GDPR Statement

Last Updated: August 26, 2026

Our Commitment to GDPR

Solidafy Labs AB is a Swedish company committed to full compliance with the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"). As a company established within the EU, data protection is fundamental to how we design, build, and operate our platform.

This statement outlines our approach to GDPR compliance across all aspects of the Solidafy Intelligence Platform, including DevAnalytics and future product modules.

Data Controller and Processor Roles

When We Are a Controller

Solidafy acts as a data controller for personal data we collect directly, including:

  • Website visitor data (via cookies and analytics)
  • Contact form submissions and sales inquiries
  • Account registration data (name, email, company)
  • Marketing communications data

When We Are a Processor

Solidafy acts as a data processor when we process Customer Data through the Intelligence Platform (e.g., data synced from GitHub, Jira, Linear, CI/CD systems). In this capacity:

  • The Customer is the data controller
  • Processing is governed by our Data Processing Agreement
  • We process data solely based on the Customer's documented instructions
  • We do not use Customer Data for our own purposes

Legal Basis for Processing

We rely on the following legal bases under Article 6 GDPR:

  • Contract performance (Art. 6(1)(b)): To provide our Services, manage accounts, and fulfill contractual obligations.
  • Legitimate interests (Art. 6(1)(f)): Service improvement, security, fraud prevention, and direct marketing to existing customers.
  • Consent (Art. 6(1)(a)): Marketing emails to non-customers, non-essential cookies. Consent can be withdrawn at any time.
  • Legal obligation (Art. 6(1)(c)): Tax, accounting, and regulatory requirements under Swedish and EU law.

Data Subject Rights

Under GDPR, data subjects have the following rights. We have processes in place to handle all requests within 30 days:

  • Right of access (Art. 15): Obtain confirmation of whether personal data is being processed and receive a copy of that data.
  • Right to rectification (Art. 16): Have inaccurate personal data corrected without undue delay.
  • Right to erasure (Art. 17): Have personal data deleted when no longer necessary for the purposes collected ("right to be forgotten").
  • Right to restriction (Art. 18): Restrict processing in specific circumstances (e.g., while accuracy is being verified).
  • Right to data portability (Art. 20): Receive personal data in a structured, commonly used, machine-readable format.
  • Right to object (Art. 21): Object to processing based on legitimate interests, including profiling and direct marketing.
  • Right regarding automated decision-making (Art. 22): Not be subject to decisions based solely on automated processing. Note: Solidafy does not make automated decisions that have legal or similarly significant effects on data subjects.

To exercise any right, contact us at privacy@solidafy.com.

For data processed by Solidafy as a processor (Customer Data), data subjects should contact the relevant Customer (data controller) directly.

Data Protection by Design and Default

In accordance with Article 25 GDPR, we implement:

  • Data minimization: We collect and process only the data necessary for the stated purposes.
  • Purpose limitation: Data is used only for the purposes specified at collection.
  • Storage limitation: Data is retained only as long as necessary and deleted when no longer needed.
  • Security by design: Encryption, access controls, and security measures are built into the platform architecture.
  • Privacy by default: The most privacy-protective settings are applied by default.

International Data Transfers

As an EU-based company, we process customer platform data entirely within the EU/EEA — all sub-processors that process customer personal data, including AI inference, are EU-located, and no Chapter V transfer mechanism is engaged for that data. For website and business-operations data, where transfers to third countries are necessary, we implement appropriate safeguards:

  • EU adequacy decisions (where available)
  • Standard Contractual Clauses (SCCs) adopted by the European Commission
  • Supplementary measures following Schrems II guidance where appropriate

For details on sub-processors and their locations, see our Sub-processor list.

Data Breach Response

We maintain a documented data breach response procedure. In the event of a breach:

  • We will notify the relevant supervisory authority within 72 hours (where required under Art. 33 GDPR)
  • Affected data subjects will be notified without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Art. 34 GDPR)
  • Where we act as a processor, we will notify the Controller without undue delay (within 72 hours)
  • We document all breaches, including facts, effects, and remedial actions taken

Records of Processing Activities

In accordance with Article 30 GDPR, Solidafy maintains records of processing activities, covering both our controller and processor processing operations.

Supervisory Authority

Our lead supervisory authority is:

  • Integritetsskyddsmyndigheten (IMY)
  • Swedish Authority for Privacy Protection
  • Box 8114, 104 20 Stockholm, Sweden
  • Website: www.imy.se
  • Email: imy@imy.se

Data subjects have the right to lodge a complaint with IMY or their local supervisory authority if they believe their data protection rights have been infringed.

Contact