How Glimit AB processes personal data for EURtracker.

Account, customer and service-administration data.

• Name, business contact details, organisation and role.
• Account identifiers, authentication and security metadata.
• Subscription, order, invoice and payment-administration information where applicable.
• Support requests, feedback and correspondence.
• Technical request, device, browser, security and diagnostic information generated when the service is used.
• Website preference information stored locally in the browser where applicable.

We process only for defined service purposes.

• Provide and administer the service: performance of a contract where applicable, or Glimit AB's legitimate interest in delivering the customer's organisational agreement.
• Account and access management: contract and legitimate interests in secure service administration.
• Security, abuse prevention and troubleshooting: legitimate interests in protecting EURtracker, customers and users.
• Support and customer communication: contract and legitimate interests in responding to requests and maintaining the customer relationship.
• Accounting, taxation and legal obligations: compliance with legal obligations.
• Optional analytics or marketing, if introduced: consent where consent is legally required.

Project content is controlled by the customer.

Quick Updates, Progress material, project structures, reporting drafts, partner information and related project content may contain personal data. Where Glimit AB processes that data on behalf of a customer, Glimit AB does not independently decide to use it for unrelated purposes.

Customers are responsible for deciding what project personal data is necessary, providing required information to data subjects and establishing the appropriate lawful basis.

AI processing happens when an authorised user requests it.

Current AI-assisted Progress synthesis and reporting drafts use the OpenAI API when a user invokes those functions. EURtracker sends the selected project context and reporting/source material needed for the request and uses store:false in the API request.

AI-generated wording remains subject to human review before formal submission. EURtracker is not designed to make significant automated decisions about individuals.

Core providers process data only for defined service functions.

EURtracker currently relies on providers including Supabase for database/authentication services, Vercel for application hosting and delivery, and the OpenAI API for user-requested AI-assisted functions. The current technical roles and public-sector baseline are described in the Security & Compliance page.

Additional suppliers may be used for ordinary business administration where needed. Contract-specific subprocessor information is governed by the applicable DPA.

Location and safeguards depend on the real provider configuration.

Some providers may process or make support data available outside the EEA depending on the service configuration. Where GDPR requires a transfer mechanism, Glimit AB uses an applicable safeguard such as an adequacy decision, Standard Contractual Clauses or another lawful mechanism.

Public-sector customers may request contract-specific information about selected regions, subprocessors and transfer safeguards as part of procurement or DPIA work.

Data is kept only while there is a justified purpose.

• Account and customer-relationship data is generally kept while the relationship is active and thereafter only as needed for legal, accounting, security or claim-handling purposes.
• Customer project data follows the customer's contract, instructions and DPA, including return/deletion at the end of service.
• Security and diagnostic records are retained according to the operational purpose and the relevant provider configuration.
• Support and feedback records are retained while needed to resolve the matter and for a reasonable follow-up period.

Where an exact period is determined by law, contract or provider configuration, that specific rule controls.

Individuals can exercise GDPR rights where applicable.

Depending on the processing and legal basis, you may have rights to access, rectification, erasure, restriction, data portability and objection, and to withdraw consent where processing is based on consent.

For project data controlled by a EURtracker customer, requests should normally be directed to that customer. Glimit AB will assist the customer as processor where required.

You may contact the Swedish supervisory authority.

If you believe personal data has been processed contrary to applicable data-protection law, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or another competent supervisory authority.

Optional tracking is not part of the current public-site design.

EURtracker's public website is designed without advertising or marketing cookies. The authenticated application may use strictly necessary session/security technologies and browser-local preferences. More detail is available in the Cookie Policy.