Privacy policy

Less Bang For Buck AB (org.nr 559587-8975), with its registered office in Sjöbo, Sweden, is the controller of the personal data described in this policy. That means we decide why and how it is processed, and we are responsible for it.

This policy covers this website and the questions you send us through it or by email. For anything about privacy or this policy, email zoltan@lessbangforbuck.com.

Our website is hosted on Firebase Hosting, a Google service. To send a page to your browser, Google’s servers have to process technical data about the request, such as your IP address, the page you asked for, the time and your browser type.

Google keeps logs of these requests for a limited period, to run the service and to detect and prevent abuse. Pages are delivered through a global content delivery network, so your request may be handled by a server outside the EU (see Transfers outside the EU/EEA). You can read more in Firebase’s privacy and security information.

Data

IP address and technical request data (page, time, browser type).

Why

To deliver the website to you and keep it secure.

Legal basis

Our legitimate interest in running a website that works and is secure (Art. 6(1)⁠(f) GDPR).

How long

Google keeps its server logs for a limited period that it sets. We don’t use them to track or profile visitors.

When you send us a question through the contact form, we receive:

• your name
• your company, if you give it
• your email address
• your question, and anything else you choose to write in it.

The form sends this to a small program (a Cloud Function) that runs on Google’s platform in its EU region europe-north1, in Finland. The program checks the form and forwards your message by email to our company inbox, through our email provider Websupport. The website doesn’t save your message in a database. It ends up in our email inbox, and that is where we keep it.

To stop spam and abuse, the program also uses your IP address to limit how many messages can be sent in a short time. It holds the IP address only briefly, in memory, and doesn’t save it.

Google Cloud records technical data about each request to the program, such as your IP address and browser type, in our technical logs. These logs are deleted automatically after 30 days.

If you email us directly instead, we handle your email in the same way.

Please don’t include sensitive information, such as details about your health or hearing. We don’t need it to answer you.

Data

Name, company (optional), email address and your question. Your IP address and browser type, to limit abuse and in our technical logs.

Why

To answer your question and follow up on it, and to keep the form free of spam.

Legal basis

Our legitimate interest in answering questions and keeping the form safe (Art. 6(1)⁠(f) GDPR). If you ask about buying from or working with us: steps you ask us to take before a possible contract (Art. 6(1)⁠(b) GDPR).

How long

We delete enquiries within 12 months of our last contact with you, unless they lead to a business relationship or the law requires us to keep them, for example when they become part of our accounting records under Swedish bookkeeping rules (Art. 6(1)⁠(c) GDPR). Our program holds the IP address only briefly, in memory. Our technical logs are deleted automatically after 30 days.

This website doesn’t set any cookies of its own. We don’t use analytics, advertising or tracking tools, and we don’t embed social media plugins.

Our fonts are stored on our own website, so loading a page doesn’t contact font services such as Google Fonts.

We link to our company page on LinkedIn. We don’t embed LinkedIn buttons, plugins or tracking pixels, so loading our pages doesn’t send data to LinkedIn. If you follow the link, LinkedIn’s own privacy policy applies to what happens there.

We share personal data only with the service providers we need to run the website and the contact form. They process it on our behalf and under our instructions:

• Google (Firebase Hosting and Google Cloud) hosts the website and runs the contact form.
• Websupport hosts our company email and delivers the form messages to our inbox.

We may also have to disclose data where the law requires it, for example to a public authority. We don’t sell your personal data.

Where we can choose, we process data in the EU: the contact form runs in Google’s region in Finland. But Google is a US company with a global network, so some data, such as your IP address, may be processed outside the EU/EEA, including in the United States.

When that happens, the transfer is protected by:

• the EU–US Data Privacy Framework, which the European Commission has found to give an adequate level of protection. Google LLC is certified under it (you can check this on the Data Privacy Framework website), and/or
• the European Commission’s Standard Contractual Clauses, which are part of Google’s data processing terms.

If any other provider we use processes data outside the EU/EEA, we make sure one of these safeguards applies. You can ask us for more information or a copy of the safeguards at zoltan@lessbangforbuck.com.

Under the GDPR you have the right to:

• Access – get a copy of the personal data we hold about you.
• Rectification – have wrong or incomplete data corrected.
• Erasure – have your data deleted, for example when we no longer need it.
• Restriction – ask us to limit how we use your data, for example while we check whether it is correct.
• Objection – object to processing we base on our legitimate interests (see below).
• Data portability – get the data you gave us in a common, machine-readable format, where we process it to take steps towards a contract with you.

To use any of these rights, email zoltan@lessbangforbuck.com. It’s normally free. We’ll reply within one month, and may ask you to confirm who you are first. Some rights have limits set by law; if one applies, we’ll explain it.

If you think we handle your personal data wrongly, please tell us first, so we can try to put it right. You also have the right to complain to the Swedish supervisory authority:

Integritetsskyddsmyndigheten (IMY)
Swedish Authority for Privacy Protection
Box 8114, 104 20 Stockholm, Sweden
imy@imy.se · www.imy.se/en

IMY has an online complaint form. You can also complain to the supervisory authority in the EU country where you live or work, or where you think the problem happened.

• You don’t have to give us your details. But we need your name, email address and question to answer you. Without an email address we can’t reply.
• We don’t make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects. Our spam checks are automatic, but if one stops you, you can always email us directly.
• We protect personal data with reasonable technical and organisational measures. For example, the website and the contact form only use encrypted connections (HTTPS).

We’ll update this policy when our website or the way we handle personal data changes. The date at the top shows when it last changed. If we make a significant change, we’ll make that clear on this page.