Bompit Privacy Policy v1.0

This Privacy Policy applies to the Bompit website and services available at bompit.com (“Bompit”).

Bompit is designed around a simple principle: useful tools should not require you to provide more information than necessary.

This Privacy Policy explains what personal data and other information may be processed when you visit or use Bompit, why we process it, who may receive it, how long it is retained, and what rights you have.

1. Who is responsible for Bompit?

Bompit is operated by:

Byte Systems Holding, Petri Mäensivu AB
Company registration number: 559579-7480
Sweden

For privacy questions or requests concerning your personal data, contact:

bompit@bytesystems.se

Byte Systems Holding, Petri Mäensivu AB is the data controller for the processing of personal data described in this Privacy Policy.

2. Information you enter into Bompit tools

Bompit's current browser-local tools are designed to perform their tool processing locally in your browser.

Information you enter into these tools is not sent to Bompit's servers for tool processing.

Generated output and downloadable files are created locally in your browser where supported by the relevant tool.

Bompit does not receive or store this tool input on its servers as part of providing these current tools.

3. Cookies and browser storage

Bompit's current tools do not require an account.

Bompit does not currently set cookies or use Local Storage, Session Storage or IndexedDB to store your tool input.

Tool input is processed in your browser and is not persisted by Bompit in browser storage.

If Bompit introduces functionality that uses cookies or other browser storage in a way that affects your privacy, we will update this Privacy Policy and, where required, request consent before using such technology.

4. Technical data processed when you visit Bompit

When you connect to Bompit, some technical data must be processed to deliver the website and to operate and protect the service.

Our infrastructure maintains limited technical access logs. Depending on the request, these may include:

• IP address;
• date and time of the request;
• requested page or resource;
• HTTP method;
• HTTP response status; and
• limited technical information necessary to operate and protect the service.

Bompit's reverse proxy is configured to exclude HTTP headers from its access logs by default.

Information entered into Bompit's current tool forms is not included in these access logs because that information is processed locally in your browser rather than submitted to Bompit's servers for tool processing.

5. Purposes and legal basis

We process limited technical data for the following purposes:

• delivering and operating Bompit;
• maintaining the availability and reliability of the service;
• diagnosing and resolving technical problems;
• detecting abusive, malicious or abnormal traffic;
• protecting Bompit and its infrastructure; and
• investigating security or operational incidents where necessary.

Where this technical data constitutes personal data, our legal basis is Article 6(1)(f) GDPR — legitimate interests.

Our legitimate interests are to operate a reliable public web service, maintain the security and integrity of Bompit and its infrastructure, prevent and investigate abuse, and diagnose technical problems.

We limit the information processed for these purposes and have designed Bompit to avoid sending current tool input to our servers where server-side processing is not necessary.

The use of legitimate interests requires that the processing be necessary for the stated purpose and that the controller's interests are not overridden by the rights and freedoms of the individual.

6. How long technical logs are retained

Bompit's infrastructure uses automatic size-based log rotation.

The reverse-proxy container is currently configured to retain a maximum of three Docker log files of approximately 10 MB each. These files contain both operational and access-log information, so this limit does not represent a fixed amount of personal data or a fixed retention period.

Older log information is automatically replaced as the configured size limits are reached.

Because retention is based on log volume rather than elapsed time, we cannot accurately state a fixed retention period in days.

We do not intentionally retain these technical logs outside this rotation for routine operation. Information may be retained separately where necessary to investigate a specific security incident, establish or defend legal claims, or comply with a legal obligation.

7. Analytics, advertising and profiling

Bompit does not currently use analytics or advertising services that track users of the service.

We do not use information entered into Bompit's current tools for advertising, behavioural profiling or marketing.

If we introduce analytics, advertising or similar technologies that materially change how personal data is processed, we will update this Privacy Policy and obtain consent where required by applicable law.

8. Hosting and service providers

Bompit uses Yelles AB, operating under the Inleed brand, as a service provider for hosting and operation of the service.

Yelles AB may process limited technical personal data on our behalf where necessary to provide, maintain and protect the services used by Bompit.

Our service provider has confirmed that personal data processed on our behalf remains within its environment in Sweden and is not forwarded to external providers at the application level.

Yelles AB may use subprocessors for physical facilities, networking and similar supporting technical services. According to the information provided to us, processing related to Bompit does not take place outside the EU/EEA.

We may also disclose personal data where required by law or where necessary to establish, exercise or defend legal claims.

9. International transfers

Our hosting provider has confirmed that processing related to Bompit's hosting environment does not take place outside the EU/EEA.

Based on Bompit's current architecture and hosting arrangement, we therefore do not transfer personal data processed through Bompit's server infrastructure outside the EU/EEA.

10. We do not sell personal data

Bompit does not sell personal data.

Information entered into Bompit's current browser-based tools is not shared with third parties for tool processing because it is not sent to Bompit's servers for that purpose in the first place.

11. Your data protection rights

Under the GDPR, depending on the circumstances, you may have the right to:

• request access to personal data concerning you;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests; and
• lodge a complaint with a supervisory authority.

Because Bompit does not require user accounts and does not associate its technical access logs with user profiles, we may not always be able to identify a particular log entry as relating to you based solely on the information you provide in a request.

To ask a privacy question or exercise your data protection rights, contact:

bompit@bytesystems.se

We may need enough information to understand and, where applicable, verify and fulfil your request.

You also have the right to lodge a complaint with a competent data protection supervisory authority. In Sweden, this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

12. Security and data minimisation

We use technical and organisational measures intended to protect Bompit's infrastructure and the limited personal data processed through it.

Bompit's current architecture deliberately performs tool processing in the browser where practical so that tool input does not need to be transmitted to our servers.

We also minimise routine technical logging. HTTP headers are excluded from access logs by default, and server logs are automatically size-rotated.

No internet service can guarantee absolute security. Our approach is therefore both to protect information and to minimise the amount of personal data Bompit needs to process.

13. Changes to Bompit

Bompit may add, change or remove tools and functionality over time.

Future tools may have different technical requirements from the current browser-local tools. If a new feature materially changes how personal data is processed, we will assess that processing and update this Privacy Policy as required before or when the new processing begins.

This is particularly relevant if Bompit introduces functionality such as:

• user accounts;
• server-side file or data processing;
• analytics or advertising;
• payment services; or
• other functionality requiring additional processing of personal data.

14. Changes to this Privacy Policy

We may update this Privacy Policy when Bompit changes, our service providers change, or legal or regulatory requirements change.

The “Last updated” date at the top of this page shows when this Privacy Policy was most recently revised.

Material changes will be communicated in an appropriate manner where required by applicable law.