Privacy Policy

1. Who we are

Leara provides a unified commerce platform that connects orders, inventory, product data and the systems surrounding modern commerce.

Depending on the context, Leara may process personal data either as a data controller or as a data processor.

We generally act as a data controller when we process personal data relating to visitors to our website, prospective customers, customers, partners and other business contacts for our own purposes.

When our customers use the Leara platform to process personal data relating to their own customers, employees or other individuals, Leara generally acts as a data processor on behalf of that customer. In those situations, the customer determines the purposes and means of the processing and Leara processes the data according to the customer’s instructions and the applicable Data Processing Agreement.

2. Personal data we collect

The personal data we process depends on how you interact with Leara.

Information you provide to us

We may collect information you provide directly to us, including:

• 01name
• 02business email address
• 03telephone number
• 04company and organisation
• 05job title or role
• 06information submitted through forms
• 07correspondence and communications with Leara
• 08information provided when requesting a demo, support or other information
• 09information provided in connection with a customer or partner relationship

Information collected when you use our website

When you visit our website, we may collect certain technical information, such as:

• 01IP address
• 02browser and device information
• 03operating system
• 04pages visited
• 05referring pages
• 06approximate location derived from technical information
• 07timestamps and interaction data

Where required by law, non-essential cookies and similar technologies are only used with your consent.

More information about our use of cookies should be provided in our Cookie Policy.

Information processed through the Leara platform

Customers may connect Leara to systems such as ecommerce platforms, ERP systems, point-of-sale systems, logistics providers, payment services and other business applications.

Depending on how a customer configures Leara, information processed through these integrations may include personal data associated with orders, customers, deliveries, users or other commerce operations.

For this data, Leara generally acts as a data processor on behalf of the relevant customer.

The customer remains responsible for determining the lawful basis and purposes for processing personal data within its use of Leara.

3. How we use personal data

Where Leara acts as a data controller, we may process personal data to:

• 01provide and operate our website and services
• 02communicate with customers, prospective customers and partners
• 03respond to enquiries and requests
• 04provide demonstrations and information about Leara
• 05establish and manage customer and partner relationships
• 06provide support
• 07maintain the security and reliability of our systems
• 08understand and improve our website, products and services
• 09administer contracts, billing and other business operations
• 10comply with legal and regulatory obligations
• 11protect Leara, our customers and others against fraud, misuse or security threats
• 12send relevant business communications and marketing where permitted by law

We do not use personal data for purposes that are incompatible with the purposes for which it was collected unless permitted or required by law.

4. Legal bases for processing

Under the GDPR, Leara relies on one or more legal bases depending on the processing activity.

These may include:

Performance of a contract
Where processing is necessary to enter into or perform an agreement with you or the organisation you represent.

Legitimate interests
Where processing is necessary for Leara’s legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include operating and securing our services, managing business relationships and improving our products.

Consent
Where you have given us permission to process personal data for a specific purpose, such as certain uses of cookies or marketing technologies. You may withdraw your consent at any time.

Legal obligation
Where processing is necessary for Leara to comply with applicable law.

5. How we share personal data

We do not sell personal data.

We may share personal data with trusted service providers that help us operate Leara, such as providers of:

• 01cloud infrastructure and hosting
• 02communications
• 03analytics
• 04customer support
• 05security and monitoring
• 06business administration
• 07professional services

These providers may process personal data only as necessary to provide their services to Leara and subject to appropriate contractual and data protection requirements.

We may also disclose personal data where required by law, regulation, legal process or a valid request from a competent authority.

If Leara is involved in a merger, acquisition, financing, reorganisation or sale of all or part of its business, relevant information may be disclosed as part of that process subject to appropriate confidentiality and data protection safeguards.

6. International data transfers

Where possible, Leara seeks to process personal data within the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we take appropriate measures to ensure that the transfer complies with applicable data protection law.

Depending on the circumstances, these safeguards may include an adequacy decision by the European Commission, the European Commission’s Standard Contractual Clauses, or another legally recognised transfer mechanism.

Where required, additional technical, organisational or contractual safeguards may also be implemented.

7. Data retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to fulfil contractual, legal, accounting, security and regulatory requirements.

Retention periods vary depending on the nature of the information, the purpose of processing and applicable legal obligations.

Where Leara processes personal data on behalf of a customer, retention and deletion are governed by the customer’s instructions and the applicable agreement with Leara.

When personal data is no longer required, we delete or anonymise it in accordance with our applicable procedures and legal obligations.

8. Security

We take appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.

Our approach to security includes measures relating to access control, infrastructure, data handling, monitoring and organisational processes.

No system can guarantee absolute security. We therefore continuously evaluate and develop our security practices as our platform and the threat landscape evolve.

9. Your rights

Depending on applicable law and the circumstances of the processing, you may have the right to:

• 01request access to your personal data
• 02request correction of inaccurate or incomplete personal data
• 03request deletion of your personal data
• 04request restriction of processing
• 05object to certain processing
• 06receive certain personal data in a portable format
• 07withdraw consent where processing is based on consent

These rights are subject to the conditions and limitations established by applicable law.

Where Leara acts as the data controller, you can contact us to exercise your rights.

Where Leara processes your personal data on behalf of one of our customers, you should generally contact that customer directly. We will assist our customers in responding to data subject requests where required under applicable law and our agreements.

10. Marketing communications

Where permitted by law, we may send information about Leara, our platform, products, events or other relevant business updates.

You can opt out of marketing communications at any time by using the unsubscribe mechanism included in the communication or by contacting us.

We may still send non-marketing communications where necessary for an existing business relationship, such as service, security or contractual notices.

11. Cookies and similar technologies

Our website may use cookies and similar technologies that are necessary for the website to function.

We may also use optional technologies for purposes such as analytics or improving our website. Where required by law, these technologies will not be activated until you have provided the appropriate consent.

You can manage your preferences through the cookie controls available on our website.

Further information should be available in our Cookie Policy.

12. Automated decision-making and AI

Leara develops technology intended to help businesses understand and operate commerce more effectively, including through the use of automation and artificial intelligence.

Where personal data is processed using automated functionality, we apply applicable data protection requirements to that processing.

Leara does not make solely automated decisions about visitors to our website that produce legal effects or similarly significant effects unless this is expressly disclosed and permitted under applicable law.

For personal data processed through the Leara platform on behalf of customers, the relevant customer determines how Leara and its functionality are configured and used within its operations.

13. Children

Leara is a business-to-business service and our website and services are not directed towards children.

We do not intentionally collect personal data directly from children through our website for our own purposes.

Personal data relating to individuals under the age of 18 may nevertheless be contained in commerce data processed by Leara on behalf of customers. In such circumstances, Leara processes that information as a data processor according to the relevant customer’s instructions.

14. Supervisory authority

If you believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority.

In Sweden, the supervisory authority is Integritetsskyddsmyndigheten (IMY).

We encourage you to contact us first if you have questions or concerns about how we process your personal data so that we can try to address them.

15. Changes to this Privacy Policy

We may update this Privacy Policy as Leara, our services or applicable legal requirements evolve.

When we make changes, we will publish the updated version and revise the “Last updated” date at the top of this page.

Where changes materially affect how we process personal data, we will provide additional notice where required by law.

16. Contact

If you have questions about this Privacy Policy, how Leara processes personal data, or wish to exercise your data protection rights, please contact us:

Leara
Sweden

Privacy: [info@leara.se]
Website: leara.se