Last updated
Privacy policy
This policy describes how AB Buddleja processes personal data on the website bokstad.se and in the Bokstad service. Bokstad has not launched. The policy therefore covers both what we do today and how the service will process data when it launches. We will update it before the service opens.
1. Controller
AB Buddleja, Swedish company registration number 559399-6076, is the data controller. Questions about personal data go to privacy@bokstad.se.
2. The website today
2.1 Early-access registration
When you register interest we store:
- your email address
- the company name
- which bank the company uses, if you entered it
- the time of registration and the language you used on the page
The purpose is to contact you about early access to Bokstad. We use the bank field to decide which banks to build support for first. The legal basis is your consent (Article 6(1)(a) GDPR), given through the checkbox in the form. You can withdraw consent at any time by emailing privacy@bokstad.se; we then delete the data.
We do not use the address for newsletters or other marketing, and we do not share it with anyone. The data is deleted no later than twelve months after Bokstad launches, or earlier if you ask.
2.2 Technical operation
The website is served through Cloudflare. When you visit, Cloudflare processes your IP address and technical details of the request (time, page requested, browser) to deliver the page and protect it from attacks. The legal basis is our legitimate interest in running a secure website (Article 6(1)(f)). We use no web analytics and no tracking tools.
2.3 The 3:12 calculator
The calculator runs entirely in your browser. The figures you enter are not sent to us. If you copy a link to a calculation, the figures are in the link; anyone who receives the link can see them.
3. The Bokstad service, when it launches
3.1 Data we will process
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: name, email address, the company's registration number | Create and administer your account, invoice, provide support | Contract (Article 6(1)(b)) |
| Bank account and transaction data: account number, balance, transactions with amount, date, counterparty and text | Fetch source data for the bookkeeping | Your explicit consent to account access under PSD2 (Article 6(1)(a)); thereafter contract (Article 6(1)(b)) to keep the books |
| Accounting data: vouchers, invoices, salaries, tax returns, annual reports | Keep the books, prepare year-end accounts and returns, file with Bolagsverket and Skatteverket | Contract (Article 6(1)(b)) and legal obligation under the Swedish Accounting Act (Article 6(1)(c)) |
| Data about other people who appear in your books, such as employees, customers and suppliers | Keep the books | You are the controller for this data; we process it as a processor under a data processing agreement |
3.2 Bank data and open banking
Bokstad fetches transactions from the company's bank account using account information services under the Payment Services Directive (PSD2). It works like this:
- You choose to connect an account and approve access with your bank, in the bank's own login. We never see your credentials.
- Access goes through Enable Banking Oy (Finland), a registered account information service provider (AISP) supervised by the Finnish Financial Supervisory Authority, Finanssivalvonta. Enable Banking is reached through the open-banking.io platform, operated by Tatic ApS (Denmark).
- The consent lasts as long as the bank requires and must then be renewed by you. You can withdraw it at any time in Bokstad or with the bank.
We only fetch data from the accounts you chose to connect, and only transactions. We do not initiate payments.
3.3 Retention
Accounting data, including bank transactions that have become the basis for vouchers, is accounting records. Under the Swedish Accounting Act (bokföringslagen 1999:1078) such records must be kept until the end of the seventh year after the calendar year in which the financial year ended. We keep them that long, even if you close your account, unless you have exported them yourself and asked us to delete them.
Account data is kept as long as you have an account and for at most twelve months after that. Bank data that has not become part of the books is deleted when the bank connection is removed.
4. Processors
We use the following companies to process data on our behalf. Each is bound by a data processing agreement.
| Processor | Country | What they do |
|---|---|---|
| Cloudflare, Inc. | USA, with registrations stored in the EU (Western Europe) | Serves the website and stores early-access registrations. Transfers to the USA take place under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses. |
| Enable Banking Oy | Finland | Account information service: fetches bank transactions with your consent. |
| Tatic ApS (open-banking.io) | Denmark | Platform for connecting to Enable Banking. |
The list will be updated before the service launches if further processors are added, for example for email or invoicing.
5. Where the data is stored
Data is stored within the EU/EEA. If a processor needs to transfer data to a country outside the EU/EEA, this only happens under an adequacy decision or the European Commission's standard contractual clauses.
6. Who we share data with
We do not sell personal data and do not share it with anyone other than the processors above, authorities when the law requires it, and Bolagsverket and Skatteverket when you choose to file a document through Bokstad.
7. Your rights
You have the right to:
- know what data we hold about you and receive a copy
- have inaccurate data corrected
- have data deleted, where we are not required by law to keep it
- ask for processing to be restricted
- receive your data in a machine-readable format
- object to processing based on legitimate interest
- withdraw consent, without affecting processing before the withdrawal
Write to privacy@bokstad.se. We reply within a month. You also have the right to complain to the Swedish Authority for Privacy Protection, imy.se.
8. Cookies and local storage
The website sets no cookies. Your language choice is saved in the browser's local storage under the name bokstad-lang, so you get the same language next time. That is the only thing we store in your browser, and it is not sent to us.
9. Changes
We will update this policy when the service launches and whenever the processing changes. The date at the top shows when it was last changed. See also the terms.