Your data

PACT Media & Sales AB, company reg. no. 559535-7970, Tomtebogatan 30, 113 38 Stockholm, Sweden, is the controller for the processing of personal data described here. This means we decide for what purposes and by what means the data is processed, and we are responsible for making sure it complies with the EU General Data Protection Regulation (GDPR) and supplementary Swedish law.

This policy covers the personal data we process when you visit pactmedia.se, contact us through the site's contact form or apply for a job with us through the site.

Send questions about how we process personal data, and requests to exercise your rights, to info@pactmedia.se or by post to the address above.

The essentials in brief. The rest of this policy covers each point in detail.

• We process the data you send us yourself through the forms, and the technical data needed to show the site and protect it from abuse.
• We never sell personal data and do not use it for advertising.
• Analytics with Google Analytics is used only if you actively accept it, and you can change your mind at any time.
• What you send through the forms reaches us as email. We keep enquiries for at most 24 months after our most recent contact, and job applications for six months.
• We use service providers, including Netlify, Brevo, Google and Cloudflare, that process data on our behalf. Some of them may process data in the USA, under the EU's rules for such transfers.
• You have the right to access, correct and erase your data, among other rights. Contact us at info@pactmedia.se.

The personal data we process depends on how you use the site:

• When you use the contact form: your name, your email address, your phone number if you provide it, and the content of your message.
• When you apply for a job through the site: the role you are applying for, or that it is an open application, your name, your email address, your phone number and your LinkedIn or portfolio link if you provide them, your motivation, any CV you choose to attach, the language you were using on the site, and the time you confirmed the terms of the application.
• When you visit the site: technical data your browser sends with every request, such as your IP address, the time, the page or file requested, your browser and operating system and, where applicable, the page you came from.
• When you use the contact form or the application page: the technical data needed to tell people apart from automated programs. See the section on the bot check.
• If you accept analytics: data about how you use the site. See the section on Google Analytics.

Providing data to us is voluntary. We need your name, email address and message to answer an enquiry, and your name, email address and motivation to receive an application. All other fields are optional.

Please do not send sensitive personal data, such as information about your health, ethnic origin, religion, political opinions or trade union membership, or your national identity number, through the forms or in your CV. We do not need it and do not ask for it.

We process personal data only for the purposes listed here, and always on a legal basis under the GDPR:

• Answering your enquiry and handling the contact that follows. Legal basis: legitimate interest (Article 6(1)(f)). Our legitimate interest is being able to answer you and continue the conversation you started, including if it leads to a collaboration.
• Handling your job application: assessing it, contacting you and carrying out the recruitment. Legal basis: steps taken at your request before a possible employment contract is entered into (Article 6(1)(b)), and our legitimate interest in being able to recruit (Article 6(1)(f)), which also covers considering you for other roles during the retention period.
• Delivering the site, keeping it secure and stable, and preventing spam and abuse of the forms. Legal basis: legitimate interest (Article 6(1)(f)) in providing a secure and working website.
• Producing visitor statistics with Google Analytics, only if you have accepted it. Legal basis: your consent (Article 6(1)(a) GDPR and Chapter 9, Section 28 of the Swedish Electronic Communications Act (2022:482)).
• Establishing, exercising or defending legal claims, for example if a recruitment decision is challenged. Legal basis: legitimate interest (Article 6(1)(f)).
• Meeting legal obligations, for example bookkeeping rules if a contact leads to business. Legal basis: legal obligation (Article 6(1)(c)).

Where we rely on legitimate interest, we have assessed that our interest outweighs your interest in the data not being processed. The processing is limited, takes place in a context you initiated yourself and is what you can reasonably expect. You always have the right to object. See the section Your rights.

Within PACT, only the people who need the data have access to it. Enquiries arrive in our shared inbox, info@pactmedia.se, and job applications go directly to the people responsible for recruitment.

We use the following service providers as processors. They process the data on our behalf, on our instructions and under data processing agreements:

• Netlify, Inc. (USA) hosts the site. Netlify receives the technical data from every visit and the content of the forms when you submit them. Form content is not stored at Netlify; it is passed straight on as email.
• Sendinblue SAS (France), which provides the Brevo service, sends the forms to us as email. Brevo stores the messages, including any CVs, and details of their delivery for a limited time, to deliver them and to troubleshoot sending.
• Google Cloud EMEA Limited (Ireland) provides Google Workspace, our email. The messages from the forms and any CVs are stored in our inboxes there.
• Cloudflare, Inc. (USA) runs the Turnstile bot check on the contact form and the application page.
• Google Ireland Limited (Ireland) provides Google Analytics, which is used only if you have accepted analytics.

Two parties also process data for their own purposes, and are independent controllers for that processing: Cloudflare, which uses data from the bot check to improve its bot detection, and Google Ireland Limited, which provides YouTube, when you play an embedded video. More in the respective sections.

We do not sell personal data or disclose it to anyone for marketing. We may disclose data if we are required to by law or by a decision of a public authority, or where necessary to protect our rights in legal proceedings.

Netlify and Cloudflare are US companies, and Google may process data in the USA even though our agreement is with an Irish Google company. Personal data may therefore be transferred to the USA.

These transfers rely on European Commission Decision (EU) 2023/1795, which finds that the EU–US Data Privacy Framework provides an adequate level of protection. Netlify, Inc., Cloudflare, Inc. and Google LLC are certified under the framework, which you can check at https://www.dataprivacyframework.gov.

The providers' agreements also include the European Commission's standard contractual clauses (Article 46(2)(c) GDPR), which protect the data should the framework not apply. Contact us if you would like to know more about these safeguards.

When you visit the site, your browser sends technical data, including your IP address, to Netlify, which serves the pages. Netlify uses the data to deliver the site, protect it from attacks and overload, and keep operational logs, which are retained for a limited time.

Your IP address is also used, briefly, to limit how many forms and automatic security reports can be sent from the same address. We do not store it for that purpose.

The site is protected by a security policy (Content Security Policy) that stops your browser from loading content from unauthorised sources. If your browser blocks something, it may automatically send us a report. We log only which rule was triggered and which resource was blocked, not your IP address or the page you were on.

Fonts are served from our own domain, so your visit makes no requests to Google Fonts or any other font service.

On the contact form and the job application page, and only there, we use Cloudflare Turnstile to check that messages and applications are sent by people and not by automated programs. The check usually runs entirely in the background.

For the check, Cloudflare processes your IP address, your TLS fingerprint (technical characteristics of your browser's encrypted connection), your browser's User-Agent (which browser and operating system you use) and which website the check is for. Turnstile does not read what you type into the form.

Cloudflare is our processor for the check itself. Cloudflare also uses the data to improve its bot detection, and is an independent controller for that processing, relying on its legitimate interest. Read more in Cloudflare's Turnstile privacy addendum: https://www.cloudflare.com/turnstile-privacy-policy/

The check is necessary for you to send your message or application through the form. It may involve technical data being read from or stored in your browser, which is permitted without consent because it is required for the service you have requested. The legal basis for the processing is our legitimate interest (Article 6(1)(f)) in protecting the forms from spam.

If the check does not work for you, you can contact us at info@pactmedia.se.

If we use visitor statistics, we first ask for your consent in a notice on the site, where declining is as easy as accepting. Until you accept, nothing is loaded from Google Analytics and no analytics cookies are set.

If you accept, we use Google Analytics 4 from Google Ireland Limited to understand how the site is used and how it can be improved: which pages are visited and for how long, how visitors find the site, what kind of device, browser and screen size they use, roughly where they are (country, region and city) and how they move around the site. Google Analytics recognises your browser by a random identifier stored in a cookie.

Google Analytics does not store your IP address. It is used only to derive an approximate location and is then discarded immediately. For visitors in the EU, this happens on servers within the EU.

We have turned off Google Analytics' advertising features: the data is not used for advertising or personalised ads, Google signals are off and Google Analytics is not linked to any advertising services.

Google Analytics automatically deletes visitor-level data no later than two months after your most recent visit. Aggregated statistics that cannot be linked to you may be kept longer.

Google Ireland Limited is our processor for Google Analytics. The data may be transferred to Google LLC in the USA. See the section on transfers.

The legal basis is your consent. Your choice applies for twelve months, after which we ask again. If you have accepted, you can change your mind at any time through “Cookie settings” at the bottom of every page. If you decline, or withdraw your consent, we stop using Google Analytics and delete the analytics cookies. Withdrawing your consent does not affect processing that took place before.

Cookies are small text files a website stores in your browser. Similar technologies, such as local storage, work in much the same way. Under the Swedish Electronic Communications Act, such storage requires your consent unless it is necessary to deliver a service you have explicitly requested.

The site needs no cookies to work. Your language choice lives in the web address (/sv or /en) and does not need to be stored. The following may be stored in your browser:

• pact-consent (local storage, pactmedia.se): your choice about visitor statistics and when you made it, so we do not have to ask on every page. Kept for twelve months and never sent to us. Necessary to respect your choice, so it requires no consent.
• _ga and _ga_<id> (cookies, Google Analytics): tell visitors and visits apart. Set only if you accept visitor statistics, and valid for twelve months from your most recent visit.
• Cloudflare Turnstile (on the contact form and the application page only): may read and store technical data in your browser to run the bot check. Necessary for you to send the form.
• YouTube (only when you play a video): YouTube stores data in your browser, in local storage and in cookies. See the section on videos.

You can delete cookies and local storage, and block cookies, in your browser's settings. The site still works, but if you block storage we cannot remember your choice about visitor statistics and will ask again.

On some of our case pages you can play videos from YouTube. The player loads only when you click to play a video, not when the page is displayed, and we use YouTube's privacy-enhanced mode (youtube-nocookie.com). YouTube learns only that you came from pactmedia.se, not which page you were on.

When you play a video, Google Ireland Limited, which provides YouTube in the EU, receives data including your IP address and information about your browser, and YouTube stores data in your browser. If you are signed in to a Google account, Google may link the playback to that account. Google is an independent controller for that processing and handles the data under its own privacy policy: https://policies.google.com/privacy

Videos play only at your request. Our legal basis for offering them is our legitimate interest (Article 6(1)(f)) in showing our work. If you do not want data sent to YouTube, you can simply not play the videos.

The site contains ordinary links to other websites, such as Instagram and articles by other publishers. No data is sent to them until you click a link. Once you have clicked, that website's own privacy policy applies.

• Contact form enquiries: 24 months after our most recent contact about the matter. If the contact leads to a collaboration, we keep the data for as long as the collaboration lasts and then for as long as needed to meet legal requirements or handle any claims.
• Job applications: six months from when we received the application, unless we have agreed otherwise with you. If you are hired, your application is kept as part of your employment records.
• Technical data and operational logs at Netlify: for the limited time needed for operation and security.
• Messages and delivery details at Brevo: for the limited time needed to deliver and troubleshoot sending.
• Google Analytics: visitor-level data is deleted automatically no later than two months after your most recent visit.
• Your choice about visitor statistics: twelve months, in your browser.

If we need data to establish, exercise or defend legal claims, for example under the Swedish Discrimination Act, we may keep it for as long as that requires. Data we are required by law to keep, such as accounting records, is kept for as long as the law requires. When the retention period has passed, we delete the data.

We take technical and organisational measures to protect personal data against loss, unauthorised access and other unlawful processing. Among other things:

• All traffic to and from the site is encrypted (HTTPS), and the forms pass the data on to our email over an encrypted connection.
• Form content is not stored on the site; it is delivered directly as email to the inboxes meant to receive it.
• Only the people who need the data have access to it.
• Applications accept attachments only as PDF or Word (.docx), and each file's format is checked before it is passed on.
• The site is protected against automated submissions and overload.

Under the GDPR you have the right to:

• access your data, meaning confirmation of whether we process personal data about you and, if so, a copy of it and information about the processing (Article 15),
• have inaccurate data corrected and incomplete data completed (Article 16),
• have your data erased, for example if it is no longer needed for the purpose it was collected for or if you withdraw a consent (Article 17),
• request that processing be restricted, for example while we check whether the data is accurate (Article 18),
• object to processing based on our legitimate interest. We may then continue only if we can show compelling legitimate grounds that override your interests, or if the processing is needed to handle legal claims (Article 21),
• receive the data you have provided to us in a structured, commonly used and machine-readable format and transfer it to someone else, where the processing is based on consent or a contract (Article 20),
• withdraw a consent at any time, without affecting processing that took place before you withdrew it (Article 7(3)).

Contact us at info@pactmedia.se to exercise your rights. It is free of charge. We respond without undue delay and within one month at the latest, and we may need to ask you to confirm your identity before we disclose or change any data.

We make no decisions based solely on automated processing, including profiling, that have legal effects for you or similarly significantly affect you. The bot check on the forms is an automated security step, not an assessment of you. If it stops a submission, you can always contact us another way.

If you are unhappy with how we process your personal data, we would like you to contact us first. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, Sweden, imy@imy.se, https://www.imy.se.

The site is aimed at businesses and professionals, not at children. We do not knowingly collect personal data about children.

We update this policy when our processing of personal data changes, for example if we start using a new service. The current version is always on this page, and the date at the top shows when it last changed.

If a change affects how we process data you have already given us, we will tell you before it takes effect, for example by email. If the change requires your consent, we will ask again.