Privacy policy
Reqventa is a B2B platform that helps companies handle incoming customer inquiries and quotation work. This policy describes how personal data is processed in and around the service, and distinguishes between cases where Reqventa is the controller and cases where Reqventa processes data on behalf of a customer.
- Version
- 1.0
This document is under legal review and has not yet been published as a final version.
1. Two roles under GDPR
Reqventa has two different roles depending on the processing in question. The distinction matters because it determines who decides how the data is used.
Reqventa is the controller for data processed for Reqventa's own purposes, such as user accounts, contract administration, support and security.
Reqventa is a processor for the content a customer organisation puts into or connects to the service, such as email, customer records, contact persons and quotation drafts. There, the customer company is the controller.
2. Reqventa as controller
When you create an account, contact us or book a demo, Reqventa processes data for its own purposes. Depending on how you use the service, the following categories may be processed:
- Account details: name, work email and role within the organisation
- Organisation membership: company and permissions within the company
- Authentication data: sign-in information and session data
- Communication: support tickets, demo requests and other correspondence
- Technical data and security logs related to use of the service
- Contract and customer administration, and billing-related data once invoicing is introduced
The purposes are to provide and administer the service, manage accounts and authentication, maintain security, provide support, manage the contractual relationship, improve service stability, prevent misuse and comply with legal obligations.
3. Legal basis
Processing necessary to deliver the service and administer the contractual relationship is based on contract, or steps taken prior to entering into a contract.
Processing for security, abuse prevention, logging, troubleshooting and improving service stability is based on legitimate interests, following a balancing test.
Processing required by law, for example accounting obligations, is based on legal obligation.
Consent is used only where it is genuinely the correct basis, for example voluntary subscription to updates. Consent can be withdrawn at any time without affecting processing already carried out.
4. Reqventa as processor
When a customer organisation uses Reqventa to process inquiries, email, contact details, customer records, quotation drafts, documents and product-related information, that content may include personal data. The customer organisation decides which data is added and for what purpose.
Reqventa processes such data only in accordance with the customer's documented instructions and the applicable agreement. That processing is governed by Reqventa's data processing agreement, which is the controlling document between the parties. This policy does not replace the data processing agreement.
5. Your business data is yours
The customer retains its rights to its business data. Reqventa claims no ownership of the customer's email, customer records, product data, price lists, quotations or other business information.
Reqventa receives only the limited right to process customer data required to deliver the service, carry out the customer's instructions, secure and maintain the service, troubleshoot errors and comply with legal obligations where applicable.
6. AI features
The service uses AI-based processing to interpret inquiries, suggest customer identification, match products and produce quotation drafts. Such processing may mean that the content of an inquiry is processed by one or more AI service providers engaged as subprocessors.
Reqventa will publish information about how customer data is handled by AI providers, including any use for model training, only once this has been verified with every provider and implementation involved. Verified subprocessors and processing regions are listed on the Subprocessors page.
7. Retention
Personal data is not kept longer than necessary for the relevant purpose or than required by law.
Account data is processed for as long as the account is active and thereafter for the period required for contractual, security or accounting purposes. Content added by a customer organisation is processed according to the customer's instructions and can be deleted or exported under the data processing agreement.
Specific retention periods are documented per category as they are established and made configurable in the service. Reqventa does not state exact periods before they are decided.
8. Recipients and subprocessors
Reqventa engages providers for hosting, database, email infrastructure and AI processing, among other things. They process personal data on Reqventa's behalf under data processing agreements.
Current, verified subprocessors, their purpose and processing region are listed on the Subprocessors page. Entries are published there only once verified.
9. Transfers outside the EU/EEA
If personal data is transferred to a country outside the EU/EEA, it takes place under a valid transfer mechanism in accordance with applicable data protection law, together with any supplementary measures required in the individual case.
Actual processing region and transfer mechanism per provider are shown on the Subprocessors page once verified.
10. Security
Reqventa applies technical and organisational security measures appropriate to the risks of the processing, including separate customer environments, database-level data isolation, access control, invitation-only account registration, encrypted communication and logging.
A closer description is available on the Security page. Reqventa makes no certification claims that are not verified.
11. Your rights
To the extent applicable data protection law grants you these rights, you may:
- request access to your personal data
- request rectification of inaccurate data
- request erasure
- request restriction of processing
- object to processing based on legitimate interests
- request data portability
- withdraw consent where processing is based on consent
- lodge a complaint with a supervisory authority
If your request concerns data for which a customer company is the controller, Reqventa will normally refer the request to that company and assist them rather than deciding the request independently.
In Sweden, the Swedish Authority for Privacy Protection (IMY) is the supervisory authority. If you are located in another country, the authority in that country may be competent.
13. Changes to this policy
This policy may be updated as the service, legislation or processing changes. The version and date of the latest update are shown at the top of the page, and previous versions are documented internally.