01 Who is responsible for your personal data?
Fabola AB is the data controller for personal data processed through this website and in connection with enquiries and engagements.
Fabola AB
Organisation number: 559258-5896
Botulfsgatan 2
223 50 Lund
Sweden
Email: [email protected]
For any question about this notice or how we handle your personal data, email us at [email protected].
02 What personal data do we collect?
When you contact Fabola through our website or by email, we may process:
- your name, if you provide it;
- your email address and other contact details;
- the organisation you represent and your role, where relevant;
- the contents of your enquiry;
- information about the product, project or regulatory question you choose to provide; and
- subsequent correspondence with you.
If you work for a client, partner or other organisation we deal with, we may also process your name, role and business contact details as part of that relationship.
Our website infrastructure processes technical information required to deliver and secure the website, such as IP address, browser and device information, request information and security logs.
Where we get personal data from
We mainly collect personal data directly from you. We may also receive business contact details from your colleagues or organisation (for example, when you are named as a project contact), from people who refer you to us, or from public professional sources such as your organisation’s website or LinkedIn profile.
03 Why do we process your personal data?
Responding to enquiries
We use the information you provide to understand your enquiry, respond to you and determine whether and how Fabola may be able to assist.
Where your enquiry concerns entering into an engagement with Fabola, the legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). For general business enquiries and correspondence, the legal basis is Fabola’s legitimate interest in communicating with prospective clients, partners and other professional contacts (Article 6(1)(f) GDPR).
Providing services
If an enquiry leads to an engagement, we process relevant contact and project information to perform our agreement and administer the client relationship.
Where you are personally a party to the agreement, the legal basis is performance of a contract (Article 6(1)(b) GDPR). Where you are an employee or representative of a client organisation, the legal basis is our legitimate interest in performing the engagement and communicating with the client’s contact persons (Article 6(1)(f) GDPR).
Accounting and legal obligations
We process invoicing and related records to comply with legal obligations, in particular the Swedish Bookkeeping Act (bokföringslagen, 1999:1078). The legal basis is compliance with a legal obligation (Article 6(1)(c) GDPR).
Website operation and security
Technical information is processed to operate the website, prevent abuse, maintain security, diagnose technical problems and protect Fabola’s systems. The legal basis is Fabola’s legitimate interest in operating and securing its website and information systems (Article 6(1)(f) GDPR).
Is providing personal data required?
Providing personal data to us is voluntary. However, we need at least your contact details to respond to an enquiry, and we need certain information to enter into and perform an engagement.
Automated decision-making
Fabola does not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you.
04 Sensitive and patient information
Fabola works in regulated health-technology fields, but the website contact form and our general email are not intended for patient-level information or other special-category personal data.
Please describe regulatory, technical or commercial questions without including information that identifies an individual patient, study participant or other person.
If we receive such information unsolicited, we will delete it, retaining only what is needed to respond to your enquiry, and may ask you to resend your question without it.
Where an engagement requires Fabola to process personal data on behalf of a client, the handling of that information will be addressed separately as part of the engagement, including any data-processing agreement required under Article 28 GDPR.
05 Who may receive your personal data?
Personal data may be processed by service providers that support Fabola’s operations, including providers of:
- website hosting, content delivery and website security (Cloudflare, Inc.);
- email and communications services;
- form processing and technical infrastructure;
- IT administration and data storage; and
- accounting and bookkeeping services.
These providers process personal data on Fabola’s behalf, under agreements governing their processing, and only as permitted by applicable law. You may contact us for more information about the providers we use.
We may also disclose information where required by law, regulation, court order or a competent authority, or where necessary to establish, exercise or defend legal claims.
We do not sell personal data.
06 International transfers
Some of our technology providers, including Cloudflare, may process personal data outside the European Economic Area (EEA), including in the United States.
Where personal data is transferred to a country without an EU adequacy decision, Fabola relies on an appropriate transfer mechanism, such as the European Commission’s Standard Contractual Clauses, together with additional safeguards where appropriate. Transfers to US providers certified under the EU–US Data Privacy Framework may instead rely on the Commission’s adequacy decision for that framework.
You can request a copy of the safeguards we rely on, or information about where they are available, by emailing [email protected].
07 How long do we keep personal data?
We retain personal data only for as long as necessary for the purpose for which it was collected:
| Category | Retention period |
|---|---|
| Enquiries that do not lead to an engagement | Deleted 24 months after our last contact with you |
| Client and engagement correspondence and project records | Duration of the engagement plus 10 years, the general Swedish limitation period for claims |
| Accounting records, such as invoices and contracts | 7 years after the end of the calendar year in which the financial year ended, as required by the Swedish Bookkeeping Act |
| Technical and security logs | Per our infrastructure providers’ retention settings, normally no longer than 12 months unless needed to investigate a security incident |
Where a longer period is necessary to establish, exercise or defend a specific legal claim, we keep the relevant data until the matter is resolved.
08 Cookies and similar technologies
Fabola does not use cookies for advertising, analytics or behavioural marketing.
The website uses only strictly necessary cookies and browser storage, which do not require consent under the Swedish Electronic Communications Act (lag (2022:482) om elektronisk kommunikation):
| Name | Type | Provider | Purpose | Duration |
|---|---|---|---|---|
| cf_clearance | Cookie | Cloudflare | Records that your browser has passed a security check, so you are not challenged again on every visit | Stored in your browser for up to 1 year, but only accepted as proof of a passed check for 30 minutes |
| Security check storage | Browser storage on challenges.cloudflare.com | Cloudflare | Used by Cloudflare’s security check to distinguish humans from automated traffic, including on the contact form | Set and managed by Cloudflare |
| fabola_lang | Cookie | Fabola | Remembers your choice of the English or Chinese version of the site | 1 year |
The footer email address is protected by a Cloudflare script that hides it from automated harvesting; this script does not set a cookie. Cloudflare processes these security signals as our service provider (see sections 5 and 6).
If Fabola introduces non-essential analytics, advertising or similar technologies in the future, this notice will be updated and consent will be obtained before those technologies are used.
09 External websites
The website contains links to third-party services, such as LinkedIn. When you follow a link to an external service, that service processes personal data under its own privacy terms. Fabola is not responsible for the privacy practices of third-party websites.
10 Your rights
Subject to the conditions in the GDPR, you have the right to:
- request access to your personal data;
- request correction of inaccurate personal data;
- request deletion of your personal data;
- request restriction of processing;
- object to processing based on legitimate interests; and
- receive personal data you have provided in a portable format, where processing is based on contract or consent.
Fabola does not currently rely on consent for any processing. If we do in the future, you may withdraw your consent at any time without affecting the lawfulness of processing before withdrawal.
To exercise your rights, email [email protected]. We will respond within one month, as required by the GDPR.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se, or with the supervisory authority where you live or work.
11 Language versions
This notice is available in English and Chinese. If the versions differ, the English version prevails.
12 Changes to this notice
We may update this notice where our processing activities, services or legal obligations change. The current version is published on fabo.la together with its last-updated date. Where changes are significant, we will take reasonable steps to inform you.