Privacy and Information Security Policy

 

1. Introduction

This Privacy and Information Security Policy ("the Policy") sets out how Goava Sales Intelligence AB ("Goava", "we") protects and handles personal data in compliance with the General Data Protection Regulation (GDPR) and Swedish data protection law.

Goava is a B2B sales intelligence company. The personal data we process is limited in scope and almost entirely business-related: contact details that professionals or their employers have published themselves, and the account and usage data of the people who use our platform. Our services are not designed to process special categories of personal data as defined in Article 9 GDPR, and we do not process personal data relating to children. News content published by third parties and displayed in our platform may incidentally contain broader personal information; that processing is covered by Goava’s certificate of publication, as described in section 3.3.

This Policy applies to all processing of personal data within Goava, and to all employees, consultants, contractors and third-party partners involved in that processing.

1.1 Corporate context

Goava Sales Intelligence AB is a Swedish limited company and is partly owned by Enento Group Plc. Goava determines the purposes and means of the processing described in this Policy independently. No parent or group company holds encryption keys for Goava’s operations.

1.2 Terms and definitions

• Personal data — any information relating to an identified or identifiable natural person (a data subject).
• Controller — the party that determines the purposes and means of processing personal data.
• Processor — a party that processes personal data on behalf of a controller.
• Sub-processor — a third party engaged by Goava that processes personal data as part of delivering our services or running our business.
• Personal data breach — a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

2. Governance and Accountability

Accountability for data protection sits with Goava’s management. Responsibilities are allocated as follows:

• Chief Executive Officer — owns this Policy, is accountable for GDPR compliance, and is the responsible contact for data subject requests and supervisory authority contact.
• Chief Technology Officer — responsible for implementing and maintaining technical and organisational security measures, including secure deletion and encryption.
• IT Security Manager — first point of contact for security incidents, coordinates technical response activities and maintains access controls.
• Line managers — request, approve and periodically review access for their team members.
• HR and People function — notifies IT of joiners, leavers and role changes so that access can be adjusted.
• All personnel — must comply with this Policy and the supporting policies listed in section 13, and must report suspected incidents immediately.

2.1 Data protection officer

Goava has not appointed a data protection officer. We are not a public authority and we do not process special categories of personal data on a large scale. Because our platform makes high volumes of publicly available business contact data available, whether Article 37(1)(b) GDPR requires a designated data protection officer is kept under review with external counsel; the conclusion will be recorded in this Policy.

The Chief Executive Officer is accountable for data protection at Goava and is the privacy contact for individuals, customers and supervisory authorities, and can be reached at privacy@goava.com.

2.2 Records, assessments and audits

• We maintain records of processing activities in line with Article 30 GDPR, although our size does not strictly require it.
• A Light PIA is performed for new processing activities, new products and material changes to existing processing, to determine whether a full data protection impact assessment (DPIA) is required.
• Light PIAs concluded that a DPIA was required for three high-volume processing activities: contact data from corporate websites, contact data from LinkedIn, and user data. A DPIA has been carried out for each. The DPIAs conclude that the residual risk to individuals is low, on the basis that the data is limited, non-sensitive, drawn from public sources and regularly refreshed.
• For news data, the Light PIA concluded that the processing is covered by the exemption in Article 85 GDPR for journalistic purposes, on the basis of Goava’s certificate of publication.
• We carry out a GDPR and information security review at least annually, and update our practices in response to regulatory developments.

3. What Personal Data We Process3.1 Categories of data

• Publicly available B2B contact information — name, role, email address, telephone number and employer, collected from corporate websites and from company pages on LinkedIn, so that our customers can identify the right person to contact at a company.
• News data — names and other details of individuals mentioned in publicly published news articles, displayed in connection with the company the article concerns.
• User account and authentication data — name, email address and credentials for the individuals who use the Goava platform on behalf of our customers.
• Usage data — how the platform is used, in order to operate and secure the service, support customers and improve the product.
• Website and marketing data — form submissions for demos, webinars and information requests, together with cookie identifiers, IP address and browsing behaviour where consent has been given.
• Communication data — the content of enquiries to our support and sales teams, including name and email address.
• Billing data — the name, email address and invoicing details of billing contacts at our customers.
• Employee and consultant data — personal data relating to our own personnel, processed for employment and engagement purposes.

3.2 Our role: controller and processor

Goava is the controller of the personal data it decides the purposes and means for. This includes the contact and news data published in the platform, user account and authentication data, usage analytics, support communications, website and marketing data, and billing data. For this data, Goava determines why and how it is processed and is accountable for it under this Policy.

Goava acts as a processor for personal data that a customer itself brings into the service — for example information about the customer’s own personnel and the customer’s own customers. Clause 5.5 of the Goava Terms and Conditions provides that the customer is the controller of that data and Goava the processor, and that Goava processes it only in accordance with the agreement and the customer’s written instructions. The data protection terms in the Terms and Conditions govern that processing.

For AI features that a customer chooses to enable, the same split applies: Goava engages the AI provider as a sub-processor, and does so on the customer’s behalf where the data concerned is the customer’s. See section 6.

3.3 Purpose and lawful basis
3.4 Profiling and automated decision-making

Goava’s analysis and scoring are directed at legal entities — companies and their buying signals — not at individuals. Our impact assessments confirm that we do not carry out evaluation, scoring or prediction of individual data subjects. We do not make decisions based solely on automated processing that produce legal effects for an individual or otherwise significantly affect them within the meaning of Article 22 GDPR. Individuals nevertheless have the right to object to profiling, as described in section 10.

4. Transparency Toward Individuals in Our Database

Most of the personal data in the Goava platform is not collected from the individual concerned, but from sources that the individual or their employer has made public. Article 14 GDPR therefore applies. Our approach is as follows:

• Published privacy notice — our Privacy Policy at goava.com sets out what data we collect, the sources it comes from, the purposes and lawful basis, how long it is kept and which rights apply. This is the primary way in which individuals are informed.
• Direct notification — individuals are not currently notified individually when their published business contact details are added to the platform. Our impact assessments identify a direct notification process as an action to implement, and we are confirming with external counsel the extent to which the disproportionate effort exemption in Article 14(5)(b) GDPR applies to this processing. We describe the position openly rather than claim a practice we have not yet put in place.
• Clearly identified sources — the data originates from corporate websites, company pages on LinkedIn and published news articles. We do not purchase or infer private contact details.
• Limited scope — we collect professional contact details in a professional context. We do not seek out special categories of data, financial information or private contact details, and we do not collect data from private social media profiles.
• Objection and erasure — an individual can object to the processing or request erasure by contacting privacy@goava.com. Requests to be removed are implemented without undue delay, and we do not require the individual to justify the request.
• Ongoing accuracy — the database is refreshed continuously against its public sources. Contact details are removed within two months of the individual no longer appearing in those sources, for example after a change of role.
• Customer obligations — our Terms and Conditions require customers to use the contact data lawfully, for legitimate B2B outreach, and to respect the rights of the individuals they contact.

5. Retention and Deletion

Personal data is retained only for as long as it is necessary for the purpose for which it was collected, or for as long as a legal obligation requires. The following periods apply:

When a retention period expires, data is securely deleted unless continued retention is required by law. Erasure requests from individuals are handled promptly. Full details are set out in the Goava Data Retention Policy.

6. Artificial Intelligence6.1 AI features in the Goava platform

AI functionality in the Goava platform is opt-in. A customer chooses whether to enable it, and no data from customers who have not enabled these features is sent to any AI provider.

Of the AI features we offer, the Research Agent and the Prospecting Agent are the components that process customer data. They use GPT models accessed through the OpenAI API in order to research companies and generate prospecting suggestions.

• Roles — Goava remains the controller. OpenAI acts as a processor under a data processing agreement between Goava and OpenAI.
• Data processed — names, business contact information and other information provided by the user as unstructured prompt data.
• Location — data originating in the EEA is processed by OpenAI Ireland Ltd. Any onward transfer to OpenAI affiliates in the United States is covered by EU Standard Contractual Clauses.
• Retention — prompt data is retained for 30 days and then deleted.
• Model training — data submitted through the API is not used to train the provider’s models. Under our data processing agreement the provider may use deidentified, anonymised or aggregated information to improve its own systems and services.
• Human oversight — AI output is presented as research and suggestions for the user to review and act on. It does not make decisions about individuals.

6.2 Internal use of AI tools

Goava also uses AI tools internally, for productivity and analysis rather than as part of the product. These tools are listed as sub-processors in section 7 and are subject to the same access control, confidentiality and transfer requirements as any other supplier. Personal data is only made available to them where necessary for the purpose concerned.

6.3 AI governance

• New AI features and new AI suppliers go through a Light PIA before launch, and a full DPIA where the assessment indicates it is required.
• AI suppliers are engaged under a data processing agreement with defined retention, security and transfer terms before any personal data is shared.
• We do not use AI to make automated decisions with legal or similarly significant effects on individuals.
• AI features are documented in the sub-processor list so that customers can see which providers are involved and what data they receive.

7. Sub-Processors

The table on the following page lists the sub-processors Goava engages, the purpose of each, the categories of personal data involved, the retention period and the processing location. The list is maintained centrally and the current version is available on request. Customers are informed of material changes to the list.

All sub-processors are engaged under a written data processing agreement containing confidentiality, security and — where relevant — international transfer obligations, and are selected on the basis of the security and privacy protections they can demonstrate.

7.1 Sub-processor list

Where a sub-processor is located outside the EU/EEA, the transfer is made under the EU Commission’s Standard Contractual Clauses. See section 9.

8. Security Measures

Goava applies technical and organisational measures to protect the confidentiality, integrity and availability of personal data.

8.1 Technical measures

• Encryption — data is encrypted in transit using TLS across all services we use, and sensitive data, including personal data, is encrypted at rest using industry-standard protocols. Credentials are stored encrypted.
• Key management — encryption keys used for Goava’s production data are managed by Goava within its cloud environment. No third party, including Enento Group, holds encryption keys for Goava’s operations.
• Access control — access is granted on a need-to-know basis under the principle of least privilege, with default deny for anything not explicitly authorised. Generic and shared accounts are not used.
• Authentication — Goava personnel accessing internal systems must use strong unique credentials of at least 14 characters, single sign-on is used where available, and multi-factor authentication is mandatory for sensitive systems, remote access and production environments. Password sharing is prohibited.
• Zero trust — we work toward a zero trust architecture in which every access request is verified regardless of network location.
• Logging and monitoring — access to critical systems, including privileged access, is logged and monitored using centralised tooling, and those logs are retained for at least 12 months.
• Hosting — the platform and its data are hosted with Amazon Web Services EMEA SARL in a data centre in Ireland, within the EU.
• Change management — changes to systems and services follow a controlled process, with testing and production environments kept separate.
• Backup and recovery — backups are maintained and recovery procedures are documented and tested under the Goava Technical and Business Recovery Plan.

8.2 Organisational measures

• Confidentiality undertakings — all employees and consultants are bound by confidentiality obligations in their employment or consultancy agreements.
• Joiner, mover, leaver process — access is provisioned to match the role, adjusted when the role changes, and removed no later than the last day of employment or engagement. Privileged access is reviewed at the same time.
• Access reviews — access is reviewed at least annually and after significant organisational change.
• Training — security and data protection training is delivered at onboarding and at least annually thereafter. Our consultants in Bangladesh are within the scope of this requirement.
• Supplier management — suppliers with access to personal data are engaged under data processing agreements and, where required, Standard Contractual Clauses.
• Information classification — information is classified under the Goava Information Classification Policy, under which unclassified data is treated as confidential by default.
• Remote working — work outside company premises follows the Goava Remote Working Policy, including secure connections and mandatory two-factor authentication.
• Test data — personal data used for testing or analytics is anonymised or pseudonymised where feasible.

9. International Transfers

Goava’s primary hosting is within the EU. Some of the services we use to run our business, and some AI providers, are established outside the EU/EEA. Where personal data is transferred to a country without an adequacy decision, we rely on the EU Commission’s Standard Contractual Clauses, supported by a Transfer Impact Assessment.

• Cloud hosting — data is hosted by Amazon Web Services EMEA SARL in Ireland. AWS has a US affiliate, so a hypothetical onward transfer under FISA Section 702 or the US CLOUD Act cannot be excluded, which is why SCCs are in place.
• United States sub-processors — transfers rely on the EU Commission’s Standard Contractual Clauses.
• Offshore development hub in Bangladesh — Goava engages consultants in Bangladesh who may access personal data. They contract directly with Goava rather than through an intermediary, are covered by Goava’s policies and training requirements, and their agreements are required to include Standard Contractual Clauses under which they undertake to comply with the GDPR.
• Assessment — a Transfer Impact Assessment prepared with Sharp Cookie Advisors concluded that the risk profile of these transfers is low: the personal data concerned is non-sensitive, largely drawn from public sources, and of no realistic interest to foreign authorities. Contractual, technical and organisational safeguards manage the residual risk.

10. Rights of Data Subjects

We recognise and uphold the following rights under the GDPR:

• Access — to obtain confirmation of whether we process personal data about you, and a copy of it.
• Rectification — to have inaccurate or incomplete data corrected.
• Erasure — to have personal data deleted where the conditions for erasure are met.
• Restriction — to have processing limited in certain circumstances.
• Objection — to object to processing based on legitimate interests, including profiling and direct marketing.
• Data portability — to receive data in a structured, commonly used, machine-readable format.
• Withdrawal of consent — to withdraw consent at any time where processing relies on it.
• Automated decision-making — not to be subject to decisions based solely on automated processing that have legal or similarly significant effects.

Requests can be made to privacy@goava.com. We respond within one month of receiving the request, and will inform the requester if an extension is needed. We do not charge a fee for handling a request, and we do not require the requester to explain why they are making it.

If you are not satisfied with how we have handled your personal data or your request, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, "IMY"), www.imy.se.

11. Incident and Personal Data Breach Management11.1 Reporting and escalation

• Any suspected security incident or personal data breach must be reported immediately to the IT Security Manager through the designated channel. The IT Security Manager escalates to the CTO and the CEO.
• All personnel are responsible for recognising and escalating suspected incidents. Failure to report is a breach of this Policy.
• Incidents are classified as critical, high, medium or low according to impact and urgency, and handled by the Incident Response Team in line with the Goava Security Incident Response Plan.

11.2 Notification

• Supervisory authority — where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, Goava notifies IMY without undue delay and, where feasible, within 72 hours of becoming aware of it, in accordance with Article 33 GDPR.
• Affected individuals — where a breach is likely to result in a high risk to individuals, we inform those individuals without undue delay, in clear and plain language, in accordance with Article 34 GDPR.
• Customers — affected customers are informed without undue delay, with the information they need to meet their own obligations.
• Documentation — all personal data breaches are documented, including those that are not notifiable and the reasoning for that assessment.

11.3 Containment and follow-up

• Incidents are contained, root causes identified and vulnerabilities eliminated before affected systems are restored.
• Evidence is preserved for analysis and, where relevant, legal purposes.
• Every significant incident is followed by a post-incident review, and the response plan is updated on the basis of what it finds.

12. Compliance and Continuous Improvement

• Goava complies with the GDPR, Swedish and European data protection legislation, and the guidance issued by supervisory authorities.
• We maintain records of processing activities under Article 30 GDPR.
• We carry out a GDPR and information security review at least annually, and after material changes to our operations.
• Security and data protection training is delivered at onboarding and at least annually thereafter.
• Password usage and adherence to security requirements are audited annually.
• We host our infrastructure with cloud providers that maintain recognised security certifications, and we prefer suppliers that can demonstrate independent assurance.

13. Related Documents

This Policy is the umbrella document for Goava’s data protection and information security framework. It is supported by:

14. Review and Changes to this Policy

• This Policy is reviewed by Goava’s management at least annually, and sooner if there is a change in regulation, in our operations, or in the suppliers and technologies we use.
• The version number and revision date on the cover page indicate the current version. Superseded versions are retained for reference.
• Material revisions are communicated to employees, consultants, customers and relevant third parties.

15. Contact

For any question about this Policy, or to exercise a data protection right:

Goava Sales Intelligence AB

Email: privacy@goava.com

Website: goava.com

Individuals also have the right to contact the Swedish Authority for Privacy Protection (IMY), www.imy.se.