1. Data controller
ZORC.se, operated by ZORC AB (company registration no. 559481-8857), is the data controller for the processing of your personal data in accordance with the EU General Data Protection Regulation (GDPR).
Contact: support@zorc.se
2. What personal data do we collect?
- Name and email address when you submit contact enquiries and registrations
- Telephone number (if you choose to provide it)
- Company name and organisation number in business relationships
- Payment details when you make a purchase (handled by our payment provider Stripe)
- Technical data such as IP address, browser type and visit behaviour via cookies
3. Why do we process personal data?
- To perform contracts and deliver ordered services and products
- To communicate with you about enquiries and support
- To send relevant information about our services (with your consent)
- To improve our website and user experience
- To comply with legal obligations (e.g. accounting)
4. Legal basis
We process your personal data on the basis of: performance of a contract, legitimate interests, legal obligation and consent (where required).
5. Recipients, processors and transfers to third countries
We never sell your personal data and never share it with third parties for their own marketing. To deliver our services we engage processors that handle data on our behalf under data processing agreements (GDPR Art. 28):
- Supabase — database, authentication and file storage (data stored in the EU region, Stockholm)
- Cloudflare — operations, hosting and security
- Stripe — payments
- Google (Google Analytics) — web analytics, only after your consent
- Resend (Plus Five Five, Inc.) — confirmation and system emails; email data stored within the EU
- Public authorities — only where required by law
Our processors may in turn engage their own sub-processors under equivalent agreements.
Transfers to third countries
Your data is stored within the EU/EEA (Stockholm). However, some of our processors and their sub-processors are established outside the EU/EEA, which means personal data may be processed in third countries — primarily the United States and Singapore:
- United States: where the recipient is certified, transfers are made under the European Commission's adequacy decision for the EU–US Data Privacy Framework (2023).
- Singapore (our database processor Supabase Pte Ltd) and otherwise: under the European Commission's Standard Contractual Clauses (SCCs), Decision (EU) 2021/914 pursuant to GDPR Art. 46, together with supplementary safeguards.
You have the right to receive a copy of the safeguards applied — contact support@zorc.se.
6. Retention and erasure
We retain personal data only for as long as necessary for the purpose:
- Contact and enquiry data: until the matter is closed and for no longer than 24 months thereafter.
- Customer and contract data: for the duration of the contract. Accounting records are kept for 7 years under the Swedish Accounting Act (1999:1078).
- Account and registration data: until you delete your account.
- Newsletter and consent: until you withdraw your consent.
- Analytics and cookie data: according to your cookie and consent settings.
We implement technical and organisational security measures, including encryption at rest and in transit (TLS), access control and logging.
7. Your rights
Under the GDPR you have the right to:
- Request access to your personal data
- Request rectification of inaccurate data
- Request erasure ("the right to be forgotten")
- Request restriction of processing
- Object to processing
- Request data portability
- Withdraw consent
Contact us at support@zorc.se to exercise your rights. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).
8. Newsletter and marketing
When you subscribe to our newsletter or tick the box to receive offers, we process your email address (and name, if provided) on the basis of your consent (GDPR Art. 6(1)(a)). We record the time and which version of the terms you accepted as evidence under the accountability principle (Art. 7(1)).
You may withdraw your consent at any time via the unsubscribe link in every email or by emailing support@zorc.se. We will then stop sending immediately and remove you from the mailing list. Data in the mailing list is retained until you unsubscribe.