Privacy notice
Last updated 02.10.2026
This notice covers all of sydera.io, including Policy Scan Enterprise and requests for an Executive Brief. We collect as little as possible, and only for the purpose stated at each form. We do not sell information, do not use it for advertising and make no automated decisions about you.
1. Data controller
Sydera.io Technologies AS, org. no. 935 699 827, a wholly owned subsidiary of STÖ GROUP AS. Privacy enquiries: hello@sydera.io. We reply within 30 days.
2. When you visit the site
We count page views and a few events with Plausible Analytics, hosted in the EU. Plausible sets no cookies and stores nothing that can follow you over time or across websites. The IP address and browser information are used briefly to tell visits apart within the same day, and are not stored. Events never contain names, e-mail addresses, organisations, answers or points. Legal basis: legitimate interest in understanding which pages are useful (GDPR art. 6(1)(f)).
The site is served by Lovable with Cloudflare in front. Cloudflare sets the cookie __cf_bm to tell visitors apart from automated bots. It expires after 30 minutes. Language choice and similar settings are stored only in your browser. Beyond this we set no cookies for visitors.
3. The guide and the PDF
The guide can be read openly without registration. If you ask for the PDF by e-mail, we use the address only to send the link. In the database we do not store the address itself, only a one-way checksum of it and the link, so that the link works and misuse can be stopped. The link and checksum are deleted automatically after 7 days. Legal basis: delivering what you asked for (GDPR art. 6(1)(b)).
If you tick the box for notice of a new edition, we store the e-mail address, optionally the organisation, the language and the time of consent. The list is used only to announce new editions. Legal basis: consent (art. 6(1)(a)). You unsubscribe with the link in every e-mail and are then removed from the list.
4. The report «The requirement that turns inward»
The report can be downloaded directly without an e-mail address. If you ask to have it sent, we store your name, organisation, e-mail address and that the report was sent. The details are used only for the dispatch and, where relevant, one reply. Legal basis: consent (art. 6(1)(a)). The details are deleted no later than 24 months after receipt, or earlier if you ask.
5. Executive Brief and Policy Scan Enterprise
When you request an Executive Brief, we store your name, group, work e-mail, role if given, any message and which sources the brief should use. We use the details to prepare the brief and to reply to you. Legal basis: legitimate interest in answering a request from the organisation you represent (art. 6(1)(f)). You can object to the processing at any time.
The brief uses only sources the group has published itself, or documents you choose to send. We read governance documents as governance text. We do not assess individuals and never ask for health information or individual cases.
If you upload PDFs, you first confirm that the material contains no personal data, apart from named public roles (board, management and line managers) in documents prepared for the board, investors or authorities. We review the files manually before they are read, but cannot guarantee that everything is caught. It is the sender's responsibility to send only approved governance documents. If we find personal data, we delete the file and let you know.
Files are stored encrypted in a private area that only Sydera's administrators can access. They are deleted automatically 90 days after receipt. The request itself is deleted after 12 months.
If the group moves on to an agreed delivery where Sydera processes information on the group's behalf, we sign a data processing agreement. The standard agreement can be downloaded below.
6. E-mail from us
E-mail is sent through Lovable Email. The service logs the recipient address, which e-mail was sent and its status, so that we can document the dispatch and respect unsubscribes and bounces. The log is deleted after 12 months. Addresses that have unsubscribed are kept on a suppression list for as long as needed to make sure we do not send again.
7. The game «Mission: human»
The game runs in your browser. Answers, choices and points are not stored and are not sent to us. We only count how many start and finish (see section 2).
8. Sign-in
Only Sydera's own administrators and customers with an agreement can sign in. For them we store e-mail address, name, organisation and sign-in events for as long as the account is active. Legal basis: contract (art. 6(1)(b)).
9. Health data and special categories
Sydera never asks for health data or other special categories under GDPR art. 9, and neither forms nor analyses are designed to receive them. If you have sent anything like that anyway, we delete it when we find it.
10. Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability. You can object to processing based on legitimate interest and withdraw consent at any time, without affecting processing that took place before. Write to hello@sydera.io. We reply within 30 days.
You can also complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no).
11. Sub-processors
| Provider | What they do | Where |
|---|---|---|
| Lovable | Hosting of the site, database, file storage and sign-in | EU (database), global delivery of web pages |
| Cloudflare | Delivery of pages and protection against automated attacks | Global network; EU Standard Contractual Clauses |
| Lovable Email | Sending the e-mails we send you | EU/USA; EU Standard Contractual Clauses |
| Plausible Analytics | Cookie-free visitor statistics | EU |
Transfers outside the EU/EEA take place only with a valid transfer mechanism under GDPR Chapter V, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
12. Retention
| Information | Kept for |
|---|---|
| Link to the guide PDF (checksum) | 7 days |
| Notice of a new edition of the guide | Until you unsubscribe |
| Files uploaded for an Executive Brief | 90 days |
| Executive Brief request | 12 months |
| E-mail dispatch log | 12 months |
| Enquiries and report dispatches | 24 months |
| Sign-in account | For as long as the account is active |
Deletion runs automatically every night. You can always ask for earlier deletion.
13. Data processing agreement
Standard data processing agreement for groups that use Sydera to process data on their behalf. It applies only when an agreed delivery involves us processing personal data for you.
14. Changes
02.10.2026: One notice for the whole site and Policy Scan Enterprise. Added the Executive Brief, sub-processors, retention periods and the data processing agreement. Removed services that have been retired.