Your personal data

1. The short version

This is what matters most. The rest of the page covers the same ground in more detail.

• Your answers are used to produce statistics. They are never used to sell you anything.
• Results are reported in groups. No client ever sees what you personally answered.
• Contact details tied to a single study are kept for a maximum of 90 days after fieldwork closes, after which the answers are de-identified.
• If you are a panel member, we keep your details for as long as the membership lasts. You can end it whenever you want.
• We never sell your data on.
• You can ask us what we hold about you, and have it corrected or erased.

2. Taking part is voluntary

You decide whether to answer. You can skip questions, stop halfway through, or not take part at all, without giving a reason and without it affecting your relationship with us or with whoever commissioned the study.

If you stop halfway, we keep the answers you have already given unless you ask us to remove them. Incomplete responses are only used in the statistics where that can be done correctly; otherwise they are set aside.

3. Who is responsible for your data

Reflect Företagsutveckling AB (reg. no. 556625-1277), Kungstensgatan 38, 113 59 Stockholm, Sweden, runs the study.

Usually we do so on behalf of another organisation. In that case the client is the data controller and we are the data processor, which means we may only handle the data in the way agreed with them. When we run a study in our own name, we are the controller ourselves.

If you reached the study through a panel provider, they are responsible for your panel profile and your contact details. We receive your answers and a code identifying the visit, not your name.

4. What data we process

Which data is involved depends on how you were invited. We use no tracking cookies, no advertising networks, and we do not buy in data about you from other sources.

• Contact details: name, email address or mobile number, where we or the client invited you directly
• Your answers, including anything you write in free-text fields
• Background details you provide, such as age, gender, town or household size
• Special category data, such as health or political opinions, only where the study explicitly asks and you have given consent
• Technical information: a temporary session cookie that keeps track of where you are in the questionnaire, timestamps, and how long answers took

5. Why we process it, and on what legal basis

The purpose is to run the study, quality-assure the material, and produce statistics and analysis from it.

Legitimate interest (Article 6(1)(f) GDPR) is the basis for the study itself and for quality control. Consent (Article 6(1)(a)) is obtained separately for special category data under Article 9 and for panel membership. Contract (Article 6(1)(b)) applies where participation carries a reward or a place in a prize draw.

We do not use your answers to target marketing at you, and we make no automated decisions about you within the meaning of Article 22.

6. Why the data is not de-identified immediately

This is the question we are asked most often, and the answer is quality control.

Before a study is finished we need to be able to go back to individual records: check that the right person received the right questionnaire, detect duplicates, trace answers that look wrong, remove responses that turn out to be invalid, and top up groups that are under-represented. None of those checks can be carried out on material where the link has already been removed.

We therefore keep the link between your answers and the identifier you were invited with for a limited period: as a rule no more than 90 days after fieldwork closes, and often less. Once the material has been checked and approved, name, email address and phone number are removed and the answers become de-identified.

Two things are worth knowing about what that means. After de-identification we can no longer retrieve your particular answers, which also means a request for erasure needs to reach us before then. And free-text answers are kept as you wrote them, because we cannot mask content inside running text without distorting it. So please do not write names, addresses or personal identity numbers into free-text fields.

7. If you are a panel member

Being in a panel means you have agreed to be approached repeatedly rather than once.

In that case we keep your contact detail and a membership identifier for as long as the membership lasts, along with the background details you have given so that we do not have to ask the same things every time. The individual studies you take part in still follow the rule above: the link between answers and identifier is removed once the material has been checked.

You can end the membership at any time, without giving a reason. We then remove your contact details without undue delay. Answers you have already given remain in de-identified form, because they are already part of statistics that have been delivered.

If the panel is run by an external provider, you end the membership with them, and their terms govern your panel profile.

8. Who can see your data

Within Reflect, only those working on the study have access, and permissions are set per person and per project.

The client receives the results in grouped form. They do not get to see individual answers alongside a name, unless you have explicitly asked to be contacted.

We use suppliers to run the technology. All of them are bound by data processing agreements and may not use the data for their own purposes. We never sell your data, and we do not disclose it to anyone outside the list below unless the law requires it.

• Database operations and storage (Supabase, Frankfurt, Germany)
• Web hosting and delivery of the questionnaire (Vercel)
• Sending invitations and reminders
• AI services for processing free-text answers (Anthropic and Google), under agreements ensuring the material is not used to train models

9. Where the data is stored

The bulk of all processing takes place within the EU and EEA, and the database is located in Frankfurt. Some of the suppliers listed above have operations in the US. Those transfers are protected by EU Standard Contractual Clauses under Article 46(2)(c) GDPR.

10. How the data is protected

Data is transmitted encrypted (TLS) and stored in a database where access is enforced at row level, not only in the application. Permissions are role-based and reviewed, access is logged, and contact details are held separately from the answers so that they can be removed on their own.

Should an incident nonetheless occur that poses a risk to you, we report it to the Swedish Authority for Privacy Protection within 72 hours and inform you where the law requires it.

11. Your rights

You have the following rights under the GDPR. They can be exercised for as long as we are able to locate your data, which is to say up until de-identification.

• Find out what data we process about you (subject access request)
• Have inaccurate data corrected
• Have your data erased
• Ask for processing to be restricted while a question is investigated
• Object to processing that rests on legitimate interest
• Receive your data in a machine-readable format
• Withdraw a consent you have given, without affecting what has already been done
• Lodge a complaint with the Swedish Authority for Privacy Protection (imy.se), the supervisory authority

12. How to make such a request

Email info@reflect.se and say which study it concerns. If you still have the invitation, it helps us a great deal if you include the link or code from it, since that is often the only thing connecting you to the right material.

We respond without undue delay and within one month at the latest. It is free of charge.

If it concerns a panel run by someone other than us, please contact them, since they hold your panel profile.

13. Contact

Reflect Företagsutveckling AB Kungstensgatan 38, 113 59 Stockholm, Sweden Email: info@reflect.se Phone: +46 709 99 52 36

The full privacy policy is available at reflect.se/en/privacy-policy.