Privacy Policy

Alteron AB (org. no. 0006148472), Råkritegatan 78, Malmö, Sweden, is the data controller for the personal data described in this policy, except where we act as a data processor on behalf of our business customers (see section 2). This policy applies to our website alteron.se and to the Alteron Node meeting-room booking system.

For any privacy question, or to exercise your rights, contact us at privacy@alteron.se. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Swedish Data Protection Act.

For our website, marketing and sales relationships, Alteron is the controller and decides why and how data is processed. For data that our business customers put into Node — such as employee accounts, room bookings and calendar events — the customer is the controller and Alteron acts as their processor. In that case, processing is governed by a Data Processing Agreement (DPA) between Alteron and the customer, and this policy is provided for transparency.

• Technical data such as IP address, browser type, device and pages viewed, collected to operate and secure the site.
• Information you submit through our contact and demo-request forms: name, email, company, and the message you send us.

• Account data: name, work email, organisation, role and authentication data (including single sign-on via Microsoft or Google where used).
• Booking data: rooms booked, meeting titles, start/end times, check-ins and the source of each booking (web, panel, Microsoft or Google).
• Device data: identifiers, status and last-seen time for the wall panels paired to your organisation.

When you contact us for support or sales, we keep the correspondence and any details needed to answer you and maintain our business relationship.

• Providing the Node service and website — legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Securing our systems, preventing abuse and keeping logs — legal basis: legitimate interests (Art. 6(1)(f)).
• Responding to enquiries and managing the customer relationship — legal basis: legitimate interests or pre-contractual steps.
• Sending service messages and, where permitted, relevant product information — legal basis: legitimate interests or consent.
• Meeting legal obligations such as accounting and tax — legal basis: legal obligation (Art. 6(1)(c)).

When your organisation connects Node to Microsoft 365 or Google Workspace, we synchronise room calendars in both directions so bookings stay consistent. All calendar traffic runs through our secure backend — the panels and browser never talk to Microsoft or Google directly. We process only the calendar data needed to mirror bookings (room, time, title and event identifiers) and do not use it for any other purpose.

Our website uses strictly necessary storage to run the site and remember your language preference. We do not use advertising cookies. If we introduce analytics or other non-essential cookies, we will ask for your consent first, in line with the Swedish Electronic Communications Act and GDPR.

We do not sell personal data. We share it only with service providers who process it on our behalf under contract, including:

• Supabase — database, authentication and hosting (EU region, Frankfurt).
• Microsoft and Google — calendar synchronisation and, where enabled, single sign-on.
• Our website hosting and form-handling providers.
• Professional advisers and authorities where required by law.

A current list of subprocessors is available to customers on request and is maintained in our Data Processing Agreement.

Node data is hosted within the European Union (Supabase, Frankfurt / eu-central-1). Where a provider such as Microsoft or Google may process data outside the EU/EEA, such transfers are protected by adequacy decisions or the European Commission's Standard Contractual Clauses together with appropriate safeguards.

We keep personal data only as long as needed for the purposes above. Account and booking data are retained for the life of the customer relationship and deleted or anonymised after the service ends, subject to any longer period required by law (for example, accounting records kept for seven years under Swedish law). Contact-form messages are kept for as long as needed to handle your enquiry.

We protect data with encryption in transit, row-level access controls that scope every record to its organisation, per-device credentials that can be revoked individually, and least-privilege access for our team. No system is perfectly secure, but we work continuously to keep your data safe and will notify you and the relevant authority of any personal-data breach as required by law.

Under the GDPR you have the right to access your personal data and to request rectification, erasure, restriction, portability, and to object to processing based on our legitimate interests. Where processing relies on consent, you may withdraw it at any time. To exercise any right, email privacy@alteron.se. If Alteron acts as a processor for your employer, we will refer your request to the customer who controls the data.

If you believe we process your data unlawfully, we would like the chance to help — please contact us first. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, imy@imy.se, www.imy.se.

Node is a workplace product intended for use by organisations and their staff. It is not directed at children, and we do not knowingly collect personal data from children.

We may update this policy as our service or the law evolves. We will post the new version here with an updated date and, for material changes, notify customers directly.