Legal
Privacy Policy
Entwine AB ("Twine", "we") runs the website www.twine.se and the Twine integration platform at app.twine.se. This policy explains what personal data we collect when you visit the website, contact us, subscribe to our newsletter, apply for a job or use the platform, why we collect it, how long we keep it, and what your rights are.
Who is responsible
Entwine AB (reg. no. 559436-1478), Centralplan 15, 111 20 Stockholm, Sweden, is the controller of the personal data described in this policy. For questions or requests about your personal data, email [email protected].
Data in our customers' systems. When a customer uses Twine to sync HR and payroll data, such as employee records, between its systems, the customer is the controller of that data and Twine processes it on the customer's behalf, under our Data Processing Agreement. If your employer uses Twine and you have questions about your employee data, contact your employer.
Visiting the website
When you visit www.twine.se, your browser sends us technical information such as your IP address, your browser type and the page you asked for. We use it to deliver the website and keep it secure. The legal basis is our legitimate interest in running a secure website.
- All traffic passes through Cloudflare, which protects the website against attacks and delivers it quickly.
- Our server logs record which pages are requested, but not your IP address.
- To stop the forms from being misused, we count submissions per IP address. The count is kept in memory for at most an hour and is never saved.
Cookies
The website uses two cookies that it needs in order to work, and Google Analytics cookies only if you accept them.
| Cookie | Purpose | Kept for |
|---|---|---|
_corporate_key |
Keeps the website's connection and forms secure | Until you close your browser |
twine_consent |
Remembers your cookie choice | 12 months |
_ga, _ga_<id> |
Google Analytics, only if you accept | 13 months |
You can change your choice at any time with "Cookie settings" at the bottom of every page. If you withdraw your consent, the Google Analytics cookies are removed.
Statistics (Google Analytics)
If you accept cookies, we use Google Analytics to understand how the website is used: which pages are visited, how visitors found us, roughly where they are (country and city), which device and browser they use, and whether they sent a form or searched for an integration. We never send Google what you type into a form. The legal basis is your consent, and nothing is sent to Google until you accept.
The service is provided by Google Ireland Limited. Google Analytics doesn't store your IP address, and we have turned off Google signals and data sharing with Google. The statistics are kept for 14 months. Google may process the data in the United States; see "Transfers outside the EU/EEA" below.
Contact and partner forms
When you send our contact form or apply to become a partner, we receive your name, email address and message, and for partner applications your company, website and the kind of partnership you're interested in. We also note which page and language you used, so that we can answer in your language. We use this to answer you and, for partner applications, to assess the partnership. The legal basis is our legitimate interest in answering enquiries.
Your message is emailed to our inbox through Brevo and isn't stored on the website. We keep enquiries for 24 months and then delete them.
We also count how many people start and send each form, and which fields they reach. The counts are anonymous: they contain nothing you type and nothing that identifies you.
Newsletter
If you subscribe to our newsletter, we use your email address to send it to you. The legal basis is your consent. Brevo stores your subscription and first sends you an email to confirm it; you're only added once you've confirmed. Every newsletter has a link to unsubscribe, and we keep your address for as long as you're subscribed.
Job applications
If you apply for a job with us, we use what you send us, such as your CV, cover letter and contact details, to assess your application. The legal basis is our legitimate interest in recruiting, and taking steps before a possible employment contract. We keep applications for two years after the recruitment ends (for an open application, two years after we received it), so that we can respond to any legal claims, and then delete them.
Using the Twine platform
If your organisation uses Twine, we process the following personal data about you as a user of app.twine.se. The legal basis is our legitimate interest in providing the service under our agreement with your organisation, and in keeping it secure.
- Your account: your name, email address, role, organisation, profile picture and settings, such as your choice of light or dark theme.
- Signing in: you sign in with Google, Microsoft or a passkey, or with a one-time sign-in link sent by email. With Google or Microsoft, we receive your name, email address and profile picture from them each time you sign in, and Twine never handles your password. With a passkey, we store only its public key. A session lasts 24 hours.
- Invitations and emails: when someone invites you, we store your email address and who invited you, and email you the invitation. We also email sign-in links and notices such as a change of email address. We only send status emails about your integrations if you agreed to them when you accepted the invitation. Your organisation can also name contacts who receive summaries by email.
- Security and audit logs: we log access to your organisation's data, including the IP address and browser for requests through our API, and keep that log for 365 days. Changes to users, roles and integrations are recorded in an audit trail, so that it can be traced who changed what. Our application logs, which we use to find and fix errors, can contain your email address.
- Cookies: the platform uses a session cookie (
_twine_core_key, 24 hours) and a cookie that remembers your theme (twine_theme, 12 months). It uses no analytics or marketing cookies.
We keep your account for as long as your organisation gives you access. When your account is removed, we delete it. Entries in the audit trail are kept so that changes can still be traced.
Who we share data with
We never sell personal data. These providers process personal data on our behalf, for the purposes below:
| Provider | What for |
|---|---|
| UpCloud | Hosting the website and the platform, in Stockholm, Sweden |
| Cloudflare | Network and protection: all traffic to the website and the platform passes through it |
| Brevo | Email: form messages, the newsletter and the platform's emails |
| Statistics on the website, only if you accept cookies | |
| AppSignal | Monitoring the platform and finding errors |
| Amazon Web Services | Storing server logs |
When you sign in to the platform with Google or Microsoft, they handle your account with them as controllers in their own right, under their own privacy policies. If your organisation connects Slack to the platform, notifications are also sent there.
We may also disclose personal data when the law requires us to.
Transfers outside the EU/EEA
Our data is stored in Sweden. Some of our providers, such as Cloudflare and Google, may process personal data outside the EU/EEA, for example in the United States. When they do, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.
How we protect your data
Access to personal data is limited to the people at Twine who need it for their work, and all traffic is encrypted. Read more about how we work with security on our security page.
Your rights
You have the right to:
- get a copy of the personal data we hold about you
- have incorrect data corrected
- have your data deleted
- have our processing restricted
- object to processing that is based on our legitimate interest
- receive data you have given us in a machine-readable format
- withdraw your consent at any time, which doesn't affect processing that happened before
To use your rights, email [email protected]. We answer within one month.
If you think we handle your personal data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.
Changes to this policy
We update this policy when the way we handle personal data changes. The date at the top shows when it last changed.
Contact
Entwine AB, Centralplan 15, 111 20 Stockholm, Sweden. Email: [email protected].