Privacy policy for SDR Bookings

SDR Bookings (sdr.achiever.se) is a portal where sales development representatives (SDRs) register booked customer meetings and follow up results against targets. It is used by invited users. This policy describes which personal data the portal processes and why.

Who is responsible for the data

SDR Bookings is provided by Forss Management Consulting AB (Formacon), which is the data controller for the processing of personal data in the service.

Forss Management Consulting AB (Formacon), org.nr 559086-4780, Lantmannagatan 33, 583 32 Linköping, formacon.se.
Pierre Lindbom, pierre.lindbom@formacon.se, 0735-28 12 15.

An organisation using SDR Bookings can sign a separate data processing agreement with Formacon. That agreement then governs the data the organisation itself registers in the service, and Formacon processes that data on the organisation's instructions.

Data we process

• User account: name, email address, password (stored only as a salted hash), whether you are an administrator and which SDR profile the account belongs to.
• Invitations: the email address the invitation is sent to, when it was created, when it expires (7 days) and whether it has been used.
• SDR profile and results: name, email address, selected products and sellers, bookings, number of calls per day, weekly and monthly targets, competition results, notifications and answers to questions.
• Bookings and customers: the customer's name (normally a company), size and notes, booked date, responsible seller, product, status, comment and reminder time. Do not enter sensitive personal data in comments and notes.
• Sellers: name, assigned products and quotas, and number of bookings.
• Activity log: which SDR created, changed or deleted a booking, with time, IP address and the browser's user agent.
• Push notifications: if you turn on notifications on a device, we store the address (endpoint) and encryption keys your browser gives us, the browser's user agent and which account the device belongs to.
• Technical logs: the web server logs IP address, time and requested address for troubleshooting and protection against attacks.

Purposes and legal basis

• Accounts, bookings, targets and results are needed for the portal to work: registering meetings and following up sales work (legitimate interest in following up the sales work).
• The activity log shows who changed what and makes it possible to correct mistakes (legitimate interest).
• The invitation email is sent so that you can create your account (legitimate interest).
• Push notifications – booking reminders and competition news, even when the app is closed – are only sent if you have turned them on yourself (consent, which you can withdraw by turning notifications off).
• The web server's technical logs are needed for Formacon to operate the portal securely (Formacon's legitimate interest).

How long data is kept

• Accounts, SDR profiles, bookings, customers and the activity log are kept for as long as the portal is in use. There is currently no automatic deletion – contact us if you want data about you to be deleted. When an assignment ends, the data is deleted or returned, under the data processing agreement where one exists.
• Unused invitations expire after 7 days.
• Push subscriptions are deleted when you turn notifications off, when your account is removed and when the push service reports that the subscription is no longer valid.
• A login lasts 24 hours and is renewed while you use the portal.
• Backups of the database are kept for up to 12 months and are then deleted automatically.

Where data is stored and which services we use

The portal and its database run on Formacon's own server in Sweden. The following external services are used as subprocessors:

Google, Apple and Microsoft may process data outside the EU/EEA. Such transfers rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses. The portal uses no analytics or advertising services.

Cookies and browser storage

• Necessary cookies for login (not readable by scripts) and for protection against forged requests (CSRF).
• A cookie that remembers your language for one year.
• The browser's local storage holds your own choices, such as light or dark mode and the most recently selected SDR, product and seller.
• A service worker stores the portal's files so that the app can be installed and receive notifications.

The portal uses no tracking or advertising cookies.

Your rights

You have the right to know which data we hold about you and to receive a copy, to have incorrect data corrected, to have data deleted, to restrict processing, to object to processing based on legitimate interest and to receive data you have provided in a machine-readable format. Contact us to exercise your rights. The portal has no built-in export or account deletion, so Formacon helps you with that. You can turn push notifications off yourself under Notifications.

If you believe we process your data incorrectly, you can lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se, or the supervisory authority in your country.

Security

The portal is only reachable over an encrypted connection (HTTPS). Passwords are stored as salted hashes, login attempts are rate limited and administrative functions require administrator rights.

Changes

We update this policy when the processing changes. The date at the top shows when it was last changed.