Privacy Policy for REFIBU AB

Last updated: September 7, 2025
Data Controller: REFIBU AB (Org.nr: 559401-1610)
Website: https://www.refibu.dk/
E-mail: skrivtil@refibu.dk

This privacy policy explains how REFIBU AB collects, processes, and protects personal data when you visit our website, contact us, or become a customer/supplier.

1. What data do we collect – and for what purposes?

1.1. When you contact us (contact form, e-mail, or phone)

Data:

Name
E-mail
Phone
Message text and any information you provide (e.g., type of asset, budget, etc.).

Purpose:
To respond to inquiries, provide advice, and issue offers.

Legal basis:
GDPR Art. 6(1)(f) (legitimate interest in responding) and, where applicable, Art. 6(1)(b) (steps prior to/for the performance of a contract).

1.2. When you enter into an agreement / become a customer

Data:
Identification and contact details, contract data, payment and transaction information, details about asset(s), correspondence, and documentation.

Purpose:
To enter into and perform the agreement, including administration, invoicing, payout, and fulfillment of legal obligations (accounting, documentation requirements).

Legal basis:
GDPR Art. 6(1)(b) (contract), Art. 6(1)(c) (legal obligation – e.g., bookkeeping law), and Art. 6(1)(f) (legitimate interests: operations, quality, enforcement of claims).

1.3. Website operation, statistics, and security

Data:
Technical log data (IP address, device, browser, time, URL), cookies, and aggregated statistics.

Purpose:
Operation, security, troubleshooting, improvement of user experience, and anonymized statistics.

Legal basis:
GDPR Art. 6(1)(f) (legitimate interest in a secure and functional website).

Cookies:
Only necessary cookies are used without consent. Any non-essential/analytical cookies are only used with your consent (see our [Cookie Policy]).

1.4. Marketing (voluntary)

Data:
Name, e-mail, and your preferences.

Purpose:
To send newsletters/offers.

Legal basis:
GDPR Art. 6(1)(a) (consent) and marketing legislation. You may withdraw consent at any time.

2. Sources

We primarily collect information directly from you. Where relevant, we may supplement with publicly available registers or information from partners (e.g., for identification/validation in connection with contract entry).

3. Recipients and data processors

We only share information when necessary and lawful:

Hosting: Our website is hosted by Simply.com, which provides operation and security.
Image hosting/CDN: We use Cloudinary to deliver images on the website.
E-mail: All e-mail correspondence is handled via [insert provider, e.g., Simply Mail or Microsoft 365].
IT support: Trusted partners under a data processing agreement.
Payment and financial partners: Where relevant for payouts and invoicing.
Advisors: Lawyers, auditors, and other professional advisors.
Authorities: Only if required by law.

We enter into data processing agreements with all suppliers who process personal data on our behalf.

Transfer to third countries (outside the EU/EEA):
Cloudinary may process data outside the EU/EEA. Transfer is based on the EU Commission's Standard Contractual Clauses (SCC) and supplementary safeguards.

4. Storage and retention periods

Inquiries without agreement: Deleted/archived within 12 months.
Customer data/contract documents: Stored for 5 years under the bookkeeping law, or longer if required for legal claims.
Marketing (consent): Until consent is withdrawn.

5. Your rights

You have the right to:

Access your data
Correct inaccurate information
Request deletion
Request restriction of processing
Object to legitimate interest
Data portability
Withdraw consent

6. Complaints

You can always contact us first. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY):
Integritetsskyddsmyndigheten (IMY)
Box 8114, 104 20 Stockholm, Sweden
Phone: +46 (0)8 657 61 00
Website: www.imy.se

7. Security

We have implemented appropriate technical and organizational measures, including access control, encryption, logging, backup, and supplier audits.

8. Changes to this Privacy Policy

We may update this policy in case of changes to our processing, systems, or legislation. The latest version is always available on our website.

Contact

REFIBU AB
Org.nr: 559401-1610
E-mail: skrivtil@refibu.dk