Privacy Policy

This Privacy Policy explains how A&A Foundry AB ("Alignr", "we", "us" or "our") collects, uses, shares and protects personal data when you visit askalignr.com, create or use an Alignr account, claim or manage a provider profile, create or respond to a logistics opportunity, communicate with us or otherwise use our services.

1. Who is responsible for your personal data?

A&A Foundry AB, registration number 559602-9685, Sweden, is the controller for the personal data described in this Privacy Policy.

Privacy contact: hello@alignr.se

2. Who this policy applies to

This policy applies to website visitors, merchant representatives, provider representatives, account users, business contacts and other individuals who interact with Alignr. Alignr is a business-to-business service and is not intended for consumers acting in a private capacity or for children under 18.

3. Personal data we collect

Account and contact data. Name, business email address, telephone number, job title, employer or represented company, account credentials, account role and communication preferences.

Company and provider profile data. Company information, locations, operational capabilities, integrations, certifications, service markets, profile ownership, claim status, verification evidence and relevant business contact information.

Merchant operations and opportunity data. Operational requirements, order and inventory information, markets, integrations, returns, special handling, current logistics setup, selection timeline, business need and other information submitted for matching and qualification.

Matching, QOA, quote and interaction data. Match results and explanations, invited providers, opportunity access, opening windows, extensions, submitted quotes, participation status, outcomes, quality claims, credits, refunds and related audit information.

Payment and transaction data. Payment status, amount, currency, VAT information, invoice details, billing contact and transaction identifiers. Full payment card details are processed by our payment service provider and are not intended to be stored by Alignr.

Communications and support data. Emails, support requests, feedback, meeting notes, objections, complaints and other correspondence with Alignr.

Technical and usage data. IP address, device and browser information, login events, timestamps, security logs, page or feature usage and cookie or consent preferences.

Marketing data. Business contact information, outreach history, campaign responses, opt-out status and information used to assess whether a company or business contact is relevant to Alignr.

4. Where the data comes from

We collect personal data directly from you, from the organisation you represent, from other participants in a verified Alignr interaction, from our service providers and from public or commercially available business sources such as company websites, business registers and professional profiles. When we obtain personal data from another source, we provide the information required by applicable law within the relevant legal timeframe. When a merchant or provider gives us personal data about a colleague or other representative, that organisation is responsible for having a lawful basis to share it and for informing the individual. This does not limit the individual's rights under Section 13.

5. Why we use personal data and our legal bases

Providing accounts and the Alignr service

We use personal data to create and administer accounts, verify company access, maintain profiles, provide matching and comparison, qualify opportunities, manage QOA access, enable quotes, provide support and enforce the relevant Participation Terms. We rely on performance of a contract or steps taken at your request where this legal basis applies. Where the contract is with the organisation you represent, we rely on our legitimate interests in administering the business relationship and delivering the requested service.

Matching, qualification and QOA administration

We structure merchant requirements, assess provider relevance, invite up to five relevant providers, provide anonymised previews, manage paid access, reveal information after successful payment and administer opening windows, extensions, claims, credits and refunds. The legal bases are performance of the relevant service relationship and our legitimate interests in operating a trusted, relevant and commercially viable B2B marketplace.

Public provider profiles and verification

We create, maintain, verify and publish factual provider profile information to support market discovery and accurate matching. We rely on our legitimate interests in providing a reliable logistics marketplace, improving data quality and allowing providers to claim, correct and complete their profiles. We balance these interests against the rights and expectations of the individuals concerned.

Payments, accounting and legal obligations

We use transaction and billing information to process payments, issue invoices, prevent duplicate charges, manage refunds and credits, comply with accounting and tax rules, and establish or defend legal claims. The legal bases are performance of the service relationship, compliance with legal obligations and our legitimate interests in protecting our legal and financial position.

Security, fraud prevention and service improvement

We use account, technical and usage data to authenticate users, manage access, detect misuse, investigate incidents, maintain audit trails, troubleshoot the service and improve functionality. We rely on our legitimate interests in operating a secure and effective service.

Model development and service improvement

We may use data submitted by merchants and providers, including provider profiles, operational requirements, requests for quotation (RFQs), quotes, Match results, outcomes, feedback and interaction data, to develop, test, train, validate and improve Alignr's matching, ranking and qualification models. We use aggregation, de-identification or pseudonymisation where reasonably practicable, apply data minimisation and restrict access. Where personal data is processed, we rely on our legitimate interests in improving the relevance, accuracy, security and effectiveness of the service, provided those interests are not overridden by the individual's interests, rights or freedoms. This processing is subject to the rights described in Section 13 and is not used to make decisions based solely on automated processing that produce legal effects or similarly significant effects for an individual.

Business communications and marketing

We may contact relevant business representatives about Alignr, respond to enquiries, manage relationships and send product or service information. We rely on legitimate interests for proportionate B2B communications and on consent where consent is required. You can object to direct marketing at any time.

Cookies and similar technologies

Strictly necessary cookies may be used to provide requested functionality, security and account access. Non-essential analytics, preference or marketing cookies are used only after the required consent has been obtained. Cookie consent can be withdrawn through the cookie settings on the Website.

6. Participation Terms and active acceptance

Alignr requires users to actively accept the applicable Participation Terms before creating an account, claiming a provider profile, submitting a merchant opportunity or proceeding with paid QOA access. The relevant checkbox must not be pre-selected. We record the user, date, time and version of the terms accepted. Material changes may require a new acceptance.

The Privacy Policy is acknowledged as information about data processing. Acknowledging the Privacy Policy is not treated as consent to processing that relies on another legal basis. Separate consent is requested where consent is legally required, for example for non-essential cookies.

7. How the QOA information flow works

Before a provider opens an opportunity

Up to five relevant providers may receive an anonymised commercial preview, which each provider can act on during its 72-hour opening window. A provider may extend its own window once by 48 hours. The preview contains operational requirements, ranges, markets, integrations, timing, Match strengths and visible gaps. The preview is designed not to reveal the merchant company, named contact, domain or direct contact details.

After successful QOA payment

When a provider successfully pays to open a QOA, Alignr shares the merchant's company name, organisation number, contact person, email address and telephone number, as entered by the merchant, and the full operational brief with that provider so the provider can assess, contact and quote for the case. The provider may use the information only for the relevant commercial opportunity and in accordance with the Provider Participation Terms.

A provider that receives personal data may act as an independent controller for its subsequent business communication and must comply with its own data protection obligations.

Provider contact details shared with the merchant

When creating an account, a provider enters its company name, organisation number, contact person, email address and telephone number. When the payment is confirmed, Alignr shares the provider's company name, those contact details and a link to its Alignr profile with the merchant, in the merchant portal and by email. Until then, the merchant sees the provider only under a pseudonym.

Alignr remains responsible as controller for its own collection, storage and disclosure of the personal data described in this section.

RFQ submission and withdrawal

Once a merchant submits and confirms a request for quotation (RFQ) or opportunity, it cannot be unilaterally withdrawn or recalled as a commercial opportunity. The merchant is not required to accept a quote or enter into an agreement, but Alignr and providers that have already received access may continue to process and retain the submitted information as necessary to administer the opportunity, communicate, maintain audit records, resolve disputes and protect legal rights, in accordance with this Privacy Policy and the applicable Participation Terms. A request to exercise data protection rights does not automatically cancel the RFQ or reverse disclosures already made; each request is assessed under Section 13 and applicable law.

8. Automated matching and profiling

Alignr uses structured company and operational information to assess relevance, explain Match strengths and gaps, and select providers for potential invitation. Payment, commercial plan or QOA purchase does not influence Match Score, ranking, invitation or selection. Alignr does not make decisions based solely on automated processing that produce legal effects or similarly significant effects for an individual.

9. Who we share personal data with

Merchants and providers. We share information between participants only as required to provide matching, QOA access, quoting and the verified interaction described in this policy and the Participation Terms.

Service providers. We use providers for hosting, databases, authentication, payments, email delivery, customer relationship management, support, analytics, security and other technical or operational services. These providers may process personal data only under appropriate contractual and security obligations.

Professional advisers. We may share data with legal, accounting, insurance or other professional advisers where necessary.

Authorities and legal recipients. We may disclose data where required by law, a binding authority request, legal process or to protect rights, security and integrity.

Corporate transactions. Personal data may be disclosed in connection with a financing, merger, acquisition, restructuring or sale, subject to appropriate confidentiality and data protection safeguards.

We do not sell personal data.

10. International transfers

Some service providers may process personal data outside Sweden or the European Economic Area. Where personal data is transferred to a country without an adequacy decision, we use an approved transfer mechanism such as the European Commission Standard Contractual Clauses and, where appropriate, supplementary safeguards. You may contact us for further information about the safeguards used for a relevant transfer.

11. How long we keep personal data

Accounts and core service data. Normally retained while the account is active and for up to 24 months after account closure or the last meaningful activity, unless a longer period is required for an unresolved case, legal claim or legal obligation.

Opportunities, quotes and support records. Normally retained for up to 24 months after the opportunity or support matter is closed.

Security and technical logs. Normally retained for up to 12 months, unless a longer period is necessary to investigate an incident, prevent abuse or protect legal rights.

Accounting and transaction records. Retained for the period required by Swedish accounting law, normally seven years after the calendar year in which the relevant financial year ended.

Marketing data. Retained while the business relationship or marketing purpose remains relevant, normally no longer than 24 months after the last meaningful interaction. If you opt out, we may keep a minimal suppression record for as long as necessary to respect the opt-out.

Public provider profile data. Retained while the information remains relevant to a current business profile and our legitimate interest continues to apply. Providers and individuals may request correction or object to the use of personal contact information.

12. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss and destruction. Measures may include role-based access, authentication, encryption where appropriate, logging, backups, data minimisation, supplier controls and incident procedures. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

13. Your rights

Depending on the circumstances and applicable law, you may have the right to request access to your personal data, correction of inaccurate data, deletion, restriction of processing, data portability and information about relevant safeguards for international transfers. You may also object to processing based on legitimate interests and object to direct marketing at any time.

Where processing is based on consent, you may withdraw consent at any time without affecting processing that occurred before withdrawal. Rights may be subject to legal limitations, for example where we must retain accounting records or protect the rights of another party.

To exercise a right, contact hello@alignr.se. We may request information necessary to verify your identity and understand the request. Nothing in the Alignr Participation Terms limits these rights.

14. Complaints

You may lodge a complaint with the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY). Information is available at imy.se. You may also contact the supervisory authority in the EU or EEA country where you live or work.

15. Changes to this Privacy Policy

We may update this Privacy Policy when our service, data practices or legal obligations change. The latest version will be published with a new effective date. Where a change materially affects individuals, we will provide additional notice through the service, by email or by another appropriate method.

16. Contact

A&A Foundry AB Registration number: 559602-9685 Privacy email: hello@alignr.se