Privacy policy

Last updated: 2026-10-21

Who is responsible

Open Strategising AB, organisation number 559496-8686, Mimersvägen 9, 754 40 Uppsala, Sweden, is the controller of the personal data described here. Contact us at privacy@openstrategising.com.

What we collect, why and for how long

Our forms collect your name, your email address and, if you give them, your phone number and the name of your organisation, together with what each form asks for below. No law requires you to give us your data, but without your name and email address we cannot answer you, and without the booking and invoicing details we cannot handle a booking. We make no decision about you by automated means alone, and we do not build profiles of you.

Booking requests

A booking request gives us the course date, the price option, roughly how many places you need and your message. After it, you send us the participants' names and email addresses, and when we confirm a booking we ask for the invoicing details and, for an organisation, its organisation number, country and VAT number or, for a private person, your address. If someone else booked a place for you, we received your name and email address from them. If dietary needs or accommodation matter for your course, we ask for them separately after your booking is confirmed, and tell you then how we handle them.

We use these details to confirm the places, run the course and invoice. When you book as a private person, the legal basis is our contract with you (Article 6(1)(b) GDPR); when you book for an organisation, it is our legitimate interest in performing the contract with the organisation, and for the participants, in performing the contract with whoever booked their places (Article 6(1)(f)). We keep booking details for three years after the last day of the course, and a request that does not become a booking as an enquiry. We keep invoices and their records as the Swedish Bookkeeping Act (bokföringslagen) requires (Article 6(1)(c)), until the end of the seventh year after the end of the calendar year in which the financial year ended.

Enquiries

When you contact us, write to our instructors or ask for early access, we use your message, and the course or programme it is about, to answer you and follow up. The legal basis is our legitimate interest in answering the people who contact us (Article 6(1)(f)) or, when you ask about booking a course, taking steps at your request before entering into a contract (Article 6(1)(b)). We keep enquiries for two years after our last contact with you, unless they become part of a booking.

Newsletter

A newsletter sign-up is recorded in our customer relationship system as unconfirmed, with the version of the wording you saw. We send you no newsletter until you confirm from an email we send for that purpose, and only that confirmation counts as consent (Article 6(1)(a)). If you do not confirm within 30 days, we delete the sign-up. Until you confirm, we keep the sign-up and send the confirmation email on the basis of our legitimate interest in checking that the address belongs to the person who signed up (Article 6(1)(f)). You can withdraw your consent at any time through the link in every newsletter or by writing to us. We keep your subscription until you withdraw it, and a record of when you consented and to which wording for two years after that, so that we can show that you consented (Article 6(1)(f)).

Meetings

The "Get Started" button on our pages lets you book a meeting with us through Calendly. We use what you enter there to hold and follow up the meeting, on the basis of our legitimate interest in meeting the people who ask to meet us (Article 6(1)(f)), and keep it as we keep enquiries.

Job applications

You apply for our open positions through our recruitment system, Manatal. We use your application to assess it and contact you, on the basis of taking steps before an employment contract (Article 6(1)(b)) and our legitimate interest in recruiting (Article 6(1)(f)), and keep it for two years after the recruitment has closed, unless you agree to our keeping it longer.

Running and protecting the website

Our hosting provider receives your IP address and what your browser sends, to deliver the pages and protect the site from attacks, and keeps its logs for one day on our plan. It also limits how often one IP address can send our forms, and so that a form sent twice is recorded once, we keep short-lived markers under one-way codes that reveal nothing you typed, and delete them within 24 hours. The legal basis is our legitimate interest in a working and secure website and in protecting our forms from abuse (Article 6(1)(f)).

Measuring how the website is used

If you accept statistics cookies, PostHog, on its EU cloud, measures how the site is used for us, counting page views and clicks on links to other sites, and we keep these statistics for up to 25 months.

If you accept marketing cookies, we use the LinkedIn Insight Tag to measure our advertising on LinkedIn. LinkedIn and we are jointly responsible for that collection: we ask for your consent and give you this information, and LinkedIn is responsible for the rest, including your rights over the data it holds, which you can use with either of us. What LinkedIn does with the data afterwards is covered by LinkedIn's own privacy policy.

The legal basis for all of this measuring is your consent (Article 6(1)(a) GDPR, and the Swedish Electronic Communications Act, lagen om elektronisk kommunikation, for the cookies themselves).

Cookies

We store your answer to our cookie banner on your device without asking, since the site needs it to respect your choice. Statistics and marketing cookies and similar technologies are used only if you accept them in the banner. The list at the end of this page shows each of them, what it does and how long it lasts. You can change or withdraw your choice at any time with Cookie settings at the bottom of every page.

Who receives your data

Apart from what Swedish law requires us to disclose, we share personal data only with the recipients below. All of them except LinkedIn are service providers that process the data on our instructions under data processing agreements:

• Vercel Inc. hosts the website and runs the functions that receive our forms, in its Stockholm region.
• Attio Ltd. is our customer relationship system, where everything you send us through our forms is recorded.
• Microsoft and Google provide our company email and documents.
• PostHog Inc. measures how the website is used, on its EU cloud, only if you accept statistics cookies.
• Upstash, Inc. stores the markers that protect our forms, in its Frankfurt region.
• Calendly LLC provides the meeting calendar.
• Manatal provides our recruitment system.
• LinkedIn Ireland Unlimited Company receives what the Insight Tag collects, only if you accept marketing cookies, as jointly responsible with us (see above), not on our instructions.
• Our accounting and invoicing provider receives what an invoice needs.

Transfers outside the EU and EEA

Where our providers allow it, the data our forms collect stays in the EU and EEA. Attio is a UK company, and several providers are, or belong to, companies in the United States, the United Kingdom or other countries outside the EEA, and may process data or reach it from there. Each such transfer is covered by a decision of the European Commission that the country protects personal data adequately, such as the EU-US Data Privacy Framework for a provider certified under it, or otherwise by the Commission's standard contractual clauses. Write to us for a copy of the safeguards that apply to a particular provider.

Your rights

You have the right to:

• access your data and get a copy;
• have inaccurate data corrected and incomplete data completed;
• have your data deleted, unless we must keep it;
• have its use restricted to storage, for example while a question about its accuracy or our use of it is settled;
• receive the data you gave us, where we use it on the basis of your consent or a contract, in a structured, commonly used and machine-readable format, or have it sent to someone else;
• withdraw a consent at any time, without affecting what we did before.

You can also object, on grounds relating to your particular situation, to our using your data on the basis of our legitimate interests. We then stop, unless we have compelling legitimate grounds that override your interests, or need the data for a legal claim. If you object to direct marketing, we always stop.

To use these rights, write to privacy@openstrategising.com. You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se, or to the supervisory authority where you live or work.