1. About this policy

This policy describes how Trelson AB (“we”) processes personal data in the Trelson service and in what belongs to the service: customer relationships, invoicing, support and mailings.

By the Trelson service we mean assignments and exams, locked exam mode (the Chrome extension and the apps for Windows, macOS, iPad and Linux), focus rooms, assessment and feedback, and writing tools such as spelling, grammar, dictation and read-aloud.

This policy covers only the Trelson service. It does not cover Trelson AB’s other services, such as Class Manager and Mail Switch, nor our website. Those services and the website have their own privacy policies.

This policy applies to you if you

• use Trelson as a student, teacher or administrator through your school (section 3)
• are a customer or a contact person at a customer, or are interested in becoming a customer
• contact us or our support about Trelson
• receive newsletters and other mailings about Trelson.

2. Contact details

Trelson AB, company reg. no. 559459-4649
Mejerivägen 3, 117 43 Stockholm, Sweden
Email: contact@trelson.com

You can reach our Data Protection Officer at dpo@trelson.com. You can always contact the Data Protection Officer with questions about how we process personal data in Trelson.

3. When you use Trelson through your school

When a municipality, a school or a group of schools uses Trelson, the organisation responsible for the school is the controller of the data about students, teachers and administrators. Trelson AB is the processor. This means that we process the data only on that organisation’s instructions, under the data processing agreement (DPA) we have with it.

In the service we process, for example,

• name, email address and user ID from the school’s Google or Microsoft account
• class and group
• students’ answers, submissions and texts
• teachers’ assessments and feedback
• technical data, for example logs of sign-ins and activity.

The data is stored within the EU/EEA. We never sell the data and do not use it for marketing. The sub-processors we use are listed in an annex to the DPA.

The school’s organisation decides how long the data is kept and answers questions about the processing. If you want, for example, a copy of your data or to have it corrected, contact your school. If you contact us, we pass your request on to the school and help the school to answer it.

The service uses only the cookies and local storage needed for signing in and for the service to work. We use no cookies for statistics or marketing.

4. Data we are responsible for

For the processing described in this section, Trelson AB is the controller.

4.1 Customers and contact persons

• Data: name, email address, phone number, role, organisation and our communication with you, for example quotes, agreements and meeting notes.
• Purpose: to give quotes, enter into and manage agreements for Trelson, sign data processing agreements and keep in touch with customers and interested organisations.
• Legal basis: legitimate interest. We need to be able to stay in contact with the people who represent our customers and the organisations that are interested in Trelson.
• Retention: three years after the last agreement or, if the organisation has not become a customer, after the last contact. Agreements and data processing agreements are kept for ten years after the agreement has ended, as they may be needed as evidence in a dispute.

4.2 Invoicing and payment

• Data: names and contact details of invoice recipients, invoices and payments. If you pay by card, the card details are handled by our payment provider Stripe. We never store card numbers.
• Purpose: to invoice and receive payments.
• Legal basis: legal obligation under the Swedish Bookkeeping Act (bokföringslagen) and legitimate interest in being able to invoice our customers.
• Retention: accounting records are kept for seven years after the end of the calendar year in which the financial year ended, as the Bookkeeping Act requires.

4.3 Support

• Data: name, email address and what you write to us.
• Purpose: to answer questions and solve problems in Trelson.
• Legal basis: legitimate interest in being able to help customers and users.
• Retention: six months after the case has been closed. When a case is closed, we remove data about students and other people that the case does not need.

4.4 Newsletters and mailings

• Data: name, email address and organisation.
• Purpose: to tell you about news in Trelson and send invitations and other information about the service.
• Legal basis: legitimate interest when you are a contact person at a customer or have shown interest in Trelson. You can unsubscribe at any time with the link in every mailing.
• Retention: until you unsubscribe. The data is then deleted within 30 days.

5. Who we share data with

We never sell personal data. We share it only with

• suppliers that process data on our behalf, for example Google (cloud services, email and documents), Mailjet (email delivery), Stripe (card payments) and suppliers of accounting and electronic signature systems
• the related company that provides parts of our IT environment under an agreement
• public authorities, when the law requires it.

All suppliers that process personal data on our behalf are bound by data processing agreements.

6. Transfers outside the EU/EEA

Customer data in the Trelson service is stored within the EU/EEA. Some of the suppliers we use for our own administration, for example Google and Stripe, may process data outside the EU/EEA, mainly in the USA. Such transfers are protected because the recipient is certified under the EU-U.S. Data Privacy Framework, or by the European Commission’s standard contractual clauses.

7. Your rights

You have the right to

• know what data we hold about you and receive a copy of it (subject access)
• have incorrect data corrected
• have data erased, for example when it is no longer needed
• ask us to restrict the processing
• object to processing based on legitimate interest
• receive data you have provided yourself in a machine-readable format, when the processing is based on consent or a contract
• withdraw your consent at any time.

Write to contact@trelson.com or to our Data Protection Officer at dpo@trelson.com. We reply within one month.

If you are unhappy with how we process your personal data, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se.

8. Security

We protect personal data with technical and organisational measures, for example encryption, limited access rights and logging. This work is governed by our information security policy for the Trelson service and our information security management system, which follows ISO/IEC 27001.

9. Changes

We review this policy together with our Data Protection Officer at least once a year and whenever we change how we process personal data. The latest version is always available on our website. If we make major changes, we inform customers and others concerned.

Last updated: 2026-11-02