Nothing is stored on your device, and the website loads nothing from other companies' servers.

For each visit we count the pages and sections viewed, the links and buttons clicked, whether the contact form was sent (not what it said), how long the page was in view, the website you came from, your country and city, your browser, operating system, screen size and type of device, and the network you visit from: the organization or internet provider that holds your address in public registers.

Your IP address is used for these lookups and to tell one day's visits apart, and is then discarded, so a visitor cannot be recognized from one day to the next. The statistics are kept for 13 months and are not shared with anyone. The legal basis is our legitimate interest in understanding how the website is used (Article 6(1)(f) of the GDPR).

To protect the form against abuse, the server keeps the sender's IP address in memory for up to one hour, to limit how many messages can be sent from one address. It is never written to disk and is not included in the email we receive.

Your rights

You can ask us for a copy of the personal data we hold about you, and ask us to correct or delete it, restrict how we use it, or object to our use of it. Email team@under-protection.se.

If you think we handle your data incorrectly, you can complain to the Swedish Authority for Privacy Protection (IMY) at imy.se.