Privacy Notice

1. Who is responsible

The controller of personal data processed via the Nelvoss marketing website is Andreas Fredriksson, a sole proprietor (enskild näringsidkare) established in Sweden.

Organisation number: 19920926-****.

Nelvoss is a brand and product name used by the controller; it is not a limited company (aktiebolag) or separate legal person.

Business address: Näbbåsvägen 7, 522 30 Tidaholm, Sweden.

Privacy contact: pilot@nelvoss.se. General contact: pilot@nelvoss.se.

2. Scope

This notice applies to visits to the Nelvoss marketing pages (including the home page, How it works, and Pilot pages) and to pilot assessment requests submitted through the website form to the pilot-lead endpoint.

It does not describe processing for authenticated product accounts, payment execution, wallet signing, or independent Buyer Proof demonstrations, which are outside this public marketing surface.

3. What we collect

When you submit a pilot assessment request, we process the fields you provide:

• Work email address
• Company name
• Role
• Primary need (selected category)
• Optional free-text context (if provided)
• Source path of the form
• Optional UTM source, medium, and campaign values if present in the page URL
• A request identifier generated for the submission (used for idempotency and operational correlation)
• Technical status and creation timestamp for the stored inquiry record

4. What we do not collect on this surface

The public marketing pilot form does not ask for passwords, payment-card numbers, private keys, seed phrases, government ID documents, or marketing-newsletter subscriptions.

A hidden honeypot field may be present to deter automated abuse; it is not intended for human input and is not stored as a pilot-lead field when empty.

5. How information is collected

Information is collected directly from you when you complete and submit the pilot form.

UTM values, if any, are read from the page URL at submission time.

Ordinary website hosting and reverse-proxy infrastructure may process technical connection metadata (such as IP address and user agent) as part of delivering pages and protecting the service. This marketing deployment does not persist IP addresses as fields in the pilot-lead database table.

6. Why we process the data

We process pilot inquiry data to:

• Assess and respond to your pilot assessment request
• Prevent spam and automated abuse (including rate limiting and honeypot checks)
• Maintain security and operational integrity of the inquiry channel
• Understand how visitors reached the form when UTM parameters are present
• Notify an internal operator mailbox when email delivery is configured

7. Lawful bases

Responding to an inbound B2B pilot inquiry is processed primarily on the basis of legitimate interests (GDPR Article 6(1)(f)): namely the interest in assessing and answering a business contact’s request about a potential pilot under the Nelvoss brand, balanced against your interests and fundamental rights.

Where you request specific steps prior to entering into a contract with the controller as a data subject, those steps may also be processed under GDPR Article 6(1)(b).

Security, abuse prevention (including rate limiting and honeypot checks), and essential service integrity measures are processed on the basis of legitimate interests (GDPR Article 6(1)(f)).

This marketing form does not rely on consent as the primary lawful basis for answering your inquiry, and it does not use a consent checkbox for newsletter marketing. Submitting the form does not subscribe you to a marketing newsletter.

8. Recipients and service providers

Inquiry data is stored in the application database used for the Nelvoss staging/public marketing deployment and may be accessed by authorised operators who need it to respond.

When operator notification is configured, a limited copy of the inquiry may be delivered to the internal operator mailbox via Strato Email so that Nelvoss can respond.

Hosting and reverse-proxy infrastructure providers process technical traffic data to deliver the website. We do not sell pilot inquiry data.

9. International transfers

Depending on hosting and email-delivery configuration, personal data may be processed on infrastructure located in the EU/EEA or, for some providers, outside the EEA.

We do not claim that all processing remains in Sweden or the EU unless that is verified for the specific providers in use. Where a transfer outside the EEA occurs, appropriate transfer safeguards must be in place under applicable law; contractual mechanisms (such as Standard Contractual Clauses) are an operator/legal-review item and are not asserted here as verified facts.

10. Retention

Non-converted pilot inquiry records are retained for a maximum of 12 months from creation, and are deleted or anonymised earlier when they are no longer needed to assess or respond to the inquiry or for related legitimate operational or legal purposes. This is an operator retention policy managed operationally; automated calendar deletion is not currently enforced by a scheduled system job. If an inquiry becomes an active pilot or customer relationship, retention follows that relationship’s contractual and legal requirements instead of this non-converted lead policy.

11. Cookies and similar technologies

The Nelvoss marketing pages covered by this notice are designed without non-essential analytics or advertising pixels, and they do not call the site’s visitor-metrics endpoint.

We do not load Google Analytics, Meta Pixel, LinkedIn Insight Tag, Hotjar, Microsoft Clarity, PostHog, or similar marketing trackers on this marketing surface.

Fonts are delivered from the site’s own system font stack; no third-party webfont CDN is used for these pages.

Strictly necessary technical processing may occur at the HTTP layer (for example TLS and reverse-proxy operation). The public production marketing site does not use Basic Auth. A cookie consent banner is not shown because non-essential tracking cookies are not part of the current marketing implementation.

Legacy product surfaces outside this marketing scope may use first-party session or metrics cookies when those surfaces are enabled; those are outside this notice’s marketing scope.

If non-essential tracking is introduced on the marketing surface later, this notice and any required consent mechanism will be updated before that tracking is enabled.

12. Security

We apply technical and organisational measures appropriate to the risk of this inquiry channel, including access-restricted hosting, least-privilege database credentials for the pilot-lead path where deployed, and limits on what is written to application logs for successful submissions.

No website can be described as perfectly secure. You should not submit secrets, private keys, or payment credentials through the pilot form.

13. Your rights

Subject to applicable law, you may have the right to request access, rectification, erasure, restriction, and portability of personal data, and to object to processing based on legitimate interests.

Where processing is based on consent (which is not the primary basis for answering pilot inquiries on this form), you would have the right to withdraw consent without affecting prior lawful processing.

You may lodge a complaint with a competent supervisory authority. In Sweden, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) is the national supervisory authority.

To exercise rights, contact the privacy contact listed above once published, or use the general contact channel published for Nelvoss when available.

14. Required and optional fields

Work email, company, role, and primary need are required to submit a pilot assessment request. Optional context and UTM values are optional. If required fields are not provided, we cannot process the inquiry through this form.

15. Automated decision-making

The marketing pilot-lead flow does not make automated decisions that produce legal or similarly significant effects about you. Honeypot and rate-limit checks may reject abusive automated traffic.

16. Changes

We may update this Privacy Notice when our processing or the public site changes. The version and last-updated date below identify the current notice. Version 1.1, last updated 2026-08-14.