Privacy Policy

Elevation State AB, company registration number 559013-8607, is the controller responsible for the processing described here. This policy covers our website, enquiries and client communications. If an engagement requires other processing, we provide additional information.

When you contact us, we process your name, contact details and the information you provide about your enquiry. The form requires your first name, last name, email address, telephone number and a brief description of your needs. Information about your organisation, registration number, website, country and business, and your choice of services or programmes, is optional. There is no legal requirement to provide this information, but the form cannot be submitted without the required fields.

We use the information to respond to your enquiry, arrange meetings and discuss a potential engagement. During an engagement, we also process relevant information about your professional role and personal data in correspondence, proposals, agreements and invoicing records to deliver and administer the engagement.

The legal basis is legitimate interests. Our legitimate interest is to respond to enquiries and manage engagements and client communications. Where you personally are or will become a party to an agreement, we instead rely on contract for processing necessary to perform that agreement or take steps at your request before entering into it.

We also process information to comply with legal obligations, including accounting requirements and obligations under the GDPR. Where information is needed to handle legal claims, the basis is legitimate interests and our legitimate interest is to protect our legal rights.

Submitting an enquiry does not subscribe you to a newsletter or constitute consent to marketing. Do not include sensitive personal data, such as health information, or unnecessary information about other people in the form.

When you visit the website, technical information such as your IP address, the time of the visit and technical error messages is processed by our providers of web hosting (Vercel) and content management (Sanity). The information is used to provide the website, troubleshoot and prevent misuse. The processing is based on legitimate interests, namely our interest in a functioning and secure website.

Some articles may contain embedded videos from YouTube or Vimeo. When such a video is shown, your IP address and technical information may be sent to that service, which may also use its own cookies.

Apart from this, we do not use cookies or similar storage in your browser, and we do not use web analytics or marketing tracking tools.

Access is limited to people who need the information for the purposes above. A provider processing personal data on our behalf must be covered by a data processing agreement and follow our documented instructions.

We use providers for web hosting (Vercel), content management (Sanity), email and delivery of form messages (Resend). The providers receive the personal data needed to provide their respective services.

Messages from the contact form are sent through Resend, which is provided by Plus Five Five, Inc. Resend processes message content and delivery data in the United States. The transfer is covered by the European Commission's standard contractual clauses in the data processing agreement with Resend. Our other providers may also process information outside the EU/EEA, including in the United States, on the basis of the standard contractual clauses or an adequacy decision.

You may contact us for information about any transfers and a copy of the applicable safeguards. We may also disclose information to public authorities where required by law and to legal advisers where necessary for legal claims.

Enquiries that do not lead to an engagement are kept while the matter is handled and afterwards only if the information is needed for follow-up, for no longer than six months after the matter has been closed. Information that is no longer needed is deleted earlier.

Ongoing engagement communication is kept during the engagement and while agreed follow-up and final settlement take place. Information that does not need to be kept as contract documentation, accounting records or for legal claims is then deleted.

At Resend, messages and delivery logs are kept for 30 days. Information may then remain in backups for up to seven days. Messages delivered to our inbox are covered by our own retention periods above.

Information that is no longer needed is deleted or anonymised. Personal data in accounting records is retained under the Swedish Accounting Act until the end of the seventh year following the end of the calendar year in which the relevant financial year ended. This period does not automatically apply to other client correspondence.

Information needed for a legal claim may be retained longer, but only to the extent and for the time necessary for that claim.

You may request access to your personal data and correction of inaccurate information. In certain circumstances, you may also request erasure or restriction of processing. Where processing is automated and based on consent or contract, you may have the right to receive information you have provided in a usable electronic format and transfer it to another controller.

Right to object

You may object to processing based on legitimate interests on grounds relating to your situation. We may then continue only if we have compelling legitimate grounds that override your interests, rights and freedoms, or if processing is necessary for legal claims. You always have the right to object to direct marketing.

Where processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of earlier processing.

Use the contact details in Section 1 to exercise your rights. This is normally free of charge. We respond without undue delay and normally within one month. Where necessary, we may extend this by up to two months because of the complexity or number of requests. We will inform you of the extension and the reasons within the first month.

You may complain to the Swedish Authority for Privacy Protection, IMY, or another competent supervisory authority, for example where you live or work. You do not need to contact us first.

The current policy is available on our website. If we intend to use information already collected for a new purpose, we inform you before that processing begins. Updating this policy does not replace consent where consent is required.