Privacy Policy
Last updated: 12 September 2026
1. Who is responsible for your personal data?
Qualidact, operated by Finn Toompuu as a Swedish sole trader, is the data controller for personal data that Qualidact determines how and why to process.
Business address: Boalt 1393, SE-286 92 Örkelljunga, Sweden
Email: hello@qualidact.com
Phone: +46 73 522 22 90
2. What data we process
Depending on how you use the site or services, Qualidact may process:
- identity and contact data, such as name, business name, email address, billing address and phone number;
- transaction data, such as product purchased, amount, currency, payment status, invoice information and Stripe checkout/session identifiers;
- business and tax information that you provide at checkout, including VAT/tax identifiers where applicable;
- technical and security data, such as IP address, browser/device information and request/security logs processed through hosting and security infrastructure;
- correspondence and support information when you contact Qualidact.
Qualidact does not receive or store your full payment-card number. Card and payment credentials are handled by Stripe.
3. Why we process data and our legal bases
- To process and deliver orders: necessary to perform the purchase contract or take steps connected with it.
- To handle accounting, tax and legal obligations: necessary to comply with legal obligations.
- To provide support and manage business relationships: necessary for the contract and, where appropriate, Qualidact's legitimate interest in operating and supporting the business.
- To protect the website, prevent abuse and troubleshoot: Qualidact's legitimate interest in maintaining secure and reliable services.
4. Service providers and recipients
Qualidact uses service providers that may process personal data on our behalf or as independent controllers for their own regulated activities. Current core providers include:
- Stripe for checkout, payment processing, payment status and related tax/payment functions;
- Cloudflare for DNS, website hosting/delivery, security and network infrastructure;
- email services used to receive and respond to business correspondence.
Personal data may also be disclosed where required by law, to professional advisers, or to authorities where there is a lawful basis.
5. International transfers
Some service providers may process data outside Sweden or the European Economic Area. Where GDPR requires safeguards for such transfers, the relevant transfer must be supported by an adequacy decision or appropriate safeguards such as approved standard contractual clauses, as applicable.
6. How long we keep data
Qualidact keeps personal data only for as long as needed for the purpose for which it was collected or for legal obligations. Accounting records and related transaction information are retained for the period required by Swedish accounting law. Support correspondence is kept only as long as reasonably needed to resolve the matter and document the business relationship. Security and infrastructure logs are retained according to the relevant service configuration and provider requirements.
7. Cookies and similar technologies
Qualidact does not currently use advertising or behavioural-marketing cookies on the website. Cloudflare and Stripe may use cookies or similar technologies that are necessary for security, fraud prevention, checkout or service operation when you use their services. If Qualidact later introduces optional analytics or marketing technologies that require consent, this policy and the website's consent mechanism will be updated before use.
8. Your GDPR rights
Subject to the conditions and exceptions in applicable law, you may have the right to request access to your personal data, correction, deletion, restriction of processing, data portability, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent for future processing.
To exercise a right, email hello@qualidact.com. Qualidact may need to verify your identity before acting on a request.
9. Complaints
You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or another competent data-protection authority.
10. Security
Qualidact uses reasonable technical and organisational measures appropriate to the size and nature of the business, including HTTPS delivery, restricted access to payment secrets and server-side payment verification. No online service can guarantee absolute security.
11. Changes
This policy may be updated when Qualidact changes providers, data uses or legal requirements. The latest version will be published on this page with an updated revision date.
12. Contact
Privacy questions: hello@qualidact.com.