Privacy Policy

Elevaite365 Group AB & Elevaite365 LLC | Last Updated: October 2026

Scope of this Policy

This Privacy Policy explains how Elevaite365 Group AB ("Company", "we", "us", or "our"), together with our U.S. subsidiary Elevaite365 LLC (collectively, the "Group"), collects, uses, and discloses personal data when you visit our website, interact with our sales and marketing teams, or access user accounts in our SaaS solutions on behalf of yourself, an organization, or a client. In these contexts, Elevaite365 acts as a Data Controller.

As a provider of enterprise software-as-a-service (SaaS) products (our "Solutions"), we are committed to respecting your privacy in compliance with applicable global data protection laws, including the EU General Data Protection Regulation (GDPR), the UK GDPR, the Australian Privacy Act 1988, applicable U.S. federal and state privacy statutes, and regional privacy frameworks across our operating markets.

Product & Customer Data Exclusions (Data Processor Role)

This Privacy Policy does not apply to the data processed through our automated testing platform. When our customers utilize Elevaite365's automated testing solutions to interact with their environments (such as Microsoft Dynamics 365 or third-party systems), Elevaite365 acts strictly as a Data Processor. In such cases, we process data solely on behalf of the customer under their instructions to execute test workflows and deliver the service.

The processing of such customer data is governed exclusively by our Data Processing Agreement (DPA), incorporated into our commercial customer contracts.

Information We Collect, Recipients, & Legal Bases (As Controller)

A. Information You Provide to Us

• Account & Business Data: Name, business email address, job title, company name, phone number, and authentication details required to set up and manage user access across our SaaS platform, Partner (PRM) portal, and customer support channels.
• Sales & Support Communications: Inquiries submitted via contact forms, email, or live chat, as well as support ticket history, feature requests, and administrative communications.

B. Automatically Collected Data (Website & Portal Telemetry)

• Device & Usage Info: IP address, browser type, operating system, referring URLs, and page interactions on our public website.
• Account Access & Security Logs: System access logs, authentication timestamps, and security telemetry collected when users authenticate into our platform, PRM portal, or administrative systems to manage subscriptions and maintain security.

C. Information from Third-Party Sources

We may obtain business contact details (such as name, corporate email, title, and company) from publicly available business directories, professional networks (such as LinkedIn), and enterprise marketplaces (such as Microsoft AppSource or Azure Marketplace) to engage with relevant enterprise prospects.

D. Third-Party Categories & Recipients of Personal Data

We share personal data only with trusted service providers acting on our behalf to support our core operations, subject to strict confidentiality and security terms:

• Cloud Infrastructure Providers: Enterprise cloud hosting, logging, and security services (e.g., Microsoft Azure).
• Business Operations & CRM: Customer relationship management, support ticketing, and B2B communication software.
• Financial & Billing Services: Subscription management and payment processing gateways.
• Professional Advisors: Auditors, legal counsel, and tax consultants, as well as law enforcement or regulatory authorities when required by applicable law.

E. Legal Bases for Controller Processing

We process personal data only when we have a valid legal basis under applicable privacy frameworks (including GDPR Art. 6):

• Contract Performance (Art. 6.1.b): To manage accounts, billings, and provide technical support.
• Legitimate Interest (Art. 6.1.f): To maintain B2B sales communications, secure our website and application portals, evaluate product usability, and process inbound B2B sales leads.
• Legal Obligation (Art. 6.1.c): To comply with statutory accounting, tax, financial auditing, and mandatory retention obligations under applicable national laws.

Global Operations & International Data Transfers

As a global company operating out of Sweden and the United States, with an international workforce and customer base across the EU/EEA, United Kingdom, United States, Canada, and Australia, personal data may be accessed or processed internationally.

We ensure that all cross-border data transfers comply with applicable global privacy laws using recognized legal transfer mechanisms and safeguards:

• Intra-Group & Operational Transfers: To the extent data is accessed by or shared within the Elevaite365 Group, it is strictly protected through group-wide data protection terms, Standard Contractual Clauses (SCCs) where applicable, end-to-end encryption, and strict role-based access controls.
• Vendor & Service Provider Transfers: To the extent third-party vendors process data on our behalf across global markets, we ensure international data flows are secured using legally recognized transfer mechanisms, such as standard contractual provisions, country-specific addenda (including the UK International Data Transfer Addendum), active certifications (such as the EU-U.S. Data Privacy Framework), or valid regional adequacy decisions.
• Data Residency & Hosting: Our operational systems and corporate databases utilize enterprise-grade cloud infrastructure (such as Microsoft Azure) with regional data hosting controls.
• Product & Customer Test Data: Cross-border transfer mechanisms and data residency guarantees for automated test workflows executed within our SaaS platform are governed exclusively by our Data Processing Agreement (DPA) incorporated into our commercial contracts.

Cookies and Tracking Technologies

We use strictly necessary cookies and similar essential technologies to support core website functionality, enable secure user authentication, and maintain platform performance. Because these cookies are strictly required to operate our website and services, they do not require prior consent and cannot be toggled off. You may restrict or block cookies at any time through your browser settings, though doing so may limit your ability to access certain features of our website.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or to comply with statutory legal, accounting, or reporting requirements:

• Account & Subscription Data: Retained for the duration of the commercial agreement plus 7 years to comply with statutory accounting, tax, and legal retention obligations (including the Swedish Bookkeeping Act and U.S. IRS regulations).
• Marketing Contact Data: Retained until you opt out or withdraw consent, or for up to 24 months from your last active interaction (e.g., email engagement or inquiry), after which the data is securely deleted or anonymized.
• Service Telemetry & Security Logs: Retained for up to 90 days unless required for active security or troubleshooting investigations.

Automated Decision-Making & Profiling

Automated Decision-Making: We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals.

Children's Privacy

Children's Privacy: Our website, portals, and Solutions are designed strictly for enterprise businesses and adults. We do not knowingly solicit or collect personal data from children under 16 years of age.

Your Privacy Rights & Supervisory Authorities

Depending on your jurisdiction, you may exercise specific rights regarding your personal data under applicable local privacy regulations (including GDPR, UK GDPR, Australian Privacy Principles, and U.S. State Privacy Laws):

• Access & Portability: The right to request confirmation of whether we process your personal data and to obtain a copy of that data in a structured, commonly used format.
• Rectification: The right to request the correction of inaccurate or incomplete personal data.
• Erasure ("Right to be Forgotten"): The right to request deletion of your personal data where legal grounds apply.
• Restriction & Objection: The right to object to or request the restriction of specific processing operations (e.g., direct marketing or processing based on legitimate interest).
• U.S. State Privacy Rights: We respect applicable U.S. state privacy laws (including CCPA/CPRA). We do not "sell" personal data, nor do we "share" personal data for cross-context behavioral advertising. We support recognized opt-out preference signals (such as Global Privacy Control) sent by browser settings.
• Withdrawal of Consent: If you have given us consent to process your data, you can withdraw it at any time using the opt-out links in our communications or by contacting us directly.

Supervisory Authority Complaints & Regional Inquiries

To exercise any of your rights, please submit your request to our central Data Protection Office at privacy@elevaite365.com.

• EU/EEA Residents: You have the right to lodge a complaint with a European data protection supervisory authority. Our lead supervisory authority in the EU is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten - IMY) at imy.se.
• UK Residents: If you are located in the United Kingdom, all UK GDPR privacy inquiries, rights requests, and data protection matters are processed directly through our Swedish Data Protection Office (privacy@elevaite365.com). You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

Contact & Data Controller Details

If you have any questions, concerns, or formal requests regarding this Privacy Policy or how we handle your personal data, please contact our Data Protection Office:

Email: privacy@elevaite365.com