Privacy policy
Last updated: [publication date]
This policy explains how Poush Digital AB handles personal data when you visit this website, contact us or work with us.
Who is responsible
The controller for your personal data is:
Poush Digital AB, org. no. 559363-4263, Lerum, Sweden Email: info@poushdigital.com Phone: +46 (0)727-11 79 61
Our full postal address is in the company details at the bottom of every page.
What we collect and why
| When | What | Why | Legal basis |
|---|---|---|---|
| You use the contact form or email us | Name, email, company, role, your message | To answer your request and suggest a time for a call | Legitimate interest in answering enquiries, or steps before a contract at your request |
| You or your organisation becomes a client | Business contact details, correspondence, contracts | To deliver the engagement and manage the relationship | Contract, or legitimate interest where the contract is with your employer |
| We invoice or pay | Names and details on invoices and receipts | Bookkeeping | Legal obligation under the Swedish Bookkeeping Act |
| You visit the website | Technical data such as IP address and browser type, handled by our hosting provider | To deliver the site securely and block spam and abuse | Legitimate interest in running a secure website |
We do not sell personal data, use it for advertising, or make decisions about you by automated means alone.
How long we keep it
| Data | Retention |
|---|---|
| Call requests that do not lead to work | 12 months after the last contact |
| Sales and partnership pitches | Deleted within 30 days |
| Business contact details of clients | The length of the relationship plus 2 years |
| Contracts and engagement correspondence | 10 years after the contract ends, the general Swedish limitation period for claims |
| Invoices and accounting records | 7 years after the end of the financial year, as required by the Swedish Bookkeeping Act |
| Client material shared for an engagement | Returned or deleted within 90 days of the engagement ending, unless the contract says otherwise |
| Technical data from website visits | As short as our hosting provider allows |
Who processes data for us
We use the following services. Each processes personal data on our behalf under a data processing agreement.
- Microsoft (Microsoft 365, including Outlook, Teams, OneDrive and Microsoft 365 Copilot; GitHub, including GitHub Copilot): email, including delivery of contact form messages, meetings, documents and AI assistance.
- Cloudflare: website hosting, the contact form, spam protection and website statistics.
- Anthropic (Claude): AI assistance in engagements.
- OpenAI (ChatGPT): occasional AI assistance in engagements.
- Our accounting firm: bookkeeping and annual accounts.
Transfers outside the EU
Some of these providers are based in the United States and may process data there. Where they do, the transfer is covered by the EU-US Data Privacy Framework if the provider is certified under it, or by the EU Commission’s standard contractual clauses.
AI tools and client data
AI agents and assistants are part of how we work. See How we work. For client work, this means:
- Your choice of provider. If you prefer, we work with the AI services your organisation has already approved, in your accounts and under your agreements. Otherwise we use Claude (Anthropic), GitHub Copilot and Microsoft 365 Copilot (Microsoft), and occasionally ChatGPT (OpenAI).
- No training on your data. We only use these services under business terms or with settings where your data is not used to train AI models.
- Only what is needed. Agents get access to the material agreed for the engagement and nothing else.
- A person reviews everything. Every deliverable is reviewed by the founder before you see it. AI output is never used to make decisions about individuals.
- Deleted after the engagement. Client material, including what AI tools processed, is returned or deleted within 90 days of the engagement ending, unless the contract says otherwise.
Cookies and statistics
This website does not use cookies for statistics, advertising or tracking. Our website statistics come from Cloudflare Web Analytics, which does not use cookies and does not identify individual visitors. Cloudflare may set strictly necessary cookies to protect the site and the contact form against abuse. Because no other cookies are used, there is no cookie banner.
Your rights
Under the GDPR you have the right to:
- get a copy of the personal data we hold about you
- have incorrect data corrected
- have your data deleted, unless we are required to keep it
- restrict how we use your data
- object to processing based on our legitimate interest
- receive your data in a portable format, where the processing is based on contract
To use any of these rights, email info@poushdigital.com. We answer within one month.
If you think we handle your data incorrectly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.
Changes to this policy
If we change how we handle personal data, we update this page and the date at the top.