Bombayworks privacy policy

Bombayworks AB (Company Reg. No. 5567209357) is a digital full-service agency that creates cost-effective digital solutions with measurable results. Our offices are located in Stockholm, Malmö, and Mumbai.

We take privacy seriously and are committed to ensuring that you retain yours. We aim to be transparent about the type of information we collect about you, how we collect it, for what purpose, and for how long. You should also be aware that you have the right to request access to this data and/or ask us to amend, correct, or—in certain cases—delete the information in question.

When and how we process your data

Bombayworks (henceforth referred to as “we”) collect different types of data depending on how you interact with us. Below is an overview of what information we store, for what purpose, and how long it is retained for each category.

1. Events and marketing

This applies when you register for webinars, after-work events, subscribe to newsletters, or request marketing materials.

Purpose: We process this data to track the effectiveness of such events, keep you informed about upcoming activities, and provide you with relevant information. If yo
u subscribe to a newsletter, your data is used for marketing communications.
What data is stored: We store your name, email address, telephone number, physical address, job title, and organisation. We may collect additional information if you provide it in registration forms.
Retention period: If you have consented to marketing, we retain your data for as long as you engage with us. Typically, data is stored for up to 24 months after your most recent interaction.
Legal basis: Processing is based on your consent (e.g. acceptance of cookies) or our legitimate interest in marketing our services to existing or potential customers. A balancing test has been carried out, concluding that our interest does not override your rights.

2. Customer relationships and services

This applies when you purchase or use any of our services or when we establish a professional relationship with you.

Purpose: To deliver the service, provide important information, fulfil contractual obligations, manage financial transactions, and keep you updated about our products. We may also collect data due to legal requirements.
What data is stored: Name, contact details, job title, organisation, and information required for invoicing and contract management.
Retention period: We retain data for as long as necessary to fulfil our agreement, typically up to 24 months after our last interaction or when the agreement is no longer valid. Certain information (e.g. contracts) may be archived for longer periods for reference or legal reasons.
Legal basis: Processing is necessary for the performance of a contract with you or your organisation, as well as to comply with legal obligations (e.g. accounting legislation).

3. Contact and support

This applies when you contact us via email, create a support request, or submit digital forms (e.g. job applications).

Purpose: To respond to enquiries and ensure that you receive assistance or a resolution to your issue.
What data is stored: The information you provide, including name, contact details, and case description.
Retention period: Data is stored for as long as the matter is active or as long as necessary to fulfil our obligations, typically no longer than 24 months after the interaction has concluded.
Legal basis: Processing is based on our legitimate interest in responding to enquiries and managing cases.

4. Website visits

We collect information sent by your browser when you visit our website.

Purpose: To improve the website and understand how users interact with our services. This helps us enhance the user experience and optimise advertising.
What data is stored: IP address, operating system, and browser version. If you identify yourself by completing a form, information about the pages you have visited may be linked to your personal data.
Data collection without cookies (pings): If you decline analytical cookies, we collect data via cookieless pings. These are signals that communicate activity to Google without storing cookies on your device. They help us understand site events such as page views and conversions while fully respecting your cookie preferences.
Google Signals (cross-device tracking): We use the Google Signals feature in Google Analytics 4. Google Signals collects aggregated and anonymised data from users logged into their Google accounts who have enabled ad personalisation. This information is used to analyse how visitors interact with our website across devices and to improve our marketing efforts. Processing only takes place after you have given consent to analytical and/or marketing cookies via our cookie management tool. Data collected via Google Signals is aggregated and cannot be used by us to directly identify individuals. Google may process data as an independent data controller under its own terms.
Legal basis: Analytical and marketing-related processing is carried out based on your consent via our cookie management.
Further information: For more details on the information we collect, please refer to our Cookie Policy. You can also read about how Google processes data. Please note that Google is an independent party responsible for its own data collection.

Third parties and data sharing

We never sell your personal data to third parties. However, data may be shared as follows:

Partners: With your permission, we may share your information with partners you select.
Service providers: We may share data with providers acting on our behalf (e.g. database maintenance). These parties act in accordance with our instructions and this policy.
Storage and transfers: Collected data is primarily stored in cloud services within the EU. However, when using services such as Google Analytics 4 (including Google Signals), data may be transferred to and processed in countries outside the EU/EEA (e.g. the United States). In such cases, we ensure appropriate safeguards are in place in accordance with applicable data protection legislation.

Your rights

You have control over your data. Your rights include:

Access: You may request a copy of your data at any time.
Rectification: You may ask us to correct any inaccuracies in your data.
Erasure: You may request that we delete your data or restrict its processing (this does not apply where we are legally required to retain data, e.g. for accounting purposes or contractual obligations).
Opt out of marketing: You may opt out of marketing communications at any time, regardless of your prior relationship with us.
Withdraw consent: Where processing is based on your consent (e.g. cookies or certain newsletters), you have the right to withdraw this at any time. You can do so via the settings in our cookie banner or by clicking the unsubscribe link in our emails.
Google ad settings: You can review and adjust your ad personalisation settings directly in your Google account at any time. There, you can disable ad personalisation entirely or modify your interests.