Legal
Privacy Policy
Netgraph Sverige AB
1. General
This Privacy Policy explains how Netgraph Sverige AB ("Netgraph", "we", "our", "us") processes personal data. The policy describes what information we collect, why we collect it, how we use and store it, and your rights as a data subject.
We are committed to ensuring your privacy and handling your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable laws.
2. Data Controller
Netgraph Sverige AB
Organization number: 556951-4622
Address: Biblioteksgatan 6A, 831 30 Östersund, Sweden
Email: info@netgraph.se
Phone: +46 (0)10 – 458 04 00
We are the Data Controller for personal data collected via our website, during business relations, or in the context of recruitment and employment.
In cases where we deliver services to customers as a technical sub-processor, we act as a Data Processor and process personal data on behalf of our customers, based on their instructions.
3. What Personal Data We Collect
Depending on your interaction with us, we may collect:
- Contact details: Name, email address, phone number, company name, job title
- Technical identifiers: IP address, MAC address, user agent
- Application data: CV, social security number, personal letter (for recruitment)
- Service usage data: Device logs, usage metrics, authentication events (for platform users)
- Status update subscriptions: The email address, webhook URL or Slack URL you give us on the status page, or, for the Netgraph Status app, the push subscription your browser creates (an anonymous delivery address plus its encryption keys), together with the data center you chose. A push subscription carries no name or email.
4. How and Why We Process Personal Data
| Purpose | Type of data | Legal basis | Retention |
|---|---|---|---|
| Responding to contact requests | Name, email, message | Legitimate interest | 12 months |
| Account and user management | Name, email, org details | Contract performance | Duration of agreement |
| Sending newsletters and offers | Name, email | Consent | Until withdrawal |
| Recruitment and hiring | CV, contact info, ID data | Consent / Legitimate interest | Max 2 years (with consent) |
| Platform delivery and customer support | Technical data, usage logs | Contract performance / Legal obligation | Up to 12 months or contract end |
| Improving services and security | Logs, metadata | Legitimate interest | Varies by service |
| Platform status updates and app notifications | Email, webhook or Slack URL, or a push subscription; chosen data center | Consent | Until you unsubscribe or turn notifications off; a push subscription is also removed when your browser revokes it |
| Website analytics (optional) | Random visitor id, page, city/region, time on page | Consent | 12 months (first-party) / 14 months (Google Analytics) |
| Invoicing, accounting, legal compliance | Name, org, billing details | Legal obligation | 7 years (per accounting laws) |
5. Cookies and website analytics
We keep website tracking to a minimum and design it to respect your privacy.
Always on (no cookies, no consent needed). We use Cloudflare Web Analytics, a privacy-first, cookieless measurement that counts page views and visits in aggregate. It sets no cookies, stores no IP addresses, and does not track you across sites.
Optional, only with your consent. If you select "Accept" on our cookie banner, we enable analytics that help us understand how the site is used: unique and returning visitors, approximate location at city and region level, time spent on a page, entry and exit pages, and where visitors come from. Nothing loads until you accept. The legal basis is your consent, which you can withdraw at any time via "Cookie settings" in the footer. This analytics has two parts: our own first-party measurement (we do not store your IP address; location is derived to city and region level only and kept in aggregate; retained for up to 12 months), and Google Analytics (described below). Together they set the following cookies:
| Cookie | Purpose | Retention |
|---|---|---|
| ng_consent | Remembers your cookie choice | 12 months |
| ng_vid | A random visitor identifier, not linked to your name or email | 12 months |
| ng_sid | Groups page views into a single visit | 30 minutes |
| _ga | Google Analytics: distinguishes visitors (set only after you accept) | Up to 2 years |
| _ga_<id> | Google Analytics: keeps session state (set only after you accept) | Up to 2 years |
About Google Analytics. We use Google Analytics 4, provided by Google Ireland Limited. It is consent-gated with Google Consent Mode: it stays fully disabled until you accept, so no _ga cookie is set and no data is sent to Google before then. We have turned off Google Signals and advertising personalisation, so your data is not used for advertising and is not combined with your activity across other sites or apps. Google acts as our processor; analytics data is retained for up to 14 months. Some processing may take place outside the EU/EEA under EU Standard Contractual Clauses. Google Analytics does not log your IP address.
Strictly necessary. Signing in to internal areas, such as the Learning Center or admin tools, sets a single session cookie (ng_learn_session) required for the login to function. This cookie is exempt from consent.
6. Sub-Processors
We may engage third-party sub-processors, such as hosting providers and cloud service providers (for example Cloudflare for hosting and Google for website analytics), to deliver our services. We always sign Data Processing Agreements (DPAs) with these providers.
If a sub-processor is located outside the EU/EEA, we ensure appropriate safeguards are in place, such as EU Standard Contractual Clauses (SCCs).
You may request a full list of current sub-processors by contacting us.
7. Security Measures
We implement technical and organizational measures to protect personal data, including:
- Role-based access control
- Encryption in transit and at rest
- Logging and monitoring
- Firewalls and intrusion prevention
- Employee training and confidentiality policies
We also require our sub-processors to adhere to strict security standards.
8. Your Rights
Under GDPR, you have the following rights:
- Right to access — You may request a copy of your personal data we process.
- Right to rectification — You may request correction of incorrect data.
- Right to erasure — You may request deletion of your data ("right to be forgotten").
- Right to restriction — You may limit how your data is processed.
- Right to data portability — You may obtain your data in a machine-readable format.
- Right to object — You may object to certain types of processing (e.g. marketing).
- Right to withdraw consent — If processing is based on consent, you can withdraw at any time.
To exercise your rights, please contact: info@netgraph.se
9. Complaints
If you believe your data has been processed in violation of GDPR, you may contact the Swedish Authority for Privacy Protection (IMY): https://www.imy.se
10. Changes to this Policy
We may update this Privacy Policy when necessary. The latest version is always available at netgraph-connect.com/privacy-policy/ or upon request.
Last Updated: July 23, 2026