Privacy Policy – navichain
| Version | 2.5 |
| Effective date | 1 November 2026 |
| Replaces | Versions 2.0 to 2.4 (1 November 2026) and version 1.0 (18 October 2025) |
| Languages | English and Swedish. Translations into other languages are provided for convenience. If they differ, the English version prevails. |
Short summary
- Who we are. Navilog Solutions AB is responsible for data about our customers and the users of the navichain platform. Its parent company Navichain AB is responsible for our website and for business contacts (section 2).
- Where your data lives. Platform data and data you give us are stored in the EU: on our own servers in Sweden, with a database replica at a hosting provider in Finland. Our backups are kept in Sweden. Where a service provider or part of our team is outside the EU/EEA, we use the safeguards the GDPR provides (section 9).
- We never sell personal or company data.
- Business contacts. We may contact people at companies about navichain, using published business contact details. You can say no at any time by replying to the email (section 5).
- Your rights. You can ask to see, correct or delete your data, and you can object (section 11).
1. Introduction
This policy explains how we process personal data when you:
- visit our website, navichain.se;
- use the navichain platform, including the navichain 365 mobile app and the customer portal (together the “Service”);
- are contacted by us as a business contact; or
- contact us yourself.
2. Data controllers
Two companies in our group are responsible for personal data, each for its own activities:
| Company | Responsible for |
|---|---|
| Navilog Solutions AB, org. no. 556647-3848, Långvägen 35, 756 52 Uppsala, Sweden | Customer (tenant) agreements and the customer relationship: customer and user accounts, support, billing |
| Navichain AB, org. no. 556853-1957, Långvägen 35, 756 52 Uppsala, Sweden | The website navichain.se, marketing, and business contacts with prospective customers and partners (section 5) |
Data our customers enter in the navichain platform, such as bookings, transports, drivers, vehicle positions and warehouse data, belongs to the customer. The customer is the controller of that data. Navilog Solutions AB processes it on the customer’s behalf as a processor, under the Data Processing Agreement that is part of the customer agreement. If you have questions about that data, contact your employer or the customer organisation first.
Both companies use the same contact address for privacy matters: privacy@navichain.se.
3. What data we process, and why
| Who | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Customer contact persons and users of the Service (controller: Navilog Solutions AB) | Name, work email, phone, login data, role, support and billing information, acceptance of terms | Provide and support the Service; billing | Contract (art. 6.1 b), or legitimate interest towards the customer company’s staff (art. 6.1 f). Billing records: also legal obligation (art. 6.1 c) |
| Drivers and other people whose data a customer enters in the Service | Location, status and operational data | Provide the Service to the customer | Processed by Navilog Solutions AB as processor on the customer’s behalf. The customer decides the purpose and legal basis (section 2). |
| Drivers using the navichain 365 app on their employer’s instruction | The phone’s location while a run is in progress and tracking is switched on, a position recorded with delivery actions, photos and signatures taken as proof of delivery, and a device token for notifications | Provide the Service to the employer | Processed by Navilog Solutions AB as processor on the employer’s behalf. The employer decides the purpose and legal basis (section 2). |
| Website visitors | Technical data needed to deliver the site, such as the IP address in the web server’s log | Run and secure the website | Legitimate interest (art. 6.1 f) |
| Business contacts at prospective customers and partners (controller: Navichain AB; section 5) | Name, job title or role, work email, work phone, employer and company data, our correspondence | Offer navichain to the company you work for | Legitimate interest (art. 6.1 f) |
| People who contact us | Name, contact details, message content | Answer your enquiry | Legitimate interest (art. 6.1 f); contract if it leads to one |
| People who object or ask us to stop contacting them | Name, email address, date and source of the request | Make sure we respect your request (suppression list) | Legal obligation and legitimate interest (art. 6.1 c and f) |
Automated decisions. We make no decisions based solely on automated processing that produce legal or similarly significant effects for you. Automatic checks in the Service, such as a missing certificate stopping a run assignment, a temporary login lockout after repeated failed attempts, or the limits of a plan, support a decision a person at your organisation takes, and that person can review them.
4. Where the data comes from
- From you: when you use the Service, contact us or reply to us.
- From your employer: when your organisation is a customer and adds you as a user.
- From published sources: for business contacts, see section 5.
5. Business contacts at prospective customers and partners
We may contact people at companies that we think could benefit from navichain, or that could partner with us. We use your name, role, work email address and work phone number, together with information about your company. We take these details from published business sources, such as company websites, business registers, industry directories and professional networks, and from our own earlier correspondence with you. On request, we will tell you which source we used for your details.
The legal basis is our legitimate interest in offering a relevant business service to companies (GDPR art. 6.1 f). We have weighed this interest against yours: the contact concerns only your professional role and uses published business details. The assessment is available on request.
You can say no at any time. You have the right to object to direct marketing, free of charge and without giving a reason (GDPR art. 21). Reply to our email or write to privacy@navichain.se, and we will stop. We keep your email address on a suppression list only so that we can respect your request.
6. How long we keep data
We keep personal data only as long as it is needed for the purpose it was collected for:
- Business contacts: as long as your company remains a relevant prospect or partner, which we review regularly, and for up to 24 months after a dialogue ends.
- Suppression list: for as long as needed to respect your objection.
- Enquiries: for up to 24 months after our last contact, unless they lead to an agreement.
- Customers and users: for the duration of the customer agreement. After it ends, the customer has a period to export its data, after which we delete it from our systems within a bounded period set out in the Data Processing Agreement. Backups rotate within a fixed window. Data we must keep by law, such as accounting records and electronic consignment notes, is kept for the period the law requires.
- Technical logs: for up to 12 months.
7. Data storage and security
Personal data is stored in the EU: on our own servers in Sweden, operated by Navilog Solutions AB, and on a replica node of our database cluster at a hosting provider in Finland. Our backups are kept on our own storage in Sweden. We protect data with encryption in transit, role-based access control, logical separation of each customer’s data, and logging of access. Service providers that process data for us work under data processing agreements.
8. Recipients and processors
We never sell personal data. We share data only with:
- Service providers that act on our instructions under a data processing agreement, for email and text-message delivery, AI functions in the Service, push notifications to the mobile app, card payments, and map, route and weather lookups. The current list is published at navichain.se/legal/sub-processors.
- Independent controllers. The search and AI services we use to research publicly available business information about companies and their contact persons, and the provider of some map lookups in the Service (directions and address lookups, sent as coordinates only, with no name or account), act as independent controllers under their own terms. The research services receive only publicly available business information, never platform data or data you have given us directly.
- Authorities, when Swedish or EU law requires it.
- A buyer or successor, in a merger or acquisition, who must honour this policy.
Customers can connect their own third-party systems to the Service, such as accounting or carrier systems. When they do, the Service passes data to that system on the customer’s instruction, under the customer’s own agreement with the provider.
9. Transfers outside the EU/EEA
We keep personal data in the EU/EEA, in Sweden and Finland. Some of our service providers, and part of our technical team working with remote access, are outside the EU/EEA. In those cases we rely on the safeguards the GDPR provides: the EU standard contractual clauses, or an adequacy decision of the European Commission. The data itself stays on our servers in the EU. Which providers these are is shown on the sub-processor list. A copy of the safeguards is available on request at privacy@navichain.se.
The independent controllers named in section 8, the research services and the map-lookup provider, may process the information they receive outside the EU/EEA under their own terms and transfer safeguards.
10. Cookies, analytics and third-party content
- The Service uses only essential cookies: the login session, protection against request forgery, and your language choice.
- The website navichain.se sets no cookies, uses no analytics and embeds no third-party content.
- Map screens in the Service load map images and fonts from third-party servers, which see your IP address when the images load. We do not use them to track you.
- The mobile app shows maps through the map components of your phone’s platform, under that platform’s terms.
11. Your rights
You have the right to:
- access: get a copy of the data we hold about you;
- rectification: have wrong data corrected;
- erasure: have data deleted when it is no longer needed or when you object;
- restriction of processing;
- data portability, for data you gave us under a contract or with your consent;
- object to processing based on legitimate interest, and to direct marketing at any time (section 5);
- withdraw consent at any time, where processing is based on consent.
Send requests to privacy@navichain.se. We answer within one month. If you ask us to stop direct marketing, we stop immediately.
12. Complaints
If you think we process your data incorrectly, please contact us first at privacy@navichain.se. You also have the right to complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY): www.imy.se, imy@imy.se, Box 8114, 104 20 Stockholm.
13. Changes to this policy
We update this policy when our processing changes. The version number and effective date at the top show the current version. We announce significant changes on the website. Version 2.5 took effect on 1 November 2026. Earlier versions are available at navichain.se/legal/privacy/v1.
14. Contact
- Privacy (both companies): privacy@navichain.se
- Navichain AB, Långvägen 35, 756 52 Uppsala, Sweden
- Navilog Solutions AB, Långvägen 35, 756 52 Uppsala, Sweden
- General: info@navichain.se, +46 73-519 44 45