Privacy policy

What this policy covers

This policy describes how DeMenso Sverige Handelsbolag processes personal data in connection with website use, enquiries, client and subcontractor cooperation, and business contacts.

Who is responsible

The controller is DeMenso Sverige Handelsbolag, trading as DeMenso Sverige, a Swedish handelsbolag based in Skara. Organisation number: 969804-8528. Correspondence address: Valhallagatan 76, 532 34 Skara, Sweden.

For privacy matters and requests about your data, contact hej@demenso.se.

Data and its sources

We receive the contact details and information you choose to send: for example your name, email, company, project description, correspondence, portfolio or CV. Business records may also include a representative’s role, contract information and billing details.

Data normally comes directly from you. If a business contact introduces you or we use relevant public professional information, we inform you of the source and scope of the data in accordance with the GDPR.

Do not include passwords, access keys, health information or other sensitive personal data in a general enquiry. If a project needs protected data, its handling must be agreed separately.

What happens in the website forms

When you submit a contact form, we process your email address, message and any optional details you provide to answer your enquiry. The message is stored in a protected queue and forwarded to hej@demenso.se through Google. An enquiry does not subscribe you to the newsletter.

For the newsletter we use your email address and voluntary consent. Your subscription becomes active only after you confirm your address through an email. We record the consent text and version, language, request, confirmation and withdrawal times, and limited technical information needed to protect the forms. You can unsubscribe using the link in the email or contact hej@demenso.se.

Email links open your email app. We receive the message when you send it; your email provider’s processing rules also apply.

Purposes and legal grounds

• Enquiries and offers: Article 6(1)(b) GDPR for necessary steps requested by you before a contract to which you would be a party; otherwise Article 6(1)(f) for responding to business enquiries and managing professional relationships.
• Client and project contact: Article 6(1)(b) where you are the contracting individual; Article 6(1)(f) for necessary communication with a company’s representatives.
• Accounting and statutory records: Article 6(1)(c), where a relevant legal obligation applies.
• Claims and dispute records: Article 6(1)(f), for establishing, exercising or defending legal claims.
• Cooperation requests, CVs and portfolios: the basis depends on the requested relationship; necessary pre-contract steps or a separately assessed legitimate interest, and consent only where it is actually requested for an optional purpose.
• Optional marketing or consent-based processing: consent where required, with a way to withdraw it. An enquiry is not a blanket marketing consent.
• Website statistics with Google Analytics 4 and Microsoft Clarity: consent, which you can withdraw at any time in Cookie settings.
• Ad measurement and remarketing in Google Ads (through Google Analytics): marketing consent, which you can withdraw at any time in Cookie settings.
• Ad measurement and remarketing on Facebook and Instagram with Meta Pixel: marketing consent, which you can withdraw at any time in Cookie settings.

Providing data is your choice

Contact information is voluntary, but we need a way to reply and enough information to understand your enquiry. A contract or statutory record may require particular details. If you do not provide necessary information, we may be unable to answer, prepare an offer or carry out the requested service.

Legitimate interests do not automatically override your rights. Their necessity and the balance with your interests must be assessed for the particular processing.

Recipients and international transfers

Hostinger provides website hosting, and we use Google services for email. With your consent we use Google Analytics 4 via Google Tag Manager and Microsoft Clarity for website statistics. The provider is Google Ireland Limited, and data may be transferred to Google LLC in the USA, which participates in the EU–US Data Privacy Framework. The provider of Clarity is Microsoft Ireland Operations Limited, and data may be transferred to Microsoft Corporation in the USA, which participates in the same framework. With marketing consent, Google Analytics shares information about conversions and audiences with our Google Ads account. With marketing consent we also use Meta Pixel. The provider is Meta Platforms Ireland Limited, and data may be transferred to Meta Platforms, Inc. in the USA, which participates in the EU–US Data Privacy Framework. We and Meta are joint controllers for the collection with Meta Pixel and the transfer to Meta; Meta is responsible for its own further processing.

Depending on the service, other relevant recipients can include authorised project collaborators, accounting or legal advisers, and authorities where disclosure is legally required. A processor must act under the required data-processing terms; an independent recipient has its own responsibilities.

Service providers may process data outside the European Economic Area. Such transfers require a basis under Chapter V of the GDPR, such as an adequacy decision or appropriate contractual safeguards. Contact hej@demenso.se for information about recipients, processing countries and safeguards relating to your data.

Retention periods and exceptions

We apply the following periods under DeMenso’s retention policy. Retention depends on the purpose, legal basis, agreement and statutory obligations. We delete data when it is no longer needed for its purpose, subject to the exceptions described below.

A legal obligation, dispute, complaint, investigation, incident or relevant claim can justify a documented hold on deletion. Access and use must remain limited to that purpose. After the reason ends, retention must be reassessed. Backup deletion can follow its rotation cycle; data must not be actively restored without a valid reason.

An unconfirmed subscription request is deleted within 7 days. A subscription does not start without confirmation.

• Simple contact enquiries: up to 12 months from the last contact. Offer enquiries and briefs: up to 24 months from the last contact. Commercial correspondence without a contract: 24–36 months for negotiation evidence and protection of interests.
• Active contracts: for the cooperation. Completed client contracts: 7 years from the end of the financial year, or longer where claims require it. Project records: 3–7 years after completion, depending on project risk; technical records: 3–7 years or as agreed, potentially longer during support.
• Accounting, invoices and tax records: 7 years after the end of the calendar year in which the financial year ended, under the applicable statutory obligations. Asset-acquisition records may be needed longer while the asset is in use.
• Client credentials: remove immediately when no longer needed. Client database exports and production data: remove after the task, usually within 30 days unless the data-processing agreement specifies otherwise. Client data retention otherwise follows that agreement and the client’s instructions.
• Subcontractor candidates: 12 months from the last contact, longer with consent. Unsolicited cooperation applications: 6–12 months, then delete or seek consent. Candidates for a specific project: the process plus 6 months; rejected candidates: 6 months unless claims or consent justify more. Consent for future contact: up to 24 months, then renew it.
• Completed subcontractor cooperation: 7 years for accounting records and 3–7 years for project records, subject to claims. Security/BYOD acknowledgements: the cooperation plus 3 years, longer for an incident; remove access immediately on offboarding.
• Website server logs: 3–12 months depending on hosting and security. Security logs: 12–24 months, longer for an incident. Incident evidence: 5–7 years, or longer during a dispute. Test accounts: until testing ends.
• Website backups: 30–90 days depending on hosting; migration working backups: 7–30 days after completion and confirmation. Client backups follow the contract or data-processing agreement.
• Newsletter: active subscriber data until unsubscribe or withdrawal; consent evidence up to 3 years afterwards, longer during a dispute. Keep only the information necessary to honour an objection or prevent renewed mailing for as long as needed. Marketing leads: 12–24 months from last activity; campaign reports: 24–36 months, preferably aggregated.
• Copyright and licence records: during the rights or licence and the relevant claims period. Image permissions: during use of the material and the claims period. Promotional media: according to the licence and purpose, with removal when no right or purpose remains.
• AI prompts containing personal or client data require a separately assessed permitted use and minimal retention under the applicable agreement and provider rules. Project AI-use records: the project plus the necessary evidence period. Generated output: according to rights and project purpose.
• Reading preferences in this browser: until reset or removal of site storage; no automatic expiry is set. Cookie choices: 180 days. Analytics cookies (after consent): up to 2 years; event data in Google Analytics: up to 14 months; recordings in Microsoft Clarity: 30 days. Meta Pixel cookies (after marketing consent): _fbp and _fbc up to 90 days.

When we work on a client’s data

A client may remain the controller while DeMenso acts as a processor, for example when working on a client’s CMS or user records. In that case the client’s instructions and the applicable data-processing agreement determine the permitted processing, access, retention and return or deletion. This website policy does not replace that agreement.

Browser storage, AI and decisions

The website remembers chosen reading preferences and cookie choices in localStorage. The cookie policy describes the keys, purposes, durations and removal of data. Change your choices through Cookie settings; Reject optional switches off both optional purposes. Google Tag Manager, Google Analytics and Microsoft Clarity load only if you accept analytics. Meta Pixel loads only if you accept marketing.

There is no automated decision-making with legal or similarly significant effects in the current website implementation. AI-assisted company work is covered by the AI policy; this website does not automatically send your enquiry to an AI service.

Your rights and contact

Depending on the conditions in the GDPR, you can request access, correction, deletion, restriction or portability, object to legitimate-interest processing, and withdraw consent. You can always object to direct marketing. Withdrawal does not affect the lawfulness of earlier consent-based processing.

Requests normally receive a response within one month. A justified extension of up to two further months is possible for complex or numerous requests; you must be informed within the first month with the reasons.

You can complain to Integritetsskyddsmyndigheten (IMY), or the competent authority in your habitual residence, workplace or place of the alleged infringement. You do not need to contact us first.

Changes to this information

We update this policy when data-processing practices, services or legal requirements change. The update date is displayed beside the document title.