Privacy Policy for Ordnad

1 Data Controller and Data Processor

ORDNAD AB (Reg. no: 559584-0967) acts in two distinct capacities depending on the context of data processing:

• Data Controller: For information collected directly about you as an individual user (such as login credentials, contact information for contract administration, billing, authentication, and technical support), ORDNAD AB acts as the Data Controller.
• Data Processor: For data your organization uploads and processes within the Service (such as personnel rosters, crisis management roles, wartime staffing/allocation (KBF/disposition), employee survey responses, department data, supplier evaluations, operational continuity records, and risk assessments), your organization acts as the Data Controller and Ordnad acts as the Data Processor under a separate Data Processing Agreement (DPA).

2 What data we collect and process

Depending on your interaction with the Service, we process the following categories of data:

• Identity and contact details: Name, email address, phone number, professional role, and organizational affiliation for user accounts, primary contacts, and invited respondents.
• Organizational, facility, and vicinity data: Corporate registration number, official business addresses, facility data (owned or leased), data obtained from official registers (e.g., Bolagsverket), and geographic risk context (public shelters, Seveso sites, fire stations, and historical major industrial incidents).
• Continuity, crisis, and personnel data: Information managed by your organization regarding crisis response teams, wartime staffing/allocation (KBF/disposition), operational competencies, and responses to capability surveys (organization, departments, personnel, and suppliers regarding endurance, continuity, backup procedures, and capability dimensions). Personnel survey responses can be pseudonymized for non-administrators.
• Operational analysis and modeling data: Operational commitments and external deliveries with maximum tolerable outage durations (MTPD), critical dependencies (infrastructure, IT, public services, workforce), protective resources (backup power, redundancy, manual fallbacks), disruption scenarios and cascade simulations, identified bottlenecks, consolidated action plans, and products/services evaluated for export control (PDA / EU Annex I).
• Technical data and security logs: IP address, authentication and access timestamps, login attempts, MFA/TOTP verification events, browser specifications, operating system details, audit logs tracking administrative actions attributed to users via x-user-id, and rate limiting logs.
• User-generated content and documents: Uploaded agreements (PDF), operational continuity plans, policy documents, finished Risk and Vulnerability Assessments (RSA per FORSA/MSB guidelines), and exported reports (DOCX/Excel).

3 Purpose and legal basis for processing

When we process personal data in our capacity as a Data Controller, we do so under the following legal bases:

4 AI Processing and National Data Sovereignty

Ordnad adheres to rigorous data privacy and sovereignty standards when utilizing Artificial Intelligence:

• Sovereign and local deployment (Sovereign Mode): Ordnad provides an architecture for sovereign Swedish hosting (se.ordnad.com and on-premise) deployed on dedicated Swedish and EU infrastructure with isolated runtime secrets in memory (RAM-disk) without storing plaintext credentials on disk.
• Cloud-based AI: Cloud AI inference is performed exclusively on dedicated models hosted within Sweden and the EU under strict Data Processing Agreements. Uploaded documents are parsed locally within Ordnad and are never sent to external OCR or document extraction services.
• Zero model training: Customer operational data, personal information, and uploaded continuity records are NEVER used to train, retrain, or fine-tune public or third-party AI models.
• Encrypted processing: All data transfers and AI API communications are safeguarded with strict transport layer security (TLS 1.3).
• Human-in-the-loop: AI features serve exclusively as advisory decision support, drafting, and synthesis. Final operational decisions, action plans, and regulatory submissions always remain under authorized human oversight.

5 Cookies and Local Storage

We implement a strict 'Privacy by Design' approach regarding cookies and tracking:

• Strictly necessary cookies and session tokens: We only store functional session cookies and local storage tokens required for secure authentication, session validation, CSRF defense, and locale preferences (e.g., session tokens and language settings).
• No commercial tracking: We do not deploy third-party advertising pixels, commercial trackers, or marketing analytics scripts (such as Meta Pixel or Google Ads/Analytics).
• No data monetization: We never sell, lease, or monetize your personal or organizational data to data brokers or third-party advertisers.

6 Data sharing and sub-processors

We only share data with vetted third-party service providers to the extent strictly necessary for service delivery, infrastructure maintenance, and communications:

• Sub-processors provided upon request: We do not publicly enumerate our commercial vendors. All sub-processors engaged for hosting, database management, transactional email, and AI inference operate under strict Data Processing Agreements (DPAs) in compliance with GDPR and security standards. A complete, up-to-date register of sub-processors and processing locations is provided to customers upon request by contacting privacy@ordnad.com.
• Official public registries: Direct API integrations for pulling verified public records (e.g., corporate registries, public shelter databases, and regulatory lists).
• Legal obligations: We may disclose information to Swedish judicial or regulatory authorities if strictly required under mandatory statutory law.

7 Data security and technical safeguards

We maintain comprehensive organizational and technical security controls to safeguard data integrity and confidentiality:

• End-to-end encryption in transit (TLS/HTTPS) and encryption at rest (AES-256) for all databases and file storage.
• Strict database-level multi-tenant isolation enforced through automated PostgreSQL Row Level Security (RLS) policies with continuous regression test guards.
• Passwordless authentication via cryptographically signed magic links or password login enforced with Time-based One-Time Password (TOTP) Multi-Factor Authentication (MFA), plus enterprise Single Sign-On (SSO).
• Runtime secret isolation in RAM-disk in sovereign mode, eliminating unencrypted credentials on disk.
• Sliding-window application rate limiting with HMAC hashing to protect against automated credential attacks.
• Continuous audit logging attributing administrative and security-critical operations directly to authenticated users (x-user-id).

8 Data retention and deletion

Personal data is retained only for as long as necessary to fulfill the operational purposes described herein, or as required by applicable law (such as the Swedish Bookkeeping Act). Upon contract termination, tenant data and user accounts are either securely returned or irreversibly expunged in accordance with our Data Processing Agreement.

9 Your rights under GDPR

As a data subject, you possess statutory rights regarding your personal data:

• Right of access: You have the right to request a formal copy of all personal data held concerning you.
• Right to rectification: You may request immediate correction of inaccurate or incomplete records.
• Right to erasure ('right to be forgotten'): You may request deletion of your personal records where no statutory retention obligations apply.
• Right to restriction and objection: You may contest processing or request temporary suspension of data handling.
• Right to data portability: You are entitled to receive your provided personal data in a structured, commonly used, and machine-readable format.

To exercise any of these rights, contact us at privacy@ordnad.com. You also have the statutory right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten - IMY) if you believe your data is processed unlawfully.

10 Modifications to this policy

We may update this policy periodically to reflect architectural upgrades, new platform capabilities, or evolving legal frameworks. Material updates will be communicated in advance via email or prominent in-app notices.