Privacy Policy

Last updated: 15 September 2026

This Privacy Policy explains how BRIGHTFIELD Kommanditbolag (“Brightfield”, “we”, “us” or “our”) collects and uses personal data when you visit https://brightfield.se (the “Website”), contact us, request information about our products or services, or otherwise interact with us in a business context.

1. Data controller

The controller responsible for the processing described in this Privacy Policy is:

BRIGHTFIELD Kommanditbolag
Organisation number: 969767-3615
Drottninggatan 104, 3 tr
111 60 Stockholm, Sweden
Email: sales@brightfield.se
Telephone: +46 40 606 0642

2. Personal data we collect

Depending on how you interact with us, we may process the following categories of personal data:

Information you provide

• identity and professional information, such as your name, employer, job title and professional role;
• contact details, such as your business email address, telephone number and postal address;
• communications, including enquiries, requests for quotations, correspondence, meeting notes and information you choose to include in a message;
• commercial and service information, such as products of interest, order and delivery details, technical support requests, warranty information and business relationship history; and
• information needed to comply with legal, regulatory, export-control, sanctions, accounting or record-keeping obligations.

Information collected when you use the Website

• technical and security data, such as IP address, browser and device type, operating system, request date and time, pages requested, referring page, error information and server logs;
• usage data collected through Google Analytics, such as pages visited, approximate location, session duration and interactions, but only where you have consented to analytics cookies; and
• cookie consent choices and other information described in our Cookie Policy.

Information from other sources

We may receive professional contact details and business information from your employer, an authorised distributor, another Brightfield business, a service partner, public business registers, trade fairs or other lawful business sources.

Please do not send patient records, medical histories or other sensitive personal data through the Website or ordinary email. If such information is genuinely required for a technical or regulatory matter, contact us first so that an appropriate and secure channel and lawful process can be agreed.

3. Why we process personal data and our legal bases

We process personal data for the following purposes and on the following legal bases under the General Data Protection Regulation (GDPR):

Purpose	Types of data	Legal basis
To answer enquiries, provide requested product information and prepare quotations	Identity, professional details, contact details and communications	Steps requested before entering a contract where you are the contracting party; otherwise our legitimate interest in responding to business enquiries and developing business relationships
To administer orders, deliveries, warranties, maintenance, support and other business relationships	Contact, commercial, service and transaction information	Performance of a contract; legal obligations; and our legitimate interest in administering B2B relationships and supporting customers
To operate, maintain and secure the Website and prevent misuse	Technical, security and limited log data	Our legitimate interests in providing a reliable and secure Website and protecting our systems and users
To measure and improve Website use through Google Analytics	Online identifiers, device and usage information	Your consent, which you may withdraw at any time
To display optional third-party content such as Google Maps	IP address, device information and data processed by the third-party provider	Your consent, where required
To comply with accounting, tax, regulatory, sanctions, export-control and other legal requirements	Identity, contact, commercial and transaction information	Compliance with legal obligations and, where applicable, our legitimate interest in responsible business administration
To establish, exercise or defend legal claims and protect our rights	Relevant communications, contracts, logs and transaction information	Our legitimate interests in protecting our legal rights and resolving disputes

Where we rely on legitimate interests, we consider whether our interests are necessary and proportionate and balance them against your rights and interests. You may contact us for more information about that assessment.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing carried out before consent was withdrawn.

4. Cookies and analytics

The Website uses a necessary session cookie and, with your consent, Google Analytics and optional Google Maps content. Details about these technologies, their purposes, durations and your choices are provided in our Cookie Policy.

You can change or withdraw your optional cookie choices at any time through Cookie Settings in the Website footer.

5. Who receives personal data

We may disclose personal data, where necessary, to:

• hosting, IT, cybersecurity, communications and website-support providers acting on our instructions;
• Google, when you consent to Google Analytics or load embedded Google Maps content;
• Brightfield-affiliated businesses, regional offices, authorised distributors, logistics providers and service partners where needed to respond to your request, supply a product or provide support;
• banks, payment, insurance, accounting, audit, legal and other professional advisers;
• competent authorities, courts or law-enforcement bodies where disclosure is required by law or necessary to protect legal rights; and
• a buyer, seller or adviser in connection with a genuine merger, restructuring, financing or transfer of all or part of our business, subject to appropriate confidentiality measures.

Service providers acting as processors may use personal data only under our instructions and must protect it appropriately. Some recipients, such as authorities or independent professional advisers, may act as separate controllers under applicable law.

We do not sell personal data.

6. International transfers

Because Brightfield operates internationally, personal data may be transferred to recipients outside Sweden and the European Economic Area, including Brightfield businesses, distributors or service partners in countries relevant to your enquiry or order. Some technology providers, including Google, may also process data internationally.

Where required, we use a lawful transfer mechanism such as:

• an adequacy decision adopted by the European Commission;
• the EU-U.S. Data Privacy Framework for participating U.S. organisations;
• the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where appropriate; or
• another transfer mechanism permitted by applicable data-protection law.

You may contact us for more information about the safeguards relevant to a particular transfer.

7. How long we retain personal data

We keep personal data only for as long as reasonably necessary for the relevant purpose, including legal, regulatory, accounting and dispute-resolution requirements. Unless a longer period is required in a specific case, we apply the following general periods:

• general enquiries that do not lead to a business relationship: up to 24 months after the enquiry is closed;
• customer, supplier, distributor, quotation, order, warranty and service records: for the duration of the relationship and thereafter for as long as needed to meet contractual, product-safety, regulatory and legal-claims requirements;
• accounting records: for the period required by applicable accounting law, generally seven years in Sweden;
• Website security and server logs: normally up to 12 months, unless a longer period is needed to investigate an incident or protect legal rights;
• Google Analytics data: according to the retention setting configured for the Website’s Google Analytics property; and
• cookie consent records: normally up to 12 months after the relevant choice, unless needed longer to demonstrate compliance.

We may retain limited information for longer where necessary to comply with a legal obligation, manage product-safety or vigilance matters, or establish, exercise or defend a legal claim. When data is no longer required, we delete it or irreversibly anonymise it.

8. Your rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• obtain confirmation of whether we process your personal data and request access to it;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• receive personal data you provided in a structured, commonly used and machine-readable format and, where applicable, have it transmitted to another controller;
• object to processing based on legitimate interests;
• object at any time to processing for direct marketing;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with a data-protection supervisory authority.

To exercise a right, email sales@brightfield.se. We may need to verify your identity before acting on a request. Exercising your rights is generally free, although the law permits a reasonable fee or refusal in certain cases involving manifestly unfounded or excessive requests.

The supervisory authority in Sweden is:

Integritetsskyddsmyndigheten (IMY)
Website: https://www.imy.se/en/

If you live or work elsewhere in the European Economic Area, you may also contact your local data-protection authority.

9. Automated decisions

We do not use personal data collected through the Website to make decisions based solely on automated processing that produce legal or similarly significant effects on you.

10. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. No method of internet transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Children’s privacy

The Website is intended for professional and business audiences and is not directed to children. We do not knowingly collect personal data from children through the Website. If you believe a child has provided personal data to us, please contact us.

12. Third-party websites

The Website may link to websites operated by other Brightfield entities, distributors or unrelated third parties. Those websites have their own privacy practices, and their operators are responsible for them. We recommend reviewing the relevant privacy notice before providing personal data.

13. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our processing, services or legal obligations. The date at the top shows when it was last updated. We will provide additional notice of material changes where appropriate.

14. Contact us

For questions about this Privacy Policy or our processing of personal data, or to exercise your rights, contact:

BRIGHTFIELD Kommanditbolag
Drottninggatan 104, 3 tr
111 60 Stockholm, Sweden
Email: sales@brightfield.se
Telephone: +46 40 606 0642