Privacy notice

Who is responsible?

Nobelton AB, Swedish company registration number 556886-4515, is the controller for personal data handled through nobelton.se and our initial enquiry process. Contact us about privacy or your rights at [email protected] or by telephone on +46 70 787 50 64.

This notice covers website visitors, people who contact us and representatives who register acquisition interests. A later advisory engagement, due-diligence process or transaction can involve different information, recipients and retention obligations; we provide relevant information before that additional processing begins. Submitting a form does not itself establish an advisory engagement.

The information we handle

A general enquiry asks for your name, email address, enquiry category and preferred language. Company name and a brief description are optional. A buyer enquiry asks for your name, organization, business email, preferred language and a short description of your acquisition interest. You may also provide buyer type, sectors, geographical interests, indicative acquisition value and currency, timing, decision-making role and a general funding approach.

We also record the form, submission time, a reference, language/category, the version fingerprint of the privacy notice and the status of staff handling and notification delivery. Messages and any follow-up correspondence may contain additional information you choose to provide. Please share another person’s details only when you are entitled to do so and direct them to this notice.

Please do not use the forms to send identity numbers, health information, criminal-case details, bank-account details, confidential transaction documents or other sensitive information. The forms do not offer file uploads or request financial evidence. Ask us for an appropriate secure channel first.

To deliver and protect the website, our hosting and security services process technical information such as IP addresses, requested addresses, request times, browser/device information and security events. The Nobelton form system processes IP addresses to create short-lived, keyed rate-limit identifiers; it does not save raw IP addresses, browser identifiers or referring addresses in the enquiry record. This does not mean that hosting and security providers keep no logs.

Why we use the information

We use enquiry information to assess and answer requests, arrange a discussion and consider acquisition criteria supplied to us. For a person asking us to take steps towards a contract with that person, the basis is Article 6(1)(b) GDPR. For company representatives, general business enquiries and manually assessing submitted acquisition interests, we rely on Article 6(1)(f): our legitimate interest in communicating with relevant business contacts and dealing with requests they initiate.

Operating, protecting and troubleshooting the website and documenting its handling process rely on our legitimate interests in secure, reliable services and preventing misuse. Where particular information must be retained to comply with a legal obligation, Article 6(1)(c) applies; handling or defending a legal claim may instead require a limited, documented legitimate-interest retention period.

A form’s privacy link informs you about processing; it is not marketing consent. Sending an enquiry does not subscribe you to a newsletter. Information is not used for an automated decision about accepting an engagement or qualifying a buyer. Automated security checks can reject suspected spam; contact us by email or phone if the form does not work.

Providing information is voluntary, but we need the required contact and enquiry fields to process a form and respond. Optional fields can be left blank. Please limit free text to what is necessary for your initial request.

Who receives the information?

Enquiries are stored privately in the website’s WordPress database using Contact Form 7, Flamingo and Nobelton Core. Authorized staff with appropriate access can read and handle them. Hosting, backup, security and email service providers process information needed to run these services. Hostup AB supplies the hosting and configured mail service; Cloudflare provides security checks used to access this website, including its administration area.

The configured staff notification mailbox is [email protected], provided by Google. The website notification includes a reference, category, language and a link requiring staff sign-in. It does not include the sender’s name, email address, company or message text. References and technical email metadata can nevertheless relate to an enquiry. Direct emails and later replies are separate from these minimal website notifications and can contain the information you include.

We do not publish enquiries or automatically send them to counterparties. If your request requires an external adviser or partner, we will identify the intended recipient and relevant arrangements before sharing the enquiry for that purpose. Information may also be disclosed where a legal obligation or a necessary legal claim requires it.

Processing outside the EU/EEA

Using a Swedish hosting provider does not mean that every associated service processes information only in Sweden. Hostup’s published service and processing documents identify international subprocessors, and Google and Cloudflare operate internationally. Depending on the service, information may therefore be processed outside the EU/EEA, including in the United States.

International processing must be covered by the applicable GDPR transfer rules, for example an applicable adequacy decision or standard contractual clauses with any necessary supplementary measures. The relevant provider, service and agreement determine the arrangement; a Swedish domain or a Gmail address is not itself a safeguard. Contact us for information about the safeguards applicable to your information and how to obtain a copy. Provider information is available from Hostup at https://hostup.se/legal/, Google at https://policies.google.com/privacy/frameworks and Cloudflare at https://www.cloudflare.com/privacypolicy/.

How long information is kept

The website retention period is 30 days after a staff member marks an enquiry handled, not 30 days after it is submitted. After that period, the website entry and its associated delivery record are eligible for permanent deletion by scheduled processing. A documented retention hold can postpone deletion where a continuing legal or operational need requires it; the reason must be reviewed and the hold removed when no longer necessary.

Enquiries still being handled are kept only while needed for a genuine outstanding request. They are not automatically deleted by the handled-enquiry timer. We review outstanding enquiries and retention holds regularly and close or delete information when it is no longer needed. An acquisition registration does not create an indefinite buyer-directory entry.

Email correspondence, notification emails, exports and backups are separate copies and are not deleted by the website timer. They must be removed when no longer needed for the relevant correspondence, recovery or legal purpose. Backups are restricted to recovery, expire or are replaced under the applicable backup schedule, and must not reintroduce deleted information into ordinary use after restoration. Any information retained for a subsequent engagement or legal obligation is limited to that separate purpose.

Short-lived form-security identifiers have a two-hour expiry and are removed by scheduled cleanup. Hosting and security logs follow the applicable service’s security and incident-handling retention arrangements. Contact us for details relevant to a particular request.

Cookies and similar technology

Website functions and security checks can use cookies or similar browser storage. Cloudflare may store security-verification information; language handling may remember a language selection; signed-in staff use authentication cookies. These are different from the private enquiry records described above. You can manage stored cookies in your browser, but blocking necessary cookies may prevent a security check or other requested function from working.

A privacy notice is not consent to optional cookies. Where consent is required for analytics, advertising or other optional technology, you must be able to choose before that technology is activated and to withdraw your choice later. For information about the cookies and services involved in your visit, contact us using the details above.

Your rights and how to contact us

Subject to the conditions in the GDPR, you can request access to your personal data, correction, deletion, restriction of processing and data portability. You can object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it without affecting processing already lawfully carried out. These rights can have exceptions, for example where information is necessary for a legal obligation or a legal claim.

Send a request to [email protected]. Tell us what your request concerns and, if possible, the email address or reference used for your enquiry. We may ask for proportionate information to verify your identity; do not send identity documents unless we specifically arrange a secure and necessary verification method. We normally respond within one month and will explain any lawful extension.

You may complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), at https://www.imy.se/, or to the competent supervisory authority where you live or work. You do not have to contact us first.

This notice was prepared on 6 October 2026. We update it when the website or relevant processing changes.