Privacy Policy
1. Who we are and what we collect
This site is run by Filip & Philip Digital AB, a digital studio registered in Sweden (organisationsnummer 559534-5082, registered address Gripsnäs Lillhem, 64731, Mariefred). When this policy says "we", that's us, and we're the data controller responsible for any personal data you share through this site. There are two kinds of data we handle. The first is what you give us directly: your name, email, company, project details, and anything else you share when you contact us, fill out a form, or hire us. The second is anonymous usage data we collect through Framer Analytics, which tells us things like page views and referral sources in aggregate without identifying anyone or using cookies.
2. How we use it and our legal basis
Under Article 6 of the GDPR, every use of personal data needs a legal reason. Ours are straightforward. We process the data you send us to reply to your messages and prepare proposals. That's our legitimate interest (Art. 6(1)(f)) and pre-contractual steps under Art. 6(1)(b). We process project data to deliver and manage the work you've hired us for, which is contract performance (Art. 6(1)(b)). And we process invoicing and accounting data because Swedish bookkeeping law requires us to (Art. 6(1)(c)). Our analytics tool, Framer Analytics, does not collect personal data at all, so no legal basis under the GDPR is needed for it. We don't use your data for profiling or automated decision-making. There's a human behind every reply.
3. Who we share it with
We don't sell your data. Ever. We do rely on a small set of trusted processors to run the business: Framer (hosting, forms, and analytics), Google Workspace/Gmail (email), and Fortnox (accounting and invoicing). Each one is bound by a data processing agreement and the GDPR, and only sees what they need to do their job. Framer processes data within the EU. Google and Fortnox process data within the EU/EEA. If any provider transfers data outside the EU/EEA, the transfer is protected by an adequacy decision, the EU-US Data Privacy Framework, or the European Commission's Standard Contractual Clauses under Article 46 of the GDPR. We may also share data when the law requires it, for example if Swedish tax authorities or a court ask us to.
4. Cookies & Tracking
This site uses a small number of cookies that are strictly necessary for it to function, such as load balancing and remembering your consent choices. These do not require consent under the Swedish Electronic Communications Act (Lag 2022:482). For analytics, we use Framer Analytics, which is entirely cookieless and does not track individuals. It collects only anonymous, aggregate data like page views and referral sources. If we ever embed third-party content (like video players or social media), those services may set their own cookies. Our cookie policy explains every category and how to manage your preferences.
5. Your Rights
Under the GDPR, you have a clear set of rights over your personal data. You can ask to see it (access, Art. 15), correct it if it's wrong (rectification, Art. 16), have it deleted (erasure, Art. 17), restrict how we use it (Art. 18), receive it in a portable format (Art. 20), and object to processing based on our legitimate interest (Art. 21). You can also withdraw any consent you've given at any time, and you have the right not to be subject to fully automated decisions. We don't make any. To exercise any of these rights, send us a message through the contact page and we'll respond within 30 days, free of charge. If you think we've mishandled your data, you can lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.
6. Security & retention
We take sensible, modern precautions to protect your data: encryption in transit (TLS), restricted access on a need-to-know basis, and trusted infrastructure providers. No system is bulletproof, but we treat your information the way we'd want ours treated. We only keep data for as long as we actually need it. Contact and project data is kept for the duration of our working relationship plus three years (in case of follow-up questions or warranty work). Accounting and invoicing records are kept for seven years, as required by the Swedish Bookkeeping Act (Bokforingslagen 1999:1078). Analytics data collected through Framer Analytics is anonymous and aggregated from the start, so it contains no personal data to retain or delete.
7. Changes & contact
As our tools and services evolve, this page may evolve with them. Whenever we make a meaningful change, we'll post the updated version right here with a new effective date. If anything's unclear, or you'd like to exercise one of your rights, get in touch through the contact page. We're happy to walk you through it.