Privacy policy

SeaPattern Sweden AB (“SeaPattern”, “we”) is the data controller for the personal data described here. This policy explains what we collect when you visit seapattern.com, why we collect it, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR).

1. What we collect

This website has no forms. We do not run a newsletter, a contact form or a registration flow, so there is nothing on the site for you to fill in. Personal data still reaches us in the situations below.

We process personal data in the situations below:

• When you email us. If you write to one of the addresses published on the site, we process the content of your message and the details you choose to include, such as your name, email address and any information about your organisation.
• When you apply for a job. Our open positions are handled on careers.seapattern.com, a separate recruitment platform provided by Teamtailor. Applications are processed there under that platform’s own privacy information.
• Automatically, in server logs. Our hosting provider records standard technical data for every request — IP address, browser type, the page requested and the time of the request — so the site can be operated and protected against abuse.
• When you browse the site. The consent banner described in section 2 tells its supplier each time you load a page, and sends it your IP address before you have chosen anything; the supplier uses the address to work out which country you are in. The supplier records your answer when you give one. If you accept analytics cookies, we also process a randomly generated identifier stored in your browser, the pages you visit, what you do on them, and standard technical details about your browser and device.

2. Cookies and tracking

This site sets cookies, and it uses Google Analytics. We use Analytics to see which pages are read, how visitors arrive and which links are followed, so that we can make the site better. We run no advertising pixels, and no tracking tools beyond the analytics and consent tools described in this section.

Analytics runs only if you agree to it — except when the consent service fails to load. The first time you visit, a banner asks whether you accept analytics cookies. Until you accept, no analytics cookie is set and we receive no measurement of your visit. If you decline, or if you ignore the banner and keep reading, that stays true. Your browser does, however, fetch the Google Analytics file itself before you have chosen: it is requested on every page load, and the banner stops that file running rather than stopping the download. Google’s servers therefore see your IP address and standard details about your browser on that one request, but nothing about your visit is measured, stored or sent back to Google unless you accept. That blocking depends on the consent service described below loading in your browser, so if an extension, a network filter or an outage stops it loading, Google Analytics runs unblocked instead. For as long as that lasts, each page you view is measured — and so is what you do on it, such as how far you scroll. Those measurements go to Google, and so reach us in Analytics, because the banner never appears for you to answer it. Each one carries the page address, your IP address, standard browser details such as language and screen size, and a randomly generated identifier that is new on every page load. No analytics cookie is set, and no identifier follows you from one page to the next. You can tell when this has happened: no banner appears at all on your first visit, and the cookie icon described below is not there either.

The banner itself is a third-party service. It is provided by CookieYes, and its script is requested on every page you visit, before and after you answer — it is what asks the question and what blocks Google Analytics until you answer. Loading it means your browser contacts CookieYes’s servers. On every page load the script also reports back to CookieYes that it ran, sending a timestamp and a randomly generated session identifier, whether you have accepted, declined or not answered at all. Before you have chosen anything, CookieYes also receives your IP address and uses it to work out which country you are in. CookieYes records your answer when you give one. A cookie called cookieyes-consent is set on your first page view, before you click anything, and is then updated with your answer.

The cookies this site sets are:

• _ga — set by Google Analytics through this site’s own code, so it is a first-party cookie on seapattern.com. It stores a randomly generated identifier that distinguishes one browser from another. It is set to last two years and is refreshed on each visit; some browsers shorten this, and Chrome caps any cookie at 400 days.
• _ga_70BH82SKV0 — set the same way, and also a first-party cookie. It stores session state for our Google Analytics measurement. Same lifetime as _ga.
• cookieyes-consent — set by the consent banner, and a first-party cookie on seapattern.com. It stores a randomly generated consent ID, a timestamp and which categories you accepted or declined, so that the banner does not ask again on every page and so that we can show what you chose. It is set to last one year.

If you accept, Google receives the pages you view on this site, how far down each page you scroll, the links you follow away from the site, any file you download from it, the two identifiers above, your IP address, and standard technical details such as your browser, device type, screen size and the site that referred you. Google processes this for us as our processor, under Google’s data processing terms for Analytics. The data is transferred to countries outside the EU/EEA; section 6 explains on what basis.

You can withdraw your consent at any time. Use the small cookie icon in the bottom-left corner of any page — the site’s consent control: it opens the consent preferences panel, where one click on the reject-all button withdraws your consent, so withdrawing is no harder than agreeing was. Clearing this site’s cookies in your browser does the same thing, and the banner will ask again. Withdrawing stops the analytics cookies being used, and from the next page load no further Google Analytics data reaches us from that browser — subject to the same limitation described above: the icon and the blocking both come from the consent service, so if it does not load, there is no icon and Google Analytics is not blocked. It does not remove the analytics cookies already in your browser — those stay until they expire, or until you clear this site’s cookies. It does not affect the lawfulness of the processing carried out before you withdrew, and it does not delete what was already collected — if you want that too, email us.

The contact page also embeds a Google Maps map showing our office. That map is not part of the analytics described above and is not covered by the consent banner — it loads whether or not you accept analytics cookies. When that map loads, your browser contacts Google’s servers directly, which means your IP address is transferred to Google and Google may set its own cookies in your browser. Those cookies are Google’s, not ours; what they are and how long they last is decided by Google, and that processing is governed by Google’s privacy policy.

3. Why we process the data, and on what legal basis

• To answer you. When you contact us we process your message in order to reply and, where relevant, to take steps before entering into an agreement. Legal basis: legitimate interest, or steps prior to a contract.
• To operate and secure the website. Server logs are used to keep the site available, diagnose faults and detect abuse. Legal basis: legitimate interest.
• To handle job applications. Legal basis: steps prior to a contract, and legitimate interest in assessing candidates.
• To see how the site is used. Analytics cookies are set only if you agree to them. Legal basis: your consent, Article 6(1)(a) GDPR. You can withdraw it at any time, as section 2 describes; withdrawal does not affect the lawfulness of the processing carried out before you withdrew.
• To ask for and record your consent. The consent banner reports each page load to its supplier, whatever you choose; before you have chosen anything it also sends your IP address. Legal basis: our legitimate interest in operating a consent mechanism and in being able to show what you chose. We cannot rely on your consent for this, because the processing happens before you have made a choice.
• So that your choice takes effect on the page you are reading. Your browser requests the Google Analytics file on every page load, which sends your IP address and standard browser details to Google. The consent banner removes that code before it can run, so the file is downloaded but not executed unless you accept, with the one exception described in section 2. Legal basis: our legitimate interest in delivering each page in one piece, so that your choice applies to the page you are already reading rather than only after you reload it. We cannot rely on your consent for this, because the request happens before you have made a choice.
• To show you where our office is. The contact page embeds a Google Maps map. Your browser loads it from Google, which is what causes your IP address to reach Google. Legal basis: our legitimate interest in showing visitors how to find us.

We do not use your data for automated decision-making with legal or similarly significant effects for you, and we do not use it for marketing without your consent. Analytics tells us how the site is used; we do not use it to identify you or to build a profile of you as an individual, and we do not combine what it tells us with data from other websites.

4. How long we keep it

Email correspondence is kept for as long as it is needed to handle the matter and for a reasonable period afterwards, so that we can follow up on the conversation. Server logs are kept only for a short period by our hosting provider before being deleted or aggregated. Recruitment data is retained according to the retention settings of the recruitment platform.

Cookies expire on their own — section 2 lists how long each one lasts — and you can delete them from your browser sooner. In Google Analytics, the records tied to an individual browser are kept for at most 14 months under our retention setting there, and are then deleted by Google. Aggregated reports, which count visits and pages without identifying anyone, are not covered by that setting and are kept for longer.

CookieYes keeps the record of your consent — a consent ID, your country, the time and what you chose — for as long as we need it to show that consent was given. Your consent itself lasts one year, after which the banner asks you again.

5. Who we share it with

We do not sell, rent or trade personal data. We do use a small number of established suppliers who process data on our behalf:

• Vercel — website hosting and content delivery.
• Microsoft 365 — email.
• Teamtailor — recruitment.
• Google Ireland Limited — website analytics. The data is processed by Google LLC in the United States; see section 6.
• CookieYes Limited — consent banner, its page-load records, and the record of your consent.

These suppliers act as processors and may only handle the data in accordance with our instructions. Google appears in two other places in a different role: your browser fetches the Google Analytics file itself from Google before you have chosen, and we decide to place the Google Maps map on the contact page — in both cases Google decides for itself what it does with the data your browser sends it. Data may also be disclosed if we are required to do so by law.

6. Transfers outside the EU/EEA

Some of the suppliers above are established in, or use infrastructure in, countries outside the EU/EEA. Where personal data is transferred to such a country, the transfer is made either to a country the European Commission has decided offers an adequate level of protection, or under the safeguards permitted by the GDPR, such as the European Commission’s standard contractual clauses. Email us at contact@seapattern.com for a copy of the safeguards we rely on.

We name two of those transfers explicitly. If you accept analytics cookies, data reaches Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework. The European Commission decided on 10 July 2023 that the framework provides an adequate level of protection; where it does not apply, Google uses the Commission’s standard contractual clauses instead.

CookieYes Limited is established in the United Kingdom. Where it processes data outside the EU/EEA, it does so under the UK adequacy decision — renewed by the European Commission on 19 December 2025 — or, where that does not apply, under the European Commission’s standard contractual clauses.

7. Your rights

Under the GDPR you have the right to:

• request access to the personal data we hold about you,
• have inaccurate data corrected,
• have your data erased,
• have the processing restricted,
• object to processing that is based on our legitimate interest,
• receive your data in a portable format, and
• withdraw your consent where processing is based on consent.

To exercise these rights, email us at contact@seapattern.com — with one exception: you can withdraw your consent to analytics cookies yourself at any time, using the small cookie icon in the bottom-left corner of any page, which is the site’s consent control. You can object to any processing we base on our legitimate interest. Three of those — the consent banner, the Google Analytics file your browser fetches before you have chosen, and the map on the contact page — run on their own as you view a page, so an objection is a reason for us to change how the site works, not something we can apply to a visit that has already happened. If you believe we are handling your personal data incorrectly, you also have the right to lodge a complaint with the Swedish Authority for Privacy Protection, IMY.

8. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss and misuse. The site is served over HTTPS, and access to the systems that hold personal data — email, recruitment, analytics and consent records — is restricted to the people who need it.

9. Changes to this policy

We may update this policy, for example if we start using a new service or change how the site works. The current version is always published on this page with the date it was last updated.

10. Contact us