Privacy Policy

1. Who is responsible?

BjornTech AB is responsible as controller for processing whose purposes and means it determines, such as administering its customer relationships and handling support. The merchant determines the purpose and use of payer data for its sales and payment integration and is responsible for that processing and its own privacy notice.

BjornTech processes payer data on the merchant’s instructions as a processor. A data processing agreement is required for that activity under applicable law. This does not mean that BjornTech is a processor for all its processing: processing for its own purposes is separate. Banks and Swish may have their own responsibilities and privacy notices.

2. Information involved and its sources

Information can come from you, your organisation, your integration or the bank and Swish payment flow. The service handles merchant contacts, payer and transaction data, support communications, and activity and security logs.

• Customer and contact information: names, email addresses, telephone numbers and billing or business contact details supplied for subscriptions or support.
• Merchant onboarding information: contact email, Swish number and integration information supplied to connect the merchant.
• Payment and refund information: amounts, references, status and any payer telephone number or message submitted with the transaction. References and messages may contain personal data; avoid adding unnecessary information.
• Technical and support information: IP addresses, usage and diagnostic information, and the content of messages you send to BjornTech. Do not send secrets or unnecessary sensitive personal data.

3. Purposes and legal bases

Personal data is used only for providing the service, administration, billing, support, troubleshooting, abuse prevention and meeting legal obligations. Payer and transaction data is processed as necessary for the service and retained temporarily for troubleshooting, not for unrelated reuse. BjornTech does not use this data for separate marketing or advertising.

Processing where BjornTech is controller requires an appropriate GDPR legal basis for each purpose. Merely using the API or accepting terms is not blanket consent to personal data processing. Contact BjornTech for information about the legal basis applicable to your personal data.

4. Recipients and international transfers

Payment information is exchanged as needed with the merchant’s integration and the relevant Swish and bank services.

This policy does not guarantee that all data stays in Sweden or the EEA. Where a transfer outside the EEA occurs, GDPR requires a valid transfer mechanism and any necessary safeguards. Contact BjornTech for information about recipients, processing locations and any international transfers, including applicable safeguards and how to obtain a copy of them.

5. Retention and security

Payer and transaction data is saved for a limited time for troubleshooting. Merchant contact and accounting data, support communications, and activity and security logs have different retention needs, including service administration and applicable legal obligations. Contact BjornTech for information about the retention periods or criteria applicable to your data, including backups.

You must protect data and credentials in your own integration and only submit information needed for the payment or support task. Do not put confidential information into public code or AI prompts. This customer duty does not replace BjornTech AB’s own data protection and security obligations.

6. Your GDPR rights

Subject to the conditions in the GDPR, you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing and portability. You may object to processing based on legitimate interests and always object to direct marketing. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.

These rights are not absolute; for example, some records may need to be kept to comply with law. Contact BjornTech using the details below to exercise rights concerning its processing. If your request concerns a merchant’s order or customer records, contact that merchant as well. Identity verification may be needed to protect your information; never email API secrets as proof of identity.

You may lodge a complaint with the Swedish Authority for Privacy Protection (IMY), or the relevant supervisory authority where you live, work or believe an infringement has occurred. You do not need to contact BjornTech first to exercise that right.

7. Required information and website technologies

A merchant contact email and Swish number are needed for the documented onboarding process, and payment information is needed to carry out requested API operations. Without the necessary information, the relevant operation cannot be completed. Avoid including unrelated personal information in optional fields.

This API documentation website saves your language preference (English or Swedish) in local storage under the key bjorntech-language where available, so the preference can be restored on later visits. You can remove it through your browser’s site-data settings. The stored preference has no automatic expiry. The website does not use analytics, tracking pixels or third-party embeds. It does load fonts from Google Fonts, which involves requests to Google’s servers and sends technical request information such as your IP address. The separate bjorntech.com checkout and website are not covered by these website-technology statements. Any information or consent required by law remains necessary.

BjornTech does not carry out profiling or solely automated decision-making with legal or similarly significant effects in connection with this service.

8. Updates and contact

This policy may be updated to reflect changes in the service’s processing. Any additional information, notice or consent required by law remains necessary. For privacy questions and rights requests, contact BjornTech AB at the details below.

Related information

• Swish API subscription and current pricing
• Integritetsskyddsmyndigheten (IMY)