Privacy policy

This page explains how Carnaby Solutions AB handles personal data when you visit www.carnaby.se and carnaby.solutions, and when you contact us using the form.

Last updated: 15 November 2026.

Summary

• We set no cookies of our own and use no external tracking scripts. In some cases Cloudflare may set a necessary security cookie.
• We use our own system to analyse how the website is used, anonymised and without personal data.
• Cloudflare protects the website and delivers it faster. This means that Cloudflare processes your IP address, among other things.
• If you write to us using the contact form, we use the details only to reply to you.

Who is responsible for your data

Carnaby Solutions AB is the data controller. This means that we are responsible for making sure your data is handled correctly and in line with the General Data Protection Regulation (GDPR).

Carnaby Solutions AB
Company registration number: 559172-6962
Garvar Lundins gränd 1
SE-112 20 Stockholm, Sweden
Telephone: +46 8 20 10 01
Email: [email protected]

If you have questions about how we handle personal data, or want to exercise any of your rights, contact us at the address above.

Cookies and tracking scripts

We do not place any cookies of our own in your browser. We use no external tracking scripts, for example for advertising or visitor statistics, and we do not share data about your visit with advertising networks or social media.

Our fonts are hosted on our own server, and the pages contain no embedded videos, maps or feeds from other services.

The only content loaded from another service is the protection against automated form submissions, Cloudflare Turnstile, and only on the contact page. It is described below.

Our own analysis of the website

We have our own system that analyses how the website is used. The purpose is to find problems, identify bottlenecks and prevent abuse.

The analysis is anonymised. IP addresses are truncated before they are stored, so that they cannot be linked to an individual, and the system uses no cookies.

How Cloudflare protects the website and the contact form

All traffic to the website passes through Cloudflare. We use Cloudflare as a firewall (WAF), which protects against attacks and malicious traffic, and as a CDN, which makes the pages load faster.

The contact form is protected by Cloudflare Turnstile, which tells humans apart from automated programs, usually without you having to do anything. Turnstile is loaded from Cloudflare only when you visit the contact page.

To provide these services, Cloudflare processes technical details about your visit, including your IP address, which browser you use and which page you request. Turnstile also analyses technical signals from your browser.

The purpose is to keep the website secure and available and to stop spam and abuse. The legal basis is our legitimate interest in protecting the website and the people who use it.

Cloudflare is our data processor for this processing. According to Cloudflare, the company also uses some Turnstile data to improve its own bot detection, and is then itself the controller of that processing. Read more in Cloudflare’s privacy policy and in Cloudflare’s information about Turnstile.

If traffic looks suspicious, Cloudflare may ask the browser to complete a check and then set a security cookie, for example __cf_bm or cf_clearance. The cookie is necessary to protect the website, is not used to track you and therefore does not require consent.

Technical logs on our web server

Our web server logs every request. The log includes your IP address, the time, which page was requested, which page you came from and which browser you use, among other things.

We use the logs only for operations, troubleshooting and security, for example to detect and stop intrusion attempts. The legal basis is our legitimate interest in running a secure website.

The logs are deleted automatically after 14 days. The server’s backups are pruned regularly. The server is located in Germany, within the EU.

The contact form

When you send the contact form, we receive your name, your email address and your message, if you include one. We also receive the page the form was sent from and the time it was sent.

We use the details to answer your enquiry and for our continued contact with you. The legal basis is our legitimate interest in being able to answer enquiries. If your enquiry concerns an assignment you want to give us, the basis is instead taking steps at your request before entering into a contract.

The message is sent by email to the staff who answer enquiries. It is not stored on the website.

We keep the message for no more than 30 days, unless it leads to an assignment. If you become a client, we keep the details for as long as the assignment lasts and then for as long as the law requires, for example under the Swedish Bookkeeping Act.

Who receives the data

We never sell personal data. We only share it with suppliers who help us run the website and our business, and they may only use the data on our behalf:

• Cloudflare, for the firewall, CDN and Turnstile.
• The supplier that runs our web server, within the EU.
• Google (Google Workspace), our email provider, for messages from the contact form.

We may also have to disclose data where the law requires it, for example to a public authority.

Transfers to countries outside the EU

Cloudflare is a US company, so data may be transferred to the United States. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which the European Commission has found to provide an adequate level of protection for personal data. You can check the certification at dataprivacyframework.gov.

The same applies to Google, which provides our email and is also certified under the EU-U.S. Data Privacy Framework.

Your rights

These rights apply within the limits set by law. Contact us at the address above and we will reply within one month.

We usually cannot link data held only by Cloudflare or in the server logs to you as a person. It may therefore be difficult for us to find your particular data there.

Complaints

If you are not happy with how we handle your personal data, please contact us first. You also have the right to complain to the Swedish Authority for Privacy Protection (IMY), the supervisory authority in Sweden: www.imy.se.

Changes to this policy

We update this policy when we change how we process personal data. The date at the top shows when it was last changed.