Privacy policy.

Data controller

Laxå Bruk AB, corporate registration number 556XXX-XXXX, is the data controller for the personal data you provide via the website, inquiry forms or other contact. We process data in accordance with the GDPR and Swedish data protection legislation.

For questions about the processing of personal data, contact us at office@laxabruk.se.

What data we process

We only process the personal data necessary to respond to your inquiry, fulfil a contract or meet legal requirements. We do not collect data about you without you providing it, except for technical data described below under cookies.

• Contact details: name, email address and phone number you provide in forms.
• Company details: company name and role you state in a technical inquiry.
• Technical information: IP address and browser type, processed according to the cookie policy.
• Message content: what you write in free-text fields, including any attached files.

Purpose and legal basis

We process your personal data to respond to inquiries, manage business relationships and meet legal requirements. Processing is based on the following legal grounds in the GDPR:

• Consent – when you provide data via forms and accept this policy.
• Contract – to prepare or fulfil an agreement you have requested.
• Legal obligation – accounting and other statutory requirements.
• Legitimate interest – protection of our IT systems and information security.

Retention and erasure

We retain your personal data only as long as necessary for the purpose it was collected, or as long as required by law (e.g. accounting requirements). Data is then deleted or anonymised. Inquiries that do not lead to a business relationship are normally deleted within 24 months unless otherwise required by law.

Your rights

Under the GDPR you have the right to information about, and some control over, how your personal data is processed. To exercise your rights, contact us at office@laxabruk.se.

• Right to information – know what data we process and why.
• Right to rectification – correct incorrect or incomplete data.
• Right to erasure – request deletion when data is no longer needed.
• Right to data portability – receive your data in a structured format.
• Right to object – object to processing based on legitimate interest.
• Right to withdraw consent – at any time, without affecting prior processing.

Disclosure and transfer

We do not sell or rent your personal data. Data may be shared with suppliers who help us run our operations (e.g. IT and email services), only to the extent necessary and with safeguards that meet the GDPR. Data is not transferred outside the EU/EEA without safeguards under Article 46 of the GDPR.

Data protection and security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or misuse. This includes access control, encrypted communication and routines for handling personal data.

Complaints

If you believe we do not process your data correctly, you have the right to complain to the Swedish Authority for Privacy Protection (IMY), Box 2275, 103 17 Stockholm, imy.se. We encourage you to contact us first so we can address the matter.