Privacy

Privacy policy

1. Who we are and who this policy covers

Precise Biometrics AB (org. no. 556545-6596), Scheelevägen 27, SE-223 63 Lund, Sweden, is the controller for the personal data described here. Questions about this policy or your data go to [email protected], or by post to the address above, marked "Data protection".

This policy covers you if you:

• visit precisebiometrics.com or our other websites
• work for a customer, prospective customer, partner or supplier of ours
• subscribe to our newsletters, press releases or financial reports
• are a shareholder or investor, or attend our general meetings
• are a board member, or are on one of our insider lists
• report a concern through our whistleblowing channel

Our employees, consultants and job applicants are covered by our separate employee and candidate privacy policy. When you use Precise Visit or Precise Access at a site run by one of our customers, that customer is responsible for your data (see section 4).

2. What we collect, why, and our legal basis

If you are	We collect	Why	Legal basis
A website visitor	IP address, device and browser details, pages visited, cookie identifiers, and the company your visit comes from	Run the site, measure its use, show relevant ads, and see which companies visit us	Consent, through our cookie banner. Strictly necessary cookies need no consent. Identifying the visiting company from your IP address, which we shorten before storing, is based on legitimate interests (section 3).
Someone who contacts us or subscribes	Name, email, phone, company, country, your message	Answer your question; send the newsletters, press releases, reports or blog updates you asked for	Legitimate interests (answering you); consent (subscriptions, which you can cancel at any time)
A contact at a customer or partner	Name, job title, employer, business contact details, emails and meeting notes, support tickets, e-signatures on contracts	Manage the relationship, deliver and support our products, sign and administer contracts	Legitimate interests (section 3). Contract, if you are a sole trader.
A prospective customer	Name, job title, company, business contact details, and how you have engaged with us	Contact you about products relevant to your company	Legitimate interests. We send marketing emails only where the Marketing Practices Act allows, and every marketing email, including personal emails from our sales team, lets you opt out.
A contact at a supplier	Name, business contact details, invoices and payment details	Order, receive and pay for goods and services, and keep accounts	Legal obligation (Bookkeeping Act); legitimate interests for day-to-day contact
An investor or shareholder	Name, contact details, organisation, holdings, notes from investor meetings	Maintain investor relations as a listed company	Legitimate interests; legal obligation for disclosures under the Market Abuse Regulation (MAR) and listing rules
A board member	Name, contact and identity details, board documents and minutes	Run the board and register board members with Bolagsverket	Legal obligation (Companies Act); legitimate interests for the board portal
On one of our insider lists	Name, personal identity number, contact details including private phone and address, employer and role, when you got access to inside information	Keep insider lists as MAR Art. 18 requires	Legal obligation
Someone reporting through our whistleblowing channel, or named in a report	Your report and anything in it; your contact details unless you stay anonymous	Receive and follow up reports	Legal obligation (Whistleblower Act 2021:890)

Where data comes from. Mostly from you or your employer. For prospects, we may get business contact details from a commercial B2B contact database, for example for people at companies that have visited our website. For investors, we use an investor database provided by our investor-relations service provider. When we collect data this way, we tell you within a month and name the source.

Sensitive data. We don't ask for sensitive data such as health information. A whistleblowing report may contain it; we then handle it only as far as needed to follow up the report.

3. Our legitimate interests

Where we rely on legitimate interests, we have weighed our interest against yours and documented the result. You can ask for a summary of that assessment.

Interest	What it covers
Running our business relationships	Keeping contact details of the people we work with at customers, partners and suppliers, and recording what we have agreed
Finding new customers	Contacting people at companies whose needs match our products, using business contact details only
Knowing which companies visit our website	Identifying the company behind a website visit from its IP address, so that we can follow up with companies interested in our products. We do not identify you as an individual from your visit.
Answering enquiries	Replying to questions sent through our website, email or phone
Investor relations	Keeping in touch with investors and analysts and recording meetings, as expected of a listed company
Board administration	Distributing board papers securely through a board portal
Network and information security	Protecting our systems and your data, for example by keeping security logs and backups

Your right to object. You can object at any time to processing based on legitimate interests. We will stop unless we have compelling grounds that override your interests, or need the data for a legal claim. You can always object to direct marketing, and we will then stop without question.

4. When we act for our customers: Precise Visit and Precise Access

When you register as a visitor or use access control at a site that runs Precise Visit or Precise Access, the company running that site is the controller of your data. We process it only on their instructions, under a data processing agreement, and do not use it for our own purposes. That company's privacy notice tells you what is collected, why and for how long. Send questions or requests about that data to them; if you contact us, we will pass your request on.

We use a small number of sub-processors to run these services, for example for hosting and for sending SMS and email notifications. Our customers get the current list and can object to changes.

5. Who we share data with

We don't sell personal data. We share it only with: 

Recipient	Examples	Why
Service providers working for us	Providers of CRM and customer support, e-signature, B2B contact data and website visitor identification, website hosting, analytics and marketing, accounting and invoicing, our board portal, investor relations services and our whistleblowing channel	They run systems for us, under data processing agreements, and may not use the data for their own purposes. Contact us for the names of the providers that handle your data.
Authorities and advisers	Bolagsverket, Skatteverket, Finansinspektionen, police or prosecutor, our external auditor, banks	When the law requires it, or to make payments
Event partners	Co-hosts of an event you register for	Only if you tick the box to share your details
A buyer or merger partner	—	If we sell or merge all or part of the business. We will tell you before your data falls under a different privacy policy.

Transfers outside the EU/EEA

Some of our service providers, for example for email and collaboration, CRM, e-signature and web analytics, are based in the USA or have support staff or sub-processors there. We transfer data only when it is protected in one of two ways:

• the provider is certified under the EU-US Data Privacy Framework, which the European Commission has found gives adequate protection, or
• we have signed the European Commission's standard contractual clauses with the provider, plus extra safeguards where needed.

Contact us for a copy of the safeguards that apply to your data.

6. How long we keep data

Data	How long
Customer and partner contacts	For the relationship, then 2 years
Prospects	2 years after our last contact
Signed contracts	The contract term plus 10 years, the general limitation period
Invoices and accounting records	7 years after the end of the financial year (Bookkeeping Act)
Website analytics	14 months
Newsletter and report subscriptions	Until you unsubscribe. We keep a record of your consent for 2 years after that.
Investor contacts	2 years after our last contact
Board minutes	For the life of the company. Board-portal access ends 1 year after the end of your term.
Insider lists	At least 5 years after the list is drawn up or updated (MAR)
Whistleblowing cases	No longer than needed, and at most 2 years after the case is closed

After these periods, we delete the data or make it anonymous.

7. Your rights

You have the right to: 

• access the data we hold about you and get a copy
• correct data that is wrong or incomplete
• erase data, for example when we no longer need it
• restrict our use of your data while a question is being resolved
• object to processing based on legitimate interests, and to direct marketing (section 3)
• withdraw consent at any time, without affecting what we did before
• data portability: receive data you gave us in a machine-readable format, where we rely on consent or contract

We answer within one month. Some rights are limited by law. For example, we must keep accounting records, and we won't reveal who made a whistleblowing report. We will tell you if a limit applies.

Cookies

We use cookies and similar technology only with your consent, except for those strictly needed to run the site. You can change your choice at any time through the cookie settings link at the bottom of every page. Our cookie policy lists each cookie, its purpose and how long it lasts.

Security

We protect personal data with technical and organisational measures that fit the risk, such as access control, encryption and supplier assessments. Read more in our Trust Center.

Contact and complaints

Contact us at [email protected]. If you are unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or to the authority where you live or work.

Changes

We will publish any change to this policy here, and tell you directly about significant changes where we can. Last updated: Oct 21, 2026.