Last updated: 2026-10-23

​

1. Who we are

This Privacy Policy explains how Acord Group AB, trading as Acord Media, Swedish corporate identity number 559526-2394, Näsvägen 5, 132 36 Saltsjö-Boo, Sweden (“Acord Media”, “we”, “us”), processes personal data when you visit acordmedia.com (the “Website”), contact us, or use our services.

​

Contact: support@acordmedia.com

​

We act in two roles:

• Data controller for data about website visitors, prospects, and our clients’ contact persons, where we decide why and how the data is used.

• Data processor for personal data that our clients give us or that is collected on their behalf in client campaigns (for example customer lists used to build audiences). In that case the client is the controller and we process the data only on the client’s documented instructions under a data processing agreement. If your data is processed in a client’s campaign, please contact that client first about your rights.

​

We comply with the EU General Data Protection Regulation (GDPR), the Swedish Data Protection Act, and the Swedish Electronic Communications Act, and we follow the terms and policies of the advertising platforms we use, including Meta’s Business Tools Terms.

​

2. What personal data we collect

2.1 Data you give us

• Clients and prospects: name, business email, phone number, job title, company, billing address, and information you submit through contact forms, meeting requests, emails, or calls.

• Invoicing: billing details and payment information needed to issue and receive payments. Card details are handled by our payment provider and not stored by us.

• Client customer data: email lists, demographic data, purchase history, or CRM data that clients provide for campaigns (we process this as a processor).

​

2.2 Data collected automatically

• Technical data: IP address, device identifiers, browser type, operating system, approximate location based on IP address.

• Usage data: pages visited, time spent, clicks, referring URLs.

• Advertising and campaign data: impressions, clicks, conversions, cost per click, return on ad spend, and event data collected through tools such as the Meta Pixel, the Meta Conversions API, and Google Analytics, but only for visitors who have accepted the relevant cookies.

​

2.3 Data from other sources

• Advertising platforms: aggregated or pseudonymized engagement metrics and audience insights from Meta (Facebook and Instagram), Google, LinkedIn, and TikTok.

• Public sources for B2B prospecting: professional contact details from business directories, public registries, company websites, and professional profiles. We only contact people in a business context and tell you the source when we first contact you. You can object at any time (see section 10).

​

2.4 Sensitive data
We do not intentionally collect special categories of personal data (such as health, ethnicity, political opinions, or biometric data), and we do not use such data in ad targeting. We ask clients not to supply such data.

​

3. Why we use your data and on what legal basis

Entering into and performing agreements (quotes, onboarding, delivering and optimizing campaigns, project communication). Legal basis: contract (GDPR Art. 6.1.b).

​

Invoicing and bookkeeping (invoices, payments, accounting records). Legal basis: legal obligation (Art. 6.1.c).

​

Responding to enquiries (answering messages and meeting requests). Legal basis: legitimate interest (Art. 6.1.f), or steps taken at your request before a contract (Art. 6.1.b).

​

B2B marketing and prospecting (contacting business contacts about relevant services). Legal basis: legitimate interest (Art. 6.1.f).

​

Newsletters and marketing emails to individuals (email campaigns where consent is required). Legal basis: consent (Art. 6.1.a).

​

Analytics and website improvement (traffic statistics, campaign attribution, A/B testing). Legal basis: consent for non-essential cookies (Art. 6.1.a); legitimate interest for strictly necessary measures (Art. 6.1.f).

​

Ad measurement and audience building (Meta Pixel, Conversions API, Custom and Lookalike Audiences). Legal basis: consent for visitor tracking (Art. 6.1.a). For client data, we act on the client’s instructions as processor.

​

Security and fraud prevention (protecting the Website and systems). Legal basis: legitimate interest (Art. 6.1.f).

Legal claims and legal requests (responding to authorities, defending claims). Legal basis: legal obligation (Art. 6.1.c) or legitimate interest (Art. 6.1.f).

​

Where we rely on legitimate interest, we have weighed our interest against your rights and interests. You can ask us for more information about this assessment.

​

4. Profiling and automated decisions

Audience building (such as Custom Audiences, Lookalike Audiences, and segmentation) may involve profiling, meaning grouping people by characteristics to show relevant ads. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

​

5. Who we share data with

• Advertising platforms: Meta (Facebook, Instagram), Google, LinkedIn, and TikTok, for ad delivery, measurement, and audience building.

• Service providers (processors): Wix (website), Loopia (hosting and domain), Notion (internal documentation and project management), Zapier (workflow automation), [payment provider], [accounting/invoicing provider], and [email/newsletter tool, if used]. They may only process data on our instructions.

• Clients: campaign reports, which contain aggregated or anonymized data.

• Authorities and advisers: where required by law, a court order, or to protect our legal rights, and to professional advisers such as accountants and lawyers bound by confidentiality.

• Business transfers: if our business is reorganized or sold, data may be transferred to the new owner under this policy.

​

We do not sell personal data.

​

6. Meta-specific information

• We may use the Meta Pixel, the Meta Conversions API, and Advanced Matching on our own site and in client campaigns to measure ad performance and build audiences. On our own Website, these only run if you consent via the cookie banner.

• For Meta Pixel data, Meta and the website operator may be joint controllers for the collection and transmission of data to Meta. Meta is then responsible for its own further use under Meta’s Data Policy.

• For Custom Audiences, customer data is hashed (SHA-256) before upload to Meta. Our clients are responsible for having a lawful basis, and where required consent, for sharing their customer data for this purpose.

• You can control ads you see through Meta’s Ad Preferences and Ad Settings in your Facebook and Instagram accounts.

​

7. Transfers outside the EU/EEA

Some of our providers (for example Meta, Google, Notion, Zapier, and Wix) may process data in the United States or other countries outside the EU/EEA. Such transfers take place only with a valid safeguard, such as the EU-US Data Privacy Framework (where the recipient is certified), the European Commission’s Standard Contractual Clauses, or another mechanism permitted by GDPR Chapter V. You can contact us to get information on the safeguards used.

​

8. Cookies and similar technologies

We use cookies and similar technologies on the Website.

• Strictly necessary cookies make the Website work and do not require consent.

• Analytics and marketing cookies (for example Google Analytics and the Meta Pixel) are only set after you give consent through our cookie banner.

​

9. How long we keep your data

• Accounting records and invoices: seven years after the end of the calendar year in which the financial year ended (Swedish Bookkeeping Act).

• Client and contract data: the duration of the agreement plus the period needed for legal claims, normally up to 3 years after the agreement ends, unless a longer legal obligation applies.

• Prospect and enquiry data: up to 2 years after our last contact.

• Newsletter subscriptions: until you withdraw consent.

• Website analytics and advertising data: according to the retention settings of each tool, normally no longer than 14 to 26 months.

• Encrypted backups: up to 90 days.

• Client customer data (as processor): according to the client’s instructions and our data processing agreement; deleted or returned when the assignment ends.

​

When data is no longer needed, we delete or anonymize it.

​

10. Your rights

Under GDPR you have the right to:

• Access the personal data we hold about you and get a copy.

• Rectification of inaccurate or incomplete data.

• Erasure (“right to be forgotten”) in the cases set out in law.

• Restriction of processing in certain situations.

• Data portability of data you gave us, where processing is based on consent or contract and is automated.

• Object to processing based on legitimate interest, and to direct marketing at any time and free of charge.

• Withdraw consent at any time. This does not affect processing done before withdrawal.

​

To exercise your rights, email support@acordmedia.com. We may need to verify your identity, and we aim to respond within one month. If your data is processed on a client’s behalf, we will forward your request to the client where appropriate.

​

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, www.imy.se, or with the supervisory authority in your own EU/EEA country.

​

11. Security

We use technical and organizational measures to protect personal data, such as encryption in transit and for backups, access controls, role-based permissions, and agreements with our service providers. No transmission over the internet or storage system is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs that is likely to put your rights at risk, we will notify IMY and affected individuals as required by law.

​

12. Children

Our services are directed at businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

​

13. Changes to this policy

We may update this policy from time to time. The latest version is always available at acordmedia.com with the date of the last update shown at the top. For material changes, we will inform you in a suitable way, for example by email to clients and subscribers or a notice on the Website.

​

14. Governing law

This policy is governed by Swedish law. This does not limit your mandatory rights as a data subject, including your right to complain to a supervisory authority or bring a claim before the courts of your country of residence.

​

15. Contact

Acord Group AB (Acord Media)
Org. no. 559526-2394
Näsvägen 5, 132 36 Saltsjö-Boo, Sweden
Email: support@acordmedia.com