This notice explains how SvereSystems handles personal data when you use the website, contact us, submit a fit check or project intake, receive a free digital resource, join optional email updates, or buy and receive a SvereSystems business service.
Data-minimisation rule: Do not send passwords, login credentials, payment-card details, unnecessary health or other special-category personal data, or third-party personal data that is not genuinely needed for the requested service.
Brand: SvereSystems
Controller: Sveresa Tmi
Business ID: 3592316-3
VAT ID: FI35923163
Business address:
Suopurontie 1
02920 Espoo
Finland
Website: www.sveresystems.com
Email: info@sveresystems.com
Sveresa Tmi, trading under the SvereSystems brand, is the controller where SvereSystems determines the purposes and means of processing for its own website, enquiries, client administration, contracts, billing, marketing, security and business records.
The categories depend on how you interact with SvereSystems and may include:
Most personal data is provided directly by you through a website form, project intake, checkout, email or other business communication.
We may also receive data from the organisation you represent, from a payment or checkout provider used for your order, or from service providers that generate necessary security, delivery or transaction records.
If a business client supplies personal data about another person as part of source material, SvereSystems will use that material only as necessary for the agreed service and in accordance with the applicable controller or processor role described below.
We use information submitted through an enquiry or fit check to understand the request, determine whether the relevant SvereSystems service appears suitable, respond to the sender and maintain an appropriate business record.
Legal basis: Article 6(1)(b) GDPR where the processing is necessary to take requested steps before a contract with you as an individual or sole trader; otherwise Article 6(1)(f) GDPR, based on our legitimate interest in handling requested B2B enquiries, assessing fit, preventing abuse and maintaining relevant business correspondence.
A fit-check submission does not by itself create a paid-service contract.
For Website + Presenter, SvereSystems uses the information needed to assess the project, confirm fit, administer payment, receive the private project intake, develop approved content and visual direction, create or coordinate agreed media, build the website, prepare the agreed contact route, perform quality checks, manage launch or handover where included, and retain an appropriate service record.
Website + Presenter forms are currently submitted through Web3Forms. Web3Forms states that form submissions are processed and forwarded to the configured email or endpoint rather than stored as submission records by Web3Forms; it also states that server logs may contain personal information and are deleted periodically.
Legal basis: Article 6(1)(b) GDPR where processing is necessary for a contract with you as an individual or sole trader; for representatives of business customers, Article 6(1)(f) GDPR based on our legitimate interest in administering and performing the B2B service relationship; Article 6(1)(c) GDPR for applicable accounting, tax and other legal duties.
We do not require passwords or hosting credentials in the standard public intake form. If technical access is later required for an agreed launch, it should be provided only through an appropriate method requested for that purpose.
For services such as First Contact Fix and Client Acquisition Conversation Review, we use submitted business context and conversation material to assess the request, produce the agreed written analysis or rewrite, deliver the work and maintain relevant service records.
Some existing conversation-service workflows may use Make.com for operational automation. Where Make is used, it processes the information needed for the configured workflow under the applicable data-processing terms.
Legal basis: the same contract, pre-contract, legitimate-interest and legal-obligation bases described above, depending on whether the individual is personally the contracting party or acts for a business customer.
SvereSystems uses Stripe for certain paid-service payment links. Stripe processes payment and transaction information needed to operate the checkout, authenticate or secure transactions, prevent fraud and comply with its own legal obligations. SvereSystems receives transaction and payment-status information needed to administer the order but does not receive the full payment-card number.
We retain invoices, transaction references and accounting information for the periods required by applicable Finnish accounting and tax law. Records needed for legal claims or dispute handling may be retained for an appropriate limitation period where justified.
Legal basis: Article 6(1)(b) GDPR for contract administration where applicable, Article 6(1)(c) GDPR for accounting and tax obligations, and Article 6(1)(f) GDPR for fraud prevention, payment reconciliation and the establishment, exercise or defence of legal claims.
SvereSystems may make free digital resources or digital products available through Payhip. Payhip may provide SvereSystems with order or download information associated with the requested resource.
Where you separately opt in to SvereSystems marketing emails, your subscriber information may be stored and processed in MailerLite for mailing-list management and email delivery.
Receiving a free resource or buying a service does not automatically subscribe you to marketing. Where consent is used, it can be withdrawn at any time, including through the unsubscribe link in a marketing email.
Legal basis: Article 6(1)(f) GDPR for delivering and administering a free resource you requested, subject to the circumstances of that flow; Article 6(1)(a) GDPR for optional marketing where consent is the chosen basis; and Article 6(1)(c) GDPR where transaction records must be retained by law.
SvereSystems may use AI-assisted tools for limited parts of drafting, analysis, organisation, coding, image generation, presenter production and quality-control workflows.
For the current internal ChatGPT workflow, SvereSystems applies a data-minimisation and anonymisation step before project material is entered into ChatGPT. Direct identifiers such as a contact person’s name, individually identifying email address and telephone number are removed, together with indirect or contextual details where necessary. Sole-trader names, identifiers and third-party details receive particular care because business information can also identify a natural person.
The material entered into the current personal ChatGPT workspace must be reduced so that no natural person is reasonably identifiable from the information provided to ChatGPT. Simply replacing a name or email address with a placeholder is not treated as sufficient if the remaining context can still reasonably be linked to that person. If sufficient anonymisation cannot be achieved without losing information needed for the task, that material is not entered into the current ChatGPT Plus workflow.
SvereSystems does not intentionally use its personal ChatGPT workspace as a processor for client personal data. The ChatGPT account is also configured so that new conversations are not used to improve OpenAI’s models. That setting is an additional privacy control and does not replace the anonymisation rule above.
Passwords, credentials, payment-card details, unnecessary sensitive personal data and unrelated third-party personal data must not be submitted to AI tools.
AI-assisted outputs are working material. Client-facing deliverables within the agreed service scope are subject to human review before final delivery.
SvereSystems does not use solely automated decision-making that produces legal effects or similarly significant effects for a person.
We do not sell personal data. Depending on the interaction and service, personal data may be disclosed to or processed through providers in the following categories:
Some providers process data on our documented instructions as processors or subprocessors. Others, particularly payment, checkout or platform providers, may also act as independent controllers for parts of their own security, fraud-prevention, regulatory or platform processing. The exact role depends on the processing activity and the provider’s applicable terms.
For SvereSystems own enquiries, fit checks, client administration, payment records, service communications, marketing, security and legal records, Sveresa Tmi normally acts as controller.
A business client may sometimes provide personal data about its own customers, prospects, employees or other individuals solely so that SvereSystems can perform an agreed service on the client’s documented instructions. To the extent SvereSystems processes that personal data on behalf of the client rather than for SvereSystems own purposes, the client may be the controller and SvereSystems the processor.
Where Article 28 GDPR applies to such processing, the SvereSystems Data Processing Agreement applies as required. The DPA does not convert SvereSystems own controller activities, such as billing or business administration, into processor activities.
Some service providers or their subprocessors may process personal data outside the European Economic Area.
Where GDPR Chapter V requires a transfer mechanism, the relevant transfer must rely on an applicable adequacy decision or appropriate safeguard, such as the European Commission’s Standard Contractual Clauses, together with any additional measures required in the circumstances. Some providers may also participate in an applicable adequacy framework where available.
You may contact info@sveresystems.com for information about safeguards relevant to a particular SvereSystems processing activity.
We keep personal data only for as long as reasonably necessary for the stated purpose, unless a longer period is required by law or justified for the establishment, exercise or defence of legal claims.
Provider-side backup, security and statutory records may remain for the provider’s applicable retention period even after SvereSystems deletes an operational copy, where the provider is entitled or required to retain them.
Subject to the conditions and exceptions in applicable law, you may have the right to:
In Finland, the supervisory authority is the Office of the Data Protection Ombudsman. You may also have the right to complain to another competent supervisory authority where GDPR allows.
To exercise a right concerning processing controlled by SvereSystems, email info@sveresystems.com. We may request information reasonably necessary to verify identity and locate the relevant records.
If the relevant personal data is processed by SvereSystems only as a processor for a business client, we may need to refer the request to that client as controller.
SvereSystems uses reasonable technical and organisational measures appropriate to the nature and scale of the processing, including limiting access to business systems, using established service providers, reducing unnecessary data collection and keeping credentials out of ordinary intake forms.
No internet or cloud service can be guaranteed completely secure. If a personal-data breach occurs, SvereSystems will assess and handle it in accordance with applicable GDPR notification and documentation duties.
SvereSystems does not use solely automated decision-making, including profiling, that produces legal effects or similarly significant effects for individuals.
Information about cookies, consent storage, the Bunny Stream embed, Stripe payment pages and Payhip’s separate store environment is provided in the Cookie Notice.
External websites and platforms have their own privacy notices and may act independently for their own processing. Following an external link does not make SvereSystems responsible for all processing performed by that third party.
We may update this Privacy Notice when SvereSystems services, workflows, providers or legal obligations change. The current version will be published on this page with its revision date.
Questions about this notice or SvereSystems handling of personal data can be sent to info@sveresystems.com.
SvereSystems
Operated by Sveresa Tmi
Business ID: 3592316-3
VAT ID: FI35923163
Suopurontie 1
02920 Espoo
Finland