Digilog Privacy Policy

1. Who we are

Digilog is provided by Digirocket AB, a company registered in Sweden with org. no. 559541-5554 ("Digilog", "we", "us"). This policy explains how we handle personal data when you visit our websites (digilogapp.com, digilog.se, digilog.dk, digilog.fi and our other Digilog websites), use the Digilog app at go.digilogapp.com, or receive documentation sent through it.

Questions about privacy, or requests to exercise your rights: info@digilog.se, or by post to Digirocket AB, Midsommarvägen 23, 126 35 Hägersten, Sweden. Please write "Privacy" in the subject line.

2. Our two roles

We handle personal data in two different roles, depending on whose data it is.

• As controller we decide how data is used for our websites, for the accounts of people who use Digilog, for invoicing our customers, and for sales and support. This policy covers that data in full.
• As processor we store data that our customers enter about their own work: installations, properties, their customers and contact persons, signatures, photos and fault reports. The customer (usually the installation or service company) is the controller of that data and decides what is recorded and for how long. We handle it only on the customer's instructions, under our data processing agreement. If your data appears in documentation a company created in Digilog, contact that company first; we will help them answer you.

Digilog is a business service. It is not intended for children, and we do not knowingly collect data about anyone under 16.

3. What we process and why

We do not sell personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.

4. Where data is stored and who we share it with

The platform and its database run on Microsoft Azure in Sweden (Sweden Central). The main suppliers we use to run Digilog are listed in Appendix A (Suppliers and sub-processors), which shows the date it was last updated. We may update Appendix A when we add or replace a supplier without otherwise revising this policy. Unless Appendix A says otherwise, each one processes data only on our instructions, under a data processing agreement.

We also exchange data with parties that are not our suppliers and decide for themselves how they handle it, such as public authorities and public registers. They are listed in Appendix B (Who we share data with). Some features pass data to a party you choose: for example when you send documentation to a recipient, or when you order through a reseller's web shop, in which case the order details go back to that reseller and its order-handling provider.

5. Transfers outside the EU/EEA

Our platform and database are hosted in Sweden. We keep other data in Sweden or elsewhere in the EU/EEA wherever we can. Some suppliers in Appendix A are US companies or may process data outside the EU/EEA. We transfer data there only when one of these safeguards applies:

• the European Commission has found that the recipient's country (such as the UK) gives adequate protection, or the recipient is certified under the EU–US Data Privacy Framework, which the Commission has also found adequate; or
• we have signed the European Commission's standard contractual clauses with the recipient, together with the additional measures they require.

You can ask us for a copy of the safeguards that apply to a transfer (see section 1).

6. How long we keep data

Where data must be deleted but a backup still holds it, the backup copy is removed when that backup expires.

7. Security

Data is encrypted in transit and at rest. The database is not reachable from the internet, access is limited to staff who need it, and every sign-in goes through Microsoft Entra. If a personal data breach puts your rights at risk, we tell the Swedish Authority for Privacy Protection (IMY) within 72 hours and inform you without undue delay.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• have incorrect data corrected;
• have data erased when we no longer need it or have no legal basis for it;
• restrict how we use your data while a question is being settled;
• data portability: receive data you gave us in a machine-readable format;
• object to processing based on our legitimate interest, and always to direct marketing;
• withdraw consent at any time, where we rely on consent.

Email info@digilog.se to use any of these rights. We answer within one month. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection, IMY, Box 8114, 104 20 Stockholm.

9. Cookies

Our websites and the platform use cookies. Our Cookie Policy lists each one, what it is for and how long it lasts.

10. Changes to this policy

We update this policy when our services or suppliers change. The date at the top shows the latest version. If a change significantly affects how we use your data, we tell users in Digilog or by email before it takes effect.

Appendix A: Suppliers and sub-processors

Last updated: 28 September 2026

This appendix lists the main suppliers we use to run Digilog, what they do for us and where they process data (see section 4). Unless stated otherwise below, each supplier processes data only on our instructions, under a data processing agreement.

Suppliers that also process personal data on our customers' behalf are listed as sub-processors in Appendix C of our Data Processing Agreement.

Appendix B: Who we share data with

Last updated: 28 September 2026

This appendix lists parties that are not our suppliers but that receive personal data from us, or provide it to us, and decide for themselves how they handle it (see section 4).

Swedish Tax Agency (Skatteverket): accounting and tax information, where the law requires it.

Statistics Sweden (SCB): when a Swedish customer enters its organisation number, we send the number to SCB and fetch the company's registered details, such as name and address.

The EU's VIES service (European Commission and national tax authorities): we send the VAT number a customer enters so that it can be verified.

Recipients you choose: when you send documentation through Digilog, the recipient receives the documentation together with the sender's name and contact details.

Resellers: when you order through a reseller's web shop, the order details go back to that reseller and its order-handling provider.