Legal
Last updated: September 5, 2026
MMG Entertainment AB
Company registration number: 559332-8775
Website: www.strictboard.com
Email: info@strictboard.com
We process the following categories of personal data:
To generate accurate registered address information, data may be retrieved from external registers or data providers.
Such processing occurs only when necessary to provide the Service.
National identification numbers are considered particularly sensitive under Swedish law.
They are processed only when clearly justified and necessary for secure identification.
Processing is necessary because the Service relies on matching identification numbers to registered addresses.
Performance of contract (Article 6(1)(b) GDPR)
Legal obligation (Article 6(1)(c) GDPR)
Legitimate interest (Article 6(1)(f) GDPR)
Personal data is retained only as long as necessary for its purpose.
Data linked to active accounts is stored during the contract term.
Accounting data is retained for seven (7) years in accordance with Swedish law.
Logs containing identification numbers are retained for a limited period and regularly deleted.
For data you submit through the forms on the website, the retention described in section 11 applies.
Address lookup data providers.
Email delivery provider, which delivers templates, replies to contact enquiries and internal notifications.
Provider hosting the newsletter subscriber list.
EU-based database provider, which stores the cookie consent record and the conversion log described in section 11.
Advertising networks, only if you have consented to marketing cookies: Google Ireland Ltd, Meta Platforms Ireland Ltd and LinkedIn Ireland Unlimited Company. What is sent to each is described in section 11.
Public authorities when required by law.
All processors are bound by data processing agreements under Article 28 GDPR. For these purposes the advertising networks act as independent or joint controllers under their own terms.
Where personal data is transferred outside the EU/EEA, appropriate safeguards such as adequacy decisions, Standard Contractual Clauses (SCC), or other lawful mechanisms are applied.
The advertising networks in section 7 contract through their European entities, but the data may be processed by their group companies in the United States. Those transfers rely on the EU–US Data Privacy Framework, to which all three are certified, and on Standard Contractual Clauses as a fallback.
The Service involves automated processing where registered address information is generated based on the entered identification number.
However, the processing does not constitute automated decision-making producing legal effects under Article 22 GDPR.
Beyond the processing within the Service, the website collects personal data through the forms below, and measures the results of our advertising. None of it requires an account with us.
Template downloads. To have a template sent to you, you provide your email address and, optionally, your name. The address is needed to deliver the document you requested — the template is attached to the email — and is also used for an internal notification to us that the template was requested. The legal basis is that the processing is necessary to carry out what you asked for (Article 6(1)(b) GDPR). The full text of every template is readable on the page without providing any details at all.
Newsletter. You can subscribe either through the form on the website or by ticking the box when you download a template. The box is optional and not pre-ticked — the template is delivered whether you tick it or not. The legal basis for these mailings is your consent (Article 6(1)(a) GDPR), which you may withdraw at any time via the unsubscribe link in every mailing.
Contact form. Name, email address and message are required; company and phone number are optional. The data is used to answer your enquiry, on the basis of our legitimate interest in responding to those who contact us (Article 6(1)(f) GDPR).
IP address. When you submit any of the forms, your IP address is read to limit the number of attempts per minute and so block automated abuse. For that purpose it is held only in the working memory of the server and is gone when the server restarts. If you have consented to marketing cookies, it is additionally stored in the conversion log described below, together with information about your browser.
Advertising measurement. If you have consented to marketing cookies, we report to the advertising networks that a conversion took place, so that we can measure which ads lead anywhere. The report is sent both from your browser and from our server. Meta receives your email address and phone number only as a SHA-256 hash, never in clear text, together with your IP address, information about your browser, and the cookie and click identifiers that show which ad you arrived from. Google receives the equivalent from the browser, where Google’s own tag hashes it before it leaves your device. The legal basis is your consent (Article 6(1)(a) GDPR). Without consent none of this is sent, and any click identifiers already captured are deleted.
The conversion log. So that the report can be resent when an advertising network is unavailable, it is stored in a database held by our EU-based database provider. The row contains the hashed values above, your IP address, information about your browser, which form you used, the page address and the timestamp. It never contains your name, your message, or your email address in clear text. Rows are deleted after 90 days.
Where the data ends up. The website has two databases of its own: the conversion log above and a record of the cookie consents given. The consent record contains your choice, the timestamp, which version of the policy you saw and information about your browser — but no IP address. Both are held by our EU-based database provider and are unreachable without our server key. Otherwise, the email address you provide in a form is passed to our processors for delivery and for the subscriber list, and the internal notification lands in our email inbox. A subscription remains until you unsubscribe. If you want your address removed from the list, the inbox or the logs, contact info@strictboard.com.
Download links. If a template is too large to attach, we send a signed link to the file instead. The link contains no personal data and stops working after 30 days.
For cookies and measurement tools on the website, see our cookie policy.
We have the right to contact you via email, phone, or other registered contact details regarding matters related to the Service, your account, or the contractual relationship. This includes operational information, security notices, billing, support communications, and updates to terms. Such messages are necessary to provide the Service and cannot be opted out of while your account is active.
We also have the right to send newsletters and other information about the Service to the email address you have registered. This includes product news, new features, updates, guides, customer stories, and related offers from MMG Entertainment AB.
The legal basis for marketing communications to existing customers and users is our legitimate interest in informing them about the Service (Article 6(1)(f) GDPR), together with the existing customer relationship exemption under Section 19 of the Swedish Marketing Act (2008:486). If you have no customer relationship with us and have only subscribed to the newsletter on the website, those mailings rest on your consent as described in section 11 instead.
You may unsubscribe from marketing communications at any time via the unsubscribe link at the bottom of every newsletter or by contacting info@strictboard.com. Unsubscribing does not affect transactional or service-related messages.
Requests may be submitted to info@strictboard.com.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).
The latest version of this policy is always available at www.strictboard.com.
