Privacy policyPrivacy policy

Who is responsible

Pixel Nordic AB is responsible for the personal data described here. This policy covers visits to pixel.se and contact with us through the website.

Swedish company registration number: 556954-1906. Our postal address and privacy contact are at the end of this page.

You can accept or reject optional cookies, or choose Statistics and Marketing separately. Open Cookie settings in the footer at any time to change your choice. Reading the website does not require consent to either category.

• What we collect
• Where it goes
• Why we use it
• How long we keep it
• Cookies and your choices
• Your rights

What we collect

Our server records your IP address, time, requested address (including any query string), response status and size, referring address and browser information. It also records the host, protocol and technical headers that distinguish page loads from other requests.

We use these logs for security, troubleshooting and daily traffic totals. To estimate daily visitors, the statistics process compares IP addresses and browser information in memory for that day. It saves counts, not those pairs, and does not link visitors across days or send the logs to Google or Upsales.

Saved reports contain totals by page, referring domain, source, device, browser and operating system, plus errors and bot traffic. They exclude IP addresses, full browser identifiers, full referring addresses and individual visit times. Query strings are removed except for cleaned campaign-source values; likely identifiers in paths and source values are masked.

With Statistics enabled, Google Analytics 4 collects page addresses and titles, referring addresses, cookie identifiers, visit timing, engagement, scrolling and link clicks. Technical details include browser, device, screen size, language and approximate location. Google receives your IP address to handle the connection; Google states that GA4 does not log or store IP addresses.

We also measure clicks on contact links and calls to action, including their location, label and destination. Google signals and optional account data-sharing settings are off. Google advertising user-data sharing and ad personalisation remain disabled.

With Statistics enabled, we also measure form starts, successful submissions, error types and thank-you page views. Events include form type, language and source page where relevant. The form fields themselves, including names, email addresses and companies, are not sent to Google Analytics.

With Marketing enabled, Upsales receives the page address (including its query string), title, referring address and random visitor and session identifiers. The connection also exposes your IP address and browser information. This helps our sales team see which companies visit and which pages interest them; the identifiers allow visits to be linked.

If you email info@pixel.se, we receive your email address, name if supplied, message, attachments and the technical information accompanying the email. Include only the information we need to answer.

Fonts and videos are served from our own website. There are no embedded social-media feeds or third-party video players. Following an external link takes you to a website with its own privacy policy.

When you use a form

The contact form asks for your first name, last name, email address, company and preferred language. All are required, together with confirmation that you have read this policy. That confirmation is not consent to marketing or optional cookies.

The newsletter form asks for your first name, last name, email address and company. Language is optional. We record your subscription choice when you tick the newsletter box and submit; this is separate from consenting to website tracking.

Upsales sends our newsletter. With the consent you give through the newsletter checkbox, emails use tracking pixels and tracked links to record opens and clicks so we can improve the briefing. Unsubscribe through the link in any issue or email info@pixel.se to withdraw that consent.

Your submission goes to our server and then to Upsales, where it can create or update a contact and company record. Our website does not keep a database of submitted fields or log their contents. Valid submissions from pixel.se are forwarded; submissions from preview or development hosts are not.

You can email us instead of using a form. Without the required fields or a successful spam check, the form cannot send your enquiry or sign-up.

How we protect forms

Cloudflare Turnstile loads when you focus or start using a form, or open the newsletter form. It connects to challenges.cloudflare.com to check for automated traffic, even if you reject Statistics and Marketing. It processes technical signals such as IP address, browser information, connection characteristics and website origin.

Our server validates the token with Cloudflare before forwarding a submission. We do not send the form fields through that validation request. Turnstile's pre-clearance option is off, so we do not use it to issue a cf_clearance cookie on pixel.se.

Cloudflare processes signals on our behalf to secure the forms, and as a separate controller to improve its bot detection. See its Turnstile privacy notice.

We also check a hidden spam field, submission timing and the number of attempts from an IP address. Attempt history is held in server memory. Application error logs record form type, outcome and reason without submitted fields; normal server access logs still record the request.

Where it goes

• Hetzner Online GmbH hosts the website, server logs and traffic reports in Falkenstein, Germany. Reports are protected by a password.
• Google provides Google Analytics and Google Tag Manager for optional Statistics, and Google Workspace for email. These services involve Google Ireland Limited, Google LLC and their service providers.
• Upsales Nordic AB provides visitor tracking, our customer relationship management system and newsletter services. Upsales receives optional Marketing data and information submitted through the forms.
• Cloudflare, Inc. provides Turnstile for form security, with the roles described above.

We have data processing agreements with these providers through their standard terms. Read Hetzner's data processing agreement, Google's data processing terms for Analytics and Tag Manager, Google Workspace's data processing addendum and Upsales' terms and data processing agreement.

Google's services can involve processing outside the EU/EEA, including in the United States. Its published terms describe the EU-US Data Privacy Framework for covered transfers and standard contractual clauses for other applicable transfers. These are legal safeguards for data sent abroad, not a promise that all data stays in Europe.

Upsales lists AWS in Sweden for its platform and customer data. Its data processing agreement requires an applicable GDPR transfer mechanism, such as EU standard contractual clauses, for transfers outside the EU/EEA.

Upsales lists SendGrid in the United States as an email-delivery subprocessor under EU standard contractual clauses.

We use Turnstile under Cloudflare's published terms and data processing addendum. Cloudflare processes data internationally, including in the United States. Its terms provide for the EU-US Data Privacy Framework for covered transfers and EU standard contractual clauses for other transfers that require them.

Read Google's transfer safeguards and Upsales' subprocessor information. Contact info@pixel.se to request a copy of the safeguards applicable to your data.

Why we use it

Under the EU General Data Protection Regulation (GDPR), our legal basis depends on the purpose:

• Legitimate interests, Article 6(1)(f), for running and protecting the website and producing aggregate reports from existing server logs. Our interest is a reliable, secure website and an understanding of overall use. Short log retention and reports without visitor identifiers limit the impact on you.
• Legitimate interests, Article 6(1)(f), for remembering and respecting cookie choices. This necessary cookie is exempt from optional-cookie consent under Chapter 9, Section 28 of Sweden's Electronic Communications Act.
• Consent, Article 6(1)(a), for Google Analytics under Statistics and Upsales visitor tracking under Marketing. You choose each purpose separately before its scripts load.
• Legitimate interests, Article 6(1)(f), for answering business enquiries by email or form and following up the discussion. Our interest is responding to people who approach us on behalf of their business.
• Consent, Article 6(1)(a), for the newsletter and measurement of opens and clicks, given through the newsletter checkbox. Withdraw by emailing us or using the unsubscribe link in an issue. Rejecting Marketing cookies does not unsubscribe you; unsubscribing does not change your cookie choice.
• Legal obligation, Article 6(1)(c), for keeping evidence of consent as required by Article 7(1). Legitimate interests, Article 6(1)(f), for a minimal suppression record after you unsubscribe, so we can respect your choice and prevent further newsletters.
• Legitimate interests, Article 6(1)(f), for form security, including Turnstile and attempt limits. Our interest is preventing automated abuse of forms you choose to use. This check is separate from optional website measurement.

Upsales links visits to identifiers and can identify a company, so it is not anonymous analytics. Our sales team reviews the visitor list manually. We do not use Upsales to profile individuals or make solely automated decisions with legal or similarly significant effects.

How long we keep it

• Server logs: daily rotation with 14 daily archives. Deletion follows the rotation schedule, rather than an exact 14-day timer for each request.
• Aggregate server reports: no fixed expiry. Saved daily counts do not retain IP addresses or individual visitor identifiers.
• Google Analytics: user-level and event-level retention is set to 14 months. User-identifier retention restarts with new activity. Google's standard aggregate reports are not covered by this expiry setting.
• Upsales visitor records: kept for 24 months, then deleted. Cookie expiry is separate from retention in Upsales.
• Email in Google Workspace: kept for as long as needed for the correspondence and customer relationship, then deleted according to our retention routines.
• Leads in Upsales: kept while there is an ongoing dialogue or customer relationship, or until you request deletion. We regularly remove inactive leads after 24 months without contact, subject to the exceptions to deletion described under Your rights.
• Newsletter records: kept until you unsubscribe. Afterwards, we keep only the suppression record needed to prevent further newsletters and evidence of your consent, for as long as needed to respect your withdrawal and demonstrate compliance.
• Form security: IP-based attempt history stays in server memory for no more than ten minutes. This does not change the separate retention of normal server access logs.
• Cloudflare Turnstile: Cloudflare's published notices do not specify a fixed number of days for signals. Its privacy policy bases retention on the processing purpose and legal obligations, with deletion, destruction or protection against further use at the end of that period. The ten-minute limit above applies to our server memory, not Cloudflare's systems.

Browser-cookie lifetimes are below. Withdrawing consent stops future optional tracking; it does not itself erase data already held by a provider. You can ask us to delete personal data under the rights described below.

Cookies and your choices

Cookies are small records stored in your browser. Our banner offers Accept all, Reject all and Settings. Acceptance and rejection are remembered for 182 days, about six months, unless you clear the cookie first. If the categories change, we ask again.

Before a choice, and after Reject all, neither Google Tag Manager nor Google Analytics nor Upsales visitor tracking loads. Statistics loads Google Tag Manager and Google Analytics. Marketing loads the Upsales script from img.upsales.com, which sends visit information to pxl.upsales.com. Marketing alone loads nothing from Google.

This is Google's basic consent mode: without Statistics consent, we do not send Google cookieless analytics pings or your default consent status. Our own server logging and aggregate reports continue independently of the banner.

The security check described above can still load when you use a form. Sending an enquiry or subscribing does not require Statistics or Marketing consent.

On a narrow screen, scroll the table sideways to read every column.

These cookies are stored under pixel.se (first-party cookies). Google and Upsales supply the optional cookies and receive the associated data. In the Upsales names, <account> is 204d20a0248a4960a4ad8a40189a0329; it identifies our account, not you.

To withdraw, open Cookie settings in the footer, switch off a category and save, or select Reject all. The site removes that category's cookies and reloads if its scripts were running. Your choice also applies when another open pixel.se tab becomes active.

You can also clear or block cookies in your browser. Clearing pn_consent makes the banner appear again. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

Read more about cookie choices from the Swedish Post and Telecom Authority (PTS).

Your rights

You can ask for access to your personal data and a copy, correction, deletion, or restriction of processing. Where processing is automated and based on consent or a contract, you can request the data you provided in a portable format.

You can object to processing based on legitimate interests for reasons relating to your situation. We must stop unless we show overriding compelling grounds or need the data for legal claims. You can object to direct marketing, including related profiling, at any time; we must stop using your data for that purpose.

You can withdraw consent at any time. Use Cookie settings for optional website tracking, or contact us about other processing. These rights have conditions and exceptions; we will explain any that apply.

Write to info@pixel.se to make a request. We may need information to verify your identity and locate records. We normally respond within one month; if complexity requires an extension of up to two further months, we will explain why within the first month.

You can complain to the Swedish Authority for Privacy Protection (IMY) or an EU/EEA supervisory authority where you live or work, or where an alleged infringement occurred. You do not have to contact us first.

Changes to this policy

We update this page when our processing changes. The date and version identify the text you are reading. New purposes requiring consent will be presented before that processing begins.

• 2026-09-26, v1: server logs and reports, cookie choices, Google Analytics, Upsales visitor tracking and email contact.
• 2026-09-26, version 2. Added contact and newsletter forms, their retention periods and Cloudflare Turnstile.