Privacy Policy

6.1 General Retention Principles

Sumbios retains personal data for no longer than reasonably necessary for the purposes for which it was collected or otherwise processed, subject to applicable legal, regulatory, contractual, operational, security, and evidentiary requirements.

The applicable retention period may vary depending on:

• the nature and sensitivity of the information;

• the purpose of processing;

• the relationship between Sumbios and the relevant individual or customer;

• whether the information forms part of a shared dataset or professional-network record;

• applicable limitation periods;

• accounting, taxation, or regulatory requirements;

• fraud-prevention and security requirements; and

• the need to establish, exercise, or defend legal claims.

Sumbios may retain certain information after an account has been deleted where such retention is required or permitted under applicable law.

6.2 Data Export and Deletion Requests

Sumbios provides mechanisms through which users may, subject to applicable law and technical limitations, request:

• access to personal data;

• receipt of personal data and, where applicable, data portability;

• correction of inaccurate personal data;

• deletion of personal data;

• restriction of certain processing;

• objection to certain processing;

• withdrawal of consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;

• rights relating to solely automated decision-making, including profiling, where applicable;

• lodging a complaint with the competent data-protection supervisory authority, including the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), or another competent supervisory authority where applicable; and

• other rights provided by applicable data-protection law.

These rights are not absolute and may be subject to conditions, exemptions and limitations under applicable law. We may need to verify your identity before acting on a request.

Where Sumbios acts solely as Processor in relation to the relevant Personal Data, a request may need to be directed to, or handled in cooperation with, the relevant Subscriber acting as Controller.

Different categories of information may be stored in different technical systems. Certain professional-network information may also be associated with multiple users, customers, organizations, or shared datasets.

Accordingly, deletion of an account or submission of a deletion request may not result in the immediate or complete removal of every associated record from every system, backup, third-party provider, or shared dataset.

6.3 Self-Service Privacy Purge

Sumbios may provide an application-level self-service privacy-purge functionality.

Depending on the systems involved, the self-service privacy purge may delete or anonymize user-specific application records, private relationship-memory or graph records, and user-linked billing or credit-ledger references.

Where initiated and completed, this process is intended to be irreversible with respect to the relevant application-level information.

Because information may also be stored or processed by authentication, payment, integration, hosting, storage, caching, backup, security and other service providers or connected third-party platforms, a self-service privacy purge may not by itself remove information from every such system. Data held in those systems is handled in accordance with applicable deletion workflows, contractual arrangements, retention requirements and provider-specific processes.

Shared professional profiles, cached enrichment data, signals, embeddings, derived data, aggregate data, or other information may also remain where such information:

• relates to other users or organizations;

• forms part of a shared professional-network dataset;

• is required to maintain the integrity of other users’ records;

• has been appropriately anonymized; or

• is subject to a legitimate or legally required retention period.

6.4 Administrative Account-Erasure Process

Sumbios may operate a separate administrative account-erasure workflow.

Such workflow may include a configurable grace period, currently expected to be ninety (90) days, during which:

• the relevant account may be disabled;

• access to the Service may be suspended; and

• an erasure request may, where supported, be cancelled.

Following completion of final account erasure, the applicable account may no longer be recoverable.

The administrative account-erasure process may include measures such as:

• revocation of connected integrations;

• deletion or deactivation of the relevant authentication identity;

• deletion or anonymization of certain account-level records.

This workflow is separate from the self-service privacy-purge functionality and may involve different systems, timelines, and technical processes.

6.5 Shared Professional-Network Information

Sumbios distinguishes, where technically supported, between user-specific workspace or CRM information and professional-network information that may be relevant to more than one user or organization.

User-owned workspace and CRM information is intended to remain private and logically separated from shared professional-network information.

Certain profile-level fields may, however, form part of shared professional-profile records. Depending on the current technical implementation, these fields may include:

• professional email addresses;

• telephone numbers;

• dates of birth or birthdays;

• social-media or professional-network account identifiers; and

• other profile-level information.

Accordingly, unless the applicable technical access controls and data model have been verified for the relevant category of information, Sumbios does not represent that every profile field is necessarily maintained as an isolated copy for each user, organization, or professional network.

6.6 Information Retained Following a Deletion Request

Sumbios may retain personal data following a deletion or account-erasure request where reasonably necessary and legally permitted, including to:

• comply with legal, regulatory, tax, or accounting obligations;

• maintain financial or billing records;

• prevent fraud or abuse;

• maintain security and system integrity;

• establish, exercise, or defend legal claims;

• maintain records of privacy requests;

• honor suppression or objection requests;

• prevent information that has been validly suppressed from being reprocessed; or

• preserve information forming part of a shared dataset where deletion would materially affect the rights, records, or legitimate interests of other users or organizations.

Where possible and appropriate, information retained for these purposes may be restricted from ordinary product use.

6.7 Opt-Out, Suppression, and Re-Ingestion

Where Sumbios accepts a valid objection, deletion or opt-out request, we will take reasonable measures appropriate to the nature of the processing to delete, restrict or suppress the relevant information. Where appropriate, we may retain the minimum information necessary to record and honour the request and reduce the risk of the same information being unintentionally reprocessed.

Because professional information may also be supplied independently by users, connected services, enrichment providers or public sources, Sumbios cannot guarantee that the same information will never be received again from another lawful source. If information is subsequently re-obtained, applicable suppression controls and data-subject rights will continue to apply.

6.8 Browser Capture and Previously Processed Information

Withdrawal of consent, disabling of a browser extension, or termination of a browser-based data-capture function prevents future processing to the extent applicable to that functionality but does not necessarily result in automatic deletion of information lawfully collected, generated, or derived before the withdrawal or disabling occurred.

Such information will instead be handled in accordance with this Privacy Policy, applicable retention periods, and any valid data-subject request.

6.9 Publicly Available Information

Information that is publicly available may nevertheless constitute personal data where it relates to an identified or identifiable individual.

Sumbios will therefore process publicly available personal data in accordance with applicable data-protection requirements and does not treat the public availability of such information as automatically removing applicable privacy obligations.

6.10 Connected Services and Third-Party Processing

Information obtained through connected services may be processed by Sumbios and by service providers involved in the operation of the Service, including providers of:

• cloud and technical infrastructure;

• integrations;

• enrichment;

• analytics;

• communications;

• payments;

• security; and

• artificial intelligence services.

Such processing is subject to applicable contractual, privacy, confidentiality, and security requirements.

6.11 AI-Generated Information and Inferences

AI-generated summaries, recommendations, classifications, relationship insights, scores, or other inferences may themselves constitute or contain personal data where they relate to an identified or identifiable individual.

Where applicable, Sumbios will apply appropriate measures relating to:

• transparency;

• accuracy;

• correction;

• contestability;

• human review; and

• other safeguards required under applicable law.

Unless expressly disclosed for a particular feature, Sumbios does not use AI-generated outputs to make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning individuals. If such processing is introduced, Sumbios will provide the information, rights and safeguards required under applicable law.

6.12 Policy and Service Development

The Service, technical architecture and data-handling practices may evolve over time.

Sumbios periodically reviews and updates its privacy, security, retention, deletion, access-control, third-party processing, opt-out, suppression and AI-governance practices to reflect changes in the Service, applicable law and regulatory guidance.

Where changes to this Privacy Policy are material, Sumbios will take reasonable steps to notify affected users as required or appropriate under applicable law.