GDPR

This English version is provided for convenience. If it differs from the Swedish original, the Swedish version applies.

1. About this policy

This policy describes how DisplayFlow, operated by E-handelsgruppen Sverige AB ("we"), complies with the requirements of the EU General Data Protection Regulation (GDPR) when we process personal data.

2. Controllership

We are the controller of the personal data processed in order to provide the service. If you use DisplayFlow in your business, you may be the controller of the data shown on your screens — in that case, we are the processor of such data.

3. Data transfers outside the EU/EEA

We use Cloudflare for networking, CDN and file storage (R2), and Stripe for payment processing. Both providers may process personal data in countries outside the EU/EEA.

• Cloudflare offers data residency options and is covered by the EU–US Data Privacy Framework.
• Stripe is certified under the EU–US Data Privacy Framework and maintains Standard Contractual Clauses (SCCs).

We have data processing agreements with both providers which ensure that transfers take place in accordance with the GDPR.

4. Encryption and security

All data transfers take place over TLS-encrypted connections. Passwords are stored as hashes using bcrypt. Payment details are never stored by us — they are handled exclusively by Stripe in accordance with PCI DSS.

5. Your rights under the GDPR

• Article 15 — Right of access to, and a copy of, your personal data.
• Article 16 — Right to rectification of inaccurate data.
• Article 17 — Right to erasure ("the right to be forgotten").
• Article 18 — Right to restriction of processing.
• Article 20 — Right to data portability.
• Article 21 — Right to object to processing based on legitimate interest.
• Article 22 — Right not to be subject to solely automated decision-making.

To exercise any of these rights, contact us at [email protected].

6. Data breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Swedish Authority for Privacy Protection (IMY) within 72 hours, in accordance with Article 33 of the GDPR. You will also be informed if the risk is high.

7. Complaints

If you have a complaint about how we process your personal data, you can contact the Swedish Authority for Privacy Protection (IMY) at imy.se.