Terms and privacy
Privacy policy
This page describes how we process personal data when you contact us, fill in the form or create an account, and what rights you have under the GDPR.
Contents10
Last updated 2026-10-12.
Data controller
NameRiffle AB, company registration number 559357-3271, Lyckebyvägen 21, 136 70 Vendelsö, Sweden, is the controller for the processing of personal data on corpusmarket.com.
If you have questions about how we process personal data, or want to exercise your rights, contact us at info@corpusmarket.se.
What data we collect
- Contact details – name, email address, phone number and role.
- Company details – company name, company registration or VAT number, and industry.
- Description of data – what you write in the form about the data your company holds, for example type, volume and time period. We don't ask for files, and you should not include personal data about others in the description.
- Account details – your email address if you create an account. You sign in with a one-time code we send by email, or with your Google account. For the one-time code, we only store a hash of the code, and for no more than 10 minutes. If you sign in with Google, we receive your verified email address and an ID for your Google account from Google, so we can link the sign-in to your account. Google processes that data under its own privacy policy.
- Technical logs – IP address, browser, timestamps and similar data needed for operations, security and spam protection.
- Visitor statistics – only if you have accepted it: which pages you visit and which buttons you use, a random visitor ID, your IP address, browser and device (type, operating system, language, screen size) and approximate location (country, region, city). Not your name, email or company.
Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Assessing your inquiry and getting back to you | Steps taken at your request prior to a possible contract, and legitimate interest where you represent a company |
| Preparing offers and administering agreements | Pre-contractual steps and performance of a contract |
| Providing and protecting your account | Performance of a contract and legitimate interest in secure operations |
| Operations, security and protection against abuse | Legitimate interest |
| Visitor statistics to improve the site | Consent, which you can withdraw at any time under "Cookie settings" |
| Sending newsletters | Consent, which you can withdraw at any time |
| Complying with legal requirements, such as bookkeeping | Legal obligation |
Where we rely on legitimate interest, we have balanced our interest against your right to privacy.
How long we keep the data
We keep the data for 24 months after our last contact. After that it is deleted or de-identified. Data we are required by law to keep, such as accounting records, is kept for as long as the law requires. An account you close yourself is deleted together with the associated data, unless we have to keep it for one of the reasons above.
Processors
We use the following providers, which process personal data on our behalf. All are bound by data processing agreements.
- Cloudflare – hosting of the site (Cloudflare Workers), the database for inquiries and accounts (Cloudflare D1, stored in the Western Europe region within the EU), and security and spam protection.
- Resend – sending email, including one-time sign-in codes.
- Google Ireland Ltd and Google LLC (Google Analytics 4) – visitor statistics, only if you have accepted it. The data is sent through our own server, so no third-party cookies are used. Google uses your IP address to determine approximate location and does not store it.
Transfers outside the EU/EEA
Some of our providers may process data outside the EU/EEA, for example for support or operations. When that happens, we ensure the transfer is supported by the GDPR, for example through an adequacy decision or the European Commission's standard contractual clauses, supplemented by additional safeguards where needed.
Statistics data sent to Google may be transferred to Google LLC in the United States. That transfer relies on the EU-US Data Privacy Framework, under which Google LLC is certified.
Your rights
You have the right to:
- access the personal data we process about you,
- have inaccurate data corrected,
- have data erased, unless we have grounds to keep it,
- request restriction of processing,
- object to processing based on legitimate interest,
- object to direct marketing – in which case we stop that processing,
- receive data you have provided in a machine-readable format (data portability),
- withdraw consent at any time, without affecting processing that has already taken place.
Contact us at info@corpusmarket.se to exercise your rights.
Complaints
If you believe we are processing personal data incorrectly, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. Our lead supervisory authority is the Swedish Authority for Privacy Protection (IMY), imy.se. Please get in touch with us first, and we will try to resolve it.
Cookies
How we use cookies and local storage is described on our page about cookies. Cookies for visitor statistics are only set if you accept them, and you can change your choice at any time under "Cookie settings" at the bottom of every page.
Changes
We may update this policy. The date at the top shows when it was last changed.