Privacy Policy — Terrasslinje

Last updated: 3 August 2026

1. Data controller

Terrasslinje AB
Hornsgatan 54
118 21 Stockholm, Sweden
Organisation number: 559123-4567
Email: [email protected]
Phone: +46 8 641 3380

Terrasslinje AB is the data controller responsible for the personal data we collect and process. For data protection enquiries, contact us at [email protected].

2. Scope

This Privacy Policy applies to all personal data processed by Terrasslinje AB in connection with our terrace design and construction services, our website terrasslinje.se, customer communications, and related business activities. It covers data collected directly from you, automatically through our website, and from third parties where applicable.

3. Personal data we collect

3.1 Data you provide directly

Identity data: full name, title
Contact data: email address, phone number, postal address
Property data: terrace location, property type, brf affiliation
Project data: service requests, project descriptions, preferences, photographs of your property
Communication data: messages, emails, consultation notes
Contract and billing data: invoice details, payment information, purchase history

3.2 Data collected automatically

Technical data: IP address, browser type and version, operating system, device type
Usage data: pages visited, time spent, referral source, click patterns
Cookie data: as described in our Cookie Policy

3.3 Data from third parties

Building authority records relevant to permit applications
Brf board communications where you authorise us to act on your behalf
Payment processor confirmation data

4. Legal basis for processing

We process your personal data on the following legal bases under Article 6 of the GDPR:

Contract performance (Art. 6(1)(b)): Processing necessary to provide terrace design and construction services, manage projects, and fulfil our contractual obligations.
Legitimate interests (Art. 6(1)(f)): Business administration, service improvement, fraud prevention, and direct marketing to existing customers — balanced against your rights and interests.
Legal obligation (Art. 6(1)(c)): Compliance with Swedish tax law, building regulations, and accounting requirements.
Consent (Art. 6(1)(a)): Where you have given explicit consent, such as for marketing communications to prospective customers or non-essential cookies. You may withdraw consent at any time.

5. Purposes of processing

We use your personal data to:

Respond to enquiries and schedule site consultations
Prepare proposals, designs, and permit documentation
Execute terrace construction projects and manage site access
Process payments and maintain financial records
Communicate project updates and provide aftercare support
Improve our services and website functionality
Comply with legal and regulatory requirements
Send relevant service information and, with consent, marketing communications

6. Data retention

We retain personal data only as long as necessary for the purposes described above:

Enquiry data: 24 months from last contact, unless a project proceeds
Contract and project data: Duration of project plus 7 years (Swedish accounting requirements)
Permit documentation: 10 years or as required by building authorities
Marketing consent records: Until consent is withdrawn plus 3 years
Website analytics: 26 months maximum
Cookie data: As specified in our Cookie Policy

After retention periods expire, data is securely deleted or anonymised.

7. Data sharing and recipients

We may share your personal data with:

Subcontractors and suppliers: Craftspeople, material suppliers, and engineers involved in your project — only data necessary for their role
Professional advisors: Accountants, lawyers, and insurers bound by confidentiality
Public authorities: Stockholm building authorities, tax agencies — when required by law or for permit applications you authorise
IT service providers: Hosting, email, CRM, and payment processing — under data processing agreements compliant with GDPR Article 28
Brf boards: Project information you authorise us to share for approval processes

We do not sell your personal data. We do not transfer data outside the EU/EEA unless adequate safeguards are in place (Standard Contractual Clauses or adequacy decisions).

8. Your rights under the GDPR

As a data subject, you have the following rights:

Right of access (Art. 15): Request a copy of personal data we hold about you
Right to rectification (Art. 16): Request correction of inaccurate or incomplete data
Right to erasure (Art. 17): Request deletion where no legal basis for retention exists
Right to restriction (Art. 18): Request limited processing in certain circumstances
Right to data portability (Art. 20): Receive your data in a structured, machine-readable format
Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing
Right to withdraw consent: Where processing is consent-based, withdraw at any time without affecting prior lawful processing
Right not to be subject to automated decision-making (Art. 22): We do not use automated decision-making with legal or significant effects

To exercise any of these rights, contact [email protected]. We respond within 30 days. We may request identity verification before processing your request.

9. Right to lodge a complaint

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY):

Integritetsskyddsmyndigheten
Box 8114
104 20 Stockholm
www.imy.se

We encourage you to contact us first so we can address your concerns directly.

10. Data security

We implement appropriate technical and organisational measures to protect personal data, including:

Encrypted data transmission (TLS/SSL) on our website
Access controls limiting data access to authorised personnel
Secure storage with regular backups
Staff training on data protection obligations
Incident response procedures for potential data breaches

In the event of a personal data breach likely to pose a risk to your rights, we will notify IMY within 72 hours and affected individuals without undue delay where required.

11. Children's data

Our services are directed at adults. We do not knowingly collect personal data from individuals under 16. If we become aware of such data, we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via our website with an updated "Last updated" date. Continued use of our services after changes constitutes acceptance of the revised policy.

13. Contact

For questions about this Privacy Policy or our data practices:

Terrasslinje AB
Hornsgatan 54, 118 21 Stockholm
[email protected]
+46 8 641 3380