Privacy Notice

Updated: 2026-05-20

This Privacy Notice explains how Krebit AB, Swedish company registration number 559375-4996, processes personal data when you visit our websites, contact us, use Krebit Sign or represent a customer, supplier, partner or other business relation.

Krebit AB is the controller for the processing described in this Privacy Notice, unless otherwise stated.

For personal data that our customers upload to or process through Krebit Sign, Krebit normally acts as processor on behalf of the customer. In those cases, the customer is the controller and the processing is governed by a separate Data Processing Agreement.

1. Who we are

Krebit AB
S:t Eriksgatan 121 B
113 43 Stockholm
Sweden

Email: info@krebit.se
Phone: +46 70 752 76 82

2. Service covered by this notice

This Privacy Notice applies to personal data processed in connection with Krebit Sign, our service for electronic signing, document handling, signing workflows and related administration.

It also applies to personal data processed in connection with our websites, forms, demo requests, sales contacts, support, marketing, billing and customer administration.

3. Personal data we process

Depending on your relationship with us, we may process the following categories of personal data:

• Contact details, such as name, email address, phone number, address, company, title and role.
• Account details, such as username, user role, organisation, login method, settings and subscription details.
• Customer and billing information, such as customer number, invoice details, payment status, agreement history and correspondence.
• Usage and technical information, such as IP address, browser, device information, log data, timestamps, activity history and security events.
• Support and communication data, such as emails, form submissions, meeting notes, chat messages and support requests.
• Signing and document related information, such as signer names, email addresses, signing status, timestamps, event logs, authentication information and audit trails.
• Marketing preferences, such as consent status, newsletter preferences and interaction with our communications.

We do not intentionally collect more personal data than needed for the relevant purpose.

4. How we collect personal data

We collect personal data when:

• You create an account or use Krebit Sign.
• You sign, approve, send or manage documents through Krebit Sign.
• You contact us by email, phone, form, meeting or other channel.
• You request a demo, trial, offer or support.
• Your employer, organisation or another user gives us your information in connection with Krebit Sign.
• You interact with our websites, cookies or digital channels.
• We receive information from third party services used to provide Krebit Sign, such as identity providers or communication providers.

5. Purposes and legal bases

We process personal data for the following purposes and legal bases.

5.1 To provide Krebit Sign

We process personal data to create accounts, enable login, manage users, send documents, collect signatures, maintain audit trails, display signing status and deliver the functions in Krebit Sign.

Legal basis: performance of contract, legitimate interest and, where Krebit acts as processor, the customer’s documented instructions.

5.2 To administer customers and business relations

We process personal data to communicate with customers, manage agreements, provide onboarding, handle invoices, follow up on orders, manage customer records and maintain the business relationship.

Legal basis: legitimate interest, performance of contract and legal obligation.

5.3 To provide support

We process personal data to answer questions, troubleshoot issues, follow up support cases and improve the customer experience.

Legal basis: legitimate interest and performance of contract.

5.4 To maintain security and prevent misuse

We process personal data to protect accounts, monitor suspicious activity, investigate incidents, prevent fraud, protect Krebit Sign and maintain logs.

Legal basis: legitimate interest and legal obligation.

5.5 To improve and develop Krebit Sign

We may process usage data, feedback and aggregated information to analyse performance, improve functions, develop new features and make Krebit Sign more useful.

Legal basis: legitimate interest.

Where possible, we use anonymised or aggregated data for this purpose.

5.6 To comply with law

We process personal data where necessary to comply with accounting rules, tax rules, sanctions obligations, legal claims, authority requests or other legal obligations.

Legal basis: legal obligation and legitimate interest.

5.7 To market our services

We may process business contact details to send relevant information about Krebit Sign, product updates, events or similar business communication.

Legal basis: legitimate interest or consent, depending on the channel and applicable law.

You can opt out from marketing at any time.

6. Personal data processed on behalf of customers

When a customer uses Krebit Sign, the customer may upload or otherwise process personal data about its employees, customers, signers, representatives or other individuals.

For such data, the customer decides the purposes and means of the processing. Krebit processes the data on behalf of the customer to provide Krebit Sign.

If you have questions about personal data processed by one of our customers through Krebit Sign, you should normally contact that customer first.

7. Cookies and similar technologies

We use cookies and similar technologies on our websites to make the website work, remember settings, analyse traffic and, where applicable, support marketing.

Some cookies are necessary for the website to function. Other cookies are used only where allowed by law, for example based on your consent.

More information is provided in our Cookie Policy and cookie settings on the website.

8. Who can access personal data

Access to personal data is limited to people and parties that need access for the purposes described in this Privacy Notice.

Personal data may be shared with:

• Employees and consultants within Krebit.
• Hosting providers, IT providers, communication providers and support tools.
• Identity and signing providers, such as BankID related service providers where applicable.
• Payment, accounting, invoicing and administration providers.
• Legal advisors, auditors, insurers and other professional advisors.
• Authorities, courts or other public bodies where required by law.

We do not sell personal data.

9. Transfers outside the EU and EEA

We aim to process personal data within the EU and EEA where reasonably possible.

Some suppliers or technical services may process personal data outside the EU and EEA. Where this happens, Krebit will take steps required under applicable data protection law, such as using an adequacy decision, standard contractual clauses or other appropriate safeguards.

10. How long we keep personal data

We keep personal data only for as long as necessary for the purposes described in this Privacy Notice, unless a longer period is required or allowed by law.

In general:

• Account and customer data is kept for as long as the customer relationship continues and for a limited period afterwards.
• Billing and accounting data is kept for the period required by applicable accounting and tax rules.
• Support data is kept for as long as needed to handle the matter and for follow up, quality and documentation purposes.
• Marketing data is kept until you opt out or until we no longer have a relevant business reason to keep it.
• Logs and security data are kept for a limited period needed for security, troubleshooting and abuse prevention.
• Customer data processed through Krebit Sign is kept in accordance with the customer agreement, the Data Processing Agreement and customer instructions.
• Data needed to establish, exercise or defend legal claims may be kept for as long as necessary for that purpose.

11. Your rights

Subject to applicable law, you may have the right to:

• Request access to personal data we process about you.
• Request correction of inaccurate or incomplete personal data.
• Request deletion of personal data.
• Request restriction of processing.
• Object to processing based on legitimate interest.
• Request data portability.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a supervisory authority.

In Sweden, the supervisory authority is the Swedish Authority for Privacy Protection, IMY.

To exercise your rights, contact us at info@krebit.se.

We may need to verify your identity before handling your request.

12. Security

Krebit applies technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration and disclosure.

Measures may include access controls, logging, encryption where appropriate, backups, supplier controls, internal routines and security monitoring.

No system is completely secure, but we work continuously to maintain and improve the security of Krebit Sign.

13. Children

Krebit Sign is intended for businesses and organisations. We do not knowingly collect personal data from children for our own purposes.

14. Changes to this Privacy Notice

We may update this Privacy Notice from time to time.

The latest version will be published on our website with the date of the latest update. Material changes may also be communicated in another appropriate way.

15. Contact

If you have questions about this Privacy Notice or how we process personal data, contact us at:

Krebit AB
S:t Eriksgatan 121 B
113 43 Stockholm
Sweden

Email: info@krebit.se