Legal
Privacy Notice
Last updated: 19 October 2026
In brief
SofClo AB (“SofClo”, “we”) respects your privacy. This notice explains how we handle personal data when you visit sofclo.com, book a demo, subscribe to updates, meet us at an event or do business with us.
- We collect only what we need: mainly the business contact details you give us.
- We never sell personal data.
- Analytics and marketing cookies are used only if you consent.
- Data that you or your organisation store in the SofClo platform is processed on your organisation’s behalf under our Data Processing Agreement (DPA), inside the EU.
- You can contact us at any time at dpo@sofclo.com to access, correct or delete your data.
1. Who is responsible
SofClo AB, corporate registration number 559561-4719, c/o Lundberg, Falkbergsvägen 7A, 146 40 Tullinge, Sweden, is the data controller for the processing described in this notice.
We have appointed a Data Protection Officer. Questions or requests: dpo@sofclo.com, or by post to SofClo AB, Attn: Data Protection Officer, at the address above.
2. What we collect, why, and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Demo bookings, contact form and sales enquiries | Name, work e-mail, company, role, phone (optional), your message | Legitimate interest in responding to business enquiries | 24 months after our last contact, unless a customer relationship starts |
| Events and trade fairs | Name, work e-mail, company, role, notes from our conversation | Legitimate interest in following up on business contacts | 24 months after the event, unless a customer relationship starts |
| Newsletter and product updates | Name, work e-mail | Consent (withdraw at any time via the unsubscribe link) | Until you unsubscribe |
| Customer and contract administration | Contact details of customer representatives, designated admin users and billing contacts | Performance of a contract | Contract term + 12 months |
| Customer support | Name, work e-mail and the content of support requests | Performance of a contract | Contract term + 12 months |
| Invoicing and accounting | Billing contacts, invoices | Legal obligation (Swedish Bookkeeping Act) | 7 years |
| Website analytics | IP address (shortened), device and browser data, pages visited | Consent (cookie settings) | 14 months |
| Website security and operation | IP address, server logs | Legitimate interest in keeping the site secure | 30 days |
We do not use personal data for automated decision-making or profiling with legal effects. We do not sell personal data.
3. Data in the SofClo platform
When our customers use the SofClo platform, SofClo processes the data they store there on their behalf, as a data processor. The customer is the data controller. That processing is governed by our Data Processing Agreement (DPA), which forms part of our Master Service Agreement. If you are a user of the platform through your employer or another organisation, please contact that organisation first about your data.
The platform is hosted on Amazon Web Services in Ireland, with immutable copies of backups stored in Amazon Web Services in Stockholm. Customer data, including backups, is stored and processed within the EU/EEA. When an agreement ends, we delete or anonymise the customer’s data within 90 days, and backups, including the immutable copies, are retained for 30 days. We may use aggregated and anonymised data, which can no longer identify anyone, to improve the platform and for benchmarking.
AI features. Some features, such as maturity assessments, recommendations, generated documents and the assistant chatbot, use AI models on Amazon Bedrock in Ireland. Customer data is processed only to deliver the feature, stays within the EU/EEA, is not stored by the AI service and is not used to train AI models. Generated content is decision support: users review it before relying on it.
4. Who we share data with
We share personal data only with service providers that help us run our business and deliver the platform. They act on our instructions under data processing agreements.
| Provider | What for | Location |
|---|---|---|
| Amazon Web Services EMEA SARL | Hosting of the SofClo platform and AI features (Amazon Bedrock); immutable backup storage (Stockholm) | Ireland (EU) and Sweden (EU) |
| HubSpot, Inc. | CRM, demo bookings, contact forms and e-mail marketing | USA – EU–US Data Privacy Framework |
| Google Ireland Ltd | Business e-mail, calendar and documents (Google Workspace) | Ireland (EU) |
| Google LLC | Website analytics (Google Analytics), only with your consent | USA – EU–US Data Privacy Framework |
The providers above handle data for SofClo’s own operations. The sub-processors that process Customer Data in the SofClo platform are listed separately at www.sofclo.com/subprocessors. Today that list contains Amazon Web Services only.
We may also disclose personal data when required by law or by a public authority, or in connection with a merger, acquisition or sale of our business, in which case the recipient will be bound by this notice.
Transfers outside the EU/EEA. We aim to process personal data within the EU/EEA, and the SofClo platform runs entirely within the EU. Where a provider processes data in the United States, we rely on the EU–US Data Privacy Framework for certified providers, or otherwise on the European Commission’s Standard Contractual Clauses with supplementary measures where needed.
5. Cookies
We use strictly necessary cookies to run the website. Analytics and marketing cookies, including Google Analytics and HubSpot tracking, are set only with your consent. You can change your choice at any time via Cookie settings in the footer of sofclo.com.
6. Security
SofClo is ISO/IEC 27001 certified, and a SOC 2 attestation is in progress. We protect personal data with encryption in transit and at rest, access control, logging and monitoring. Read more in our Trust Portal at www.sofclo.com/trust-portal.
7. Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy of it;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to processing, including direct marketing;
- data portability; and
- withdraw consent at any time, without affecting processing carried out before the withdrawal.
To exercise your rights, contact our Data Protection Officer at dpo@sofclo.com. We respond within one month. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se, or with the supervisory authority in the country where you live or work.
8. Changes to this notice
We may update this notice from time to time. The date at the top shows the latest version. We will inform customers of material changes by e-mail or through the platform.