Skip to content
    AccountStart free
    Legal

    Privacy Notice

    Last updated: 7 October 2026

    1. Introduction

    Ansvar Systems AB (referred to as "Ansvar", "we", or "us") is responsible for the processing of your personal data as described in this Privacy Notice ("Notice").

    We recognise the importance of your privacy and are committed to handling your personal data in a transparent and secure manner. This Notice explains how we collect, use, transfer, store, or otherwise process (collectively "process") your personal data, why we do so, and the rights you have under applicable data protection law.

    We are committed to processing personal data in accordance with applicable data protection laws, including the EU General Data Protection Regulation 2016/679 ("GDPR") and applicable national legislation. You can contact us using the details set out in section 10 below.

    We encourage you to read this Notice in full so that you understand how we process your personal data.

    2. Scope

    This Privacy Notice applies only where Ansvar acts as controller of personal data, meaning that we determine the purposes and means of the processing. This will typically be the case when:

    • you visit and interact with our website (https://ansvar.eu/ (the "Website")) or otherwise contact us;
    • you are in commercial dialogue with us, or otherwise interact with us in the course of our business operations, for example as a representative of an existing or prospective client, partner, or supplier; or
    • you participate in our webinars or other events.

    Ansvar provides a compliance-focused AI platform that helps organisations perform regulatory analysis (the "Services"). The Services are intended for business users and not for private individuals acting in a personal capacity. Where a free version of the Services is offered, it is likewise intended solely for business users: at signup, every user accepts our Terms of Service, which include a confirmation that the Services are used for business purposes. For paid subscriptions we additionally collect billing information and, where applicable, a VAT identification number.

    When we deliver the Services to our corporate customers, we generally act as a processor, processing personal data on behalf of and in accordance with the instructions of the relevant customer (who acts as controller), and subject to an applicable data processing agreement.

    Accordingly, this Notice does not apply to personal data processed within the Services when a corporate customer uses the platform for its own purposes. If you access or use the Services through one of our customers, please refer to that customer's privacy notice for more information about how your personal data is processed.

    Although this Notice concerns processing where Ansvar acts as controller, we include the following information for transparency about our Services. When Ansvar provides the Services to a client and processes customer data or model traffic on that client's behalf, Ansvar acts as processor and does so in accordance with the client's instructions and the applicable data processing agreement. In that context, we do not train, fine-tune, or evaluate any model on customer data. Where customers configure their own provider credentials, model inference may be routed through those credentials so that Ansvar does not hold or proxy the customer's model traffic in that context. Where Ansvar operates the inference path directly, provider retention policies may apply as published by the relevant provider.

    We also want to clarify that we do not collect any sensitive information such as data revealing racial or ethnic origin, health status, political opinions, religious or philosophical beliefs, or trade union membership.

    3. How we collect your personal data

    We collect personal data from various sources. Most often, we collect personal data directly from you, for example when you fill in a contact form on our Website, schedule a meeting with us, register for a webinar or event, or otherwise communicate with us in connection with our business relationship. We may also collect personal data from publicly available sources, such as information published on your employer's website or on professional networking sites such as LinkedIn. The Services also retrieve official publications of public bodies, and some of them name people; section 4 explains how we handle that. In addition, we may receive personal data from third parties in the form of referrals, but we do not buy personal data from third parties. In certain circumstances, personal data may also be generated internally by our systems, for example internal reference numbers and relevant logs.

    4. Why and how we use your personal data

    This section explains why we process your personal data, the categories of personal data processed for each purpose, and the legal basis that allows us to do so.

    When you visit and interact with us through our Website or communication channels

    When you visit and interact with us through our Website or other communication channels, we process your personal data to respond to your inquiries about our Services, provide requested information or demonstrations, schedule meetings with us, and otherwise communicate with you. The personal data we process includes business contact details such as your name, email address, and phone number, as well as job-related information such as your job title, the organisation you represent, VAT ID where relevant, and any additional information you include in your message or inquiry. We base this processing on our legitimate interest in responding to your inquiries about our business operations and communicating with you, and we only use your information in ways that are necessary and proportionate to provide the requested information or support.

    To market our Services

    We process personal data to market our Services to persons in key positions within organisations that we consider may be interested in our Services. The personal data we process includes business contact details such as your name, business email address, and business phone number, as well as job-related information such as your job title and the organisation you represent. This helps us ensure that our marketing efforts are directed toward professionals whose roles are connected to the Services we offer. We base this processing on our legitimate interest in marketing our Services or, where required by applicable national law, on your prior consent.

    Client relationship management, contracting, billing, and business administration

    We process personal data relating to representatives of current and prospective clients, partners, and suppliers in order to manage our commercial relationships and to enter into, perform, and administer our agreements with the organisations they represent. This includes entering into agreements, handling day-to-day business communications, setting up and administering the customer relationship at organisational level, verifying business status through VAT ID where relevant, processing subscription payments and billing, and carrying out related administrative and operational tasks. The personal data we process for these purposes may include business contact details such as your name, business email address, and business phone number, job-related information such as your job title and the organisation you represent, VAT ID where relevant, communication data, and transaction and billing data. We base this processing on our legitimate interest in managing our business relationships and administering our operations, as well as on our legal obligations relating to accounting and record-keeping. For the avoidance of doubt, this section does not cover personal data processed through a client's use of the Services, including personal data relating to authorised users of the platform, uploaded workspace content, prompts, or other service-use data. In that context, the relevant client acts as controller and Ansvar acts as processor.

    When you participate in our webinars or other events

    When you participate in our webinars or other events, we process your personal data to manage your registration and participation, communicate with you in relation to the webinar or event, promote similar activities, and contact you afterwards to collect feedback and improve the quality of our activities. The personal data we process includes business contact details such as your name, email address, and phone number, job-related information such as your job title and the organisation you represent, communication data related to your registration and feedback, and, where relevant, photos and/or video recordings from the event. We base this processing on our legitimate interest in administering and arranging webinars and events, spreading brand awareness, and improving our activities.

    To enable us to comply with legal obligations and defend against legal claims

    We process your personal data to comply with various legal obligations. This means that, in order to meet requirements under applicable laws, we may need to collect and store certain personal data. The categories of personal data processed for this purpose can vary depending on the specific requirements set out in legislation such as tax, accounting, or bookkeeping laws. We base this processing on our necessity to comply with legal obligations.

    Furthermore, we may process your personal data to enable Ansvar to establish, exercise, or defend legal claims. Legal claims in this context are not limited to current legal proceedings but also include actual or prospective court proceedings, obtaining legal advice, or establishing, exercising, or defending legal rights in any other way. For this purpose, we will process any personal data that may be relevant. We base this processing on our legitimate interest in being able to establish, exercise, and defend against legal claims according to applicable law.

    Cookies and similar technologies

    Our Website does not use tracking cookies, third-party cookies, or cookie walls. We set one strictly functional first-party cookie, ansvar_account, when you sign in to your Gateway account: it records only your subscription plan name (for example "solo" or "team") so that pages such as Pricing can show your current plan and hide sign-up prompts you no longer need. It contains no tracking identifier, no token, and no personal data beyond that plan name; it is scoped to .ansvar.eu, expires after 30 days, and is never shared with any third party. Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in showing signed-in visitors accurate account state; the cookie is not used for tracking or profiling. You can delete it at any time in your browser without losing access to any part of the Website.

    When you choose English or Simplified Chinese using our language controls, we save that choice in your browser's local storage under ansvar-site-language. The value is only en orzh-CN; we do not send it to our servers or third parties. We use it to show or dismiss the Chinese-page suggestion on the homepage. You can change it using the language controls or remove it by clearing this site's browser storage. Without a saved choice, the homepage checks your preferred browser language locally to decide whether to offer the Chinese introduction.

    If we introduce other cookies or similar technologies, we will obtain your prior consent where required and will provide a separate cookie notice with detailed information about their types, purposes, and how you can manage your preferences.

    Website analytics (cookieless)

    We measure aggregate Website usage with Umami, an open-source analytics tool that we host ourselves on our EU infrastructure. It sets no cookies and stores no identifiers on your device. Your IP address is processed transiently to de-duplicate visits and is not stored; we see only aggregated statistics (pages viewed, referrer domain, browser type, country). No analytics data is shared with, or processed by, any third party. Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in understanding how the Website is used. You can object at any time — see "Your rights" below.

    When your name appears in an official publication we serve

    The Services retrieve official publications of public bodies: legislation, regulations, court decisions, regulator and agency decisions, official gazettes and public procurement notices. Some of these publications name people, for example officials acting in their role, parties named by the publisher, or sole traders named in a tender award. We obtain these publications from the public body that publishes them, not from you. We base this processing on our legitimate interest in providing legal, compliance and procurement research from official sources (Article 6(1)(f) GDPR).

    We screen these sources for personal data under a written procedure. We do not serve the personal data of a private person once we have confirmed it; we withhold or redact it and report the finding to the publisher. We do not profile individuals or rank results by a person's name. We keep the publisher's original files in a closed archive so that we can show what we received, and when we withhold personal data, or you ask us to delete it, we delete it from every copy, the archive included. Because these publications can name very many people, we do not contact each person individually (Article 14(5)(b) GDPR); this section is how we inform you. You can exercise your rights under section 8, including the right to object, by writing to privacy@ansvar.eu.

    5. Retention of personal data

    We retain personal data only for as long as necessary for the relevant purpose, including where we have an ongoing legitimate business need to do so or where retention is required to comply with applicable legal, tax, or accounting requirements.

    More specifically:

    • Personal data related to the management of client, partner, and supplier relationships will generally be kept for the duration of the relationship and for a reasonable period thereafter to handle any follow-up matters.
    • Personal data related to our marketing operations will be retained until you opt out of receiving marketing communications or until we determine that the data is no longer relevant for our legitimate interest in marketing our services.
    • Personal data related to events that we organise, including registration details and feedback, will be kept for a limited period after the event to analyse and improve future activities. Photos and recordings may be retained for a longer period unless you request removal.
    • Billing, transaction, and accounting records, and any personal data that we need to retain pursuant to our legal obligations (including transaction data and data required for bookkeeping), will be retained for the period required by applicable law, such as tax and accounting regulations, which may include seven years under Swedish accounting rules.
    • Data relevant to legal claims will be retained for as long as necessary to establish, exercise, or defend legal rights.

    When we have no ongoing legitimate business need or legal reason to process your personal data, we will either delete or anonymise it.

    6. Recipients of personal data

    We may disclose personal data to the following categories of recipients:

    • Courts and similar judicial entities and/or authorities when required by law or to comply with legal obligations.
    • Our business partners where necessary to manage partnerships.
    • Service providers that support our core operational activities, such as IT infrastructure, payment processing, and communication and collaboration providers.
    • The Swedish Institute for Standards (SIS), which receives, quarterly, the identity of ISO Standards Add-on subscribers and which Standards each uses — and, for Standards designated as requiring verification, the outcome of that verification — as required by Ansvar's licence agreement with SIS (legal basis: performance of contract and our legitimate interest in performing Ansvar's licence obligations). See the ISO Standards Add-on — Supplemental Terms.
    • New owners in the event of a change of ownership of our business, provided that the new owners will only process personal data as set out in this Notice.

    Our Data Processing Agreement is published at ansvar.eu/dpa and the current list of sub-processors at ansvar.eu/subprocessors. A countersigned copy of the DPA is available on request — contact privacy@ansvar.eu.

    7. Transfers of personal data

    If we, either directly or through our service providers, transfer your personal data to countries outside the EU/EEA ("Third Countries"), we ensure that adequate safeguards are in place so that your personal data remains protected in accordance with this Notice and applicable data protection laws.

    We implement one of the following measures:

    • Transfer to an adequate country: By transferring the personal data to a country that the European Commission has recognized as providing an adequate level of protection; or
    • Appropriate safeguards: By using a valid transfer mechanism, such as the standard contractual clauses (controller-to-controller or controller-to-processor) approved by the European Commission, for transfers to countries that do not have an adequacy decision.

    8. Your rights

    You have certain data protection rights in relation to how we process your personal data. You can contact us at any time using the contact details set out in section 10 below to exercise the rights described below. If your personal data is processed in connection with a corporate client's use of the Services, including as an authorised user of the platform, that client is the relevant controller and you should normally direct your request to that client in the first instance. Once we receive your request, we will respond as promptly as possible and, in any event, within one month. Please note that the rights below are not absolute and are subject to applicable limitations, exceptions, and exemptions. Before taking any action, we may ask you to verify your identity to ensure your request is handled securely.

    Right to access

    You have the right to request access to and information about how we process your personal data. In addition, you may request a copy of the personal data we process about you. Please note that your request must not adversely affect the rights and freedoms of others, such as their right to privacy and confidentiality. In such cases, we may need to limit the information we disclose.

    Right to rectification

    You have the right to challenge the accuracy of your personal data at any time. Depending on the purpose of the processing, you may also request that your personal data be completed. Where relevant, we may ask you to provide an additional statement to clarify or complete the information.

    Right to erasure

    In certain circumstances, you have the right to request the deletion of your personal data (the "right to be forgotten"), for example when the data is no longer necessary for the purpose for which it was collected or we no longer have a legal basis to continue processing it.

    Please note that there may be legal reasons why we may need to retain your personal data, such as to comply with a legal obligation to retain the data, to establish, exercise, or defend legal claims, or when there is another lawful basis for processing your personal data.

    Right to restrict the processing

    In certain circumstances, you have the right to request that we restrict the processing of your personal data, for example while we assess a contested accuracy issue, where processing is believed to be unlawful, or where you need the data for legal claims and would otherwise be entitled to erasure.

    Right to object

    You have the right to object to the processing of your personal data at any time. This means we must stop processing your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms.

    You have an absolute right to object to receiving marketing communications from us at any time.

    Right to data portability

    When our processing is based on your consent or on a contract with you, you have the right to receive the personal data that you have provided to us in a structured, commonly used, and machine-readable format and to transmit that data to another controller. Where technically feasible, you may also request that we transmit your personal data directly to another controller.

    Right to withdraw consent

    If we process your personal data based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent applies only to future processing and does not affect the lawfulness of processing carried out before consent was withdrawn.

    Automated decision-making

    We do not make decisions based solely on automated processing, including profiling, that would produce legal effects concerning you or otherwise significantly affect you.

    Right to lodge a complaint

    You have the right to lodge a complaint to your national data protection authority. As Ansvar is established in Sweden, the competent supervisory authority is Integritetsskyddsmyndigheten (IMY), which supervises the processing of personal data in Sweden:

    Integritetsskyddsmyndigheten
    Box 8114, 104 20 Stockholm
    Email: imy@imy.se
    Phone: 08-657 61 00
    Website: www.imy.se

    9. Changes to this Notice

    We may amend this Notice from time to time. The current version is available on our Website, and you can see when this Notice was last updated by checking the "last updated" date displayed at the top of this Notice. Material changes to how we collect or process your personal data will be communicated to you by email and, where appropriate, before they take effect.

    10. Contact information

    Our contact details are:

    Ansvar Systems AB
    Business ID: 559547-2225
    VAT: SE559547222501
    Address: Ingemarsboda 565, 841 74 Fränsta, Sweden
    Telephone: +46 736 207 435
    Email: privacy@ansvar.eu