Legitimate interest: business contacts

1. What this assessment covers

For some solar and battery installers in our installer directory, Enskild Firma Milkevich Valiantsin ("Numsolar", "we") prepares a Numsolar account that the company can take over: a prepared organisation. This page is our legitimate interest assessment (Art. 6(1)(f) GDPR) for the data we use for it. How we handle data in general is in the privacy policy.

A prepared organisation holds only:

• public company data from the directory: name, organisation number, office address, website, the company's general phone number and e-mail address (for example info@), description, certifications and service area — and only data we rated as reliable (high or medium confidence);
• the brand from the company's own website: logo, colours and fonts;
• a starter kit with example prices and one demo proposal for a fictional customer ("Exempelkund (demo)") on a fictional house.

It holds no personal data about named people: no names, no direct e-mail addresses or mobile numbers, no users and no members. Sole traders (whose organisation number is a personal identity number) are never included.

2. Purpose

We want to show a solar company how Numsolar works with the company's own details and brand, so that the company can quickly decide whether it wants to use the service. The company gets a link to a ready account instead of an empty one. This is a legitimate commercial interest: offering a service to businesses (GDPR recital 47).

3. Necessity

• The data is company data, not data about private individuals. General addresses such as info@ and switchboard numbers are as a rule not personal data. We still give them the same protection, because the general address of a small company can reach one person.
• We use only what is needed to show an account in the company's name and brand. Data with low confidence stays empty.
• Without the data we cannot show a prepared organisation; an empty account does not show the value for that company.

4. Balancing

• Reasonable expectations. The company itself published the data for business contact, or it is in public registers. A company that markets itself to homeowners can expect to be contacted about a business service for exactly that work.
• Low impact. No personal data about named people, nothing is published and nothing is sold. The company can take over the account, change everything, or ignore it.
• Never public. A prepared organisation is never shown to the public: not in the directory, not in the quote comparison, not on any page and not in the sitemap. It appears only after the company itself took it over and chose "Go live".
• No e-mail from the service. Numsolar never sends e-mail to a prepared organisation. Any e-mail to the company's general address is sent by hand by us, identifies Numsolar as the sender, contains a claim link (valid 30 days, single use) and stops immediately if the company says no (Swedish Marketing Act, marknadsföringslagen 2008:486, 19–21 §§).

We find that our interest does not override the fundamental rights of the people who may be reached through the company's general contact details, with the safeguards below.

5. Safeguards

• No personal data about named people in a prepared organisation, its demo customer or the demo proposal.
• Never public before the company takes it over and chooses "Go live"; no e-mail from the service.
• The website is read with care. Our reader, NumsolarBrandBot, obeys robots.txt, makes at most 10 requests per website, waits at least 3 seconds between websites and reads only public pages. If robots.txt blocks us, the template default colours are used.
• No paid or AI lookups to build the organisation and nothing from LinkedIn or people-search sites.
• Limited access. Only Numsolar's administrators see a prepared organisation before it is taken over.
• Removal on request (section 6).

6. Objection and removal

E-mail contact@numsolar.com with the company's name or organisation number, or answer "no" to our e-mail. We then do this:

• The prepared organisation, its demo customer, the demo proposal and every stored file (logo, PDF, preview image) are removed within 24 h.
• The company is blocked, so it is not prepared again when we refresh the directory.
• Backup copies expire within 5 weeks: the files leave the nightly mirror at the next sync, and the database copies (7 daily and 4 weekly) are overwritten within five weeks. We do not edit the copies; a restored copy is not prepared again, because the block is checked every time.

You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se.

7. How long we keep it

A prepared organisation stays until the company takes it over, asks us to remove it, or we remove it. We review prepared organisations that are not taken over after 180 days and decide then whether to remove them. Once the company has taken over the organisation, the terms for companies and section 5 of the privacy policy apply.

8. Review

We repeat this assessment before we change the data we use, and at least once a year. Questions: contact@numsolar.com, Enskild Firma Milkevich Valiantsin.