Rev 2.0, 22.09.26
1. Introduction and controller
This Privacy Policy describes how HDR AB (“Provider”, “we”, “us”), address Järntorget 3, 413 04 Göteborg, Sweden, company/VAT no. SE556639198201, processes personal data in connection with the accsyn product and related websites (including https://accsyn.com and https://accsyn.io).
Provider is the data controller for personal data processed to operate accounts, authentication, billing relationships, support and Product security/audit logging. Where a customer organisation (workspace Licensee) decides how content and end-user access are managed inside a workspace, that organisation typically acts as controller for such content and access decisions, and Provider acts as processor on their instructions. This Policy focuses on processing for which Provider is controller, and summarises processor activities where relevant.
We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Swedish data-protection law. Cloud infrastructure used to host the Product is located entirely within the European Union and operated in ISO/IEC 27001-certified premises.
2. Personal data we collect
Provider intentionally minimises personal data. For user accounts, we store:
(a) Account identifier — primarily the user’s e-mail address, which serves as the account login identity; and/or
(b) Profile data received from a third-party authentication provider when you sign in with single sign-on (currently Google or Microsoft), limited to the attributes those providers return for authentication (typically e-mail address and, where provided, display name and a provider user identifier). We do not request or store additional personal profile information beyond what is required to create and maintain the account and complete authentication.
In addition, Provider stores audit trail logs related to file and content access within the Product. Such logs may include, for each relevant event: the authenticated user (e-mail / account id), timestamp, action performed (for example download, upload, share or access), resource identifiers, technical metadata (such as IP address and client/application information), and geolocation data derived from the connection (for example approximate country or region). Audit logs are kept for security, accountability, abuse prevention and to help Licensees investigate access to their data.
When you subscribe or pay for the Product, payment and billing are handled by Stripe (and, where invoice billing applies, by Provider’s invoicing process). Card details are processed by Stripe and are not stored by Provider. Business or billing contact details that you or your organisation voluntarily provide for contracting, invoicing or support (for example company name, VAT number, billing e-mail or postal address) may be stored as needed to perform the contract.
If you contact support, we process the content of your communications and any personal data you choose to include. Content that you or your organisation transfer or store through the Product (files, metadata you attach, share lists you configure) is processed to deliver the service; Provider does not use such content for its own marketing purposes.
3. Purposes and legal bases
We process personal data for the following purposes and GDPR legal bases (Art. 6):
(a) Providing the Product, accounts, authentication, workspaces and transfers — performance of a contract (Art. 6(1)(b)), or steps prior to entering a contract (for example trial signup).
(b) Billing, payment collection, invoicing and accounting — Art. 6(1)(b) and compliance with legal obligations (Art. 6(1)(c)), including bookkeeping and tax requirements.
(c) Security, misuse prevention, troubleshooting and audit logging of file access (including geolocation) — legitimate interests (Art. 6(1)(f)) in securing the Product and customer data, and where applicable performance of the contract (Art. 6(1)(b)).
(d) Customer support and service communications — Art. 6(1)(b) and/or Art. 6(1)(f).
(e) Service-related notices (for example security, downtime or material changes to Terms or this Policy) — Art. 6(1)(b) and/or Art. 6(1)(f). Marketing e-mails are only sent where permitted (consent or soft opt-in under applicable law) and you may unsubscribe at any time.
4. Retention
Account data (e-mail / SSO identity attributes) is retained for as long as the account exists and for a reasonable period thereafter as needed to close the account, resolve disputes and meet legal obligations. Audit trail logs, including geolocation-related fields, are retained for a limited period appropriate to security and investigation needs and then deleted or anonymised, unless a longer retention is required by law or an active investigation. Billing and invoice records are retained as required by Swedish accounting and tax law (typically seven years or as otherwise mandated). Support correspondence is retained as long as needed to handle the matter and for a proportionate follow-up period.
5. Recipients and processors
Personal data may be disclosed to:
(a) Authentication providers (Google, Microsoft) when you choose to sign in with them — subject to their terms and privacy notices;
(b) Payment processors (Stripe) for card-based subscriptions;
(c) Hosting and infrastructure providers within the EU operating ISO/IEC 27001-certified premises;
(d) Professional advisers (for example accountants or legal counsel) under confidentiality obligations, where necessary; and
(e) Public authorities where required by law.
Workspace administrators may see user identities (e-mail) and audit information for their workspace as part of the Product’s intended functionality. We do not sell personal data.
6. Transfers outside the EU/EEA
Provider hosts Product data, including account identifiers and audit logs, within the European Union. Some subprocessors or authentication/payment providers may process limited data outside the EU/EEA. Where such a transfer occurs, we rely on an adequacy decision and/or appropriate safeguards under Chapter V GDPR (for example Standard Contractual Clauses), together with supplementary measures where required.
7. Your rights
Subject to the conditions and exceptions in the GDPR, you have the right to: access your personal data; rectification; erasure (“right to be forgotten”); restriction of processing; data portability; and objection to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
Erasure may be limited where we must retain data for legal obligations (for example accounting), to establish or defend legal claims, or where audit/security logs must be preserved for a proportionate period. To exercise your rights, contact us at privacy@accsyn.com. You may also lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or another competent supervisory authority in the EU/EEA.
8. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration, taking into account the nature of the data and the risks involved. Measures include access controls, encryption in transit where applicable, logging/audit trails, and hosting in ISO/IEC 27001-certified EU premises. No method of transmission or storage is completely secure; the Product is provided on a best-effort basis as described in our Terms.
9. Cookies and similar technologies
Our websites and applications may use strictly necessary cookies or similar technologies required to authenticate sessions and operate the Product. Where non-essential cookies (for example analytics) are used, we will obtain consent where required by law and provide information about those cookies at the point of collection.
10. Children
The Product is intended for business use. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@accsyn.com and we will take appropriate steps to delete it.
11. Changes
We may update this Privacy Policy from time to time. The revision date above indicates the current version. Material changes will be published on this page and, where appropriate, notified through the Product or by e-mail. Continued use of the Product after an update constitutes acknowledgement of the updated Policy.
12. Contact
Privacy requests and questions: privacy@accsyn.com. Postal address: HDR AB, Järntorget 3, 413 04 Göteborg, Sweden. Related Terms of Service: accsyn Terms and Conditions.