We are a regulatory consultancy. It would be a poor advertisement if we were vague about this, so this notice says plainly what we collect, why, who sees it and how long we keep it.
Last updated 23 October 2026
Axiom Biotek AB is the data controller for the personal data described in this notice.
| Company | Axiom Biotek AB |
|---|---|
| Organisation number | 559598-1480 |
| Address | Kurortsvägen 20B, Åre, Sweden |
| Contact | hello@axiom-biotek.com |
We have not appointed a data protection officer. We have assessed that we are not required to, because our core activities do not consist of large-scale monitoring or large-scale processing of special category data. Privacy questions go to the address above and are handled by the Managing Director.
We collect your name, work email address, company, the topic you select and whatever you write in the message. We use it to answer you and, if it leads somewhere, to prepare a proposal.
Lawful basis: our legitimate interest, and yours, in responding to an enquiry you have chosen to send (Article 6(1)(f)); or, where you are asking us to quote for work, the steps taken at your request before entering a contract (Article 6(1)(b)).
Please don't put confidential product information or anyone's health data into the form. Tell us roughly what you are working on and we will arrange a secure route for the detail.
We keep the correspondence and the contact details in it, for the same reasons.
We hold the business contact details of the people we work with, together with the records of the work itself. Where a client's documentation contains personal data — for example the names of people who approved a record, or complaint and incident information — we handle that on the client's instructions under a written data processing agreement, and the client remains the controller for it.
Lawful basis: performance of the contract with the client (Article 6(1)(b)), and our legitimate interest in maintaining a working relationship (Article 6(1)(f)). Where we act as a processor, the client's basis applies.
We keep your name, role and business email so we can send it, and a record of your subscription and any unsubscribe.
Lawful basis: legitimate interest in business-to-business communication with people who have asked to receive it (Article 6(1)(f)). Every issue carries an unsubscribe link, and we act on it.
We run no analytics and no tracking. We set no advertising or analytics cookies, and there is no cookie banner because there is nothing to consent to. Our host may set a strictly necessary cookie to protect the site from automated abuse. Standard server logs, including IP addresses, are held by our host for security purposes.
Everything on this site, including the typefaces, is served from our own host. Your browser makes no requests to Google or any other third party when you read these pages.
We keep the list short on purpose. We do not sell personal data, and we do not share it for anyone else's marketing.
| Provider | What for | Where |
|---|---|---|
| Microsoft | Email, documents and collaboration (Microsoft 365) | European Union |
| Formspark | Delivers the contact form to our inbox | European Union (Ireland) |
| Cloudflare | Website hosting and DNS | Global network |
Each of these acts on our instructions under a written agreement. We assess a provider before we use it, and we keep a register of them. We may also disclose information where the law requires it, or to a competent authority exercising a power under the medical device regulations.
Contact form submissions are stored in the European Union (Ireland) by Formspark, under its data processing agreement. Where Formspark's own sub-processors handle data outside the EEA, it relies on an adequacy decision or the European Commission's standard contractual clauses.
Our Microsoft 365 tenant stores data in the European Union. Cloudflare operates a global network and may route traffic outside the EEA in the course of serving the site. You can ask us for details of any safeguard at hello@axiom-biotek.com.
| What | How long |
|---|---|
| Enquiries that do not lead to work | 12 months from the last contact |
| Client records and correspondence | For the engagement, then as required by law and by our quality system |
| Accounting records | Seven years, as required by the Swedish Bookkeeping Act |
| Authorised Representative records | At least ten years after the last device under the mandate was placed on the market, and fifteen years for implantable devices, as required by Article 11 of the Medical Device Regulation |
| Newsletter subscription | Until you unsubscribe |
Some of these periods are set by law and we cannot shorten them, including where you ask us to erase data. Where that applies we will say so.
Under the GDPR you can ask us to:
Write to hello@axiom-biotek.com. We reply within one month. We may ask you to confirm who you are first, and we will only ask for what we need to do that.
If we are handling your data on a client's behalf, we will pass your request to that client, who is the controller, and tell you we have done so.
If you think we have handled your data badly, please tell us first — it is usually quicker. You also have the right to complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), at imy.se, or to the authority in the EU country where you live or work.
If we change this notice we update the date at the top. Where a change is material we will say what changed.