Vyer Technologies AB, 559089-5891, (“Vyer”, “we”, “us” or “our”) is committed to safeguard your privacy since your privacy is important to us. This privacy policy describes how Vyer as a data controller collects and uses your personal data. The processing of personal data differs a bit depending on whether you are a user of our services at https://app.vyer.com/login, represent a current or a potential customer, represent a supplier or business partner, visit our website https://www.vyer.com or apply for a job. This privacy policy also describes your rights as a data subject and how these rights are enforced. We comply with applicable privacy legislation, for example the General Data Protection Regulation 2016/679 (“GDPR”) and additional legislation.

Last updated: 2025-10-15

1. Personal data, purpose and legal grounds

This Data Processing Agreement has been entered into between “the Supplier” Vyer Technologies AB, corporate identity number 559089-5891, Storgatan 23C 12, 114 55 Stockholm, (Data Processor) and “the Customer” (Data Controller) in connection with the Customer's acceptance of the terms and conditions in the Supplier's Subscription Agreement upon electronic signing of the Order Form concerning the “Vyer” service. The Agreement implies, among other things, that the Supplier, acting as a data processor, will process personal data on behalf of the Customer (Personal Data).

Personal data means any information relating to a living natural person, both directly (e.g. social security number or a photo) and indirectly (information which together with other information makes it possible to relate to a person).

The personal data we process might be name, contact details (email address and telephone number), log in details, information contained in our communication, IP address and other information collected by cookies and similar techniques. The personal data is mostly collected directly from you when creating a user account, entering into an agreement with your employer, in our communication e.g. via telephone or email, or when you apply for a job. Other sources of data could be e.g. public registers for marketing, information published on websites and the unit you are using when visiting our website or app.

Definitions

User of our services

To be able to use our services, you have to make a registration and a user account will be created. We process the personal data in order to let us:

give you access to your user account. We also might contact you and communicate with you in different ways. The processing is necessary for the performance of our contract of providing you a user account or, if you have been invited, for our legitimate interest of performing according to the contract with your employer/an organisation which is a customer to us. 

improve current and develop new products and services. The processing is necessary for the purpose of our legitimate interest of product development.

market Vyer and our products and services. We use direct marketing via email (of course always with the option of unsubscribing) where we show you relevant product recommendations and offerings. The processing is necessary for the purpose of our legitimate interest of market Vyer.

Representing a customer

If you are in contact with Vyer within your employment at a customer of ours, we will process your personal data in order to let us:

provide the services we have committed to supply in the contract with your employer and perform other rights and obligations such as administration, invoicing and payment. We will contact and communicate with you in in different ways, e.g. when giving you support. The processing is necessary for the purpose of our legitimate interest of performing according to the contract with your employer.

improve current and develop new products and services. The processing is necessary for the purpose of our legitimate interest of product development.

market Vyer and the products and services we believe is of interest of your employer. We use direct marketing via email (of course always with the option of unsubscribing) where we show you relevant product recommendations and offerings. The processing is necessary for the purpose of our legitimate interest of market Vyer.

Potential customer or representing a potential customer

We will process your personal data in order to let us: 

market Vyer and the products and services we believe is of interest to your employer. We use direct marketing via email (of course always with the option of unsubscribing) where we show you relevant product recommendations and offerings and we make contact by telephone as well. The processing is necessary for the purpose of our legitimate interest of market Vyer.

Representing a supplier or a business partner

If you are employed at any of our suppliers or business partners, your personal data will be processed by us in order to let us: 

comply with the rights and obligations we have in the contract with your employer, such as administration, invoicing and payment, and for communication. The processing is necessary for the purpose of our legitimate interest of performing according to the contract with your employer.

Visitor of our websites

When you visit our website or app we will collect information using cookies. More information about our cookies and how we use them is found in our cookie policy [link]. If the information we collect contain personal data, we will process the personal data in order to let us:

provide websites and an app with basic functionalities. The processing is necessary for the purpose of our legitimate interest of having a website, an app and services that are working optimally.

retrieve statistics, such as information about how long a visit lasts, which parts of the website/app you have read and other information about behavior on the website. The processing is based on your consent.

Job applicant 

When you apply for a job, we will process your personal data included in your personal letter and CV, such as skills, competences, work experience, education, grades, references and other information you include in your application. We will process your personal data in order to let us:

make an assessment of your application and evaluate the possibility of an employment and take necessary preceding measures of an eventual employment contract. The processing is necessary for the purpose of our legitimate interest of hiring new personnel.

save your application and personal data in case there is another future opening relevant for you. The processing is based on your consent.

perform the duties and rights we have as an employer in the recruitment process. The processing is necessary for compliance with legal obligations and for the purpose of our legitimate interest of being able to bring our case to justice if necessary.

Sensitive personal data is processed only if necessary or if you have given your explicit consent to the processing. Sensitive data may as an example be processed if you have a disability or other specific needs which must be considered in the recruitment process.

2. Transfer of your personal data 

Your personal data will be shared with selected companies which help us deliver our services. For example, we use suppliers for storing of data in clouds, CRM tools, emailing, accounting, project management, HR administration, analytical tools and recruitment services. Suppliers which process personal data on our behalf have signed a data processing agreement according to applicable legislation. Companies helping us with recruitment and, in doing so, are making selections on our behalf, are responsible themselves for their processing of personal data.

We may have to share your personal data with authorities, courts and other relevant parties if required by law, in conjunction with a legal process or to answer a request from regulators and other authorities.

If we would take a future decision of selling or transfer Vyer or parts of Vyer, your personal data might be shared with or transferred to parties involved in the process.

3. How long we keep your personal data

We keep your personal data as long as necessary to fulfil the purposes for which it was collected. Once fulfilled, your personal data will be erased or anonymized.

How long we save your personal data depends on the type of information and why we process it. The same personal data might be saved for different purposes. As an example, information might be saved due to regulatory reasons, even though it has been erased and anonymised for other purposes.

We regularly review our need to keep data, taking into account applicable legislation.

4. Transfer to third country

Generally, no personal data is transferred outside EU/EEA. In case of a transfer, for example to a supplier in a third country, the transfer is made according to applicable legislation. We will transfer your personal data to a destination outside EU/EEA only if adequate safeguards are in place in accordance with GDPR. 

5. Your rights as a data subject

Right to information and access to your data. You have the right to request information about how we process your data and a transcript of personal data processed by us. The first transcript may be requested free of charge, however if you make repeated and unreasonable requests for copies, we might charge you with an administrative fee.

Right to rectification. You have the right to correct inaccurate or incomplete information about yourself. 

Right to erasure (‘right to be forgotten’). You have the right to request that we erase personal data about you, for example if the data is no longer necessary in relation to the purposes for which it was collected or otherwise processed, or if there is no legal basis for processing the data. 

Right to restriction. You are entitled to request that the processing of your personal data should be limited until inaccurate or incomplete information about you has been corrected, or until an objection from you have been handled.

Right to object. You have right to object to processing based on legitimate interest. This means that we may no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests.

Right to withdraw your consent. You may at any time withdraw any consent you have given us. However, please note that it will not affect any processing that has already taken place.

Right to complain. You have the right to lodge a complaint to the Supervisory Authority in the country you live or work in, if you believe that we have not complied with our obligations regarding your personal data. In Sweden the Supervisory Authority is Datainspektionen, https://www.datainspektionen.se/.

Please contact us using the contact details at the bottom to exercise any of your rights. 

6. Changes to this Privacy Policy

Vyer might change and update this privacy policy. The latest updated version is always found on this website and in our app. We recommend that you regularly visit our website or app to keep updated on our processing of personal data. 

7. Contact us

For more information about our processing of your personal data, if you have questions or contact us in any other matter, please contact us by email at contact@vyer.com or by mail:

Vyer Technologies AB

Storgatan 23C, 114 55 Stockholm, Sweden

Concepts not capitalized, such as ”processing”, ”data subject”, ”personal data breach” etc., shall have the same meaning as in the Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (”GDPR”). Other capitalized concepts not defined in the Data Processing Agreement shall have the same meaning as in the Subscription Agreement.

Processing

GDPR

The Parties undertake to fulfil their obligations under the GDPR and laws that implement or supplement the GDPR (”Applicable Data Protection Legislation”).

Purpose-bound

The Supplier may only process Personal Data for the purposes set out in Appendix A and/or according to the Customer's written instructions. The Supplier shall immediately inform the Customer if the Supplier considers that the Customer's instructions violate the Applicable Data Protection Legislation.

Security and confidentiality

Requirements for authorized persons

The Supplier shall implement and maintain all measures required under Article 32 GDPR. The Supplier shall ensure that all persons authorized to process Personal Data have committed themselves to confidentiality, or are under an appropriate statutory obligation of confidentiality.

Personal data breaches

Procedure

The Supplier shall notify the Customer without undue delay (if possible, never later than 36 hours) if the Supplier discovers any personal data breach concerning Personal Data. The notification shall contain the information required for the Customer to be able to fulfil their obligations under Articles 33–34 GDPR.

Data Protection Impact Assessments and prior consultation

Advice

The Supplier shall assist the Customer with data protection impact assessments and prior consultation with the supervisory authority in accordance with Articles 35–36 GDPR, if requested by the Customer.

Communication

Referral

If any data subject, supervisory authority, or other external party contacts the Supplier regarding Personal Data, the Supplier shall immediately refer the request to the Customer.

Rights of the data subject

Rights

Where possible and considering the nature of the processing, the Supplier shall assist the Customer through appropriate technical and organizational measures in fulfilling their obligation to respond to requests for exercising the rights of the data subject under the GDPR.

Sub-processors

Prior authorization

The Supplier is hereby granted a general prior authorization to engage subcontractors for the processing of Personal Data (”Sub-processors”). The Supplier shall enter into written data processing agreements with all its Sub-processors, with at least the same level of obligations as the Supplier has under this Data Processing Agreement.

Duty to inform

The Supplier shall inform the Customer of any plans to engage new or replace Sub-processors, so that the Customer has the opportunity to object to such changes. Such objection must be notified to the Supplier within thirty (30) days from the Supplier informing the Customer of its plans, after which the Customer shall be deemed to have accepted the Sub-processor in question.

Exception

In the event that the Customer's objection to the engagement of a Sub-processor, in the Supplier's opinion, counteracts an effective provision of the Supplier's services, the Supplier may withdraw from the Subscription Agreement without any liability or obligation to pay a fine due to such withdrawal with a notice period of thirty (30) days.

Liability

The Supplier is responsible for its Sub-processors as if the processing had been carried out by the Supplier itself. A list of sub-processors, considered approved when the Data Processing Agreement is entered into, is set out in Appendix A.

Transfer outside the EU/EEA

Safeguards

The Supplier may only transfer Personal Data outside the EU/EEA if the Supplier ensures that the transfer is covered by appropriate safeguards, or is otherwise permitted under the Applicable Data Protection Legislation.

Permitted transfer mechanism

If the transfer mechanism used to ensure that the transfer is permitted under the Applicable Data Protection Legislation were to be declared invalid or unlawful by the Court of Justice of the European Union, the European Commission, or another competent EU institution or national court or authority, the Supplier shall ensure that all processing of Personal Data outside the EU/EEA takes place on the basis of another permitted transfer mechanism according to the Applicable Data Protection Legislation.

Power of attorney

By entering into this Data Processing Agreement, the Customer grants the Supplier a power of attorney to represent the Customer in signing standard contractual clauses (appendix to the European Commission's decision 2010/87/EU of 5 February 2010 concerning the transfer of Personal Data outside the EU/EEA, or such approved clauses that replace or supplement these, in the Customer's name and on the Customer's behalf. Furthermore, the Customer expressly agrees that the Supplier may also represent the sub-processor in question in relation to the standard contractual clauses.

Review and control

Controls

The Supplier shall give the Customer access to all information that the Customer needs to verify that the Supplier fulfils its obligations under this Data Processing Agreement. The Supplier shall also enable and contribute to audits/inspections that the Customer, with at least ten (10) days' notice, conducts themselves or with the help of a third party (however, not a competitor of the Supplier).

Confidentiality undertakings

The Customer may only carry out audits/inspections on the Supplier's premises during the Supplier's normal office hours and shall be carried out in a manner that does not impede the Supplier's obligations towards its customers, subcontractors, or third parties. The Customer and others who will participate in auditing/inspecting the Supplier, shall first sign customary confidentiality undertakings with the Supplier.

Transfer and erasure

Upon termination of the agreement

When the Subscription Agreement expires or when the Customer requests it, the Supplier shall, without undue delay and according to the Customer's instruction, erase all Personal Data or transfer all Personal Data to the Customer and subsequently erase existing copies.

Exception

The Supplier may save/process Personal Data without hindrance to this Data Processing Agreement if required by the Supplier in order for the Supplier to fulfil its legal obligations and the Supplier first informs the Customer of the legal requirement.

Applicable law and dispute resolution

Application of law

Swedish law applies to this Data Processing Agreement, with the exception of choice of law rules that imply the application of foreign law. The provisions of the Subscription Agreement regarding dispute resolution also apply to this Data Processing Agreement.

Liability

In case of breach of contract

The Supplier shall compensate the customer for its damages to the extent that the Supplier's action has constituted a breach of the Data Processing Agreement or the Applicable Data Protection Legislation. To the extent permitted by Applicable Data Protection Legislation, the Supplier's liability shall under no circumstances exceed 100% of the compensation paid by the Customer during a calendar year. Otherwise, the same liability limitations as stated in the Subscription Agreement apply.

Agreement term

Validity

This Data Processing Agreement applies from the day it is signed by the parties until the day the Supplier stops processing Personal Data.

Compensation

Cost price

The Supplier is entitled to invoice the Customer for its costs (at cost price) for assisting the Customer with impact assessments, prior consultations, individual requests for exercising the rights of the data subject, and for transferring and erasing Personal Data. The Supplier is also entitled to invoice the Customer for the Supplier's costs (at cost price) in connection with any audits/inspections by the Customer, unless these show that the Supplier has significantly failed in its obligations under this Data Processing Agreement.

Interpretation

Priority of interpretation

This Data Processing Agreement shall take precedence over the Subscription Agreement in all matters relating to Personal Data.

Appendix A

Subject of processing

In connection with the use of the Vyer service, the Customer and the Customer's Users have the opportunity to save information on their Organization Account, for example when marking details in the premises and reporting errors. The information may contain personal data.

Nature and purpose of processing

The Supplier will process Personal Data for the purpose of:

  • Providing the service in accordance with the Subscription Agreement, and otherwise in accordance with the Customer's documented instructions.

  • Storing information for the Customer that the customer chooses to save on their Organization Account in the Vyer service.

Categories of data subjects

The Customer's employees and other individuals whose data is needed for the use of the Vyer service.

Categories of Personal Data

  • Name

  • Phone

  • Email

  • Position

  • Responsibility

Processing time - retention periods

The Supplier will process Personal Data for as long as the Subscription Agreement runs and for a limited time thereafter in accordance with this Data Processing Agreement, unless Personal Data is erased beforehand by the Customer.

Sub-processors

  • Google Cloud Services, Germany, storage of building information

  • Sendgrid, USA, email notifications

  • Intercom, EU, support communication

  • Flagsmith, UK, Control access to specific features

  • Mixpanel, EU, Usage analysis for service improvement

  • Attio, UK, User groups for support communication