Privacy Policy
Last updated: 21 July 2026
At Saryo AB (“Saryo”, “we”, “our”, or “us”), we value your privacy and are committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Swedish data protection laws.
This Privacy Policy explains what information we collect, why we collect it, how we use it, and your rights regarding your personal data.
This Privacy Policy applies to visitors to our website, people who contact us through the website, email, LinkedIn or other professional channels, prospective and existing customers, suppliers and business partners, and individuals who contact us regarding employment or consulting opportunities. Separate privacy information may be provided to employees, consultants and candidates participating in a structured recruitment process.
Contents
1. Data Controller
Saryo AB is the data controller responsible for the processing of personal data described in this Privacy Policy.
Saryo AB
Organization number: 559594-6756
Lergöksgatan 5C
421 50 Västra Frölunda
Sweden
Website: https://saryo.se
Email: privacy@saryo.se
Key Terms
- Data Controller
- The entity that determines the purposes and means of processing personal data.
- Personal Data
- Any information relating to an identified or identifiable natural person.
- Processing
- Any operation performed on personal data, such as collection, storage, use, or deletion.
2. Personal Data We Collect
Depending on how you interact with us, we may collect the following categories of personal data.
Information You Provide
When you contact us through our website, email, or LinkedIn, we may collect:
- Name
- Company name
- Job title
- Email address
- Telephone number
- Any information you choose to include in your message
Messages submitted through our contact form are transmitted over HTTPS through our website infrastructure. We use Resend, an email delivery service, to transmit the message to Saryo’s business email environment. The message and any subsequent correspondence are received, stored and managed using Microsoft 365.
We use this information to respond to your inquiry, manage appropriate follow-up, assess a possible business or contractual relationship, maintain relevant correspondence and, where necessary, establish, exercise or defend legal claims. Contact-form information is not used for unrelated marketing without an appropriate legal basis.
Access to correspondence is limited to authorized persons within Saryo who need the information to handle the inquiry or business relationship.
To help protect our website against abuse and spam, submissions may be subject to automated security checks.
Recruitment Information
If you apply for employment or consulting opportunities, we may collect:
- CV or résumé
- Cover letter
- Employment history
- Education
- Skills and certifications
- References (where applicable)
- Information provided during interviews
Technical Information
When you visit our website, certain technical information may be processed automatically in order to operate, secure, and improve the website. This may include:
- IP address
- Browser type and version
- Operating system
- Device type
- Pages visited
- Referring website (where available)
- Date and time of access
This information may be processed through our website infrastructure and security services for purposes such as website operation, performance monitoring, abuse prevention, and security.
Website usage statistics are also collected through Cloudflare Web Analytics as described in Section 5.
Information from Third Parties
In certain circumstances, we may receive personal data about you from third parties, such as:
- Business partners or professional networks (e.g. LinkedIn) when they provide your contact details for potential collaboration.
- Event organizers where you have consented to your information being shared.
- Publicly available sources where permitted by applicable law.
Where we receive such data, it will be processed in accordance with this Privacy Policy and applicable data protection law.
3. How We Use Your Information
We process personal data for the following purposes:
- Following up on business inquiries and communicating with prospective customers, consulting brokers, suppliers and professional partners where the communication is relevant to their professional role
- Preparing proposals and providing consulting services
- Processing recruitment applications
- Operating, securing and troubleshooting the website
- Measuring website usage and performance through privacy-oriented analytics
- Complying with accounting, tax, regulatory or other legal requirements
- Establishing, exercising or defending legal claims
- Optional processing for which Saryo specifically requests consent
4. Legal Basis for Processing
Under GDPR, we rely on one or more of the following legal bases depending on the purpose of processing:
| Purpose | Legal Basis |
|---|---|
| Following up on business inquiries and communicating with prospective customers, consulting brokers, suppliers and professional partners where the communication is relevant to their professional role | Saryo’s legitimate interests in communicating with individuals in their professional capacity, Article 6(1)(f). Recipients of direct outreach communications have the right to object to processing for this purpose at any time. Where an individual asks Saryo to take steps before entering into a contract with that individual, Article 6(1)(b) may apply. |
| Preparing proposals and providing consulting services | Contractual necessity where the individual is a contracting party; otherwise legitimate interests in administering the relationship with the customer or partner organization. |
| Processing recruitment applications | Legitimate interests in assessing and recruiting suitable personnel, Article 6(1)(f). Legal obligations or legitimate interests in establishing, exercising or defending legal claims may also apply. |
| Operating, securing and troubleshooting the website | Legitimate interests in providing a secure, reliable and functional website, Article 6(1)(f). |
| Measuring website usage and performance through privacy-oriented analytics | Legitimate interests in understanding website performance and improving the website, Article 6(1)(f). |
| Complying with accounting, tax, regulatory or other legal requirements | Compliance with a legal obligation, Article 6(1)(c). |
| Establishing, exercising or defending legal claims | Legitimate interests, Article 6(1)(f), and other applicable legal provisions. |
| Optional processing for which Saryo specifically requests consent | Consent, Article 6(1)(a). Consent will only be used where it is voluntary, specific and capable of being withdrawn. |
Key Terms
- Consent
- Freely given, specific, informed and unambiguous indication of agreement to the processing of personal data.
- Legitimate Interests
- A legal basis where processing is necessary for our legitimate business interests, provided those interests do not override your rights and freedoms.
5. Cookies and Website Analytics
Essential Cookies
Our website may use cookies or similar technologies that are strictly necessary for the operation and security of the website. These cookies cannot be disabled through our website as they are required to provide the requested service.
Analytics
We use Cloudflare Web Analytics to understand how visitors use our website.
Cloudflare Web Analytics does not use client-side cookies or local storage to collect usage metrics and is not designed to fingerprint or track individuals across websites. Cloudflare records website-performance and page-view measurements when the analytics beacon is used. Unsampled beacon data is retained by Cloudflare for a limited period and is subsequently aggregated or sampled for longer-term analytics reporting.
No advertising, profiling, or behavioral tracking cookies are used.
Because Cloudflare Web Analytics operates without cookies, we do not request consent specifically for analytics. Should we introduce additional analytics or marketing technologies that require consent in the future, this Privacy Policy and our website will be updated accordingly.
You can learn more about Cloudflare Web Analytics in Cloudflare’s Privacy Policy.
Key Terms
- Cookies
- Small text files stored on your device by your web browser when you visit a website.
- Web Analytics
- The measurement, collection, analysis and reporting of web data for purposes of understanding and optimizing web usage.
6. Recruitment
We process candidate information to assess suitability for employment or consulting opportunities and to administer the recruitment process. The processing is normally based on Saryo’s legitimate interests in recruiting suitable personnel.
If you are not selected, application material will normally be deleted or anonymized no later than six months after the recruitment process has concluded. Information may be retained for a longer period where this is necessary to establish, exercise or defend a legal claim.
If Saryo wishes to retain your information for possible future opportunities beyond the ordinary retention period, we will inform you separately about the purpose, legal basis and applicable retention period.
If you participate in a structured recruitment process, additional privacy information may be provided separately.
7. Sharing Personal Data
We do not sell, rent, or trade your personal data.
We may share personal data only with trusted service providers that assist us in operating our website and business, including:
- Cloudflare, which provides website hosting infrastructure, content delivery, DNS, website security and Web Analytics.
- Resend, which transmits messages submitted through the website contact form to Saryo.
- Microsoft, which provides Microsoft 365 services used to receive, store, manage and secure business email and correspondence.
- Other professional or IT service providers where necessary for accounting, legal support, maintenance, security or business administration.
These providers generally process customer content and service data on Saryo’s behalf as data processors under their applicable contractual data-protection terms. They may separately act as data controllers for limited information processed for their own purposes, such as account administration, billing, fraud prevention, legal compliance or service-security management.
We may also disclose personal data where required by applicable law or in response to lawful requests from public authorities.
8. International Transfers
Saryo uses service providers that operate internationally. Personal data may therefore be processed in or accessed from countries outside the European Economic Area.
Cloudflare
Cloudflare operates a global website and security network. Depending on the services used and the nature of a request, website and security information may be processed outside the EEA. Cloudflare’s Data Processing Addendum provides for relevant international-transfer mechanisms, including the EU Standard Contractual Clauses where required.
Resend
Resend’s primary processing operations are located in the United States. Contact-form message content, email addresses and delivery metadata may therefore be processed in the United States. Resend’s Data Processing Addendum incorporates the EU Standard Contractual Clauses and other applicable transfer mechanisms.
Microsoft 365
Saryo’s Microsoft 365 tenant is established for an organization in the EU/EFTA region and is covered by Microsoft’s EU Data Boundary commitments for relevant Microsoft 365 services. Limited transfers or remote access outside the EU Data Boundary may nevertheless occur in documented circumstances. Microsoft applies contractual, organizational and technical safeguards under its applicable data-protection terms.
You may contact Saryo at privacy@saryo.se for additional information about the safeguards applied to international transfers.
9. Data Retention
We retain personal data for the periods described below, unless a longer period is required by applicable law or for the establishment, exercise or defense of legal claims.
| Category | Retention Period |
|---|---|
| Routine contact-form inquiries and related correspondence | Normally retained for up to 12 months after the inquiry has been resolved. |
| Business-development and professional-contact correspondence | Retained while the relationship or discussion remains active and normally for up to two years afterwards, unless a longer period is required for a contract, legal claim or legal obligation. |
| Customer and supplier relationship records | Retained for the duration of the relationship and afterwards according to applicable contractual, accounting and legal-claims requirements. |
| Accounting records and correspondence forming part of accounting documentation | Retained for at least seven years where required by Swedish accounting rules. |
| Recruitment records for unsuccessful candidates | Normally deleted or anonymized within six months after the recruitment process concludes. |
| Resend contact-form transmission data | Resend currently retains email data for approximately 30 days under its standard service arrangements; copies delivered to Microsoft 365 follow Saryo’s own retention rules. |
| Cloudflare Web Analytics data | Unsampled beacon data is retained by Cloudflare for seven days and is then aggregated or sampled for longer-term analytics reporting. |
| Website security and operational logs | Retained according to the applicable Cloudflare service configuration and for no longer than necessary for security, abuse prevention, troubleshooting or incident investigation. |
| Legal disputes or complaints | Relevant information may be retained until the matter and applicable legal-claim periods have ended. |
10. Your Rights
Under GDPR, you have the right to:
- Access your personal data
- Request correction of inaccurate information
- Request deletion of your personal data where applicable
- Restrict processing
- Object to processing based on legitimate interests
- Request data portability
- Withdraw consent where processing is based on consent
- Lodge a complaint with a data protection supervisory authority, including the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY)
To exercise your rights, contact privacy@saryo.se. We will normally respond within one month after receiving a valid request. We may request information necessary to verify your identity before disclosing or changing personal data. Certain rights are subject to conditions and exceptions under applicable law.
11. Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.
However, no method of electronic transmission or storage can be guaranteed to be completely secure.
12. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority in accordance with GDPR requirements, and where required, we will also inform affected individuals without undue delay.
We maintain internal incident response procedures to detect, investigate, and contain personal data breaches promptly.
13. Third-Party Links
Our website may contain links to third-party websites, including LinkedIn.
We are not responsible for the privacy practices or content of third-party websites. We encourage you to review their respective privacy policies.
14. Children’s Privacy
Our services are intended for businesses and professionals.
We do not knowingly collect personal data from children under the age of 16.
If you believe a child has provided personal information to us, please contact us so we can remove it.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in legal requirements or our business practices.
The latest version will always be available on this website.
16. Contact Us
If you have any questions about this Privacy Policy or how we process your personal data, please contact us.
Saryo AB
Organization number: 559594-6756
Lergöksgatan 5C
421 50 Västra Frölunda
Sweden
Website: https://saryo.se
Email: privacy@saryo.se