Privacy policy
Last updated
This is a translation for convenience; the Swedish version is legally binding. Läs originalet på svenska.
This policy describes how Värn processes personal data when you visit the website and use the service.
Controller
- For account data and website visits, Värn is the controller.
- For data processed in the service on behalf of your organisation – for example affected accounts in data breaches – your organisation is the controller and Värn is the processor. The processing is governed by a data processing agreement.
What data we process
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | Name, email address, language choice | Providing the service | Contract |
| Sign-in security data | Session data, two-step verification | Protecting the account | Contract and legitimate interest |
| Organisation data | Organisation name, company registration number, roles | Administering the organisation | Contract |
| Audit log | Who did what and when | Security and traceability | Legitimate interest |
| Data breaches (as processor) | Local part of affected email addresses, the breach name and types of data | Monitoring on the customer's behalf | The customer's instructions |
We never process passwords or other content from data breaches. Monitoring of your websites collects technical configuration – not content from your visitors.
Retention and deletion
- Raw check results are deleted after the retention period the organisation chooses (30–1,095 days).
- Notifications are deleted after 12 months and the audit log after 24 months.
- Closed invitations are deleted 90 days after they expired, were accepted or were revoked.
- Account data is kept for as long as the account exists.
- The organisation's owner can export all data and delete the organisation at any time under Settings → Data and deletion. Deletion happens immediately and cannot be undone. We keep only a note that the deletion took place (the organisation's id, the time, who deleted it and the number of records deleted), except for data we are required by law to keep.
- Deleted data remains in the database backups for at most 7 days.
Subprocessors
We use the following types of suppliers:
- Database and authentication – hosted in an EU region.
- Error reporting – Sentry, hosted in the EU (Frankfurt). Receives technical error reports from our servers when something goes wrong. The reports contain the error message, the line of code and which page or function was affected, and may contain internal id numbers. We never send names, email addresses, IP addresses, cookies or form content.
- Uptime monitoring – Better Stack, which checks that the website and the background service are running. No personal data about you or your users is sent there.
- Data breach monitoring – Have I Been Pwned (only domain names are sent in requests).
- Email delivery – for notifications and invitations, if email is enabled.
- Visitor statistics – Plausible Analytics, hosted in the EU, on the public website and the sign-up pages (not in the service). Plausible uses no cookies and stores no personal data; we only see aggregated statistics.
An up-to-date list is available on request.
Cookies
We only use necessary cookies for sign-in, security and language choice, and a cookie that remembers whether you chose the light or dark look on the website. We use no cookies for advertising, tracking or statistics.
Your rights
You have the right to request access to, rectification or erasure of your personal data, to request restriction, to object to processing and to receive data you have provided in a machine-readable format. Contact us at kontakt@varnsecurity.se. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).
Changes
We update the policy when the service or the processing changes. Material changes are announced in the service.