Privacy policy

1. Introduction

The Privacy Policy is intended to help you feel confident that Nudgd handles your Personal Data in accordance with applicable privacy law. Below we describe how Nudgd processes Personal Data, what rights you have, and how to contact Nudgd if you have questions or want to exercise your rights.

If Nudgd changes the Privacy Policy, an updated version will be published on Nudgd’s website at https://nudgd.se.

2. Processing, purposes, and legal basis

Nudgd collects and processes Personal Data only to the extent necessary to provide, market, deliver, and evaluate Nudgd’s services. Collection and processing take place based on consent, an existing contract, or a legal obligation, for example when Nudgd must retain data under bookkeeping rules. Exceptions apply where prior consent is not practically possible, processing is still permitted by law, and Nudgd has a legitimate interest in processing Personal Data, for example for marketing, follow-up of delivered services, or to establish, exercise, or defend legal claims (balancing of interests).

Nudgd may process Personal Data collected for its own purposes, in which case Nudgd is the controller. Examples include collecting Personal Data via the website for newsletters, demo booking, or contact forms, or when support stores data needed to administer support and complaint matters. The legal basis is then explicit consent or a balancing of interests. Nudgd may also need to process Personal Data to meet legal obligations arising from law, judgments, or authority decisions. The legal basis is then the legal obligation.

Nudgd may also process Personal Data on behalf of a third party, in which case Nudgd is a processor. Examples include when a municipality or company uses Nudgd’s services to send SMS or other targeted messages. The legal basis is then a contract between the data subject and that third party, the third party’s legal obligation, or a balancing of interests carried out by that third party.

3. Special categories of personal data

Special categories of Personal Data means data revealing racial or ethnic origin, political opinions, religious beliefs, or trade union membership, as well as data concerning health or sex life.

As a rule, Nudgd does not process special categories of Personal Data about the user.

4. Cookies

Nudgd uses cookies on its websites to adapt content for visitors. Cookies may then be shared with Nudgd’s partners.

Cookies are stored on the visitor’s device only if they are strictly necessary to use the website, or when the visitor has given consent. Which cookies are used is described in the cookie information on the website.

Cookie policy

5. Disclosure to others

Nudgd does not share your Personal Data with any third party other than as set out in this Privacy Policy, unless Nudgd is required to disclose such data under applicable rules or in connection with an ongoing legal, administrative, or collection proceeding where you and Nudgd are parties.

Nudgd engages subcontractors for services connected to Nudgd’s offerings (processors). These providers may process Personal Data collected by Nudgd. Nudgd may also need to store Personal Data using such providers’ services. On the marketing website, tools for demo scheduling and form handling may be used, for example.

Nudgd may share Personal Data you submit in the service, including email address, with our clients so they can respond to your feedback.

Nudgd always limits such providers’ access to the Personal Data needed for Nudgd to offer its services, protect its rights, and meet its obligations. Nudgd also requires providers to (i) protect your Personal Data in accordance with this Privacy Policy or Nudgd’s other instructions and (ii) not use or disclose Personal Data for any other purpose than stated above.

6. Storage of personal data

Personal Data processed by Nudgd is stored on an external server provided by Nudgd’s processor within the EU/EEA.

Personal Data is not stored longer than necessary for the purposes of the processing (usually three months) and for Nudgd’s legal obligations, such as bookkeeping rules. Nudgd does not store data longer than required by applicable law and otherwise deletes Personal Data in accordance with the rules in force at the time.

7. Transfers to third countries

As a starting point, Nudgd will not transfer Personal Data to a third country (that is, a country outside the EU/EEA). If Nudgd must do so, for example because a service provider is based in a third country, Nudgd will only transfer Personal Data if the country has an adequate level of protection under applicable privacy law, or if other lawful safeguards are in place.

If Google Maps is used to show location information, your IP address may be stored when you use the map. That information is generally sent to a Google server in the United States and stored there. The legal basis is then GDPR Article 6.1(a) (consent), where required. Information about Google’s handling of user data is available in Google’s privacy policy. If you do not want to transfer data to Google via Google Maps, you can disable JavaScript in your browser. Map display and some other functions will then not work.

8. External links

The Privacy Policy only covers Personal Data that Nudgd processes within Nudgd’s services and digital channels. Nudgd’s websites may contain links to pages that Nudgd does not control. Nudgd accepts no responsibility for Personal Data processing or collection on such pages, which are also outside the scope of this Privacy Policy.

9. Right to request information

You have the right to request, free of charge, information about which Personal Data Nudgd as controller processes about you in a so-called register extract. When you send your request, please specify which data you are interested in (unless you want all data), so Nudgd can provide what is relevant to you. If you request register extracts repeatedly, Nudgd may charge a fee or in certain cases required by law refuse the request.

Register extracts are sent within 30 days of Nudgd receiving a request. If the extract is so extensive that Nudgd needs more time, or if Nudgd for any reason cannot meet a request, Nudgd will notify you.

10. Right to rectification

To meet its obligation to keep Personal Data accurate and relevant, Nudgd works systematically with its registers and updates Personal Data when necessary. If you notice that Personal Data Nudgd processes about you is incorrect, or that important information is missing, you have the right to have your Personal Data corrected. Simple Personal Data is normally corrected without further consideration, but in special cases Nudgd may need to assess your request. Nudgd will not grant a request if it is practically impossible or requires an unreasonably large effort.

If your Personal Data is changed at your request, Nudgd will inform any subcontractors and partners that received the data about the update. If you ask, Nudgd will also tell you to whom the correction was disclosed.

11. Right to be forgotten

You have the right to request that Nudgd as controller erase your Personal Data if any of the following applies:

Nudgd may refuse to erase your Personal Data if Nudgd needs to keep it to meet a legal obligation or to establish, exercise, or defend legal claims against you or defend Nudgd against such claims, for example in a dispute.

When Nudgd receives a request as above, Nudgd assesses whether there are grounds to erase your Personal Data and notifies you of the assessment. If Nudgd erases your data at your request, Nudgd informs any providers and partners that received the data, unless that is practically impossible or requires an unreasonably large effort.

• the data is no longer needed for the purposes for which it was collected and for which Nudgd processes it
• Nudgd processes Personal Data based on your consent and you withdraw that consent
• Nudgd processes Personal Data for direct marketing and you object to continued processing for that purpose
• Nudgd processes Personal Data based on a balancing of interests and there are no legitimate interests that override yours
• erasure is required to meet a legal obligation
• there is otherwise another relevant legal ground for you to request erasure

12. Right to restriction of processing

You have the right to request restriction of Personal Data that Nudgd processes as controller when any of the following applies:

Restriction means the Personal Data is marked so that in the future it may only be processed for certain limited critical or statutory purposes.

• you have contested the accuracy of the Personal Data, for the period that allows Nudgd to verify whether the data is accurate
• the processing is unlawful and you oppose erasure and instead request restriction of use
• Nudgd no longer needs the Personal Data for the purposes of the processing, but you need it to establish, exercise, or defend legal claims
• you have objected to processing pending verification of whether Nudgd’s legitimate interests override yours

13. Deletion of data

Personal Data is not retained longer than necessary for the purposes of the processing (usually no longer than three months). Otherwise Nudgd deletes Personal Data as required by applicable law, with a case-by-case assessment of when different types of Personal Data should be deleted.

14. Right to object

You have the right to object to Nudgd’s processing of your Personal Data as controller when the processing is based on a balancing of interests. You then need to specify in writing which processing you object to. After such an objection, Nudgd may continue the processing only if Nudgd can show compelling legitimate grounds that override your interests.

If your Personal Data is processed by Nudgd as controller for direct marketing, you always have the right to object to that processing at any time.

15. Right to data portability

If you have provided Personal Data to Nudgd and Nudgd processes it, you may in some cases have the right to receive and take that Personal Data with you, for example to move it to another company. For data portability, the request must concern Personal Data you yourself provided to Nudgd and that Nudgd processes as controller based on your consent or to perform a contract with you. The right does not apply when processing is based on a balancing of interests or a legal obligation, nor when portability is technically impossible or requires an unreasonably large effort.

16. Right to lodge a complaint

If you have complaints or objections regarding Nudgd’s handling of your Personal Data as controller, Nudgd asks that you first contact Nudgd using the details below so Nudgd can help you. You always have the right to lodge a complaint directly with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

17. Security

Nudgd takes appropriate technical and organizational security measures required under applicable rules to protect Personal Data against, among other things, unauthorized access, alteration, or destruction. To keep Personal Data secure and confidential, Nudgd uses data networks protected by firewalls and password protection according to industry standard. Nudgd may also use encryption for digital transmission of such Personal Data. Security routines are updated as technology develops.

18. Governing language

This privacy policy may exist in several languages. If there is any difference in interpretation or content between language versions, the Swedish version always prevails.

19. Contact details

If you want to exercise any of the rights above, please submit a written request via the form on Nudgd’s contact page or by email to [email protected].

Because it is important that Nudgd does not disclose your Personal Data to unauthorized parties, please sign your request where possible and include a copy of a valid ID document, such as a passport or driving license. If you have questions about this policy or Nudgd’s processing of Personal Data, contact Nudgd at the same email address.

For AI Act, GDPR roles, and related commitments, see Compliance.