Privacy Policy

Last updated: 28 September 2026

Organization: Robsonus AB

Organization Number: 559219-1687

Address: Ringvägen 53, Apt. 1201, 137 31 Västerhaninge, Haninge Municipality, Stockholm County, Sweden

Email: robert@robsonus.com

Phone: +46 70 405 32 64

1. Overview

Robsonus AB ("we", "us", "our" or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and otherwise process personal data in accordance with the EU General Data Protection Regulation (GDPR), the Swedish Act (2018:218) containing supplementary provisions to the GDPR (Data Protection Act) and the Swedish Electronic Communications Act (2022:482, LEK).

2. Data Controller

Robsonus AB is the data controller responsible for the processing of personal data. For any inquiries regarding this Privacy Policy or our data processing practices, please contact us at the address above.

Robsonus AB is not required to appoint a Data Protection Officer (DPO) under Article 37 GDPR, as the company does not engage in large-scale systematic processing of sensitive personal data and is not a public authority. For data protection enquiries, please contact us directly at robert@robsonus.com.

3. Personal Data We Collect

We may collect and process the following categories of personal data:

• Contact Information: Name, company name, email address, phone number and your message (when you submit our contact form, book a call or otherwise contact us)
• Visit Source Data: When you submit the contact form, we include the page you submitted it from, any campaign parameters in the link (UTM) and the ad click ID from Google Ads (gclid) or LinkedIn (li_fat_id) if you arrived via an ad. We use them to understand which channels generate enquiries. If you have accepted statistics cookies, the campaign parameters are stored temporarily in your browser's session storage (sessionStorage) so that they are kept if you move on to another page. The storage is cleared when you close the tab.
• Form draft: When you submit the form, what you have written is stored temporarily in your browser's session storage so that the text can be restored if sending fails. If sending succeeds, the thank-you page reads the email address from the draft for enhanced conversions (see Hashed User-Provided Data above) and deletes the draft immediately. The email address is never placed in a web address.
• Technical Data: IP address and time of form submission, stored on our server for at most 24 hours to limit abuse (submissions per hour), and server logs at our hosting provider.
• Website Usage Data: IP address, browser type, pages visited, referrer URL, timestamp (collected via Google Analytics 4, only after consent)
• Cookie Data: Information about your consent preferences (managed via Cookiebot)
• Conversion Data: Information about conversions and interactions with our services (tracked via Google Ads and Microsoft Advertising, only after consent)
• Hashed User-Provided Data: When you submit our contact form and consent to marketing cookies, your email address is hashed (SHA-256) and transmitted to Google Analytics 4, Google Ads and Microsoft Advertising to improve conversion measurement accuracy. The original email is never shared - only the irreversible hash.
• Cross-Device Data (Google Signals): If you are signed into your Google account and have enabled ad personalization, Google may associate your visits across devices using Google Signals. This only applies if you have granted marketing consent via our cookie banner.

Providing data via the contact form is voluntary. If you do not provide an email address, we will be unable to respond to your enquiry. Website usage data is collected via cookies only if you have consented - you can manage this through the cookie settings.

4. Legal Basis for Processing

We process personal data on the following legal bases:

• Consent (Article 6(1)(a) GDPR): Website analytics (Google Analytics 4), ad measurement and remarketing (Google Ads, Microsoft Advertising) and hashed email sent to Google and Microsoft (enhanced conversions). Cookies and similar technologies for these purposes are used only after consent under Chapter 9, Section 28 of the Swedish LEK. The same applies to temporary storage of campaign parameters in your browser. You can withdraw your consent at any time.
• Pre-contractual steps (Article 6(1)(b) GDPR): To respond to your enquiry or book a call you have requested
• Legitimate Interest (Article 6(1)(f) GDPR): To protect the form against spam and abuse (computational check in the browser, per-IP limit), server logs for security, and to understand which channels generate enquiries (source data in the form)
• Legal Obligation (Article 6(1)(c) GDPR): For example, bookkeeping rules if an enquiry leads to an assignment

5. Purposes of Processing

We process personal data for the following purposes:

• To respond to your inquiries and provide information about our services
• To analyze website traffic, user behavior, and campaign performance (Google Analytics 4)
• To track conversions and optimize advertising campaigns (Google Ads, Microsoft Advertising)
• To manage user consent preferences (Cookiebot)
• To prevent fraud and improve website security
• To comply with legal obligations

We do not use automated decision-making or profiling that produces legal effects concerning you.

6. Third-Party Services and Data Sharing

We may share personal data with the following third parties:

Google LLC (United States)

• Google Analytics 4: Website traffic, user behavior, event tracking
• Google Ads: Conversion tracking, remarketing campaigns
• Google Tag Manager: Tag management and event tracking
• Events via our server: Some clicks (email, phone, LinkedIn, contact buttons) are sent via our own server to Google Analytics 4. This happens only if you have accepted statistics cookies.
• Google Signals: Cross-device tracking and demographic/interest data for users signed into Google who have consented to ad personalization. Enables improved audience reporting and cross-device remarketing. Requires marketing consent.
• Enhanced Conversions / User-provided data: Hashed (SHA-256) email address from contact form submissions is transmitted to Google Ads and Google Analytics 4 to improve conversion measurement accuracy and audience quality. Requires marketing consent.
• Transfer to the US: Google LLC is certified under the EU-U.S. Data Privacy Framework, which is a transfer basis under the European Commission's adequacy decision. Standard Contractual Clauses (SCCs) apply as a supplement.
• IP-based measurement (from 3 August 2026): In the EEA, UK, and Switzerland, Google may use your IP address to measure ad performance and personalize ads when you have granted marketing consent. Without consent, no Google tags are loaded and no data is sent to Google.
• How Google uses your data: See How Google uses information from sites or apps that use our services and the Google Privacy Policy.

Cookiebot (Usercentrics A/S, Denmark)

• Purpose: Cookie consent management and Google Consent Mode v2 implementation
• Data Shared: Cookie preferences, consent status, timestamps
• Location: The data is processed within the EU (Ireland)
• Privacy Policy: Usercentrics Privacy Policy

Resend (Resend Inc., United States)

• Purpose: Delivering contact form emails to us
• Data: Everything you enter in the form, the visit source data, the page language and whether you had accepted marketing cookies when submitting
• Role: Processor
• Transfer: Resend is certified under the EU-U.S. Data Privacy Framework; Standard Contractual Clauses (SCCs) in Resend's data processing agreement apply as a supplement

Microsoft (Microsoft Ireland Operations Ltd / Microsoft Corporation, United States)

• Microsoft Bookings: When you book a call, your name, email, phone and chosen time are processed in our Microsoft 365 environment. Microsoft acts as processor.
• Microsoft Advertising (UET): Measures conversions from Bing ads, including a hashed (SHA-256) email address from the contact form. Only after marketing consent.
• Transfer: Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework

Spam Protection (ALTCHA, on our own server)

• How it works: The contact form is protected by a computational task (proof-of-work using the ALTCHA method) that your browser solves automatically. The task is fetched from and checked on our own server.
• Data: No data is shared with third parties and no cookies or local storage are used. Only the technical request itself is recorded in the server log (IP address, time).
• Legal basis: Legitimate interest (Article 6(1)(f) GDPR) in protecting the form against automated spam

OVH (OVH SAS, France)

• Purpose: Hosting of the website and the contact form's server side
• Data: Server logs (IP address, time, requested page, browser) and the technical data described above
• Role: Processor. Data is stored within the EU. OVH keeps server logs for 12 months as required by French law.

7. Data Retention

We retain personal data as follows:

• Contact Form Submissions: Retained for 3 years or until you request deletion
• Google Analytics Data: Retained according to Google's retention policies (default: 14 months)
• Cookie Preferences: Retained according to Cookiebot's settings
• IP addresses for form rate limiting: At most 24 hours
• Server logs: 12 months (legal requirement for our hosting provider OVH)

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right to Access: You can request a copy of your personal data
• Right to Rectification: You can request correction of inaccurate data
• Right to Erasure: You can request deletion of your data (subject to legal obligations)
• Right to Restrict Processing: You can request limitation of processing
• Right to Object: You can object to processing based on legitimate interest and to processing for marketing purposes
• Right to Data Portability: You can request your data in a portable format
• Right to Withdraw Consent: You can withdraw consent for analytics and marketing cookies

To exercise any of these rights, please contact us at robert@robsonus.com or write to our address above. We will respond within 30 days.

9. Cookie Policy

For detailed information about cookies and cookie management, please see our Cookie Policy.

10. Google Consent Mode v2

We use Google Consent Mode v2 in basic mode: Google tags (Google Tag Manager, Google Analytics, Google Ads) are loaded only after you have given consent via Cookiebot. Until then, no data is sent to Google. All consent signals default to "denied" and are updated as soon as you make a choice.

• ad_storage: Marketing cookies (Google Ads) - requires explicit consent
• ad_user_data: Sending user data (hashed email) to Google for advertising - requires explicit consent
• ad_personalization: Personalized ads and Google Signals - requires explicit consent
• analytics_storage: Analytics cookies (Google Analytics 4) - requires explicit consent

If you deny consent, no analytics or advertising tags are loaded. You can withdraw or change your consent at any time via the Cookie settings link in the footer.

11. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encrypted transfer (HTTPS), protection against automated submissions and restricted access to incoming enquiries.

12. International Transfers

Some data is transferred to the United States (Google, Microsoft, Resend). These transfers are based on the EU-U.S. Data Privacy Framework (Google, Microsoft, Resend), supplemented by Standard Contractual Clauses (SCCs).

13. Changes to This Policy

We may update this Privacy Policy. Changes will be posted on this page with a new "Last updated" date. We will clearly inform you on the website of any material changes.

14. Contact Information

If you have questions about this Privacy Policy or our data processing practices, please contact:

Robsonus AB
Email: robert@robsonus.com

15. Supervisory Authority

You have the right to lodge a complaint with the Swedish Data Protection Authority (Integritetsskyddsmyndigheten) if you believe we have violated your data protection rights.

Integritetsskyddsmyndigheten (Swedish Data Protection Authority)
Website: www.imy.se

Questions about cookies and similar technologies fall under the Swedish Post and Telecom Authority (PTS), www.pts.se.