Privacy Policy
1. Who we are
Mailflow Sweden AB ("Mailflow", "we", "us") is the data controller for the personal data described in this policy.
- Legal name: Mailflow Sweden AB
- Registration number: 559438-4744
- VAT number: SE559438474401
- Registered with the Swedish Companies Registration Office (Bolagsverket)
- Registered address: Säteråsvägen 13, 443 92 Lerum, Sweden
- Contact: anton@mailflowsweden.com
2. Personal data we process
We process business contact data in a professional context. This typically includes name, job title, business email address, employer, the employer's website, a public professional profile, and country.
We do not seek out special categories of personal data as defined in Article 9 GDPR, and our sourcing is directed at business email addresses. Where data outside this scope is identified, it is removed.
3. Where the data comes from
Some information you provide to us directly, when you contact us or use our website.
Contact data for business prospects is obtained from third-party providers of B2B contact data and from publicly available sources such as company websites and professional networks. This disclosure is made under Article 14 of the GDPR and, where applicable, under the UK GDPR.
4. Purpose and legal basis
We contact named decision-makers about services that are directly relevant to the recipient's professional role.
Legal basis: legitimate interest, Article 6(1)(f) GDPR.
Balancing test. Mailflow has a commercial interest in reaching relevant decision-makers about email marketing services. The contact is made in the recipient's professional capacity, using data limited to business role information. Every message identifies the sender and postal address, and provides a clear opt-out in accordance with the applicable law in each recipient's jurisdiction. Objections are honoured immediately.
5. Recipients
We engage processors that support outbound sending, email infrastructure, website hosting and data storage. Each is bound by a data processing agreement. Recipient data is used only for the purposes described in this policy.
6. Transfers outside the EEA
Some processors may be located in countries outside the European Economic Area, including in jurisdictions without an adequacy decision from the European Commission. Where such transfers occur, they are made under appropriate safeguards, in the first instance the Standard Contractual Clauses adopted by the European Commission (Implementing Decision 2021/914), together with the UK International Data Transfer Addendum where United Kingdom data is transferred. Supplementary measures include encryption in transit and at rest, and access controls.
7. Retention
Prospect data is retained for as long as it is relevant to the purpose, normally up to 24 months from the last meaningful contact.
If you object or ask to be removed, your details are moved to a permanent suppression list and retained there for as long as needed to ensure you are not contacted again.
Client data is retained in line with each engagement contract. Bookkeeping records are retained under Swedish accounting law.
8. Your rights
You have the following rights under GDPR and, where applicable, UK GDPR, exercisable in the first instance directly with us using the contact details in this policy, and, where you consider that the matter has not been resolved, raisable with the Swedish Authority for Privacy Protection (IMY, imy.se) as our lead supervisory authority, the Information Commissioner's Office (ICO, ico.org.uk) in the United Kingdom, or your local data protection authority:
- Access the personal data we hold about you
- Rectification of inaccurate data
- Erasure
- Restriction of processing
- Data portability
- Object to direct marketing at any time. This right is absolute. No reason is required and the objection is honoured immediately.
9. Cookies
Our website uses essential cookies to remember your consent choice and to protect against automated traffic. Analytics cookies load only after you accept them in the cookie banner shown on your first visit. You can change your preferences at any time via the "Cookie settings" link in the footer.
10. Automated decision-making
Our processing does not involve automated decision-making that produces legal or similarly significant effects as defined in Article 22 GDPR.
11. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, multi-factor authentication, and data processing agreements with every processor we engage.
12. Changes to this policy
We may update this policy from time to time. Material changes will be reflected in the "Last updated" date at the top of this page.
13. Contact
Mailflow Sweden AB
Säteråsvägen 13
443 92 Lerum, Sweden
anton@mailflowsweden.com