1. In short
This text is for you as a person in the EU or EEA: a visitor to taktbygg.se, a person who creates an account directly with us, and a contact person at a customer company in the EU or EEA. It does not cover people in the United Kingdom or Switzerland, which have their own data protection rules. Frontier Solutions is established in Sweden.
Frontier is the controller for visits, an account created directly with us, the contract, the invoice and email sent to us. We use the data to show the website, remember the language and the selected project, create the account, send confirmation and password reset, invoice and reply. Storage in the browser is used for those functions. There is no analytics or marketing storage.
When a customer company uses Taktbygg for its projects, the company is the controller for the project data and for users the company invites. Frontier then processes that data on the company's instructions. That processing is described in the data processing agreement.
2. Who is responsible
| Controller | Mikael Persson, who carries on a sole trader business under the name Frontier Solutions. Taktbygg is the product name. |
|---|---|
| Address | Myrbacksgatan 27c, 703 81 Örebro, Sweden |
| Website | https://www.taktbygg.se |
| Contact for personal data | mikaelperssonx@outlook.com |
| Support | support@taktbygg.com |
| Data protection officer | No data protection officer has been appointed. |
3. Two roles
3.1 Frontier is the controller
This covers visits to the website, an account you create with us yourself, our contract and our invoicing, and email you send to us. The legal basis, recipients and periods are in section 4. Article 6.1 b is used only when you yourself are the contracting party or you yourself ask us to take a step before a contract with you. For an employee or other contact person at a customer company, the basis is legitimate interest, Article 6.1 f.
3.2 The customer is the controller
This covers projects, schedules, files, staffing and users the customer invites. Frontier is the processor. The customer decides the purposes and legal basis and must inform its users. An invited user turns to their employer or client for access, rectification and erasure of that data. Frontier helps the customer carry out the request.
4. Processing for which Frontier is the controller
| Purpose | Data | Legal basis | Recipient | Storage |
|---|---|---|---|---|
| Show the website and protect it against misuse | IP address, browser type, requested address and time | Legitimate interest (Article 6.1 f). The interest is an available and secure website. The log is not used for marketing or profiling. | Vercel Inc., which operates the website. The function runs in Stockholm. The request may first be received at another point of presence. | Vercel runtime log: 1 day on the current Pro subscription without Observability Plus. |
| Remember the selected language | Cookie NEXT_LOCALE with a language code (sv, en or no) |
Legitimate interest (Article 6.1 f): to show the website in the selected language. The cookie is needed for that function. | Stored in your browser. Sent to Vercel when you load a page. | Session cookie with no expiry date. The browser removes it when the browser is closed. Checked against www.taktbygg.se on 21 September 2026. |
| Create and keep an account you register with us | Name, email and organisation name. Phone number and organisation number if you fill them in. Passwords are stored hashed, not in plain text. | Contract or steps before a contract (Article 6.1 b) when you yourself are the contracting party or you yourself ask us to create the account. Name, email, organisation name and password are required. Without them, no account is created. Phone and organisation number are optional. If you register the account for a company and are not yourself the contracting party, the basis is instead legitimate interest (Article 6.1 f): to give the company access and keep the account secure. | Supabase Pte. Ltd. Database and sign-in in Stockholm (eu-north-1). Vercel Inc. when the account pages run. | For as long as the account is open. After a request to close it, the account data is deleted within 30 days. Where a customer contract then applies and the customer is the controller, deletion follows that contract. Accounting records follow the accounting row. |
| Send account confirmation and password reset | Email address and the content of the message | The same basis as the account row. You yourself ask for the message when you register or ask for a new password. | Supabase Auth sends the message through Resend (Plus Five Five, Inc., SMTP). Sending from Ireland, storage in the USA according to Resend. | Supabase sends the message. We do not keep our own copy of the message. The email address remains with the account. |
| Keep the sign-in, selected project and choices in the browser | A cookie whose name starts with sb- and ends with auth-token. Cookie ttp-selected-project-id. In browser storage: ttp:selectedProjectId, enhanced-theme, pwa-install-dismissed and, for the life of the tab, __pwa_kill_reload_done. |
Legitimate interest (Article 6.1 f): to keep the sign-in, project, appearance and install prompt you have chosen, and to stop the page reloading in a loop. Where a customer company is the controller for use of the service, the same data is also processed on that company's instructions. | The browser. On requests, Supabase and Vercel respectively. | The sign-in cookie remains until you sign out. Supabase may also limit the session. Such a limit is not confirmed in production, so this text assumes the session lasts until sign-out. The access token is renewed at roughly one-hour intervals in the local configuration. The project cookie lasts at most 180 days. The project id in browser storage remains until you change project or clear the site data. Theme and a dismissed install prompt remain in the same way. The sessionStorage flag disappears when the tab is closed. |
| Contract, invoice and accounting | The contact person's name and email, organisation, invoice address and the payment details needed for the invoice | Legitimate interest (Article 6.1 f): to administer the contract with the customer company and send the invoice to the contact person the company has named. If you yourself are the contracting party, contract (Article 6.1 b) applies to invoicing you. Legal obligation (Article 6.1 c) to keep accounting records under the Swedish Bookkeeping Act (1999:1078), Chapter 7, Section 2. | Bokio Group AB, Sweden, stores the accounting records on Microsoft Azure in Ireland, the Netherlands and Sweden. The invoice is sent to the address the customer company has given. | Accounting records are kept until the end of the seventh year after the calendar year in which the financial year ended. Other contract correspondence is kept during the contract term and then for ten years, the general limitation period for claims between traders under the Swedish Limitations Act (1981:130), Section 2. |
| Reply to email sent to us | Sender, address and what you write | Legitimate interest (Article 6.1 f): to reply to the person who writes. If you yourself ask for a contract with you, steps before a contract apply (Article 6.1 b). | Email to support@taktbygg.com is received by Cloudflare, Inc. and forwarded to mikaelperssonx@outlook.com. Cloudflare states that the content is not stored by them. The mailbox is an ordinary Outlook.com account. The contracting party is Microsoft Ireland Operations Limited. Microsoft states that the data may be stored in the user's region, in the United States, or in another country where Microsoft operates. | Email that belongs to a contract or to accounting follows the row above. Other email is deleted no later than 24 months after the matter is closed. |
We do not use the data in this section to train models, for advertising, or for automated decisions that have legal or similarly significant effects for you.
5. Data we receive from the customer company
When a customer company names a contact person, we receive name, email and role from the company. The purpose is the contract, the invoice and replies to email, on the basis and for the periods in section 4. We provide this information no later than in the first email to the person. The customer company also informs its contact persons. Users the company invites into a project are covered by section 3.2.
6. Cookies and browser storage
The website stores only what is needed for language, sign-in, the selected project, the selected appearance, a dismissed install prompt, and to prevent a reload loop. There is no analytics, advertising or tracking storage. No consent banner is therefore shown. Such a banner is used if storage that is not needed for a requested function is added.
| Storage | What it does | When it is set | Period |
|---|---|---|---|
| Cookie NEXT_LOCALE | Stores sv, en or no | When the page is loaded | Until the browser is closed |
| Cookie sb-…-auth-token | Keeps the sign-in | When you sign in | Until you sign out, unless Supabase has a shorter session limit |
| Cookie ttp-selected-project-id | Remembers the selected project | When you select a project after sign-in | At most 180 days |
| localStorage ttp:selectedProjectId | The same project id | When you select a project | Until you change project or clear the site data |
| localStorage enhanced-theme | Stores light or dark appearance | When the appearance is stored | Until you clear the site data |
| localStorage pwa-install-dismissed | Remembers that the install prompt was dismissed | When you dismiss the prompt | Until you clear the site data |
| sessionStorage __pwa_kill_reload_done | Prevents a reload loop | When the page needs the flag | Until the tab is closed |
7. Recipients and countries
The recipients are those named for each purpose in section 4. We do not disclose data under an open category such as "partners" or "third parties".
- Vercel Inc. (United States). Operation of the website. Execution in Stockholm. The contract with Vercel contains the EU standard contractual clauses. Vercel also states that the company is certified under the EU–US Data Privacy Framework. That statement is the supplier's own and has not been checked in the official register in this text.
- Supabase Pte. Ltd. (Singapore). Account, sign-in, and confirmation and reset email, with the account stored in Stockholm. Singapore has no adequacy decision. The safeguard is the standard contractual clauses in Supabase's processor terms. Access by staff outside the EU/EEA can be a transfer even when the data is stored in Sweden.
- Cloudflare, Inc. (United States). Forwards email to support@taktbygg.com to the Outlook address. Cloudflare states that the email content is not stored by them. Cloudflare, Inc. is registered under the EU–US Data Privacy Framework with the status Active – Re-certification under Review, checked in the official register on 23 September 2026. Cloudflare also states that standard contractual clauses apply if the certification lapses.
- Microsoft Ireland Operations Limited (Ireland). Contracting party for the mailbox mikaelperssonx@outlook.com. It is an ordinary Outlook.com account. Microsoft's EU Data Boundary for Microsoft 365 does not apply to that account. Microsoft states in its privacy statement that personal data may be stored in the user's region, in the United States and in other countries where Microsoft operates, and that a transfer from the EEA may take place under standard contractual clauses. Microsoft Corporation is registered under the EU–US Data Privacy Framework with the status Active – Re-certification under Review, checked in the official register on 23 September 2026.
- Bokio Group AB (Sweden). Stores accounting records, including name and email on the invoice. Bokio is the processor for the bookkeeping Frontier enters. According to Visma's Trust Centre for Bokio SE, updated on 23 September 2026, the service runs on Microsoft Azure in Ireland, the Netherlands and Sweden. The processor agreement allows subprocessors outside the EU/EEA with safeguards under the GDPR.
You can ask for a copy of the safeguards that apply to a transfer by writing to mikaelperssonx@outlook.com. Trade secrets in the contract text may be masked.
Service email that Taktbygg sends about a customer project, for example an invitation, is sent on the customer's instructions. Recipients and countries for that processing are in the data processing agreement, not here.
8. Your rights
Where Frontier is the controller, you can ask for:
- access to the data and a copy
- rectification of inaccurate data
- erasure, when the data is no longer needed or the processing has no basis
- restriction while an objection or rectification is considered
- objection to processing based on legitimate interest
- data portability for data you yourself have provided and that we process under a contract with you
Objection applies to processing based on legitimate interest. We then stop the processing, unless we can show compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims. Data portability does not apply to processing based only on legitimate interest or a legal obligation.
Write to mikaelperssonx@outlook.com. We reply within one month. A complex matter can take longer. We then tell you within the first month. The request is free of charge. We may ask for the information needed to see that the request comes from you.
Erasure does not apply to accounting records that the Swedish Bookkeeping Act requires us to keep. For data where the customer is the controller, we forward the request to the customer, or ask you to contact the customer directly.
9. Complaints
You can complain to the Swedish Authority for Privacy Protection, imy.se, or to the supervisory authority in the EU or EEA country where you live, work, or where the alleged infringement took place.
10. Changes
The date and version number above change when the text changes. A change of purpose, recipient, country or storage period is written into the table in section 4. Customers with a contract are told about a change that affects them. Visitors without an account see the new text on the website when it is published.