Privacy policy

This privacy policy describes how Endura Systems AB, company registration number 559213-9462 (“Endura Systems”, “we”, “us” or “our”), processes personal data when you visit our website, use Rytmia, contact us or otherwise interact with us.

The policy applies to website visitors, users of Rytmia, customer contacts, invited users, support contacts and other people who interact with us.

If you use Rytmia through your employer, customer, principal or another organization, that organization may also be responsible for how your personal data is used. In such cases we may act as a processor on the organization's behalf.

We may process the following categories of personal data:

• Identity and contact details, such as name, personal identity number (personnummer), email address, phone number, role, employer and organization.
• Account details, such as authentication method, language choice, user settings, roles, permissions and account status.
• Electronic identification data from logging in and signing with BankID: the name and personal identity number BankID verifies and, for a signature, what was signed, when, and BankID's record of the signature.
• Content in the service, such as clients, service sites, quotes, orders, instructions, schedules, assignments, checklists, comments, deviations, photos, invoice drafts and other information submitted by users.
• Attendance and location data recorded at events such as check-in and check-out. Rytmia is not designed for continuous location monitoring between those events.
• Usage and technical data, such as IP address, device information, browser type, log data, timestamps and actions in the service.
• Communication data, such as support tickets, email, feedback and meeting notes.
• Billing and commercial data, such as subscription details, invoice references and information about the customer relationship.

We process personal identity numbers only where secure identification requires it. BankID identifies you by yours when you log in or sign, and an organization invites a coworker by theirs so that only that person can accept the invitation.

We collect personal data directly from you, from BankID when you log in or sign with it, from the organization that invites or administers your account, from other authorized users, from your use of the service and from third-party services that you or your organization choose to connect to Rytmia.

Some data — for example client contacts, access instructions or staffing — may be entered by other users within your organization. The organization is responsible for having the right to process and share that data.

We process personal data in order to:

• Provide, secure, maintain and improve Rytmia.
• Create and manage user accounts, organizations, roles, permissions and invitations.
• Identify you when you log in, and let you sign quotes, deletions of accounts and organizations, and support access with BankID.
• Support quoting, planning, staffing, work on site, documentation, review and invoice preparation.
• Document attendance at check-in and check-out, and give authorized users relevant information about work performed.
• Provide customer support and answer enquiries.
• Communicate about the service, security, product changes and administrative matters.
• Manage subscriptions, billing, accounting and customer relationships.
• Prevent and investigate abuse, fraud, security incidents and technical problems.
• Comply with legal obligations and establish, exercise or defend legal claims.
• Send marketing communication where permitted by law and where the recipient can unsubscribe.

Depending on the context, we rely on one or more of the following legal bases:

• Performance of a contract, where the processing is needed to provide Rytmia or related services.
• Legitimate interests, for example securing and improving the service, supporting customers, managing business relationships and preventing abuse.
• Legal obligation, where the processing is required for accounting, tax, regulatory compliance or other legal requirements.
• Consent, for example for certain cookies, marketing choices or optional features where consent is required.

Where a customer organization decides what personal data is entered into Rytmia and why, the customer is normally the controller and we are the processor. We then process the data according to the customer's instructions, our data processing terms and applicable data protection law.

If you have questions about data your organization is responsible for in Rytmia, you should contact the organization in the first instance. We assist the organization where law and contract require it.

We may share personal data with:

• Service providers that help us operate, secure, support, communicate, analyse and improve Rytmia, including the identification service through which we use BankID.
• Customer administrators and other authorized users within your organization, according to the roles and permissions configured.
• Third-party services the organization chooses to connect, for example mapping, communication or accounting services.
• Professional advisers, such as lawyers, auditors, insurers and accounting consultants.
• Authorities, courts or other third parties where required by law or necessary to protect rights and safety.
• Buyers, investors or successors in connection with a merger, acquisition, financing, restructuring or sale of business assets.

We aim to use service providers within the EU/EEA where practically possible. If personal data is transferred outside the EU/EEA, we use appropriate safeguards, such as adequacy decisions, standard contractual clauses and supplementary measures where required.

We keep personal data only for as long as it is needed for the purposes described in this policy, including to provide the service, comply with legal obligations, resolve disputes, maintain security and enforce agreements.

Customer data is normally kept according to the customer's subscription, configuration and instructions. Certain data may remain in backups, logs, accounting records or security records for a limited time.

9.1 When you delete your account

You can delete your account yourself, in the Rytmia app under Account, in the web app under your profile and in the client portal under Profile. You confirm the deletion by signing with BankID. It takes effect as soon as you have signed and cannot be undone: there is no grace period and no restoration. Delete your Rytmia account sets out the steps.

The deletion applies to you as a person, not only within the organization you have open. Your name, your phone number, the personal identity number your account is tied to, your sign-ins, the devices that receive your notifications and your notifications in the service are removed. Your memberships in all organizations end. Invitations addressed to your personal identity number are deleted, as is what you have signed with BankID about yourself alone, such as letting Rytmia support use the service as you. You can later create a new account with BankID, but it is not connected to the organizations you belonged to.

What you have recorded for an employer stays with the employer: attendance at check-in and check-out, checklists, deviations, photos and past assignments. The data remains as the organization's records, without your name. Audit logs within an organization retain the details about you that were recorded when the event occurred. What you signed with BankID on an organization's behalf, and a quote you signed as a client, stay with that organization as its evidence of what was signed. A company you are a client of also keeps its own record of you as a contact. For that data the organization is the controller, and a deletion request is directed to the organization (see section 6).

The deletion cannot go through while you are checked in anywhere, or while you are the only administrator of an organization that still exists. Check out, or appoint another administrator or delete the organization, and then try again. The service names the organizations concerned.

Leaving an organization is a different thing from deleting your account. Leaving ends only that membership, while your account, your other memberships and what you have recorded in the organization remain. Leaving an organization also requires that you have checked out and that the organization retains at least one administrator.

9.2 When an organization is deleted

An administrator can delete the entire organization, in the web app and in the app. That too is confirmed by signing with BankID, and that too takes effect immediately: access ends for every member, anyone checked in is checked out at that moment, and invitations that have not yet been answered are withdrawn. There is no separate cancellation of the subscription in the service — deleting the organization is the way out, and that way stays open even for an organization whose subscription has already ended.

The organization's data is then no longer accessible to anyone. It remains until the last day of the month following the month in which the deletion took place, counted in Swedish time, and is then permanently removed. Removal never happens before the final invoice has been issued. A deleted organization cannot be restored by the customer.

The calendar month in which the organization is deleted is the last one invoiced, in arrears and without proration, for the seats the organization holds on that day. Invoice records are subject to the archiving requirements of the Swedish Accounting Act and therefore remain with us even after the organization's data has been removed.

People who belong to no organization after the deletion have their identity retired along with it, in the same way as when they delete their own account.

We use technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration and disclosure.

No system is completely secure. You and your organization are responsible for protecting your credentials, keeping contact details current and managing users' access.

Depending on the circumstances and applicable law, you may have the right to request access, rectification, erasure, restriction, data portability or to object to processing of your personal data. Where processing is based on consent, you can withdraw that consent at any time.

You delete your own account yourself in the service, in the app under Account, in the web app under your profile and in the client portal under Profile. Section 9 describes what is deleted, what stays with your employer and what can prevent a deletion. If your request concerns data for which a customer organization is the controller, direct it to that organization (see section 6).

You also have the right to lodge a complaint with a data protection authority. In Sweden the supervisory authority is the Swedish Authority for Privacy Protection (IMY). You may also contact your local supervisory authority within the EU/EEA.

We use cookies and similar technologies in accordance with our Cookie policy. Necessary technology may be used to make the service work and to protect user sessions. Non-essential cookies are used only where permitted by law and, where required, with your consent.

Rytmia is intended for businesses and professional use. The service is not directed at children, and we do not knowingly collect personal data from children for the website's marketing purposes.

We may update this privacy policy from time to time. If the changes are material, we will give reasonable notice. The latest version is always available on our website.

If you have questions about this privacy policy or wish to exercise your rights, you can contact Endura Systems AB through our contact page.