Legal
Privacy Policy
Last updated: 20 October 2026
This page explains what personal data Navis Mater processes via navismater.com, why, how long we keep it, and your rights under the GDPR.
- What we collect: very little — what you send if you contact us or sign up for updates on the paper, and technical logs generated on visit.
- Why: to reply to you, send updates you asked for, and to run and secure the site.
- How long: enquiries up to 24 months, subscriptions for as long as you are subscribed, technical logs up to 12 months, accounting records 7 years.
- Your rights: access, rectification, erasure, restriction, objection and data portability.
- Contact: info@navismater.com.
1. Data controller
Navis Mater AB (reg. no. 559537-7184), Sweden, is responsible for personal data processed via navismater.com. Contact: info@navismater.com.
2. What we collect
navismater.com is an informational website, so we collect very little: (a) if you contact us through the contact form or by email: your name, email address, what you write in your message and, if you provide them, your organisation and role; (b) technical data that arises automatically on any site visit – IP address, browser type and access times – handled by our hosting and CDN provider for security, reliability and aggregated visitor statistics (see section 10); and (c) if you sign up for updates on the paper: the data described under Subscribing to updates on the white paper below. We run no advertising or tracking, have no user accounts, and collect no special-category data.
Subscribing to updates on the white paper
If you sign up for updates on the white paper The Governed Agentic Organization, we process your email address, your name if you give it, your chosen language, the page you signed up from, when you signed up and confirmed, and which version of the consent text you agreed to.
The purpose is to send new editions and significant updates of the paper, a few times a year. We send no sales emails to the list. The legal basis is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time via the link in every email or by emailing info@navismater.com.
Signing up is confirmed in two steps: you receive an email and confirm by pressing a button. If you don't confirm within seven days, the details are removed from our list.
The list is stored in a Cloudflare database in the EU. The confirmation email and the mailings are sent through our email delivery provider, Resend, which is our data processor. Resend keeps records of sent emails, including the recipient's address, in the USA for 30 days, plus backups for seven days. The transfer to the USA is based on the European Commission's standard contractual clauses and the EU-U.S. Data Privacy Framework.
The details on the list are kept for as long as you are subscribed. When you unsubscribe, your details are removed from our list immediately. We then keep only a fingerprint (hash) of your email address, which cannot be used to email you, together with the times you signed up, confirmed and unsubscribed and which consent text you agreed to. We keep this for 24 months so that we can show that we had your consent. The legal basis is our legitimate interest in being able to show that we follow the rules (Article 6(1)(f) GDPR).
To stop automated signups we use Cloudflare Turnstile, as in the contact form.
3. Why, and on what legal basis
To respond to an enquiry you send through the contact form: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time. To respond to an enquiry you send by email, and to operate and secure the website: legitimate interest (Art. 6(1)(f) GDPR). Our legitimate interest is that people who contact us get an answer, from us or from the company the enquiry concerns, and that the website is available and secure. There is no automated decision-making, including profiling, in connection with our processing.
4. Retention
Correspondence and briefing requests are kept only as long as needed to handle your matter and reasonable follow-up, and are deleted no later than 24 months after your most recent contact, unless law requires otherwise. Technical and security logs: up to 12 months. Anything we must keep under the Swedish Accounting Act (e.g. if an engagement follows): 7 years.
The transactional-email provider that delivers the contact form keeps the messages, including their content, in the US for 30 days. After that they are deleted, and the provider's backups are purged within a further seven days. Enquiries in our own inbox are kept for at most 24 months, as above.
5. Who we share it with
Hosting and content delivery are handled by an established hosting and CDN provider. Delivery and spam protection for the contact form are handled by a transactional-email provider and a privacy-preserving anti-bot service respectively; some processing by these providers may take place in the US, with safeguards as described in section 6. A current list of the specific processors we use (with category, purpose and region) is available on request. If your enquiry concerns one of the companies in Navis Mater's portfolio, we may pass it on to that company where needed to respond to you. That company then becomes an independent controller for its handling of the enquiry. We disclose data to authorities or our accountants and legal advisers where required by law. We do not sell personal data.
6. Transfers outside the EU/EEA
The site is delivered via a global content delivery network (CDN) and some of our providers are US-based companies, so some processing may take place outside the EU/EEA, including in the US. For such transfers we rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework where the provider is self-certified under that framework, and otherwise on Standard Contractual Clauses (SCCs) with supplementary safeguards. The transactional-email provider that delivers the contact form stores the messages in the US (see section 4); for that transfer we rely on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. Technical safeguards such as encryption in transit (TLS) are applied throughout. You can obtain a copy of the Standard Contractual Clauses by contacting us at info@navismater.com.
7. Security
The website is a static site served over HTTPS/TLS, which keeps its attack surface small. We apply appropriate technical and organisational measures, and in the event of a breach likely to pose a high risk we notify affected individuals in line with GDPR.
8. Your rights
You have the right to access, rectification, erasure, restriction, objection (to processing based on legitimate interest), data portability, and to withdraw consent at any time. To exercise a right, contact info@navismater.com; we respond within one month. Withdrawing consent does not affect the lawfulness of processing before you withdrew it. We then stop processing the enquiry and delete it, unless we must keep the data for another reason, for example under the Swedish Accounting Act if an engagement has followed.
9. Complaints
If you believe we have processed your data unlawfully, you may complain to the Swedish Authority for Privacy Protection (IMY): www.imy.se · imy@imy.se · +46 8-657 61 00 · Box 8114, 104 20 Stockholm.
10. Cookies and visitor statistics
The site uses no analytics, advertising or tracking cookies, only strictly necessary technical cookies our hosting and CDN provider may set, which do not require consent. The contact form is protected against automated submissions by Cloudflare Turnstile. It stores only temporary, strictly necessary data in your browser to tell people apart from automated submissions, and this data is not used for analytics or marketing. Such data does not require consent.
We keep simple visitor statistics on our server as pages are delivered to your browser. For each day we count how many times a page or a file (for example the report as a PDF) was fetched, and from which approximate country, as the country is derived by our hosting and CDN provider Cloudflare. We also count how many enquiries are sent through the contact form, per topic. If a page or a file is fetched by an AI service that gives its own name, such as ChatGPT or Claude, we count the fetch separately under the service's name and by whether it was made on behalf of a person or for the service's own collection. Nothing else about the service or about the person using it is stored. We do not store your IP address, details of your browser, where you came from or anything else that can be linked to you. No script runs in your browser for this, and nothing is stored on or read from your device. We only see aggregated figures, which are kept for 13 months. The purpose is to understand how the site is used, and the legal basis is our legitimate interest.
11. Changes
We may update this policy. The current version and date always appear at the top of this page.
← Back to home