Privacy policy

1. Who we are

Reqport AB, org.nr 559550-0272, ("Reqport") is a Swedish company that provides a platform for organizations to securely receive, process, and respond to data requests from law enforcement and government authorities. The platform is designed so that Reqport cannot access the content of data requests or responses — all such data is encrypted, processed in confidential computing environments, and technically inaccessible to us.

2. Who this policy applies to

This Privacy Policy explains how Reqport collects and uses personal data when Reqport acts as the data controller — meaning when we collect data for our own purposes. This applies to:

• (a) Website visitors who interact with reqport.com, including those who request a demo or contact us.
• (b) Platform users who register for an account on the Reqport platform, whether they represent a subscribing customer or a law enforcement / government authority.

What this policy does not cover: When Reqport processes data on behalf of a subscribing customer (for example, the content of data requests and responses transmitted through the platform), Reqport acts as a data processor. That processing is governed by our Data Processing Agreement with the relevant customer, not this Privacy Policy.

3. What data we collect

3.1 Website visitors

When you visit our website, request a demo, or contact us, we may collect your name, email address, company name, and the content of your message. When you visit the site, your browser automatically sends basic technical data such as IP address and browser type, which we use to operate and secure the site. We also use essential cookies needed to operate the site. With your consent, we also use Google Analytics to collect information about how you use our website, such as pages visited, time on site, approximate location, and device type. We use Google Analytics only on our public website. We do not use Google Analytics or any other third-party analytics in the Reqport platform.

3.2 Platform users (all types)

When you register for the Reqport platform, we collect your name, email address, organizational affiliation, and role. This applies equally to users representing subscribing customers and users representing law enforcement or government authorities.

3.3 Subscribing customers (billing)

For subscribing customers on a paid plan, we additionally collect billing contact information and payment-related data as necessary to process invoices.

4. Request data is inaccessible to Reqport

The content of data requests and responses transmitted through the platform ("Request Data") is encrypted and processed in confidential computing environments. This applies to both authorities and subscribing customers. Reqport holds no decryption keys and cannot access this data. In legal terms, we process Request Data on behalf of the subscribing customer receiving the request, under our data processing agreement with that customer, from the moment an authority submits the request through the platform.

5. How we use your data

• To provide the platform. We use your account information and login activity to operate the platform, authenticate you, and maintain security. Legal basis: performance of a contract (Article 6(1)(b) GDPR) or, for authority users, our legitimate interest in providing the platform (Article 6(1)(f) GDPR).
• To communicate with you. We use your contact information to respond to enquiries, send service-related notifications, and provide support. Legal basis: performance of a contract or legitimate interest.
• To improve our services. We use platform usage data, such as login activity and which features are used, to understand how the platform is used and to improve it. We only use the results in aggregated form that does not identify you. Legal basis: legitimate interest.
• To understand website usage. With your consent, we use Google Analytics to measure and improve our website. Legal basis: consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time via the cookie settings.
• To comply with legal obligations. We may process your data where required by applicable law, including tax, accounting, or regulatory requirements. Legal basis: legal obligation (Article 6(1)(c) GDPR).

We do not use your personal data for advertising, profiling, or automated decision-making. We do not sell your data to third parties.

6. Who we share data with

We share personal data only where necessary to operate our services, or where you have given your consent:

• (a) Infrastructure providers. Our platform is hosted on Microsoft Azure within the European Economic Area.
• (b) Authentication providers. We use third-party providers for authentication services, hosted within the EEA.
• (c) Legal requirements. We may disclose data where required by law, regulation, or court order.
• (d) Analytics. Google Ireland Ltd provides website analytics (Google Analytics), only if you have given consent.

We do not share personal data with advertisers or marketing partners. A current list of sub-processors is maintained in Annex III of our Data Processing Agreement.

7. International data transfers

Platform data is processed and stored within the European Economic Area. Website analytics data collected through Google Analytics may be transferred to Google LLC in the United States. Such transfers rely on the EU–US Data Privacy Framework and Standard Contractual Clauses. If a transfer outside the EEA becomes necessary, we will ensure appropriate safeguards are in place in accordance with Chapter V of the GDPR, including Standard Contractual Clauses where required.

8. Data retention

• Website visitor data: Contact form submissions and demo requests are retained for 12 months, after which they are deleted. If a commercial relationship is established, the data is kept for as long as the relationship lasts and deleted within 12 months after it ends, unless a longer period is required by law.
• Analytics data: Google Analytics data is retained for 2 months and then deleted automatically.
• Cookie consent record: Your cookie choice is stored in your browser until you change it or clear your browser data.
• Platform user data: Account information and login activity are retained for the duration of the account and deleted within 12 months of account closure, unless otherwise required by law.
• Authority user data: Account information and login activity for authority users are retained for the duration of the account and deleted within 12 months of account closure. At the authority's request, account data can be deleted earlier.
• Request Data: Data requests and responses transmitted through the platform are retained for the period agreed with the receiving subscribing customer in our Data Processing Agreement, based on that customer's regulatory requirements. Reqport cannot access this data at any time during the retention period. This applies to both authorities and subscribing customers.
• Billing data: Retained for the period required by Swedish accounting and tax law (currently 7 years).

9. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• (a) Access. You may request a copy of the personal data we hold about you.
• (b) Correction. You may request that we correct inaccurate or incomplete data.
• (c) Deletion. You may request that we delete your personal data, subject to any legal obligations requiring us to retain it.
• (d) Restriction. You may request that we restrict the processing of your data in certain circumstances.
• (e) Portability. You may request your data in a structured, commonly used, machine-readable format.
• (f) Objection. You may object to processing based on legitimate interest. We will cease processing unless we have compelling legitimate grounds.

To exercise any of these rights, contact us at privacy@reqport.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or the data protection authority in your country of residence.

10. Cookies

We use essential cookies necessary to operate the website. With your consent, we also use Google Analytics cookies to understand how visitors use the site. We do not use advertising cookies. You can accept or reject analytics cookies in the cookie banner and change your choice at any time. We use Google Analytics only on our public website (reqport.com). We do not use Google Analytics or any other third-party analytics in the Reqport platform.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will publish any changes on this page and update the "Last updated" date. If you have a platform account or have given us your email address, we will also notify you of material changes by email or through the platform before they take effect.

Contact