Privacy Notice
Vesence AB
1. Introduction
Vesence AB ("Vesence", "we", "us" or "our") is processing your personal data when you interact with us in various contexts. We respect your privacy and are committed to protecting the personal data we process about you. All processing of personal data is carried out in accordance with the requirements set out in applicable data protection legislation, including the General Data Protection Regulation EU 2016/679 ("GDPR").
Depending on in which capacity you are reading this notice, the processing of your personal data may differ. You may read this notice in the capacity as a (i) visitor on our digital channels, or (ii) a corporate contact person (e.g. a supplier or customer contact). To make this notice more relevant to your particular situation, the notice is divided into two sections with specific information related to the various roles that you may have when we are processing your personal data.
2. Who is the data controller for the processing of your personal data?
Vesence is the data controller for the processing of your personal data as described in this privacy notice. If you have any questions regarding the processing of your personal data, please contact Vesence using the contact details set out below.
Vesence AB
Email: support@vesence.com
Address: Kungsgatan 17, 111 43 Stockholm
Org. No.: 559456-6902
3. If you are a visitor on our digital channels
3.1 How we collect your personal data
We collect your personal data from:
- Yourself, either from you, or indirectly from you through the collection of data that is generated by you, when you visit our digital channels or communicate with us regarding questions or feedback.
3.2 Purposes of the processing of your personal data
3.2.1 Track your use of our website and our digital channels
When you are browsing the website or our digital channels, we will process your IP address and browser user-agent string to track your activity. Your personal data is processed for this purpose to manage your use of and improve this website, for our internal records and for statistical analysis.
| Categories of personal data | Legal basis |
|---|---|
| Consent. We only process your personal data using tracking features (cookies) if you have given us your consent to such processing. |
| Retention period: Your personal data will be processed for as long as necessary for the purposes described herein. For example, when processing your personal data for the purpose for maintaining the website, we will anonymise your data as soon as practicably possible and then use the anonymised data for further website development. | |
3.2.2 Communicate with you and respond to your questions and feedback
Where we offer you a possibility to communicate with us by asking questions or providing feedback regarding our services and our business, we will process your personal data when you submit a question, comment, feedback or any other message or inquiry. The purpose of the processing is to be able to communicate with you and to handle your inquiry.
| Categories of personal data | Legal basis |
|---|---|
| Legitimate interest. The processing is necessary in order to fulfil our legitimate interest to communicate with you, e.g. to develop our business, handle complaints, and respond to media inquiries. |
| Retention period: One (1) year from the last communication. | |
3.2.3 Fulfil legal obligations
We will process your personal data where necessary in order to comply with legal obligations, e.g. accounting obligations.
| Categories of personal data | Legal basis |
|---|---|
All information mentioned above. | Legal obligation. The processing is necessary in order to comply with our legal obligations. |
| Retention period: Subject to local legal requirements on the data controller for at least seven (7) years from the end of the calendar year in which the accounting year ended to comply with bookkeeping obligations. | |
3.2.4 Establish, exercise and defend legal claims
For the purposes of establishing, exercising and defending legal claims (for example in connection with a dispute or legal process), we may process your personal data.
| Categories of personal data | Legal basis |
|---|---|
All information mentioned above. | Legitimate interest. The processing is necessary in order to fulfil our legitimate interest to establish, exercise or defend the legal claim, for example in connection with a dispute or legal process. |
| Retention period: As long as necessary to establish, exercise or defend the legal claim. | |
4. Corporate contact persons and users
4.1 How we collect your personal data
We collect your personal data from:
- Yourself, either from you, or indirectly from you through the collection of data that is generated by you, when you communicate with us regarding questions or feedback or when using the services.
- Publicly available sources, e.g. information that you have published on professional network platforms such as LinkedIn.
- Your employer, when your details are provided to us as the supplier's or business partner's contact person, representative or service user, or when you are listed as a reference on an invoice.
- Third parties, that lawfully sell company information for marketing purposes for the purpose of sending B2B marketing.
4.2 Purposes of the processing of your personal data
4.2.1 Managing user accounts
Your personal data are processed by us for the purpose of managing user accounts, e.g. to keep track of the number of users of the solution/service for the purpose of license management, to handle onboarding and offboarding of user accounts and to allow you to access and use the Vesence solutions or services that your employer has purchased from Vesence.
| Categories of personal data | Legal basis |
|---|---|
| Legitimate interest. The processing is necessary in order to fulfil our legitimate interest to manage the user accounts in order to be able to provide our solutions to our customers and to manage licenses. |
| Retention period: Your personal data will be stored for as long as you have an active user account, and your data will be deleted no longer than ninety (90) days after your user account has been cancelled. | |
4.2.2 Marketing and sales activities (B2B)
Your personal data will be processed for the purpose of marketing our products and services. We may contact you in your capacity as someone who has the authority and legal capacity to procure products and services on behalf of the organisation you represent.
| Categories of personal data | Legal basis |
|---|---|
| Legitimate interest. The processing is necessary in order to fulfil our legitimate interest to send B2B marketing to promote our products and services. |
| Retention period: Your personal data will be processed for a maximum period of one (1) year for this purpose. If the marketing contact leads to concrete commercial discussions your personal data will be processed for a longer period, please see the purpose in section 4.2.3 below. | |
4.2.3 Communicate with you and respond to your questions and feedback
Where we offer you a possibility to communicate with us by asking questions or providing feedback regarding our services and our business, we will process your personal data when you submit a question, comment, feedback or any other message or inquiry. The purpose of the processing is to be able to communicate with you and to handle your inquiry.
| Categories of personal data | Legal basis |
|---|---|
| Legitimate interest. The processing is necessary in order to fulfil our legitimate interest in communicating with you, e.g. to develop our business, handle complaints, and respond to media inquiries. |
| Retention period: One (1) year from the last communication. | |
4.2.4 Administration of contractual relationship
Your personal data in your capacity as representative of a customer or business partner to us will be processed because we have a legitimate interest in administering the relationship with our customers, suppliers and partners, and to be able to manage the overall cooperation and day-to-day activities. This also includes processing within the scope of the negotiation and execution of our commercial and legal agreements.
| Categories of personal data | Legal basis |
|---|---|
| Legitimate interest. The processing of your personal data is necessary in order to satisfy our legitimate interest in being able to administer our business contact relationships and facilitate, e.g., day-to-day communications. |
| Retention period: Your personal data will be processed until the commercial relationship ceases, or until you cease to be a contact person. Please note that if, e.g., your name is visible in an agreement document, your personal data may be stored for a longer period even if you cease to be a contact person. | |
4.2.5 Develop and improve our products and services
We collect information about your use of our services which we aggregate to perform data analysis to develop our products and services, and to gain better insights and improve and optimise our services. The data collected relates to the features you use, actions you take, the dates and times of access, amount of time spent within the services and types and volumes of queries you submit. As a controller, we never process personal data that is part of any content you upload or insert in our services.
| Categories of personal data | Legal basis |
|---|---|
| Legitimate interest. The processing is necessary in order to fulfil our legitimate interest to develop and improve our services. |
| Retention period: Your personal data will be stored for as long as you have an active user account, and your data will be deleted no longer than ninety (90) days after your user account has been cancelled. | |
4.2.6 To ensure network and information security in Vesence's services
To manage and protect our services and related IT systems, maintain the secure and efficient use of internal information, and ensure the safety of business-critical information and other assets, we process your personal data as necessary. This includes, inter alia, activities such as logging, troubleshooting, backup, change and problem management in systems, and handling potential IT incidents.
| Categories of personal data | Legal basis |
|---|---|
| Legitimate interest. The processing is necessary in order to fulfil our legitimate interest in managing and protecting our website, services and related IT systems. |
| Retention period: For as long as you are using the services. | |
4.2.7 Invoicing administration
We will process your contact information for reference purposes when we are either issuing invoices to or receiving invoices from the company that you represent, as your contact information may be visible on the invoices (depending on whether the organisation you represent has named you as an invoice reference or not).
| Categories of personal data | Legal basis |
|---|---|
| Legitimate interest. The processing is necessary in order to fulfil our legitimate interest to have a reference person on the invoices we issue and to process such information that appears on invoices we receive. |
| Retention period: During the commercial relationship, after which the information will be stored for an additional period in order to comply with legal obligations as set out in section 4.2.8 below. | |
4.2.8 Fulfil legal obligations
We will process your personal data where necessary in order to comply with legal obligations, e.g. accounting obligations.
| Categories of personal data | Legal basis |
|---|---|
All information mentioned above. | Legal obligation. The processing is necessary in order to comply with our legal obligations. |
| Retention period: Subject to local legal requirements on the data controller for at least seven (7) years from the end of the calendar year in which the accounting year ended to comply with bookkeeping obligations. | |
4.2.9 Establish, exercise and defend legal claims
For the purposes of establishing, exercising and defending legal claims (for example in connection with a dispute or legal process), we may process your personal data.
| Categories of personal data | Legal basis |
|---|---|
All information mentioned above. | Legitimate interest. The processing is necessary in order to fulfil our legitimate interest to establish, exercise or defend the legal claim, for example in connection with a dispute or legal process. |
| Retention period: As long as necessary to establish, exercise or defend the legal claim. | |
5. With whom do we share your personal data?
Where necessary in order to achieve the purposes set out above, we share your personal data with other entities or authorities. Please note, however, that we, regardless of the recipients' capacity, will only share your personal data with trusted recipients and only to the extent necessary.
Data processors acting on our behalf
In order to fulfil the purposes of the processing of your personal data and to be able to run our business, we transfer personal data to external parties such as third-party service providers that we have engaged, as well as other partners that process your personal data on our behalf. These external parties will act as our data processors and may only process your personal data in accordance with our instructions and not for their own purposes. We are the data controller for the processing of personal data that these external parties carry out on our behalf.
Recipients that act as data controllers
The categories of recipients mentioned in the table below will process personal data in the capacity of data controllers, i.e. these recipients will determine the purposes and means of the processing without our involvement.
| Recipients | Purpose | Legal basis |
|---|---|---|
| Establish, exercise or defend a legal claim, see sections 3.2.4 and 4.2.9. | Legitimate interest in being able to establish, exercise or defend legal claims. |
Transfers of personal data outside of the EU/EEA
Vesence always strives to store and process your personal data within the EU/EEA. In exceptional cases, however, your personal data may be transferred to, and processed in, a country outside the EU/EEA by our suppliers or processors. In such cases, Vesence has ensured that there are sufficient safeguards to protect your personal data. This means that such suppliers must meet the requirements of the GDPR.
6. Your rights
Under applicable data protection laws, you have certain rights in relation to the processing of your personal data. We process your personal data to the extent necessary in order to fulfil your rights. Please submit requests for exercising your rights by contacting us on the contact details set out in Section 2 above.
You have, under certain circumstances, the right to exercise the following rights:
Access
You may request confirmation of whether or not personal data is processed and, if that is the case, access your personal data and additional information such as the purposes of the processing. You are also entitled to receive a copy of the personal data undergoing processing. If the request is made by electronic means, the information will be provided in a commonly used electronic format if you do not request otherwise.
Object to certain processing
You have the right to object to the processing of your personal data based on a legitimate interest for reasons which concern your particular situation. In such a situation, we will stop using your personal data where the processing is based on a legitimate interest, unless we can show that the interest overrides your privacy interest or that the use of your personal data is necessary in order to manage or defend legal claims.
Rectification
You have at any time the right to have inaccurate personal data rectified, as well as, taking into account the purposes of processing, the right to have incomplete personal data completed which relates to you.
Erasure
You may have your personal data erased under certain circumstances, such as when your personal data is no longer needed for the purposes for which it was collected. However, we cannot delete your personal data if we, e.g. are obliged by law to keep the data.
Restriction of processing
You may ask us to restrict the processing of your personal data to only comprise the storage of your personal data under certain circumstances, such as when the processing is unlawful, but you do not want your personal data erased. If the processing of your personal data has been restricted, we may only, in addition to storing the data, process your personal data with your consent, or in order to establish, exercise or defend legal claims or to defend the rights of others.
Withdrawal of consent
You have the right to at any time withdraw your consent to the processing of personal data to the extent that the processing is based on your consent.
Data Portability
You may ask to receive a machine-readable copy of the personal data processed on the basis of your consent or on the basis that the processing is necessary in order to perform an agreement with you, and which personal data have been provided to us by you (data portability) and ask for the information to be transferred to another data controller (where possible).
Complaints to the supervisory authority
You acknowledge that you always have the right to lodge complaints pertaining to the processing of your personal data with your local supervisory authority.
7. Updates
Vesence may change or update this privacy notice from time to time. The latest version of the privacy notice is always available on Vesence's website at www.vesence.com/privacy. In case of changes that are significant and require your consent, Vesence will inform you of this and request your consent.
This privacy notice was last updated: 7 October 2025.