Privacy Policy

1.1. This Privacy Policy explains how Ronja Technologies AB ("Ronja", "we", "us") collects, uses, shares, and protects personal data when you visit ronja.tech (the "Website"), request a demo, or subscribe to our communications (together, the "Website Services"), and when you use the Ronja data platform (the "Platform"). The Website Services and the Platform together are the "Services".

1.1a. The marketing and advertising purposes described in this Privacy Policy apply only to the Website Services. They never apply to data processed inside the Platform, or to data accessed from accounts you connect to the Platform. See Section 16 for how we handle data accessed from a connected Google account.

1.2. Ronja is the Data Controller for personal data processed through the Website and marketing activities. When you use the Ronja data platform under a customer agreement, Ronja acts as Data Processor on your organization's behalf; that processing is governed by the Data Processing Agreement.

1.3. We process personal data in accordance with Regulation (EU) 2016/679 (the "GDPR") and applicable Swedish data protection law.

Ronja Technologies AB (Org.nr 559471-4692)
Luntmakargatan 26, 111 37 Stockholm, Sweden
Email: hello@ronja.tech

For any question relating to this Privacy Policy or the processing of your personal data, please contact us at the email address above.

3.1. Data you provide to us. When you contact us through the Website, we collect the information you submit: your full name, business email address, company size, and the content of your message.

3.2. Data collected automatically. The Website and its service providers may process technical and usage data, including:

• IP address and approximate location derived from it
• Browser type, device information, operating system, and language preferences
• Page path, referring domain, session duration, and permitted campaign parameters
• Privacy choices and identifiers stored in cookies or similar technologies, including Google Analytics and LinkedIn identifiers while the relevant category is active
• While Measurement is active, a random session journey identifier plus page, section, scroll, engagement, link, action, and form-result events

Ronja does not send the text you type into forms, contact details, click coordinates, or arbitrary URL query parameters to its Website analytics.

Measurement and Marketing Trackers are active when you first visit the Website. You can disable either category independently in the privacy preferences panel. A saved opt-out is applied on later visits before the corresponding service starts. Disabling a category stops future events sent by Ronja's Website code and removes accessible first-party cookies for that category. It cannot undo data already transmitted or remove cookies that a provider stores on its own domain.

3.3. Platform account data. If you register for a Ronja account, we process the data required to create and administer the account, including name, business email, company, authentication credentials, workspace role, and activity logs.

3.4. Customer Data inside the platform. Data that customers connect to or upload into the Ronja platform is processed on the customer's instructions under the Data Processing Agreement and is not governed by this Privacy Policy.

4.1. We process personal data relating to the Website Services for the following purposes:

• To operate, maintain, and secure the Website
• To respond to demo requests, sales enquiries, and support messages
• To send product updates, newsletters, and other direct marketing communications (see Section 5.2 for the legal basis and your rights)
• To understand journeys through the Website and measure which content and actions are useful, unless you disable Measurement
• To deliver and measure online advertising, including on LinkedIn, unless you disable Marketing

4.2. We process personal data relating to the Platform for the following purposes only:

• To operate, maintain, and secure the Platform
• To provide the features you request, including processing data from accounts you connect to the Platform
• To provision and administer customer accounts and billing
• To comply with legal, tax, and regulatory obligations

4.3. We do not use Platform data, or data accessed from accounts you connect to the Platform, for advertising, marketing, profiling, or for training or improving any machine learning or artificial intelligence model.

5.1. We rely on the following legal bases under Article 6 of the GDPR:

• Consent (Art. 6(1)(a)) where consent is required by law, including direct marketing communications where you actively opt in (see Section 5.2). These purposes do not apply to the Platform.
• Contract (Art. 6(1)(b)) to provide the Services you request and to administer your account.
• Legal obligation (Art. 6(1)(c)) to comply with tax, accounting, and other statutory duties.
• Legitimate interests (Art. 6(1)(f)) to secure the Website and the Platform, prevent abuse, respond to your enquiries, understand Website use, measure business-to-business advertising, and carry out direct marketing to business contacts and prospects on the Website Services (see Section 5.2). We balance these interests against your rights and freedoms.

5.2. Direct marketing. We send product updates, newsletters, and other direct marketing communications under two legal bases: (i) your consent under Art. 6(1)(a) GDPR, where you have actively opted in via a checkbox on a form on the Website; and (ii) our legitimate interests under Art. 6(1)(f) GDPR, to communicate with business contacts and prospects who have engaged with Ronja in a professional capacity (for example, by submitting a form on the Website, requesting a demo, or attending an event), where this is consistent with their reasonable expectations as professionals in our target market. You have the right to object to direct marketing at any time, without giving reasons (Art. 21(2) GDPR), and the right to withdraw consent at any time. To exercise either right, click the unsubscribe link in any marketing email or contact us at hello@ronja.tech. Withdrawal or objection takes effect immediately and does not affect the lawfulness of processing carried out before that point.

5.3. Website measurement and advertising controls. Google Analytics Measurement and LinkedIn Marketing are active on a first visit. You can disable or re-enable either category independently at any time in the Website's privacy preferences panel. An opt-out applies to future collection from Ronja's Website code. Where applicable law requires consent for a particular Tracker or processing activity, we rely on consent for that activity.

5.4. You may withdraw consent for any other purpose by contacting us at hello@ronja.tech.

6.1. The Website uses cookies and similar technologies for strictly necessary functionality, analytics, and advertising. Strictly necessary Trackers are always active. Google Analytics Measurement and LinkedIn Marketing Trackers are active when you first visit the Website.

6.2. You can disable or re-enable Measurement and Marketing independently at any time through the privacy preferences panel. A saved opt-out is applied on later visits before that category starts. Disabling a category stops future events sent by Ronja's Website code and removes accessible first-party cookies for that category, but it cannot undo data already transmitted or remove cookies stored on a provider's own domain.

6.3. You can also block or delete cookies through your browser settings; doing so may affect the functionality of the Website. The categories of cookies and Trackers used correspond to the third-party services listed in Annex 1.

7.1. We share personal data only as described in this Privacy Policy. Categories of recipients include:

• Service providers that host, operate, analyze, and secure the Website and the platform, acting as processors on our behalf (see Section 8).
• Professional advisors such as auditors, accountants, and lawyers, under confidentiality obligations.
• Authorities where disclosure is required by law, court order, or to protect our legal rights.
• Corporate transactions such as a merger, acquisition, or asset sale, subject to appropriate confidentiality protections.

7.2. We do not sell personal data.

7.3. Third parties that receive data as processors are bound by written agreements that are no less protective than this Privacy Policy and that meet the requirements of Article 28 of the GDPR.

8.1. The table in Annex 1 lists the third-party services used on the Website and the categories of personal data processed through each. Sub-processors used to provide the Ronja data platform itself are listed in Annex 3 of the Data Processing Agreement.

8.2. Each listed provider processes personal data in accordance with its own privacy policy, which we encourage you to review.

9.1. Website hosting and core infrastructure are configured in Amazon Web Services EU regions. Content delivery may process network request data at edge locations outside the EU/EEA.

9.2. Some Website service providers, including Google, LinkedIn, HubSpot, and iubenda, are established in, or may transfer personal data to, countries outside the EU/EEA, including the United States. Where such transfers occur, they are protected by appropriate safeguards under Chapter V of the GDPR, including Standard Contractual Clauses adopted by the European Commission and, where applicable, reliance on the EU–US Data Privacy Framework.

9.3. A copy of the safeguards used for any specific transfer is available on request by contacting hello@ronja.tech.

10.1. We retain personal data only for as long as necessary for the purposes described in this Privacy Policy and to comply with our legal obligations.

10.2. Typical retention periods:

• Demo and contact form submissions: up to 24 months from the last contact, unless a longer commercial relationship develops.
• Marketing email subscriptions: until you unsubscribe or we determine the subscription is inactive, after which your data is deleted or anonymized.
• Analytics data: up to 14 months in Google Analytics 4 and aggregated thereafter.
• Advertising identifiers: according to the retention settings of the advertising provider (typically up to 180 days for LinkedIn Insight Tag).
• Server and security logs: up to 12 months.
• Account data for active customers: for the duration of the customer agreement, subject to the Data Processing Agreement.
• Accounting and tax records: 7 years as required by Swedish law (Bokföringslagen).

11.1. Subject to applicable law, you have the following rights in relation to your personal data:

• Access to the personal data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate or incomplete data (Art. 16)
• Erasure of your data where one of the grounds in Article 17 applies
• Restriction of processing (Art. 18)
• Portability of data you have provided to us (Art. 20)
• Objection to processing based on our legitimate interests, including direct marketing (Art. 21)
• Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal
• Not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22)

11.2. To exercise any of these rights, email hello@ronja.tech. We will respond within one month in accordance with Article 12 of the GDPR.

11.3. You also have the right to lodge a complaint with a supervisory authority. The lead authority for Ronja is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, Sweden, imy@imy.se, www.imy.se.

12.1. We implement technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration, and disclosure. These include encryption in transit and at rest, role-based access controls, multi-factor authentication for personnel, network segmentation, centralized logging, and regular vulnerability testing.

12.2. Further detail on the security measures applied to Customer Data processed through the platform is set out in Annex 2 of the Data Processing Agreement.

We do not use personal data collected through the Website to make decisions based solely on automated processing that produce legal or similarly significant effects concerning you.

The Services are directed to businesses and professionals and are not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact hello@ronja.tech and we will delete it without undue delay.

We may update this Privacy Policy from time to time to reflect changes in our practices, our Services, or applicable law. We will post the updated version on this page and revise the "Last updated" date above. Material changes affecting registered users will be communicated by email or through the Services at least 30 days before they take effect.

16.1. Access. When you connect a Google account to the Platform, Ronja accesses only the data covered by the permissions you grant at that moment. Depending on which services you connect, this may include Google Analytics reports, Google Ads campaign and spend data, Search Console performance data, Google Sheets contents, Google Calendar events, Google Drive file metadata and contents, and Gmail message metadata and contents. Permissions are requested only when you connect the service that needs them; a user who connects only read-only services is never asked for write access.

16.2. Use. We use Google user data only to provide the features you request inside the Platform. We do not use it for advertising, marketing, profiling, credit assessment, or any purpose other than providing and improving the user-facing features you are using it for.

16.3. Sharing. We do not sell Google user data and we do not share it with data brokers. To answer your requests, relevant content is processed by Amazon Bedrock, operated by Amazon Web Services, under terms that prohibit the use of that content to train or improve any model. We do not use Google user data to create, train, or improve any machine learning or artificial intelligence model. We do not otherwise transfer Google user data except where necessary to provide the features you request, to comply with applicable law, or as part of a merger or acquisition with your prior consent.

16.4. Protection. Google user data is protected by the measures described in Section 12, including encryption in transit and at rest, role-based access controls, multi-factor authentication for personnel, network segmentation, centralized logging, and regular vulnerability testing.

16.5. Retention and deletion. Google user data is stored within your workspace and is deleted when you disconnect the Google account or delete the workspace. You can disconnect a connected account at any time from the integrations page in the Platform, and you can revoke Ronja's access at any time from your Google account permissions page at myaccount.google.com/permissions.

16.6. Ronja's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

Questions, requests, or complaints about this Privacy Policy can be directed to:

Ronja Technologies AB
Luntmakargatan 26, 111 37 Stockholm, Sweden
Email: hello@ronja.tech

Last updated: August 2026

Advertising

Service	Purpose	Personal data	Provider
LinkedIn Insight Tag	Advertising measurement, conversion tracking, and retargeting while Marketing is active; Marketing can be disabled in the privacy preferences panel	IP address; browser and device information; page and event identifiers; advertising identifiers; Trackers; Usage Data	LinkedIn Ireland Unlimited Company (Ireland)

Analytics

Service	Purpose	Personal data	Provider
Google Analytics 4	Website journey and usage measurement while Measurement is active; Measurement can be disabled in the privacy preferences panel	IP-derived location; browser and device information; referring domain; permitted campaign parameters; random session journey identifier; page, section, scroll, engagement, link, action, and form-result events; Trackers; Usage Data	Google Ireland Limited (Ireland)

Privacy preferences

Service	Purpose	Personal data	Provider
iubenda Privacy Controls and Cookie Solution	Collection and storage of privacy preferences and consent records	Consent choice; IP address; timestamp; Trackers	iubenda s.r.l. (Italy)

Customer relationship management

Service	Purpose	Personal data	Provider
HubSpot	Receipt and storage of Website form submissions, contact management, and follow-up communications	Full name; business email address; company size; message content; page URL and title; submission timestamp; HubSpot cookie identifier when available	HubSpot Ireland Limited (Ireland); EU data region

Hosting and infrastructure

Service	Purpose	Personal data	Provider
Amazon Web Services	Website hosting, object storage, and content delivery	IP address; browser, device, and network information; request metadata; Usage Data	Amazon Web Services EMEA SARL (Luxembourg)

We share personal data only with providers that are bound by applicable data protection requirements. Further information on each provider's processing is available in its own privacy policy.