Introduction
Teknosell KB is committed to protecting the privacy of everyone we deal with: the people who visit this website, the people who use our free Value Selling Portal, the people who contact us, and the sales and service staff we coach on behalf of their employers.
This policy explains what personal data we hold, why we hold it, what we are allowed to do with it and what you can ask us to do about it. It follows the General Data Protection Regulation (EU) 2016/679 (GDPR), the Swedish Electronic Communications Act for cookies and similar storage, and, where our AI tools are involved, the EU AI Act (Regulation (EU) 2024/1689).
Who is responsible for your personal data
The controller is Teknosell KB, Oskarsgatan 4, 414 63 Göteborg, Sweden. You can reach us at info@teknosell.com.
Our Data Protection Officer is Marta Megger. You can reach her at gdpr@teknosell.com with any question about this policy or any request about your own data.
What we collect, and why
Each activity below lists the data involved, what we use it for, and the legal basis we rely on. Where that basis is legitimate interest, it also says what the interest is.
1. Visiting this website
- Data
- IP address, browser and device data, and the pages requested
- Purpose
- Delivering the site, keeping it secure and stopping attacks and abuse
- Legal basis
- Legitimate interest, Art. 6(1)(f) GDPR: our interest in running a working, secure website
Nothing that tracks you across visits is stored in your browser unless you agree to it in the cookie banner. See 15 and our Cookie Policy.
2. The contact form
- Data
- Name, email address, company, what you are interested in, the content of your message, and your phone number and team size if you give them. With it we store the page you sent it from, your IP address, the country it points to and your browser type
- Purpose
- Replying to your enquiry and emailing you a copy to confirm we have it. The IP address, country and browser type are kept to stop spam and abuse
- Legal basis
- Steps taken at your request before a possible contract, Art. 6(1)(b) GDPR, and legitimate interest, Art. 6(1)(f) GDPR: our interest in answering business enquiries and keeping the form free of spam
3. Demo calls
- Data
- Name, email address, phone number, company, message, call recording
- Purpose
- Arranging the call, and recording it for demonstration and training
- Legal basis
- Legitimate interest in arranging the call you asked for, Art. 6(1)(f) GDPR, and your consent for the recording, Art. 6(1)(a) GDPR
4. Coaching participants, standard programme
- Data
- Name, email address, job title, company, call records, coach notes
- Purpose
- Running the coaching sessions and documenting the results
- Legal basis
- Performance of the contract with your employer and legitimate interest, Art. 6(1)(b) and (f) GDPR: our interest, and your employer's, in delivering the programme they bought
5. Coaching participants, where recordings are analysed by AI
- Data
- Name, email address, job title, company, voice recordings, call records, coach notes
- Purpose
- Running the coaching sessions and analysing recordings through the OpenAI API
- Legal basis
- Consent for the analysis, Art. 6(1)(a) GDPR, together with the contract and legitimate interest described in 4
6. AI assisted coaching comments
- Data
- Voice recordings, evaluations, interaction history
- Purpose
- Drafting coaching comments for a trainer to work from
- Legal basis
- Contract and legitimate interest, Art. 6(1)(b) and (f) GDPR: our interest in giving consistent, timely feedback. With the transparency duty in Art. 50 of Regulation (EU) 2024/1689
A human trainer reviews and approves everything before it reaches a participant. No automated decisions are made about anyone, and none of this material is used to train models.
7. Coaching participants located in China
- Data
- Name, email address, job title, company, recordings, coach notes, and any further data required by Chinese law
- Purpose
- Running the coaching sessions in line with Chinese law
- Legal basis
- Consent under Art. 6(1)(a) GDPR and Art. 13 PIPL, together with contract and legal compliance
Data is transferred to the EEA and to the United States under standard contractual clauses.
8. Programme surveys
- Data
- Survey answers, satisfaction ratings, written feedback, and identifying details where the respondent chooses to give them
- Purpose
- Judging the quality of the training, collecting suggestions and reporting back
- Legal basis
- Contract and legitimate interest, Art. 6(1)(b) and (f) GDPR: our interest in improving our programmes and reporting results to the client
Reporting is aggregated and anonymised. Survey answers are never used to make automated decisions about anyone.
9. The global good examples library
- Data
- Recordings of training sessions that contain personal data
- Purpose
- Building a library of strong answers for the ordering company and its related entities, and for nobody else
- Legal basis
- Consent and contract, Art. 6(1)(a) and (b) GDPR
10. References and testimonials
- Data
- Name, job title, company, the content of the testimonial
- Purpose
- Publishing on our website, our social media and our marketing material
- Legal basis
- Consent, Art. 6(1)(a) GDPR
11. Freelancers, contractors, suppliers and purchases
- Data
- Name, address, email address, phone number, contract details, payment details and invoices. Billing address for purchases. We do not hold payment card numbers.
- Purpose
- Managing the working relationship, paying people, processing orders and support, and keeping the accounting records
- Legal basis
- Contract, Art. 6(1)(b) GDPR; legal obligation for the accounting records, Art. 6(1)(c) GDPR; and legitimate interest, Art. 6(1)(f) GDPR: our interest in running our business
Payments are processed by Stripe.
12. Social media
- Data
- Username, content you post, interactions, messages
- Purpose
- Running our own channels, replying to people and promoting our services
- Legal basis
- Legitimate interest, Art. 6(1)(f) GDPR: our interest in being present on social media and answering the people who contact us there
13. Your free Value Selling Portal account
- Data
- Name, work email, company, team size, your role where we ask for it, and that you accepted the Terms of use. With the account: your progress in the toolbox and the e-learning, including the notes and answers you type there, the six-digit sign-in codes we email you (stored only in scrambled form) and your sign-in sessions. Your IP address, country and browser type at sign-up and sign-in
- Purpose
- Opening your account, signing you in on any device, keeping your progress so you can carry on where you stopped, and the emails the account needs: the welcome email and sign-in codes. The IP address, country and browser type are kept to stop abuse of a free service
- Legal basis
- Performance of a contract, our Terms of use, Art. 6(1)(b) GDPR; for the abuse checks, legitimate interest, Art. 6(1)(f) GDPR: our interest in keeping a free service available to genuine users
You can close your account yourself at any time, in the account menu at the top of the portal. Closing it deletes the account, your progress and notes, and your sign-up details straight away.
14. Emails about new parts of the portal, and follow-up
- Data
- Name, work email, whether you asked for these emails, and the team size you gave us
- Purpose
- Emailing you when a new part of the portal goes live; for people who lead larger teams, one personal email from us about coaching
- Legal basis
- Your consent, Art. 6(1)(a) GDPR, given with a separate box that is never ticked for you. The one personal follow-up rests on legitimate interest, Art. 6(1)(f) GDPR: our interest in offering our services to businesses
Switch the update emails off in the account menu, or with the link in any of them. You can object to the follow-up at any time and we will not contact you again for marketing.
15. Measuring the website and our advertising
- Data
- Pages viewed, the link or ad that brought you (campaign parameters and click ids), analytics and advertising cookies; for a sign-up or an enquiry, your email address in hashed form
- Purpose
- Knowing which pages and ads work, and telling Google and LinkedIn which ads led to a sign-up or enquiry
- Legal basis
- Consent, Art. 6(1)(a) GDPR, given in the cookie banner. Without it, no analytics or advertising tag runs and nothing about the campaign is kept in your browser. The campaign parameters of the visit in which you send a form are stored with it: legitimate interest, Art. 6(1)(f) GDPR, our interest in knowing which of our campaigns bring enquiries
Recipients: Google (Analytics, Ads) and LinkedIn (Insight Tag, Conversions API). Where their tags run, we and Google or LinkedIn are joint controllers for collecting the data on our site and passing it to them (Art. 26 GDPR). Under those arrangements we are responsible for telling you about it and for asking your consent; Google and LinkedIn are responsible for what they do with the data afterwards, under their own privacy policies, and you can exercise your rights with either party. A hashed email address is still personal data. Both may process data in the United States; see Transfers outside the EEA.
16. Bob, the AI customer
- Data
- What you say to Bob, as text. Where your browser cannot recognise speech itself, short pieces of your audio instead. Your portal account, which Bob needs, and how much you have used him today. Your IP address, to limit how often the service can be called
- Purpose
- Turning your answer into text, marking it against the four steps we coach, letting Bob reply to you, and keeping use within fair limits
- Legal basis
- Performance of a contract, our Terms of use, Art. 6(1)(b) GDPR; for the usage limits, legitimate interest, Art. 6(1)(f) GDPR: our interest in keeping a free AI service affordable and available. With the transparency duty in Art. 50 of Regulation (EU) 2024/1689
Bob is an AI and tells you so. In Chrome, Edge and Safari, your browser turns your speech into text with its maker's own speech service (Google, Microsoft or Apple), under that company's terms; the page tells you this before the microphone starts, and you can type your answer instead. In other browsers, Microsoft Azure in Sweden does it for us. An AI model on Microsoft Azure in Sweden marks the text and writes Bob's reply. We do not store your words or your audio, they are not used to train any model, Bob does not analyse your voice for emotion or identity, and the score is feedback for you, not a decision about you. Our Terms forbid using it to make decisions about people. We have assessed the risks of AI voice practice in a Data Protection Impact Assessment. Please do not tell Bob anything confidential.
No automated decisions
None of this processing leads to a decision about you that is based solely on automated processing and has legal or similarly significant effects (Art. 22 GDPR). Bob's score is practice feedback that only you see.
Cookies
Analytics and advertising cookies are only set after you agree in the cookie banner. You can change your choice at any time under Cookie settings at the bottom of every page. Our Cookie Policy lists everything this site stores in your browser and why.
How long we keep it
- Website security logs: kept by Cloudflare for a short period, up to 30 days
- Contact form enquiries, with the IP address and browser data stored with them: as long as we need to handle the enquiry and anything that follows from it, and no longer than 24 months after our last contact with you, unless it leads to a contract
- Portal accounts, including your saved progress and notes: until you close the account, or 24 months after you last used it, whichever comes first. Closing it deletes everything at once
- Sign-in codes: they stop working after 10 minutes and are deleted within a day. Sign-in sessions end after 90 days, or when you sign out
- Update emails: until you switch them off or close your account
- Bob: your words and audio are not stored. Technical logs that hold no content (timings, costs, the score) are kept for up to 30 days. The daily usage counts per account are deleted after 30 days
- Measurement: analytics data for 14 months; what Google and LinkedIn keep is set by their own policies
- Emails we send: the sending service keeps a delivery log for its standard period
- Demo call recordings: up to 24 months, or until you withdraw your consent
- Testimonials: for as long as they are published, or until you withdraw your consent
- Social media: for as long as the content stays on our channels
- Coaching programmes: as agreed in the contract with your employer
- Invoices and accounting records: seven years, as the Swedish Bookkeeping Act requires
Who we share your data with
These service providers process personal data for this website on our behalf, under data processing agreements. Where data leaves the EEA, the last column says what protects it.
Service providers for this website| Provider | What they do for us | Where, and the safeguard |
|---|
| Cloudflare | Hosting, the database behind the forms and the portal (run in the EU), the films, security | EU and Cloudflare's worldwide network; a US company. EU-US Data Privacy Framework and standard contractual clauses |
| Microsoft Azure | Speech to text, Bob's voice and the AI marking of Bob calls | Sweden, within Microsoft's EU Data Boundary |
| Resend | Sending the emails from the forms and the portal | Sent from the EU; stored in the United States. EU-US Data Privacy Framework and standard contractual clauses |
| Microsoft 365 | Our email inboxes, where enquiries and replies arrive | EU. EU-US Data Privacy Framework |
| Google and LinkedIn | Analytics and advertising, only with your consent (see 15) | EU and the United States. EU-US Data Privacy Framework |
When you talk to Bob in Chrome, Edge or Safari, the browser's own speech service (Google, Microsoft or Apple) hears your voice under that company's terms. See 16.
For our coaching programmes we also share data with:
- video meeting and calendar services used for the sessions
- payment service providers (Stripe)
- the advertising platforms above, only with your consent
- public authorities, where the law requires it
Passing data to someone else does not hand over our responsibility for it. Teknosell remains accountable as controller or processor, and data goes to a public authority only where legislation allows it.
Transfers outside the EEA
Some data reaches the United States, through the providers listed above and the meeting services used for coaching, and, for participants located there, China (see 7).
Transfers to the United States rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses. Transfers to China rely on standard contractual clauses. All of them are backed by encryption, restricted access and documented risk assessments. Ask gdpr@teknosell.com for a copy of the safeguards.
Whether you have to give us your data
Giving us your data is voluntary. Without a name and a work email we cannot open a portal account, and without contact details we cannot answer an enquiry or perform a contract.
Where you are on a coaching programme, we usually receive your details from your employer or their authorised representative so that sessions can be scheduled. Where that happens, this policy is how we tell you about it, as required by Article 14 GDPR.
Our services are for working adults. They are not aimed at children, and we do not knowingly collect data from anyone under 16.
Your rights
Under the GDPR you have the right to:
- ask what we hold about you, and get a copy
- have inaccurate data corrected
- have data erased; for a portal account you can do it yourself in the account menu
- have processing restricted
- receive your data in a portable form
- object to processing that relies on legitimate interest
- object at any time to direct marketing, after which we stop, without exception
- withdraw consent at any time, where consent is what we rely on, as easily as you gave it: update emails switch off in the account menu
To exercise any of these, write to gdpr@teknosell.com. We answer within one month. Withdrawing consent does not affect anything we did lawfully before you withdrew it.
You can also complain to a supervisory authority. In Sweden that is the Swedish Authority for Privacy Protection (IMY, imy.se). If you live or work elsewhere in the EEA, you can go to your own national authority instead.
How we keep data safe
Traffic is encrypted with TLS, our premises are physically secured and access to personal data is controlled and reviewed. Sign-in codes and sessions are stored only in scrambled (hashed) form.
We hold ISO/IEC 27001:2022 certification. Our Information Security manifesto sets out the full commitment.
Impact assessments and identity checks
Where a processing activity carries a high risk to people's rights, we carry out a Data Protection Impact Assessment before we start, as we have for AI voice practice.
When someone asks for access, deletion, correction or restriction, we verify who they are first. That is not obstruction, it is the only way to be sure we are not handing somebody's data to the wrong person.
Changes to this policy
If we change this policy we will publish the new version here and update the date at the top of the page. If a change matters for how we use your account data, we will also email account holders before it applies.
