Privacy policy
How POISE AB processes personal data on poise.se: what we collect, why, how long we keep it and what rights you have.
1. Controller
POISE AB, company reg. no. 556773-0923, Brunnsgatan 9, 172 68 Sundbyberg, Sweden, is the controller for personal data processed through this website. Contact: info@poise.se.
2. What we process
- Contact form: name, email address, company (optional), chosen topic and message (optional). Name and email are required; without them we cannot reply. The website database keeps only name, email, topic and a daily hash of the IP address. Company and message exist only in the email to us.
- Visitor statistics: one record per page view and button click (page, referring page, device type, language) with a hash of the IP address that changes daily. No cookie, no browser storage, no third-party tools.
- Abuse limits: to limit the number of requests to forms and tools, a daily hash of the IP address is kept for at most seven days.
- Server logs: standard web-server logs (IP address, time, requested page, browser) for operations and security, for up to 30 days.
- Security updates (subscriptions): see section 5.
- Free domain check: the domain you enter is checked against public DNS, HTTPS and email records. The result is cached for six hours, the domain name is counted in tool statistics (12 months) and, for subscribers to the monthly check, the result history is kept for 24 months. No personal data is required.
We make no automated decisions about you and do no profiling.
3. Purposes and legal bases
| Processing | Purpose | Legal basis |
|---|---|---|
| Contact form | Answer your enquiry | Legitimate interest (Art. 6(1)(f)): answering an enquiry you sent us |
| Statistics, abuse limits, server logs | Operations, security, improving the site | Legitimate interest (Art. 6(1)(f)): keeping the site secure and working |
| Security updates | Deliver what you subscribed to | Consent (Art. 6(1)(a)) with double opt-in |
4. Retention
| Data | Period |
|---|---|
| Contact form in the database (name, email, topic, IP hash) | 12 months, then automatic deletion |
| Company and message text | Only in the email to us; not stored in the website database |
| Visitor statistics (per page view, daily IP hash) | 12 months |
| Abuse limits (daily IP hash) | 7 days |
| Server logs | Up to 30 days |
| Subscribers | While the subscription is active. Unconfirmed sign-ups are deleted after 7 days, unsubscribed addresses after 24 months |
| Subscription activity log | 24 months (evidence of consent, Art. 7(1)) |
| Domain check: cache / tool statistics / result history for subscribers | 6 hours / 12 months / 24 months |
5. Security updates
If you sign up at poise.se/en/subscribe we process the following data with your explicit consent.
5.1 What we store
- Email address – required; identifies the subscription and is the delivery address. Work addresses only; free webmail and disposable addresses are rejected.
- Domain for the monthly check – optional. If you give none but subscribe to the monthly check, we use the domain of your email address.
- Topic choices – which of the three mailings you chose (monthly domain check, weekly vulnerability alerts, weekly threat digest).
- Watchlists – vendors and products you want alerts for, news sources and the number of stories per mailing.
- Language – Swedish or English.
- Timestamps – sign-up, confirmation, last mailing and last open, plus a hard-bounce counter that stops mailings to addresses that fail.
- Activity log – one row per event (sign-up, confirmation, code attempt, unsubscribe, mailing, bounce), to demonstrate consent (Art. 7(1)).
5.2 What we do not store
- Your IP address in clear text. A daily hash of the IP address is kept for at most seven days for abuse limits.
- Tracking pixels that identify you. Lettermint, our delivery service, records only aggregate open statistics to protect sender reputation.
- Cross-site click tracking. Links in our mailings go straight to their destination, with no redirect that profiles you.
- Browser fingerprints, third-party pixels or advertising identifiers.
5.3 Double opt-in
No subscription is activated without your confirmation. After sign-up we send a six-digit code valid for 30 minutes. Until you enter it no further mail is sent, and your address is deleted automatically after seven days.
5.4 Unsubscribing
Every mailing contains an unsubscribe link and a List-Unsubscribe header that mail clients show as a button. You can also unsubscribe from your management page. Unsubscribing is immediate and asks no questions.
6. Recipients and suppliers
We do not sell, trade or rent personal data. Data is shared with:
- Lettermint (EU) – delivers email from the website. Your enquiry is forwarded to us through Lettermint (name, email, company, topic and message), and the security updates are sent through Lettermint (email address and content). Lettermint processes the data for delivery only.
- Our own infrastructure in a Swedish data centre in Stockholm, where the website, the database and api.poise.net run.
- Swedish authorities where required by law.
The full list of suppliers, regions and roles is on the Trust Centre page.
7. Where data is processed
Data processed through this website is processed within the EU/EEA and is not transferred outside the EU/EEA. How personal data is processed in our services to customers, including suppliers with a parent company outside the EU, is set out in the data processing agreement and on the Trust Centre page.
8. Cookies and browser storage
The website sets no cookies and stores nothing in the browser, so there is no cookie banner. Exception: the sign-in to our administration interface uses a session cookie; that interface is not available to visitors.
9. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21), and to withdraw consent at any time. Write to info@poise.se; we reply within one month. For subscriptions the fastest route is the unsubscribe link in the mailing or your management page.
You may complain to the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, Sweden, www.imy.se.
10. Security
Encryption in transit (TLS 1.2 or later), encrypted secrets at rest, role-based access and multi-factor sign-in for administration. Confirmation codes are stored as bcrypt hashes. Unsubscribe links are signed (HMAC) and cannot be guessed.
11. Changes
Changes are published here with a new date. Material changes are emailed to active subscribers.