Privacy Policy New
Version: 2026-10-19 Previous version: 2024-03-25
1. About this policy
This policy describes how Elastx AB processes personal data where we ourselves determine the purposes and means of the processing, that is, where Elastx is the controller. It applies to you if you are a contact person at a customer, supplier, or partner, a prospective customer, a user of our services, a visitor to our website, present in our data center space, or otherwise in contact with us.
This policy does not cover personal data that our customers store and process on the Elastx Cloud Platform. For that data, Elastx is a processor, see section 9.
2. Controller and contact details
Elastx AB Corporate identity number: 556906-5617 c/o Convendum, Kungsgatan 9, SE-111 43 Stockholm, Sweden
Send questions about data protection and requests to exercise your rights to gdpr@elastx.se.
Elastx has not appointed a data protection officer under Article 37 of the General Data Protection Regulation (GDPR), as we are not required to do so. Data protection matters are handled by an internally designated data protection lead.
3. What personal data we process, why, and on what legal basis
The table below shows, for each category of data subjects, what data we process, for what purpose, on which legal basis under Article 6(1) GDPR, and for how long the data is retained.
| Data subjects and personal data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Contact persons at customers (contractual, technical, billing) Name, role, organization, email, phone | Managing the customer relationship, delivering the services, providing operational information and support | Legitimate interest (Art. 6(1)(f)). If the customer is a sole trader: contract (Art. 6(1)(b)) | For the duration of the customer relationship. Data is updated or deleted when we learn that you no longer hold the role. Deleted no later than 24 months after the customer relationship ends. |
| Users of the customer portal, cloud platform, and support system Name, email, user ID, ticket history | Providing access and handling support tickets | Legitimate interest (Art. 6(1)(f)) | Account: for the duration of the customer relationship. Tickets: 24 months after the ticket is closed. |
| Users of our services and visitors to our website (security logs) IP address, timestamps, user agent, login events, request details, event metadata, including web server logs for elastx.se | Detecting, investigating, and preventing security incidents, attacks, and abuse | Legitimate interest (Art. 6(1)(f)) | 90 days, unless a longer period is necessary for an ongoing security investigation. |
| Customers, suppliers, and partners (billing) Names and contact details in invoices and accounting records | Accounting and invoicing | Legal obligation (Art. 6(1)(c), Swedish Accounting Act 1999:1078) | Seven years after the end of the calendar year in which the financial year ended. |
| Prospective customers Name, role, organization, email, phone, notes from meetings, trade fairs, and conferences | Business contact and follow-up | Legitimate interest (Art. 6(1)(f)) | 24 months after the most recent contact. |
| Recipients of newsletters and invitations Name, email, organization | Information about our services, events, and webinars | Legitimate interest (Art. 6(1)(f)) | Until you unsubscribe, and no longer than 24 months after the most recent contact or the end of the customer relationship. |
| Contact persons at suppliers and partners Name, role, organization, email, phone | Managing the supplier or partner relationship | Legitimate interest (Art. 6(1)(f)) | For the duration of the contractual relationship and no longer than 24 months thereafter. |
| Individuals present in our data center space, for example technicians from the colocation provider Images and video footage | Preventing and investigating crime, protecting equipment and customer data | Legitimate interest (Art. 6(1)(f)) | 14 days. See also on-site signage. |
| Visitors to elastx.se IP address, device and browser information, visit statistics | Web analytics to improve the website | Consent (Art. 6(1)(a) and the Swedish Electronic Communications Act) | See section 8. |
| All of the above, in case of disputes or legal claims Data relevant to the specific case | Establishing, exercising, or defending legal claims | Legitimate interest (Art. 6(1)(f)) | For as long as the claim is ongoing. |
About legitimate interest: Where we rely on legitimate interest, we have carried out a balancing test and concluded that our interest in running, securing, and following up on our business outweighs the impact on your privacy, in part because the data is limited and relates to your professional role or your use of our services. You can request more information about the balancing test using the contact address in section 2.
Employees and job applicants: For job candidates, the purpose is to evaluate your application and to conduct mandatory background and citizenship controls via our approved external screening provider. For employees this means Elastx needs the data to pay salaries, pay invoices, pay taxes and fees, contact the correct representatives, and so on.
4. Where the data comes from
In most cases, you provide the data yourself. Contact details for contact persons at customers, suppliers, and partners may also be provided by your employer. Data about prospective customers may come from meetings and events, business cards, or public sources such as company websites. Security logs and video footage are generated when you use our services, visit our website, or are present in our data center space.
You are not required to provide personal data to us. However, without contact details for designated persons, we cannot deliver the services or handle support tickets.
5. Who we share the data with
We never sell personal data. Data may be shared with:
- Suppliers that process data on our behalf (processors), for example for email, customer records, the support system, finance, and web analytics. They may only process the data according to our instructions and under data processing agreements.
- Auditors and advisors bound by confidentiality.
- Public authorities when required by law, for example the Swedish Tax Agency, the Swedish Authority for Privacy Protection (IMY), the Swedish Civil Defence Agency (MCF) in connection with incident reporting, or the Swedish Police Authority.
- A buyer or acquiring company in the event of a transfer of all or part of the business.
6. Transfers outside the EU/EEA
Personal data is primarily processed within the EU/EEA. Some of our suppliers, including for email and the support system, are established in the United States or use subcontractors there. Transfers outside the EU/EEA take place only on the basis of an adequacy decision by the European Commission, such as for the EU-U.S. Data Privacy Framework, or the European Commission's standard contractual clauses supplemented by any necessary safeguards. You can request information about the applicable safeguards using the contact address in section 2.
7. Your rights
You have the right to:
- access the personal data we process about you,
- have inaccurate data rectified,
- have data erased, for example when it is no longer needed for its purpose. However, we may need to retain data that is subject to legal requirements, such as the Swedish Accounting Act,
- request restriction of processing, for example while we verify whether the data is accurate,
- object to processing based on legitimate interest. If you object to direct marketing, we will always stop that processing,
- receive data you have provided in a structured, machine-readable format (data portability), where the processing is based on consent or contract,
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
You can unsubscribe from mailings at any time using the link in each email. However, operational information necessary for the service is sent to designated contact persons for as long as the customer relationship continues.
Contact us using the address in section 2. We will respond without undue delay and no later than within one month. We may need to verify your identity before disclosing any data.
We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
Complaints: If you believe that we are processing your personal data incorrectly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), Box 8114, SE-104 20 Stockholm, Sweden, www.imy.se. Feel free to contact us first, and we will try to resolve the matter.
8. Cookies and web analytics
A cookie is a small text file stored in your browser when you visit a website. Cookies often contain a unique identifier. Such an identifier may, alone or combined with other data, constitute personal data.
Strictly necessary cookies are used for the website to function, for example to remember your cookie preferences. They do not require consent.
Analytics cookies are used to understand how the website is used. We use Piwik Pro for web analytics. Analytics data is stored on servers in Elastx's own data centers. Analytics cookies are set only if you actively accept them in the cookie banner. If you make no choice, no analytics cookies are set. Analytics cookies have a lifetime of 12 months..
You can change or withdraw your consent at any time by clicking the cookie icon in the lower left corner of the website. You can also delete cookies in your browser settings.
9. When Elastx is a processor
When our customers use the Elastx Cloud Platform to store or process personal data, the customer is the controller and Elastx is the processor. In that case, we process the data only according to the customer's instructions and the data processing agreement entered into with the customer. We do not access the content of customer environments beyond what is required to deliver the service.
This does not apply to logs that we process for the security of our own services and infrastructure. For those logs, Elastx is the controller, as described in section 3.
If you are a user of a service running on the Elastx Cloud Platform, please contact the organization providing that service with questions about your personal data.
More information about security, certifications, and sub-processors is available in our Trust Center.
10. How we protect the data
Elastx is certified under ISO/IEC 27001, 27017, and 27018. We protect personal data with technical and organizational measures, including access control based on the principle of least privilege, encryption, logging, and regular reviews. If a personal data breach occurs, we handle and report it in accordance with our procedures and applicable law.
11. Changes to this policy
We review this policy at least once a year and whenever there are material changes to our processing. The current version and date are shown at the top. Previous versions are archived and no longer apply.