Privacy policy.
Here we explain which personal data we use, why we use it and how to contact us about it.
You can make an enquiry through Asana or by email. We accept open applications by email. We store your name and work email when you request a resource.
Who is responsible?
Porobic Group AB, Swedish registration number 559116-2689, is the controller for our website, business contacts and recruitment. Our address is Hammarby Kajgata 12, 120 30 Stockholm, Sweden. Contact Fedja Porobic at fedja@porobicgroup.com.
This policy covers website visitors, resource users, people who contact us, customer and supplier representatives, job applicants and people appearing in our content.
How we receive enquiries
When you choose to open the enquiry form, you leave our site and go to Asana. Porobic Group uses the information you submit there to assess and respond to your enquiry. Asana provides the form and enquiry management service.
You can also contact us by email. The email buttons open your email app and you choose what to send.
When you request a resource
You need to enter your name and work email to open a template. We store these details with your email domain, the resource and version, first and latest request, request count, language and the page you came from on this site. This lets us provide access and understand demand for resources. Our lawful basis is our legitimate interest in handling your resource requests, GDPR Article 6(1)(f).
Details are stored in Cloudflare D1 through OpenAI Sites. We check the domain’s email settings through Cloudflare’s DNS service. It receives the domain, not your name or full email address.
Coded email and network addresses and temporary request counters limit misuse. We do not store raw IP addresses in the resource list. Resource requests send no emails and do not subscribe you to a newsletter. Requesting is optional, but access requires a name and work email.
Resource records become eligible for deletion 90 days after the latest request. Expired records are removed in batches during later resource requests. Stored abuse-prevention counters have a 24-hour expiry and are cleared in the same way. You can request deletion by email.
When you contact us
When you email us, we use your name, contact details, company affiliation and correspondence to respond, assess a collaboration and follow up. Business information is also personal data when it can be linked to an individual.
For business contacts, we normally rely on our legitimate interest in handling business conversations, Article 6(1)(f). If you personally are the contracting party, necessary pre-contractual or contractual processing may instead rely on Article 6(1)(b).
We keep relevant correspondence while the enquiry or business conversation is active. A specific follow-up need, contract or legal claim then determines which details need to remain.
Customers, partners and suppliers
We use contact details, professional roles, correspondence, orders, contracts and invoice information to deliver work, administer the relationship and handle payments. The basis is normally legitimate interest for business contacts, contract where you personally are the contracting party, and legal obligation for accounting, Articles 6(1)(f), (b) and (c) respectively.
For personal data we process on a client’s behalf, the client is normally the controller and provides its own privacy information. This policy describes our own processing.
Details are kept for the relationship and its necessary closure. Accounting records are retained through the seventh year after the end of the calendar year in which the financial year ended. This does not automatically apply to all correspondence.
Jobs and freelance work
You can send an open application by email. We use your contact details, professional details and what you tell us about yourself to assess your fit for employment or freelance work. We ask for a link to a short video introduction. Share the video only with the people who need to see it.
Our lawful basis is normally our legitimate interest in assessing your application under GDPR Article 6(1)(f). If we want to retain your information for future recruitment, we ask for separate consent. Avoid sending identity numbers, health details or other sensitive information.
We retain your information while we assess your application and during any related recruitment process. Afterwards we retain only information needed for a specific legal claim or that you have separately consented to us keeping for future recruitment.
Where does information come from?
Information mainly comes from you. For business or recruitment contacts, we may also use relevant professional details from your company or a professional profile you refer us to. The website does not automatically retrieve LinkedIn profiles, references or video links.
People in our content
Names, professional roles, images, voices and quotations may appear in Noll till 100, Fedja’s Journal and our creative work. The purpose is to produce and share knowledge and present our work. The lawful basis depends on the context, for example our legitimate interest in professional content or your consent. Contact us with questions about your participation.
We retain content while it remains relevant to its purpose. Requests for changes or removal are assessed in context, considering the lawful basis and your rights.
Who receives the information?
Team members handling your enquiry and providers of hosting, email, collaboration, accounting or legal advice may receive relevant information. Google Workspace is used for email and documents. OpenAI Sites and Cloudflare deliver the website and resource database.
Links to Google Sheets, YouTube, Spotify and LinkedIn open external services with their own privacy terms. We do not pass your resource registration to Google when you open a Sheets template.
Provider services may involve processing outside the EU/EEA. Such transfers require a GDPR basis, such as an applicable adequacy decision or standard contractual clauses and supplementary safeguards where necessary. Contact us for information about recipients, countries and applicable safeguards.
When information is no longer needed
Retention follows the purposes and periods above. A legal requirement or specific legal claim may require limited information to remain longer. Technical information is needed for hosting, troubleshooting and security incidents. When the need ends, information must be deleted or anonymised.
Your rights
You can request access to your personal data and correction of errors. Subject to the GDPR’s conditions, you can also request deletion, restriction and data portability. A legal obligation may, for example, prevent us from deleting certain accounting records.
You can object to processing based on legitimate interest. We then assess whether there are grounds to continue. Direct marketing must stop if you object. Consent can be withdrawn at any time; this does not affect processing already carried out on that consent.
Email fedja@porobicgroup.com. We may need to check that the information concerns you. You will normally receive a response within one month, and notice within that time if a permitted extension is needed. Exercising your rights is normally free. You can also complain to the Swedish Authority for Privacy Protection, IMY, or another competent supervisory authority.
Security and automated decisions
Access to information must be limited to people who need it for their work. The website uses HTTPS. It does not make solely automated decisions with legal or similarly significant effects on you, or send candidate videos to an AI service.
Changes to this policy
We update this policy when processing changes. The date at the top identifies the latest version. We provide further information about material changes where they affect you.
Questions about your data?
Email Fedja Porobic and tell us what you need help with. Please do not send identity numbers, ID documents or sensitive information in an initial email.
fedja@porobicgroup.com