Privacy policy
How Normavo AB processes personal data about contact persons at customers and suppliers, persons we contact in our sales activities, persons who get in touch with us and persons who apply for jobs with us.
Last updated 25 October 2026. Questions about personal data and data protection: privacy@normavo.com
1. About this policy
This policy applies to the personal data about the groups above for which Normavo AB is the controller, that is, where we determine the purposes and means of the processing. Our employees receive information about how we process their data directly from us.
The policy does not apply to the data that our customers themselves enter into our service. In that respect, the customer is the controller, and we process the data on the customer’s behalf in accordance with the customer’s instructions and our contract with the customer. The contract also governs how long the data are retained. If you are employed by one of our customers and have questions about data in the service, you must direct them to your employer.
2. Who is responsible
Normavo AB, corporate identity number 559457-1860
Vasagatan 28, 111 20 Stockholm, Sweden
Questions about personal data and data protection: privacy@normavo.com
3. Cookies
Our website is built in Wix Studio, and the platform sets cookies that are needed for the website to function, to be secure and to allow troubleshooting. They are set by Wix and not by us, and we cannot switch them off. Wix describes which cookies are concerned on its help page support.wix.com/en/article/cookies-and-your-wix-site.
A cookie is a small text file that is stored in your browser. Some are deleted when you close the browser, others when their expiry date has passed. You can block or delete cookies in your browser settings, but parts of the website may then stop working.
With your consent, we also use cookies for visitor statistics, in order to see how the website is used and to be able to improve it. You can change your choice at any time via the fingerprint icon at the bottom left of this page. Your choice is stored in your browser by our consent tool (Usercentrics). We do not use any cookies for marketing.
4. How we process personal data
You are not obliged to provide data to us. Without the data we need, however, we cannot respond to your enquiry, perform a contract or process your application.
4.1 Contact persons at our customers
What we process
Name, title and role, employer, email address, telephone number, correspondence with us and notes on meetings, contracts and ongoing work.
Where the data come from
From you, from your employer or from your employer’s website.
Why and on what basis
To enter into and perform the contract with your employer, to keep in contact during delivery and to provide support; the legal basis is our legitimate interest in being able to manage the customer relationship. To invoice and keep accounts; the legal basis is a legal obligation under the Accounting Act.
For how long
During the term of the contract and for 24 months thereafter. Data forming part of accounting information are retained up to and including the seventh year after the end of the calendar year in which the financial year ended, in accordance with Chapter 7, Section 2 of the Swedish Accounting Act.
4.2 Persons we contact in our sales activities
We sell to organisations and therefore contact persons who have a role in which our service may be relevant. We use AI tools to compile background material in preparation for making contact. The tools may retrieve publicly available information about you when they search the web. A member of staff reviews and approves everything before we send anything, and we do not make any automated decisions about you.
What we process
Name, title and area of responsibility, employer, work email address and work telephone number, publicly available information about the person’s work, and our own notes about the contact.
Where the data come from
We primarily obtain the data from public sources: the employer’s website, LinkedIn, press releases, news articles and public registers. If your email address has not been published, we may have based it on the address format used by your employer. Where we have been in contact with you, data also come from you, and we write the notes about the contact ourselves.
Why and on what basis
To be able to present our service to organisations where it may be relevant and to reach the right person there. The legal basis is our legitimate interest in marketing our services. We have weighed this against your interests and fundamental rights and freedoms, and only process data relating to your professional role, never your private life.
For how long
24 months from our most recent contact with you. If you tell us that you do not wish to be contacted, we will erase the data, except for the minimum we need in order not to contact you again.
You always have the right to object to this processing (see section 7).
4.3 Contact persons at suppliers and partners
What we process
Name, title, employer, email address, telephone number and correspondence.
Where the data come from
From you or from your employer.
Why and on what basis
To manage the collaboration, order and receive services and handle invoices. The legal basis is our legitimate interest in being able to administer supplier and partner relationships, and a legal obligation under the Accounting Act for what forms part of accounting documentation.
For how long
During the collaboration and for 24 months thereafter. Data forming part of accounting information are retained up to and including the seventh year after the end of the calendar year in which the financial year ended, in accordance with Chapter 7, Section 2 of the Swedish Accounting Act.
4.4 If you contact us
This applies to you if you email us, submit our web form or contact our support.
What we process
The form collects your email address and, if you wish, a message. If you email us, we also process your name, any telephone number and attachments. Data from the form are stored with our website provider Wix.
Where the data come from
From you.
Why and on what basis
To reply to you, resolve your enquiry and follow up. The legal basis is our legitimate interest in being able to handle incoming questions and provide support.
For how long
24 months from when the enquiry was closed. If the enquiry relates to a customer or supplier relationship, we instead retain the data for as long as stated in section 4.1 or 4.3 respectively.
4.5 If you apply for a job with us
What we process
The application, CV, covering letter, contact details, notes from interviews and the references that you yourself have provided.
Where the data come from
From you, and from referees to whom you have referred us.
Why and on what basis
To carry out the recruitment and to be able to respond to any claims under the Swedish Discrimination Act. The legal basis is our legitimate interest in recruiting staff and in being able to defend ourselves against legal claims.
For how long
No more than 26 months after the employment decision was made. This period corresponds to the time limits within which a job applicant may bring an action for discrimination under Chapter 6, Section 4 of the Swedish Discrimination Act and Sections 64-66 of the Swedish Employment (Co-determination in the Workplace) Act. If you would like us to retain your application for future recruitment, we will ask for your consent. If you would like us to erase it earlier, we will do so, unless we need the data in order to be able to defend ourselves against legal claims.
If you are a referee, we process your name, your contact details and what you tell us about the applicant. We have received your name and contact details from the applicant, and we receive what you tell us about the applicant from you. We use the data for the same purposes and retain them for as long as the application.
5. Who receives the data
We engage suppliers that process personal data on our behalf in the areas of operations and cloud services, email and collaboration tools, customer and contact registers, accounting, website, consent management, and AI support for research in preparation for sales contacts. The data are processed in Sweden and elsewhere within the EU/EEA, and in some cases outside the EU/EEA (see section 6). We will provide information on who the suppliers are on request.
We also disclose data to public authorities when required by law, and to our advisers, for example an auditor or legal representative, when necessary in an individual case. We never sell on personal data.
6. Transfer outside the EU/EEA
Some of our suppliers, or their subcontractors, process personal data outside the EU/EEA, primarily in the USA. The transfers take place either to recipients covered by a decision of the European Commission on an adequate level of protection or on the basis of the European Commission’s standard contractual clauses under Article 46 of the General Data Protection Regulation. Contact us at privacy@normavo.com if you would like to know what applies to a particular transfer or to obtain a copy of the safeguards.
7. Your rights
You have the right to:
-
Find out what data we hold about you and obtain a copy of them.
-
Have inaccurate data rectified and incomplete data completed.
-
Have data erased, for example if we no longer need them. The right does not apply to data that we are required by law to retain, such as accounting documentation, or that we need in order to be able to defend ourselves against legal claims.
-
Request that we restrict the processing, for example while we investigate an objection or an item of data that you consider to be inaccurate.
-
Object to processing based on legitimate interest. If you object to us contacting you for marketing purposes, we will always stop.
-
Receive the data you have provided to us and transmit them to another controller, where we process them on the basis of your consent or a contract with you.
-
Withdraw consent at any time. This does not affect processing that has already taken place.
Where we rely on legitimate interest, you can, on request, find out more about how we have weighed our interests against yours. Contact us at privacy@normavo.com to exercise your rights. We normally respond within one month and may need to ask a few questions in order to know for certain who you are.
8. Complaints
If you are not satisfied with how we process your personal data, you are welcome to get in touch with us first. You also always have the right to lodge a complaint with the supervisory authority:
Swedish Authority for Privacy Protection (IMY)
imy@imy.se
www.imy.se
9. Changes
If we change how we process personal data, we will update this policy and change the date at the top. In the event of major changes, we will inform you directly if you are a contact person at one of our customers.