Privacy policy
What this website knows about you
The website collects very little about you. Here we describe exactly what that is.
Controller
Who processes the data
Xertified AB is the controller of the personal data described here.
- Company: Xertified AB
- Company registration number: 559211-3251
- Registered office: Uppsala
- Address: Dragarbrunnsgatan 35, 753 20 Uppsala, Sweden
- Email: info@xertified.com
- Phone: +46 (0)18 265 06 06
Do you have questions about this policy? Or do you want to exercise any of your rights? Then write to info@xertified.com.
The website
What the website does not do
No cookies
The website uses no cookies, which are small files that websites store in your browser. So you do not need to accept any cookies.
No forms
The website has no forms. You contact us by email or phone and decide for yourself what you tell us.
No access logs
Many web servers keep a log of which pages visitors read and which IP addresses they have. Our web server does not do that.
Nothing loaded from other companies
Fonts, images and design are loaded from our own server. The website loads nothing from Google or other companies. So your IP address is not passed on when you read a page.
If something goes wrong on the server, a line is written to an error log. The line may contain an IP address. We need the error log to fix faults. We keep it on the basis of legitimate interest under Article 6(1)(f) of the General Data Protection Regulation (GDPR). The error log is deleted after at most 14 days.
Visitor statistics
We do not measure visits
The website does not collect any visitor statistics. So we do not know how many people visit it or which pages they read.
If we start measuring visits, we will update this policy first. We will then describe what we measure, why and how long we keep the data.
When you contact us
Email, applications and vulnerability reports
You send us an email
If you write to info@xertified.com, we process your name, your email address and what you write. We do this so that we can reply to you and follow up the matter. The legal basis is our legitimate interest in replying to people who contact us. If you are a customer, the basis may instead be our contract with you. We keep the email while the matter is open and then for at most 24 months.
You apply for a job with us
We receive applications by email, even when we have no vacancy. We process what you send so that we can assess your application. The legal basis is that you have asked us to assess you for possible employment. This is set out in Article 6(1)(b) of the GDPR.
We keep the data during the recruitment. After the recruitment we keep it for two years. This lets us show how the selection was made if anyone questions it. The legal basis for this is our legitimate interest under Article 6(1)(f). If you want us to delete your application sooner, we will do so.
You report a vulnerability
If you write to security@xertified.com, we process your email address and what you write. We do this so that we can investigate and fix the flaw and get back to you. The legal basis is our legitimate interest in fixing flaws in our products. We keep the data while the matter is open and then for at most 24 months.
We only publish your name if you have agreed to it. You are welcome to remain anonymous.
Others who process data
Who else can see the data
We never sell personal data, and we do not pass it on to other companies for marketing.
Email to us is handled by our email provider, Microsoft, and is stored within the EU. The provider processes the data on our behalf under an agreement with us. Our web server is owned by Xertified and located in Sweden.
We disclose data if the law or a decision by a public authority requires it.
Your rights
What you are entitled to
Under the GDPR, you have the right to:
- know what data we hold about you and get a copy of it
- have incorrect data corrected
- have data erased in some cases
- ask us to restrict processing, which means that we only store the data and do not use it
- object to processing based on legitimate interest
- receive the data you have provided in a machine-readable format
Write to info@xertified.com if you want to exercise any of these rights. We reply within one month.
Are you unhappy with how we have handled your data? Then you can complain to the Swedish Authority for Privacy Protection (IMY) at imy.se.
Changes to this policy
If we change anything important in this policy, we update the date below. The website has no accounts and no newsletter. So we cannot notify you directly. Check this page if you want to know what applies.
Last updated: 12 October 2026.