Privacy Policy

Last updated: 25 September 2026

1. Who we are

Sveanorr Law AB is the controller responsible for the processing of personal data described in this policy.

Sveanorr Law AB
Org. no. 556918-6009 · VAT no. SE556918600901
Fabriksgatan 36 C, 702 23 Örebro, Sweden
E-mail: sveanorrlaw@gmail.com · Phone: +46 70 776 15 10

We have not appointed a Data Protection Officer. For any question about your personal data, contact us using the details above.

2. What this policy covers

This policy applies when you visit sveanorrlaw.se (in English, Swedish or Russian), contact us through the website form, book a consultation, reach us by phone, e-mail, WhatsApp or Telegram, and when we act for you as a client.

3. What data we process, why, and on what legal basis

a) Contact form. Name, e-mail address, phone number, your message and any information you choose to include. We use it to reply to you and to assess whether we can take on the matter, including a conflict-of-interest check. Legal basis: steps taken at your request before entering into an agreement (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f)).

b) Consultation booking. Name, e-mail address, phone number, the chosen time and any notes you add. We use it to schedule and hold the meeting and to send you confirmations and reminders. Legal basis: Art. 6(1)(b).

c) Phone, e-mail, WhatsApp and Telegram. Your contact details and the content of the communication. We use it for the same purposes and on the same legal basis as in a) and b). WhatsApp and Telegram are operated by third parties under their own privacy policies (see section 5).

d) Client assignments. Identity and contact details, information about the matter, information about counterparties and other persons involved, and invoicing details. Legal bases:

  • performance of our agreement with you (Art. 6(1)(b));
  • compliance with legal obligations (Art. 6(1)(c)), for example the Swedish Bookkeeping Act and customer due diligence, including identity verification, where the Swedish Anti-Money Laundering Act (2017:630) applies;
  • our legitimate interest (Art. 6(1)(f)) in processing data about counterparties and in establishing, exercising or defending legal claims.

If a matter involves special categories of personal data or data about criminal offences, we process such data only where necessary for legal claims (Art. 9(2)(f) and Art. 10 GDPR, together with the Swedish Data Protection Act (2018:218)).

Please do not send sensitive information through the website form. Share it once we have agreed on how to communicate securely.

e) Website statistics and advertising (cookies). If you accept statistics and/or marketing cookies in our cookie banner, we use:

  • Google Analytics 4, to understand how the website is used;
  • Google Ads, to measure how many enquiries, bookings and calls come from our ads, and for remarketing.

Legal basis: your consent (Art. 6(1)(a) GDPR and Chapter 9, Section 28 of the Swedish Electronic Communications Act (2022:482)). You can change or withdraw your consent at any time via “Manage consent” on the website.

We use Google Consent Mode. If you decline, no analytics or advertising cookies are stored on your device. Google tags then send only cookieless signals, such as that a page was viewed, your consent choice, and technical details like browser type and time. Advertising identifiers are removed from these signals. Google uses them only in aggregated form to estimate statistics and conversions. Legal basis: our legitimate interest in measuring the effectiveness of our website and advertising (Art. 6(1)(f)). You can object to this processing by contacting us.

f) Technical operation and security. IP address, browser type, time of access and pages requested (server logs), plus strictly necessary cookies that remember your language and your cookie choice. We use this to operate the website securely. Legal basis: our legitimate interest (Art. 6(1)(f)). Strictly necessary cookies do not require consent.

g) Map on the contact page. The Google Maps map loads only after you accept marketing cookies. Until then, a placeholder is shown.

h) Record of your cookie choice. When you make a choice in the cookie banner, we store a record of it: the date and time, the categories you accepted or declined, your region and a shortened IP address (the last part is removed). We use it to be able to demonstrate that consent was given, as required by Art. 7(1) GDPR. Legal basis: legal obligation (Art. 6(1)(c)).

4. Where we get your data from

Mainly from you. In client assignments we may also receive data from our client, counterparties, authorities, courts and public registers such as Bolagsverket and Kronofogden, and from checks required under anti-money-laundering rules.

5. Who we share data with

  • Oderland Webbhotell AB (Sweden): hosting of the website and its database.
  • Google Ireland Limited: Google Analytics, Google Ads, Google Tag Manager, Google Maps and e-mail. These services may involve access by Google LLC in the USA (see section 6).
  • WhatsApp (Meta) and Telegram: only if you choose to contact us through these apps. They process data as independent controllers under their own privacy policies. Telegram is based outside the EU/EEA, so please do not share confidential information through it.
  • Authorities, courts, counterparties and experts: where needed to carry out an assignment or where required by law.
  • Accountants, auditors and IT consultants: under confidentiality obligations and, where required, data processing agreements.

We never sell personal data.

6. Transfers outside the EU/EEA

Google LLC is certified under the EU–US Data Privacy Framework, which the European Commission recognised as providing adequate protection in its decision of 10 July 2023. Google also uses the EU Standard Contractual Clauses. Telegram is based outside the EU/EEA, and using it is your own choice.

7. How long we keep data

Data Retention period
Enquiries that do not lead to an assignment 12 months after our last contact
Consultation bookings without an assignment 12 months after the meeting
Client files 10 years after the matter is closed (general limitation period)
Anti-money-laundering documentation 5 years after the business relationship ends (longer if an authority requires it)
Accounting records 7 years after the end of the calendar year (Bookkeeping Act)
Google Analytics data up to 14 months
Records of cookie choices 3 years
Cookies see our Cookie Policy

8. Your rights

You have the right to:

  • access your personal data;
  • have inaccurate data corrected;
  • have data erased;
  • restrict processing;
  • data portability;
  • object to processing based on our legitimate interest;
  • withdraw consent at any time.

Contact us to use these rights. We reply within one month and may ask you to confirm your identity. Some rights are limited by law. For example, we cannot erase data we are required to keep, or data needed to establish, exercise or defend legal claims.

9. Complaints

If you are dissatisfied with how we process your personal data, you can lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, www.imy.se. We would appreciate the chance to resolve the matter with you first.

10. Cookies

More information about the cookies we use, and the option to change your choice, is available in our Cookie Policy.

11. Security

We protect personal data with access controls, encrypted connections (HTTPS) and confidentiality in all our work. Only people who need the information for their work have access to it.

12. Children

Our website and services are not intended for children, and we do not knowingly collect children’s personal data through the website.

13. Changes to this policy

We may update this policy. The date at the top shows when it was last changed.