Privacy policy

What we process, why, and for how long

When you contact us

We process your name, your contact details and whatever your message contains, in order to answer your enquiry. The legal basis is our legitimate interest in answering the enquiries we receive (Article 6(1)(f) GDPR). We delete the correspondence twelve months after the matter is closed.

When you visit the website

The web server records the IP address of your device, together with the time and the page requested, in a log we use to keep the website secure and available: to detect faults, overload and abuse. The legal basis is our legitimate interest in keeping the website secure and available (Article 6(1)(f) GDPR). Logs are deleted after 30 days. The website runs on Kntnt Sweden AB's platform, with server infrastructure from Hetzner Online GmbH.

Information we publish about people

As a company listed on Nasdaq First North Growth Market we publish information about identifiable people on this website:

• Transactions by persons discharging managerial responsibilities. Name, position and the details of each notified transaction: instrument, nature, date, volume and price. The information comes from the public insider register kept by Finansinspektionen (the Swedish Financial Supervisory Authority). The record stays on the website for as long as the company’s shares are admitted to trading.
• Our largest shareholders. Name and holding as at the most recent reconciliation date, from the public share register and public nominee list kept by Euroclear Sweden AB. The table shows the most recent snapshot and is replaced when a new one is published.
• Our board and management. Name, role, background and photograph, for as long as the person holds the position.

Press releases and reports in the disclosure archive also name people where the news did – an executive quoted, a nominee proposed – and remain part of the market’s record. The legal basis for these publications is our legitimate interest in giving shareholders and the market the transparency expected of a listed company (Article 6(1)(f) GDPR).

Who receives your personal data

SeaTwirl engages Kntnt Sweden AB as processor to operate and administer the website and its services on SeaTwirl's behalf. Kntnt Sweden AB in turn engages Hetzner Online GmbH as sub-processor for server infrastructure. The processors handle the data under the instructions in this chain. We also disclose data to public authorities where the law requires it. We never sell personal data.

Your rights

You have the right to:

• access – ask whether we process personal data about you, and receive a copy of it;
• rectification – have inaccurate data about you corrected;
• erasure – have your data deleted, for instance when you have withdrawn your consent or the data is no longer needed;
• restriction – have the processing paused while a dispute about it is settled;
• objection – set out separately in the next section, as the law requires;
• data portability – receive the data you have given us in a machine-readable format, where we process it on the basis of your consent.

To exercise any of these rights, email us at info@seatwirl.com. It costs nothing, and we reply within a month.

Your right to object

Because we base some processing on legitimate interest, you have the right to object to it at any time, on grounds relating to your particular situation. If you object, we stop the processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms. Object by emailing us at info@seatwirl.com.

Withdrawing your consent

Where we process your personal data on the basis of your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of the processing that took place before it.

Complaints

If you think we are handling your personal data wrongly, you have the right to complain to a supervisory authority. In Sweden that is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se[2]. You can also complain to the authority in the EU country where you live or work.

Changes to this policy

Last updated: 26 August 2026