Privacy Policy

1. Who we are

This policy applies to the website khourycompanies.com and to our customer portal at kund.khourycompanies.com. Both are operated by Khoury Companies AB ("Khoury Companies", "we", "us"), a company registered in Sweden. Khoury Companies AB is the data controller responsible for the personal data described in this policy, except for leads we process on behalf of a client (see section 3) - there, the client is the controller and we act as processor.

2. Our approach to your data

The public website (khourycompanies.com) is built to collect as little personal data as possible. It uses no tracking cookies, no advertising trackers and no web analytics, and it has no public account, no sign-up and no online forms. The only cookie that may be set is the one that remembers the language you chose yourself (see section 5).

The customer portal (kund.khourycompanies.com) is a signed-in service for existing clients. Accounts are created only by us - you cannot sign up yourself. To deliver the portal we process the personal data described below.

3. Personal data we process

Information you send us. If you contact us by email, we receive your email address, your name where you provide it, and the content of your message. We use this only to read and respond to your enquiry and to manage any business relationship that follows from it.

Technical data from your visit. As with any website, our hosting provider automatically processes limited technical data when a page loads - such as your IP address, browser type, the pages requested and the date and time of the request. This is used to deliver the website reliably and securely and to detect and prevent misuse.

Customer data in the portal. For clients with an account, we process the data we need to deliver the service: your name, email address, phone number, company and a profile picture if you upload one, along with your password (stored encrypted and never in plain text). We also process the content we manage for you in the portal, such as projects, advertising and your subscription.

Leads and contacts. As part of the advertising service we may collect and show leads for you - the name, phone number, email and a description of people who have expressed interest in your business. This data is made available only to you and to us, and is processed so that you can follow up on them. For leads collected through advertising, we act as a data processor on behalf of the client we perform the service for. The client is the controller and is responsible for informing, and having a lawful basis towards, the data subjects. We process the data on the client's instructions and in accordance with applicable data protection law.

4. Legal basis for processing

We process visitor and enquiry data on the basis of our legitimate interest (Article 6(1)(f) GDPR) in responding to enquiries, operating a secure website and protecting it from abuse. Where your message concerns entering into an agreement with us, we may also rely on steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).

We process your data in the customer portal in order to perform our contract with you as a client (Article 6(1)(b) GDPR) and, where applicable, on the basis of our legitimate interest in delivering and improving the service securely (Article 6(1)(f) GDPR).

5. Cookies and browser storage

We use no analytics, advertising or other tracking technologies, so no cookie consent banner is shown. On the public website, the only thing stored is your language, and only if you choose one yourself in the language menu: in your browser's local storage and in a strictly necessary cookie (kc_lang, valid for one year) so that the home page opens in your language next time. The cookie contains only the language code and is used for nothing else. If you have not chosen a language, the home page follows the country you visit from if it is Sweden, Norway, Denmark or Finland, and otherwise the language your browser reports. This is decided during the visit and is not stored.

When you sign in to the customer portal, a necessary login token is stored locally in your browser to keep you signed in. It is technical and required for the service to work, is not shared with anyone and is not used to track you. You can sign out at any time to remove it.

6. Service providers and third parties

To operate the website and the customer portal we rely on a small number of service providers:

• Hosting and infrastructure. The website and portal are hosted by Netlify, which processes server log data on our behalf in order to deliver and secure the service.
• Database, authentication and file storage. The portal's accounts, data and profile pictures are stored with Supabase, on servers within the EU. Supabase processes this data on our behalf as a data processor.
• Email delivery. Portal notifications, such as when you receive a new lead, are sent via Resend. Your email address and the content of the notification are then processed to deliver the email.
• Content delivery. Some static visual assets may be served through third-party content delivery networks. Loading them transmits your IP address to the relevant network as a normal part of delivering web content.

We do not sell or rent your personal data. Where a provider processes data outside the EU/EEA, that transfer is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. How long we keep your data

Email correspondence is kept for as long as needed to handle your enquiry and any related business relationship, and afterwards only where required to meet legal obligations such as bookkeeping. Technical server logs are retained for a short period and are then deleted or anonymised.

Data in the customer portal is kept for as long as you are a client of ours. When the client relationship ends, we delete or anonymise your account and related data, except what we need to keep to meet legal obligations.

8. Your rights

Under the GDPR you have the right to request access to the personal data we hold about you and to ask that it be corrected, erased or its processing restricted. You may also object to our processing and request data portability. To exercise any of these rights, contact us at support@khourycompanies.com.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se, the supervisory authority for data protection in Sweden.

9. Changes to this policy

We may update this policy from time to time. The current version is always published on this page, with the date of the most recent revision shown at the top.

10. Contact

Questions about this policy or about how we handle personal data can be sent to support@khourycompanies.com.