1. Data Controller

The data controller responsible for your personal data is:

2. Personal Data We Collect

We collect personal data only when you actively provide it — specifically when you submit the contact form on our website. Data collected includes:

• Contact details: Full name, email address
• Professional details: Company or organisation name, type of engineering service required
• Project information: Free-text project description and any details you choose to share

We do not collect payment card data, government identification numbers, health data, biometric data, or any other special-category personal data as defined by GDPR Article 9. We do not knowingly collect data from individuals under the age of 16.

Technical data (IP addresses, browser request headers) may be incidentally logged by third-party services used to deliver this website — see Section 10.

3. How We Use Your Data

We use the personal data you provide solely to:

• Respond to your enquiry about our engineering services
• Assess whether your project aligns with our capabilities and availability
• Prepare and deliver project proposals or quotations
• Fulfil a project agreement, if entered into
• Comply with legal obligations (e.g., accounting records under Swedish law)

We will not use your data for unsolicited marketing communications without your explicit prior consent.

4. Legal Basis for Processing (GDPR)

Processing of your personal data is based on one or more of the following legal grounds:

• Article 6(1)(b): Processing necessary to take steps at your request prior to entering a contract — responding to your project enquiry.
• Article 6(1)(f): Our legitimate interest in receiving and responding to business enquiries. We have assessed that this interest does not override your fundamental rights and freedoms.
• Article 6(1)(c): Compliance with a legal obligation (e.g., Swedish Bokföringslagen — accounting retention requirements).
• Article 6(1)(a): Your consent, where explicitly given (e.g., for follow-up communications).

5. Data Retention

• Enquiry data (no project contract follows): Deleted within 3 years of last contact, or sooner upon your request.
• Project data (where a contract is entered): Retained for the duration of the project plus 7 years, in accordance with the Swedish Bookkeeping Act (Bokföringslagen 1999:1078).
• Language preference: Stored in your browser's localStorage. We never access this server-side. It persists until you clear your browser storage.

You may request deletion at any time under your rights in Section 8, subject to legal retention obligations.

6. Data Sharing

We do not sell, rent, or trade your personal data. We do not share your data with third parties for marketing purposes.

We may share personal data in the following limited circumstances only:

• Service providers: Email hosting or secure cloud storage providers used by Structura Nordic AB — bound by data processing agreements and permitted to use your data only to provide services to us.
• Legal requirements: If required by applicable law, a court order, or to protect the rights, property, or safety of Structura Nordic AB or others.
• Joint venture partners: Where a project is delivered in collaboration with a trusted engineering partner, only the minimum project-related data strictly necessary will be shared, and only with your knowledge.

7. International Data Transfers

Your personal data is primarily stored and processed within the European Economic Area (EEA). If any processing occurs outside the EEA — for example, if a cloud service provider operates servers outside Europe — we ensure appropriate safeguards are in place pursuant to GDPR Chapter V, such as Standard Contractual Clauses (SCCs) adopted by the European Commission, or adequacy decisions.

8. Your Rights Under GDPR

As a data subject, you have the following rights under GDPR Chapter III:

• Right of access (Art. 15): Obtain confirmation of whether we process your data and receive a copy of it.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
• Right to erasure (Art. 17): Request deletion of your personal data — the "right to be forgotten" — subject to legal retention obligations.
• Right to restriction (Art. 18): Request that we restrict processing of your data in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to object (Art. 21): Object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any right, contact us at info@structuranordic.se. We will respond within 30 days as required by GDPR Article 12.

You also have the right to lodge a complaint with the Swedish supervisory authority:

9. Cookies & Local Storage

What We Store

This website uses browser localStorage (not traditional HTTP cookies) to store two values:

What We Do Not Use

We do not use analytics cookies, advertising cookies, retargeting pixels, social media tracking, or session fingerprinting of any kind.

Managing Your Preferences

Clear localStorage at any time via your browser's developer tools or settings (Storage → Local Storage → delete entries for this site). To reset your consent choice, clear the sn-cookie-consent key — the cookie notice will reappear on your next visit.

10. Third-Party Services

This website loads resources from the following providers to deliver its design and functionality. These are technically necessary for the site to work as intended:

We have no control over the data practices of these providers. Please review their privacy policies for full details. These services are loaded as part of delivering the website and fall within the "strictly necessary" technical category.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or destruction, in line with GDPR Article 32. Measures include:

• Restricting access to personal data to authorised personnel only (in practice, Premchand Potdar as the sole director)
• Using encrypted and secure communication channels for all data transmission
• Regular review of information security practices

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the supervisory authority (IMY) within 72 hours and inform affected individuals without undue delay, as required by GDPR Articles 33–34.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. The current version is always available on this page, with the effective date displayed at the top. Where changes are material, we will make reasonable efforts to provide notice (e.g., a banner on the website).

Continued use of our website following any update constitutes acceptance of the revised policy.

13. Contact Us & Lodge a Complaint

For questions about this Privacy Policy, to exercise your data rights, or to report a concern:

If you are not satisfied with our response, you have the right to lodge a complaint with the Integritetsskyddsmyndigheten (IMY) — the Swedish Data Protection Authority — at www.imy.se.