Privacy Policy

BackingNordics

Last updated: 10 October 2026

1. Introduction

BackingNordics ("BackingNordics", "we", "us", "our") is a service operated by Active Intelligent Stockholm AB, company registration number 559605-8825, with its registered office at Drevergatan 1B, 115 47 Stockholm, Sweden (the "Company"). This privacy policy describes how we collect, process and protect your personal data when you:

• visit our website www.backingnordics.com,
• create an account or become a customer of BackingNordics,
• request or receive quotes through our service,
• are contacted by us as a prospective customer as part of our outreach activity,
• are a contact person at one of our Suppliers,
• apply for employment or an internship with us, or
• otherwise communicate or interact with us.

Active Intelligent Stockholm AB is the controller for the processing of your personal data and is responsible for ensuring that the processing complies with Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR"), the Swedish Act (2018:218) containing supplementary provisions to the EU General Data Protection Regulation (the "Data Protection Act"), the Swedish Electronic Communications Act (2022:482) and other applicable data protection legislation.

We take your privacy seriously. This policy is written to be as transparent and as complete as possible so that you fully understand how we handle your data, what rights you have and how to exercise them.

2. Controller and contact details

Controller:

Active Intelligent Stockholm AB. Company registration number: 559605-8825. Registered office: Drevergatan 1B, 115 47 Stockholm, Sweden.

Contact for data protection matters:

Email: oskar@backingnordics.com. Web: www.backingnordics.com

We have not appointed a data protection officer, as we are not required to under Article 37 GDPR. Data protection matters are handled at the email address above.

If you have questions about this privacy policy, wish to exercise any of your rights, have questions about our processing of your personal data or wish to raise a complaint, contact us at the email address above. We answer your request without undue delay and as a rule within one month of receiving it.

3. Definitions

The following terms are used in this privacy policy in accordance with the GDPR:

• Personal data: Any information relating to an identified or identifiable natural person.
• Processing: An operation or set of operations performed on personal data, whether or not by automated means (for example collection, storage, retrieval, use, disclosure and erasure).
• Controller: The party which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Processor: The party which processes personal data on behalf of the controller.
• Third country: A country outside the EU and the EEA.
• Legitimate interest: One of the legal bases for processing under Article 6(1)(f) GDPR, where processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where the interests or fundamental rights and freedoms of the data subject override those interests.

4. What personal data we process

Which personal data we process depends on your relationship with us. The following sets out each category of data subject in detail.

4.1 Customers of BackingNordics

When you create an account or become a customer of BackingNordics, we process:

• First and last name
• Job title or role
• Company name
• Company registration number
• Company address
• Work email address
• Work telephone number
• Login credentials (passwords are always stored encrypted and hashed)
• Profile picture (if you choose to upload one)
• Information about your company's size, sector, operations, needs and preferences
• Communication and correspondence with us
• User behaviour on our platform (for example which tools you have looked at, which quotes you have requested, click data)
• IP address, device information, browser, operating system and technical identifiers

4.2 Prospective customers (prospects): B2B outreach

As part of our outbound sales and marketing activity we process personal data about contact persons at companies we consider may benefit from our services:

• Name of the contact person
• Job title or role
• Work email address
• Work telephone number (direct line or switchboard)
• Public LinkedIn profile and other publicly available professional information
• Company details (name, registration number, sector, number of employees, turnover, address and similar)
• The source of the data (for example allabolag.se, LinkedIn, the company's own website, a public trade register, a data provider)
• Interaction history (calls, emails, meetings, notes)
• Status in the sales process
• Any preferences you have told us about (for example that you do not wish to be contacted)

4.3 Customers matched with a Supplier

When you, as a customer or prospective customer, request or receive a quote from one of our Suppliers, we share certain data with that Supplier. We then also process:

• A description of your needs and requirements
• Which product, service or quote is concerned
• Correspondence about the quote
• The outcome of the process (whether or not an agreement was concluded)
• Contract details, price and date of conclusion (if an agreement is concluded)

4.4 Contact persons at Suppliers

For our Suppliers we process the following data about contact persons:

• Name
• Job title
• Work email address and work telephone number
• Company details
• Correspondence, meeting notes and contract documentation

4.5 Website visitors

When you visit www.backingnordics.com we process:

• IP address
• Browser type and version
• Operating system
• Referring website
• Campaign parameters and ad click identifiers in the address you arrived from, and, when you submit a form, the page you submitted it from, your approximate country, your device type and browser user agent (what is stored in your browser, and when, is set out in section 12)
• Date and time of the visit
• Which pages you visit and for how long
• Cookies and similar technologies, including a randomly generated visitor identifier stored in your browser (see section 12)
• Click and behavioural data, if you have consented to analytics cookies

4.6 People applying for employment or an internship

If you apply for a job or an internship with us, we process:

• Name and contact details
• CV and covering letter
• Educational background and work experience
• References
• Any work samples
• Other information you share in your application
• Notes from interviews and assessments

Applications for advertised roles reach us by email at oskar@backingnordics.com.

4.7 People who communicate with us

When you email us, call us, give feedback or otherwise communicate with us, we process the personal data you provide yourself together with any metadata from the communication (telephone number, email address, time and similar).

4.8 Sensitive personal data

We do not intentionally process special categories of personal data ("sensitive personal data") under Article 9 GDPR (for example data on health, ethnic origin, political opinions, religion, sexual orientation or trade union membership). We ask that you do not provide such data to us voluntarily either, for example in free text fields.

5. Where we collect personal data from

We collect personal data from the following sources:

• Directly from you: When you create an account, complete a form, call us, email us, apply for a job, enter into an agreement or otherwise interact with us.
• Public sources: For our outreach activity we obtain information about companies and contact persons from publicly available sources, for example Bolagsverket, allabolag.se, ratsit.se, hitta.se, eniro.se, companies' own websites, LinkedIn (public profiles), trade registers, business registers and similar.
• Third party data providers: We may supplement our databases with information from reputable B2B data providers which have a legal basis for their collection and with which we have a processor agreement or a data sharing agreement.
• Cookies and technical collection: When you visit our website we automatically collect certain technical information as described in section 12.
• Referrals: We may receive your contact details from existing customers who recommend us to you.
• Our Suppliers: We receive feedback from Suppliers on the outcome of quotes and on any agreements concluded through our introduction.
• Social media and public industry contexts: For example if you interact with us on social media or have attended an event.

6. Purposes and legal basis for the processing

We process personal data only where we have a legal basis under Article 6 GDPR. Below we set out in detail each purpose, which personal data are processed and which legal basis we rely on. The bases are not interchangeable: where we rely on consent you may withdraw it, where we rely on legitimate interest you may object, and where we rely on a legal obligation or on the performance of a contract neither of those applies.

6.1 Providing customer and platform services

Purpose: To create and administer your customer account, give you access to the platform, handle your requests, provide the matching service through which you receive quotes from suppliers, and all other administration of the customer relationship.

Personal data: Contact and company details, login credentials, information about your needs, usage data.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR). The processing is necessary for us to perform the agreement with you as a customer and to provide the service you have requested.

6.2 Passing quotes to Suppliers

Purpose: To pass on your requirements and contact details to relevant Suppliers so that they can prepare a quote for you.

Personal data: Contact details, company details, description of needs.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR), since you have requested a quote through our service.

6.3 Outreach activity (B2B prospecting / cold outreach)

Purpose: To contact prospective customers by telephone, email or other channels in order to introduce BackingNordics and our suppliers' offerings, and to invite them to work with us.

Personal data: Professional contact details for contact persons at companies (B2B), company details, interaction history.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR). We have carried out a balancing test and consider that our legitimate interest in marketing our services to companies within the relevant target group outweighs the individual's interest in not being contacted in their professional capacity.

Our balancing test in summary:

• We contact people only in their professional capacity, at companies within our target group (Swedish small and medium sized enterprises).
• We use only professional contact details, never private ones.
• The volume of personal data we process is limited to what is necessary for the purpose.
• We make clear at first contact who we are and why we are getting in touch.
• We respect a request not to be contacted immediately, and then erase all data except a suppression record.
• The individual has an absolute right to object to direct marketing (see section 11.7).
• We check our contact lists against any applicable suppression registers and against our own suppression lists.

You always have the right to object to this processing. See section 11.7.

6.4 Direct marketing to customers

Purpose: To send newsletters, offers, information about new suppliers and services, surveys and similar to existing customers.

Personal data: Email address, name, areas of interest, segmentation data, click data.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR) for email marketing of our own similar services where the conditions for soft opt-in in Section 19 of the Swedish Marketing Act (2008:486) are met: we obtained the email address in connection with a sale to the recipient, the recipient has not objected, and we offer a clear, simple and free opt-out when collecting the address and in every subsequent marketing email. Otherwise, consent (Article 6(1)(a) GDPR).

You can unsubscribe from our mailings at any time using the unsubscribe link in every mailing, or by contacting us at oskar@backingnordics.com.

6.5 Bookkeeping, accounting and compliance with legal obligations

Purpose: To meet requirements under the Swedish Bookkeeping Act (1999:1078), the Annual Accounts Act (1995:1554), tax legislation, anti money laundering legislation and other financial or commercial law.

Personal data: Company details, transaction data, invoice information, payment details.

Legal basis: Legal obligation (Article 6(1)(c) GDPR).

6.6 Improving and developing the service

Purpose: To analyse usage and to develop and improve the platform, the services, the website, the sales process and the customer experience.

Personal data: Usage data, behavioural data, IP addresses (as a rule pseudonymised), aggregated statistics.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR). Our interest in developing and improving the service normally outweighs the intrusion the processing may represent, particularly since the data are usually pseudonymised or aggregated.

6.7 Training our models on anonymised data

Purpose: To train and improve our models, in particular to detect and counter pricing discrimination between buyers.

Personal data: Data from engagements, such as prices, contract terms and supplier offers. Before it is used for training, the data is anonymised so that it cannot be linked to the customer or to any individual.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR). Our interest is to improve the service and to counter pricing discrimination between buyers. The anonymisation itself is based on this legitimate interest. Once data has been anonymised it is no longer personal data and falls outside the GDPR.

6.8 Security and fraud prevention

Purpose: To protect the platform, prevent unauthorised access, misuse and fraud, and ensure IT security and continuity.

Personal data: IP addresses, security logs, usage data, event data.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR), and where applicable a legal obligation (Article 6(1)(c) GDPR).

6.9 Handling legal claims and disputes

Purpose: To prevent, establish, exercise or defend legal claims.

Personal data: All data which may be relevant to the specific dispute or matter.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR), and where applicable a legal obligation (Article 6(1)(c) GDPR).

6.10 Recruitment

Purpose: To assess your application, communicate during the recruitment process and potentially offer employment or an internship.

Personal data: CV, covering letter, contact details, other application information, notes from interviews.

Legal basis: Legitimate interest (Article 6(1)(f) GDPR), or steps taken prior to entering into a contract (Article 6(1)(b) GDPR).

6.11 Cookies and similar technologies

Purpose: To provide necessary functionality on the website, analyse usage, improve the website and, where applicable, for marketing.

Legal basis: Consent (Article 6(1)(a) GDPR and Chapter 9, Section 28 of the Swedish Electronic Communications Act (2022:482)), except for strictly necessary cookies, which are processed on the basis of legitimate interest (Article 6(1)(f) GDPR).

Section 12 describes the categories in use.

7. Retention periods

We process your personal data only for as long as is necessary for the purpose for which they were collected, or for as long as required by law. When the personal data are no longer needed they are erased or anonymised.

Our general retention periods are set out below. Shorter or longer periods may apply in individual cases based on a specific assessment.

• Active customer account: For as long as the account is active
• Closed customer account: 12 months after closure, after which the data are erased or anonymised (except where the law requires longer retention)
• Prospect database (no response): Up to 24 months from the last recorded contact attempt
• Prospects who have said they do not wish to be contacted: A limited suppression record is retained indefinitely in order to prevent further contact
• Customers who have entered into an agreement through us: For the duration of the customer relationship plus 24 months, and longer where the law requires
• Accounting records: 7 years from the end of the financial year to which the records relate, under Chapter 7, Section 2 of the Swedish Bookkeeping Act
• Correspondence (email and similar): Generally 24 months, longer where necessary in order to establish, exercise or defend legal claims
• Direct marketing data: Until the recipient unsubscribes, plus 12 months
• Cookies: As set out in section 12, at most 13 months
• Job applications (unsuccessful): Up to 24 months after the decision, in order to be able to respond to any claim under the Swedish Discrimination Act
• Job applications (successful): In accordance with the employment contract and employment legislation
• Security and system logs: Generally 12 months
• Agreements with suppliers and their contact persons: For the duration of the contractual relationship plus 10 years (the limitation period)

8. Recipients of personal data: who we share your data with

We may share your personal data with the following categories of recipient. Each recipient is given access only to the data necessary for the relevant purpose.

8.1 Suppliers (independent controllers)

When you, as a customer, request a quote, we share the necessary data with the relevant Supplier (for example Telavox, Pipedrive, Fortnox, Scrive, Teamtailor, Pleo, Qred or another partner relevant to your needs). That supplier then becomes an independent controller for its own processing and you are covered by its privacy policy.

Suppliers: When you enter into an agreement with a Supplier through us, we may receive information from the Supplier about that agreement, such as prices and terms, so that we can verify your savings. BackingNordics does not receive any compensation from Suppliers.

8.2 Processors (our sub-processors)

We engage suppliers which process personal data on our behalf. With every such supplier we enter into a data processing agreement under Article 28 GDPR governing, among other things, security, confidentiality and onward transfer. The sub-processors we use for this website and for the lead handling behind it are:

• Vercel: Website hosting and the serverless function behind our forms. Receives every request to the site, including IP address, user agent and the URL requested, and processes submitted form data in memory as it is passed on. Form submissions are processed in Stockholm, Sweden (arn1), within the EU.
• Supabase: Database storage for enquiries submitted through the site. Receives email address, the source of the enquiry, and where provided a name, a company name, the text typed into the website's enquiry field and the message written in the partner application form. For each enquiry it also receives the page it was sent from, how you arrived on this visit and, where you have consented to statistics cookies, on your first visit, the version of the site, your country, device type and browser user agent. Hosted in region eu-west-2, London, United Kingdom.
• Zapier: Onward notification of new enquiries to the people who act on them. Receives email address, source, name, company name, the free text message and the text typed into the website's enquiry field, and the same information about where the enquiry came from that our database receives: the page it was sent from, how you arrived on this visit and, where you have consented to statistics cookies, on your first visit, the version of the site, your country, device type and browser user agent. The free text message is also stored in our database.
• Google Workspace: Email, documents and internal collaboration. Receives correspondence and any personal data contained in it. No region restriction is configured, so Google may process this data in any of its global locations. See section 9.
• Cookiebot (Usercentrics): Consent management. Sees your IP address and your recorded consent state.
• Meta: The Meta Pixel. On this website it fires a page view event only. The same pixel is used in our signed-in application, where it additionally fires a Lead event when an opt-in form is submitted and a CompleteRegistration event when a signup completes; neither carries anything beyond the name of the form. Sees IP address, user agent, the page URL and any Meta cookies in your browser. It loads only after you consent to marketing cookies.
• Crescere: Our own analytics infrastructure, operated by Active Intelligent Stockholm AB and hosted on Supabase in region eu-west-3, Paris, France. Receives the page path, any UTM campaign parameters and a randomly generated daily visitor identifier. The identifier is never derived from your IP address or your device. It also receives a copy of each enquiry stored in our database, with the same fields our database holds for it, so that it can be followed up.
• Sentry: Error monitoring and performance diagnostics for our signed-in application. Because personal data collection is enabled, an error or trace event carries your IP address, your user id, request headers, cookies, request and response bodies and URL query parameters. It also records session replays, sampled at one in ten sessions and at every session in which an error occurs; text is masked and media blocked by default, so a replay shows page structure, navigation and interactions rather than the words on the screen. Its integration with our model calls means the inputs and outputs of Darwin conversations are recorded as well. Hosted in the European Union.
• Vercel Analytics: Product analytics for this website and our signed-in application, a separate purpose from the hosting above. Receives the time of the event, the page URL and path, the referrer, filtered query parameters, an approximate location, which Vercel's documentation records to city level, device type, operating system and browser, and, in our signed-in application, one custom event recording that a signup completed, sent with no further properties. It uses no third-party cookies; a visitor is identified by a hash of the incoming request which is discarded after 24 hours, and a recorded data point is not associated with your IP address. Vercel publishes no processing region for this product and offers no setting to choose one, so it is processed in the United States. See section 9.
• OpenAI: The model provider behind Darwin. Receives spend data, supplier names, contract details and requirements, and personal data where it appears within that information, including names, work email addresses and job titles. See section 14 for further detail and the basis for processing.

We also engage suppliers for accounting and invoicing, telephony, identification and signing, and IT support. Our current list of sub-processors, with their type and location, is published at /subprocessors and is kept up to date there.

8.3 Employees, sales consultants and other consultants

Employees, sales consultants (our SDR team) and other consultants at our company have access to personal data to the extent required to perform their duties. All are bound by confidentiality and receive regular data protection training.

8.4 External advisers

Auditors, lawyers, solicitors and other advisers, to the extent necessary for their engagement with the Company.

8.5 Public authorities

We may disclose personal data to public authorities where we are required to do so by law, for example to the Swedish Tax Agency, the Police Authority, the Swedish Enforcement Authority, or at the request of a court.

8.6 Corporate transactions

In the event of a sale, merger, restructuring or other corporate transaction, personal data may be transferred to the buyer or a prospective buyer as part of the transaction, provided that the recipient undertakes to handle the data in accordance with applicable data protection legislation.

9. Transfers of personal data to third countries

We aim to use suppliers within the EU and the EEA wherever possible. Some of our suppliers are nonetheless established outside the EU and the EEA, or may transfer personal data outside it for purposes such as technical support, operations or maintenance.

Where we transfer personal data to a third country we ensure that the transfer complies with the requirements of the GDPR through one of the following mechanisms:

• An adequacy decision by the European Commission under Article 45 GDPR. This includes the decision covering the United Kingdom, which is what our database hosting in London relies on, and the EU-US Data Privacy Framework for certified US suppliers.
• The European Commission's Standard Contractual Clauses under Article 46(2)(c) GDPR.
• Binding Corporate Rules, where such rules exist.
• Supplementary technical and organisational measures where an assessment shows that such measures are needed (for example encryption or pseudonymisation).

Five of our sub-processors process personal data in the United States, and they do not all rest on the same mechanism. We name them one at a time below.

OpenAI processes in the United States, so a third country transfer occurs. It is made under the European Commission's Standard Contractual Clauses, which OpenAI's data processing addendum incorporates by reference.

Meta also processes in the United States. Transfers to Meta are made under the EU-US Data Privacy Framework, under which Meta is certified.

Zapier processes in the United States as well, on Amazon Web Services infrastructure there. Zapier is certified under the EU-US Data Privacy Framework, and its data processing agreement additionally adopts the Standard Contractual Clauses, so the transfer rests on both.

Google Workspace processes correspondence and the personal data within it. Google's Data regions policy, which would allow us to keep that data in a chosen geography, is not available on our subscription tier, so no region restriction is configured and Google may process the data in any of its global locations, including the United States. Google LLC is certified under the EU-US Data Privacy Framework, and transfers are made under it.

Vercel Analytics processes in the United States. Vercel publishes no processing region for this product and offers no setting to choose one, so unlike our hosting, which runs in Stockholm, the analytics data leaves the EU. Vercel's data processing addendum relies on the European Commission's Standard Contractual Clauses, and the transfer is made under them.

You have the right to contact us at oskar@backingnordics.com to obtain information about the safeguards we have put in place and, where applicable, a copy of them.

10. Security measures

We take appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration and destruction, in accordance with Article 32 GDPR. The measures we apply include:

• Encryption of data in transit (TLS/HTTPS), and where appropriate at rest
• Access restriction on the principle of least privilege
• Two factor authentication for administrative accounts where possible
• Logging and monitoring of access to sensitive systems
• Regular security updates and patch management
• Regular backups
• Data processing agreements with every sub-processor that handles personal data
• Confidentiality undertakings from staff and consultants
• Regular training in data protection and information security
• Established procedures for handling personal data breaches
• Assessment of new tools and suppliers from a data protection perspective before they are taken into use

10.1 Personal data breaches

In the event of a personal data breach which is likely to result in a risk to your rights and freedoms, we report the breach to the Swedish Authority for Privacy Protection (IMY) within 72 hours of becoming aware of it, in accordance with Article 33 GDPR. If the breach is likely to result in a high risk to your rights and freedoms, we also inform you directly in accordance with Article 34 GDPR.

11. Your rights under the GDPR

Under the GDPR you have the following rights in relation to our processing of your personal data. To exercise any of them, contact us at oskar@backingnordics.com.

We answer your request without undue delay and as a rule within one month of receiving it. If the request is complex, or if we have received a large number of requests, the period may be extended by up to two further months, and we will inform you of the extension.

In some cases we may need to verify your identity before acting on your request, so that we do not disclose data to the wrong person.

11.1 Right to information (Articles 13 and 14 GDPR)

You have the right to receive information about how we process your personal data. That information is what this privacy policy provides.

11.2 Right of access: a copy of your data (Article 15 GDPR)

You have the right to obtain confirmation as to whether we process personal data about you and, if so, a copy of the data together with further information about the processing (purposes, categories of data, recipients, retention period, your rights, where the data were obtained from, and so on).

11.3 Right to rectification (Article 16 GDPR)

You have the right to have inaccurate personal data about you corrected without undue delay, and incomplete data completed.

11.4 Right to erasure: the "right to be forgotten" (Article 17 GDPR)

You have the right to request that we erase your personal data where any of the following applies:

• The data are no longer necessary for the purpose for which they were collected.
• You withdraw your consent and there is no other legal basis for the processing.
• You object to the processing and there are no overriding legitimate grounds.
• The data have been processed unlawfully.
• Erasure is required in order to comply with a legal obligation.

Note that the right to erasure is not absolute. In some cases we are obliged or entitled to retain data despite your request, for example in order to meet bookkeeping requirements, to handle legal claims or to comply with other statutory obligations.

11.5 Right to restriction of processing (Article 18 GDPR)

You have the right to request that we restrict the processing of your personal data in certain circumstances, for example if you consider the data to be inaccurate (while we verify this), if the processing is unlawful but you do not want the data erased, or if you have objected to the processing and we are considering your objection.

11.6 Right to data portability (Article 20 GDPR)

You have the right to receive the personal data you have provided to us, and which we process on the basis of consent or of a contract, in a structured, commonly used and machine readable format. You also have the right to have the data transmitted to another controller where this is technically feasible.

11.7 Right to object (Article 21 GDPR): particularly important

This one matters: you have the right to object at any time to processing of your personal data based on legitimate interest (Article 6(1)(f) GDPR), including profiling. We will then stop the processing unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms.

Direct marketing: In respect of processing for direct marketing (including our outreach activity) you have an absolute right to object. We will stop all such processing immediately when you object.

If you do not wish to be contacted by us for outreach purposes, tell us at oskar@backingnordics.com and we will add you to our suppression list.

11.8 Right not to be subject to automated decision making (Article 22 GDPR)

We do not use automated decision making, including profiling, which produces legal effects concerning you or similarly significantly affects you. See section 14 for what our automated processing does and does not do.

11.9 Right to withdraw consent

Where we process your personal data on the basis of consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

11.10 Right to lodge a complaint with a supervisory authority

If you consider that our processing of your personal data infringes data protection legislation, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), which is the supervisory authority in Sweden.

Integritetsskyddsmyndigheten (IMY):

Box 8114, 104 20 Stockholm, Sweden. Email: imy@imy.se. Web: www.imy.se. Telephone: +46 8 657 61 00.

We would appreciate it if you contacted us first, so that we have the chance to put any shortcoming right directly.

12. Cookies and similar technologies

Our website uses cookies and similar technologies to provide necessary functionality, to analyse usage and, where applicable, for marketing. We use Cookiebot to ask for and record your consent. On your first visit you are asked to consent to non-necessary cookies in accordance with Chapter 9, Section 28 of the Swedish Electronic Communications Act (2022:482). You can change or withdraw your consent at any time through the cookie settings on the website.

Cookiebot sorts what the site sets into four categories:

• Necessary: Required for the site to function and for your consent choice itself to be remembered. These are set without consent, on the basis of legitimate interest.
• Preferences: Remember choices you have made, such as settings that change how the site behaves for you.
• Statistics: Help us understand how the site is used, in aggregate. Set only with your consent.
• Marketing: Used to measure and target advertising. The Meta Pixel falls into this category and loads only after you consent. Set only with your consent.

Cookies set by this site expire after at most 13 months. Our cookie policy at /cookies carries the live declaration Cookiebot generates from a scan of this site, listing every cookie actually set with its provider, purpose and expiry.

Browser storage, which is not a cookie: our own analytics, Crescere, stores a randomly generated visitor identifier under the key crescere_vid in your browser's local storage. It exists so that repeat page views within a single day are counted once, it is regenerated at midnight local time, and it is never derived from your IP address, your device or any other identifier. Unlike a cookie it does not expire on its own: it remains in your browser until it is replaced the following day, or until you clear site data for this website through your browser settings.

When you have consented to statistics cookies, we also store where your visit came from: the page you landed on, the referring website and any campaign tags or ad click identifiers in the address (utm parameters, fbclid, gclid, li_fat_id). It is stored under bn:visit-origin in session storage, which is cleared when you close the tab, and on your first visit under bn:first-touch in local storage, which remains until you clear site data for this website. Both are sent to us only if you submit a form, so we know how you found us. Without that consent nothing is stored, and if you withdraw it both are removed.

13. Profiling and automated decision making

We may segment customers and prospects by sector, company size, geography, needs, behaviour on the platform and similar factors in order to make more relevant recommendations, selections and mailings. This constitutes profiling under the GDPR.

This profiling has no legal effects concerning you and does not similarly significantly affect you. You have the right to object to profiling as set out in section 11.7.

14. Automated processing in Darwin

Darwin is our procurement agent. It is built on models provided by OpenAI. We operate in Sweden and the EU, and Darwin is offered to companies, not to consumers.

What is sent to the model provider:

• Company procurement information. This means spend data, supplier names and contract details for the company being served, together with the description of what the company needs.
• Personal data only where it appears within that procurement information, typically the name, work email address, job title and company of the person acting for the company, or of a named contact at a supplier. We do not send special categories of personal data under Article 9 GDPR to the model provider.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR) where the processing is necessary to deliver the service the company has asked for, and legitimate interest (Article 6(1)(f) GDPR) for improving how the service works.

Retention by the model provider: Inputs and outputs are retained for up to 30 days and are then deleted, unless longer retention is required by law. They are retained for abuse monitoring, and are also stored as retrievable response objects for the same period.

Use for training: Data sent to our model provider is not used to train the model provider's models. We train our own models on anonymised data only, as described in section 6.7 (Training our models on anonymised data).

Processing region: The United States. European processing is available from OpenAI but is not in use, so this is a transfer to a third country, made under the Standard Contractual Clauses described in section 9.

Human involvement: Darwin prepares findings, comparisons and recommendations. It does not conclude agreements on your behalf and it does not make decisions producing legal effects concerning you or similarly significantly affecting you. A person decides whether to act on what Darwin proposes.

15. Children

Our services are directed at companies and at people acting for companies, and are not intended for anyone under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we are processing data about a person under 18 without a proper legal basis, we will erase it.

16. Changes to this privacy policy

We reserve the right to update this privacy policy from time to time, for example to reflect changes in our business, in legislation or in how we process personal data. The current version is always available at www.backingnordics.com and the date of the most recent update is shown at the top.

Where changes are material we will inform you in an appropriate way, for example by email (if you are a customer) or through clear information on the website, before the changes take effect.

17. Contact us

Do you have questions, want to exercise any of your rights, want to unsubscribe from our mailings, want to be added to our suppression list, or want to raise a concern about our processing of personal data? We are always available.

Active Intelligent Stockholm AB. Company registration number: 559605-8825. Registered office: Drevergatan 1B, 115 47 Stockholm, Sweden. Email: oskar@backingnordics.com. Website: www.backingnordics.com

This privacy policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the Swedish Act (2018:218) containing supplementary provisions to the EU General Data Protection Regulation, and other applicable data protection legislation.