Privacy PolicyVersion
2026:1
Melt&Marble Privacy Policy
1. Who this notice covers
This Privacy Policy explains how and why Melt&Marble uses personal data about external individuals who interact with us, or whom we may contact proactively.
Use the links below to see what we process, our lawful basis, how we keep data secure, and your rights.
2.5 Suppliers and other vendor contacts
Data about employees is handled in separate internal notices.
2. Your data
We process personal data only when we have a clear purpose and we keep it to a minimum.
For each activity below, we explain:
-
Why we need the information
-
What the information is
-
the Legal basis, i.e. why the processing is lawful
-
Your rights related to that legal basis
-
-
Retention, i.e. how long we keep and use the data
-
Sources and disclosures, where the data comes from and who we may share it with, such as service providers and other organisations
2.1 Website visitors
Why
To provide a secure and functional website, understand basic usage patterns and keep our systems stable and protected.
What
While we do our best not to identify you and also do not use the information in any way specific to you, certain technical usage data may still be considered personal data through logical deduction. Information gathered through cookies may include:
-
IP address and other online identifiers
-
Browser type and version, operating system and device information
-
Basic usage data such as pages visited, date and time of access, internal search queries and error logs
Legal basis
Consent. We rely on your consent for cookies and similar technologies that are not strictly necessary, for example those used for analytics or to improve your experience.
Legitimate interests. Where you do not give consent, we still use cookies and technical logs that are strictly necessary to provide the website, keep it secure and remember choices you have made (such as your cookie preferences). For these, we rely on our legitimate interests in operating a secure and reliable website, which are not overridden by your interests or rights.
Retention
Technical logs and similar records are kept only for as long as necessary to provide and protect the website, maintain stability, troubleshoot issues, and perform the basic analytics for which you have given consent. After this, the data is deleted or irreversibly anonymised.
Sources and disclosures
Collected automatically from your device when you visit our website, mainly through our web server via cookies, or similar technologies.
Stored with our website hosting and infrastructure providers acting as processors, and accessed only by personnel or service providers who need it for operation, support or security.
2.2 Job applicants
Why
To run our hiring processes, assess applications and stay in touch with you during recruitment.
What
Information you provide in your application, for example:
-
CV and cover letter
-
Contact details (name, email address, phone number)
-
Links to online profiles you choose to share (such as LinkedIn)
-
Information from references you allow us to contact
-
Interview notes and internal assessments
Legal basis
Legitimate interests (our legitimate interest is to recruit and document recruitment decisions in a fair and structured way).
Where we move forward with an offer, steps needed to enter into an employment contract may also apply.
Right to object
You may object to further processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, or need to retain limited data to establish, exercise or defend legal claims (for example, in relation to discrimination rules). In that case we will minimise what we keep and restrict access.
Retention
For the duration of the recruitment process and, where necessary, for a limited period afterwards to document the process and decisions. If we would like to keep your details on file for future roles, we will ask you first where required.
Sources and disclosures
From you, and from referees or public sources (such as LinkedIn) that you point us to. Processed in our recruitment tool (HR platform acting as a processor), with access limited to the hiring team and management. No external sharing beyond that, unless required by law.
2.3 Customer and partner contacts
Why
To manage the customer relationship with your company, deliver our products and services, handle day-to-day communication and support long-term collaboration.
What
-
Basic business contact details (name, role, business email, phone number, organisation)
-
Communication history (emails, meeting notes, contract-related correspondence)
Legal basis
Legitimate interests. Our legitimate interest is to manage and develop relationships with our customers in an efficient and professional way. In some cases, the processing is also linked to the performance of a contract with your company (for example, where we need your details as an authorised contact person).
Right to object
You have the right to object, on grounds relating to your particular situation, to our processing of your personal data based on legitimate interests. If you do so, we will stop processing your data for those purposes unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary to establish, exercise or defend legal claims. Where possible, we will assign another contact person for your organisation and minimise further use of your details.
Retention
Kept while the customer relationship is active and for a limited period afterwards, for example to handle follow-up questions or contractual obligations. We remove or update contact details when we know they are no longer current.
Sources and disclosures
From you or your employer (for example when your company appoints you as a contact person), and from our communications with you.
Stored in our customer and contact management tools, with access for employees who need it to perform their work. We do not share this information outside Melt&Marble and our IT/service providers, except where required by law.
2.4 Potential customers and partners
Why
The purpose of collecting and storing potential business contacts’ details is to enable Melt&Marble to build and maintain professional relationships with individuals and organizations that may be interested in our products or services. This includes:
-
Networking and business development activities.
-
Following up on previous meetings, trade shows, or conferences.
-
Sending relevant B2B communications about our services or collaboration opportunities.
What
-
Basic business contact details (name, job title, company, business email, phone number)
-
Information about your organisation’s potential interest in our products or services
-
Notes on our interactions with you (for example, when you asked us to follow up)
Legal basis
Legitimate interests. Our legitimate interest is to market and grow B2B sales in a proportionate and targeted way.
Opt-out
You can opt out of further outreach at any time. Just tell us in a reply or use any unsubscribe option we provide. We will then stop contacting you for marketing purposes and keep only a minimal “do-not-contact” record so we can respect your choice.
Retention
Kept while the contact details are relevant for B2B prospecting and we believe our outreach remains proportionate, or until you opt out. After that we either delete your data or keep only the do-not-contact flag.
Sources and disclosures
From legitimate business sources (e.g., business cards, LinkedIn, conferences, previous interactions). We store only the minimal data needed to manage prospecting activities. Contact details are stored in our prospecting and contact management tools, hosted by third-party IT providers acting as processors. Access is limited to employees who need it for sales or business development.
2.5 Suppliers and other vendor contacts
Why
For ordering, payments and follow-ups.
What
Basic business contact details (name, role, email, phone number).
Legal basis
Legitimate interests. Our legitimate interest is to manage supplier relationships in an efficient and structured way.
Retention
Kept while the supplier relationship is active and for a limited period afterwards, for example to ensure financial traceability or comply with legal obligations. Contact details are removed or updated when we know they are no longer current.
Sources and disclosures
From you or your employer. Stored in our order-tracking or vendor-management systems, with access for employees who need it to perform their work. Not shared outside Melt&Marble and our IT/service providers, except where required by law.
Note: Former vendors may remain in our records where needed to maintain financial traceability or for other legal reasons, or if future re-engagement becomes relevant.
2.6 Investors and shareholders
Why
To handle shareholder communications (occasional updates about Melt&Marble and highlight key events), governance and required filings; and to conduct due diligence and compliance activities where required (including KYC checks initiated by banks, professional advisors, or in financing processes).
What
Core shareholder information (Address, email, phone, personal identity number (for private owners), number of shares). Additional information for board members, major shareholders, officers and—where necessary—other shareholders (Passport/ID information, Nationality, Personal identity numbers or equivalent identifiers, Birth date, Beneficial ownership information - including information about intermediate ownership structures until ultimate beneficial ownership is established)
Legal basis
Legal obligation for required filings, compliance checks, and beneficial ownership reporting.. Contract for ownership-related processing. Legitimate interest for providing shareholder updates and managing corporate governance efficiently (balanced against the minimal privacy impact and safeguards in place).
Retention
For as long as the shares are owned (contract). For as long as required under applicable laws for compliance and KYC (legal obligation) and corporate governance documentation (legitimate interest). And for a limited period afterwards where necessary to maintain essential shareholder contact or verify ownership history (legitimate interests).
Sources and disclosures
From you or your representative. From you or your representative, and where necessary from publicly available corporate records or intermediaries involved in establishing beneficial ownership. Stored with very limited access and with our IT/service providers acting as processors.
We may share relevant investor information with banks, professional advisors, auditors, potential investors, and compliance providers where necessary for corporate governance, financing, due diligence, KYC requirements, or legal compliance, always under confidentiality. Otherwise, we share it only where required by law.
2.7 Potential investors (B2B contacts)
Why
To communicate with relevant investment contacts about Melt&Marble (positioning for future rounds).
What
Basic business contact details (name, email, phone number).
Legal basis
Legitimate interests. Our legitimate interest is to inform qualified investors about Melt&Marble in a proportionate and targeted way.
Retention
Kept while the contact details remain relevant for investment outreach, or until you opt out. After that we delete the data or keep only a minimal do-not-contact flag.
Sources and disclosures
From you or your firm, public sources, or referrals. Stored in our CRM with access limited to the CEO, CFO and CBO. We may share relevant information with advisors or potential co-investors under confidentiality, and otherwise only where required by law.
2.8 Social media and other online platforms
Why
To maintain our presence on social media (for example LinkedIn), interact with people who choose to connect with us there, and respond to messages or comments.
What
-
Information from your public profile on the relevant platform (such as name, role and organisation)
-
Messages you send to us and comments you post on our pages
-
Our responses and internal notes on relevant interactions where needed
Legal basis
Legitimate interests. Our legitimate interest is to communicate about our company and respond to individuals who contact us through social media.
Retention
We keep this information as long as it remains visible on the platform or is needed to handle or follow up on the interaction. You can usually control or delete your own posts and messages directly on the platform.
Sources and disclosures
From you and from the social media platform you use (in line with the platform’s own privacy settings). The platform provider is responsible for any personal data it processes independently, in line with its own privacy policy. We may copy limited relevant contact details or information from the platform into our own systems (for example to follow up on a business enquiry or ongoing conversation); in that case the data is handled in the same way as other business contact data in this policy.
3. Our service providers (”processors”) and international transfers
We focus on what we do best - synthetic biology and metabolic engineering of microbial cell factories - and rely on specialist service providers for supporting functions. These providers (“processors”) handle personal data only on our instructions, under a data processing agreement, and may not use it for their own purposes.
Categories of processors:
-
Recruitment platforms (applicant tracking systems).
-
Prospecting and CRM tools (customer and prospect contact management).
-
Email and newsletter delivery services.
-
Cloud storage and collaboration tools.
-
IT operations and security (e.g., access management, support/ticketing).
-
Finance and accounting (invoicing, payment processing).
-
E-signature and contract management.
-
Website hosting, operations and analytics (logs, cookie tools, where applicable).
Control & security: We keep control of what is processed and by whom. Processors must apply appropriate security measures (e.g., encryption where supported, deletion and access controls) to meet GDPR requirements.
Sub-processors: Where a processor uses sub-processors, they must have our authorization and equivalent safeguards.
Location / international transfers: Some processors (or their sub-processors) may be located outside the EU/EEA. When that happens, we use EU Commission Standard Contractual Clauses or equivalent transfer mechanisms, carry out transfer risk assessments where required, and apply appropriate technical and organizational measures to ensure a level of protection essentially equivalent to the level required under EU law.
Want details? If you want details: You can ask us for more information about which processors handle your data, whether your data is transferred outside the EU/EEA, and the key safeguards we rely on (including a copy or summary of the relevant contractual clauses).
4. Your rights
If you believe that we process data about you, or if you are unsure and would like to know, we are happy to help you check and confirm this, so that you can take control and gain insight into the data we have about you.
This service is entirely free, and we are happy to help. The easiest and fastest way to reach us and get help is by contacting us via the preferred channels described in chapter 5. We will respond to your request as quickly as possible, and within one month at the latest. You can find out more about your rights below.
General Information About Your Rights
The reason we have listed the legal basis in connection with the reasons we may have for processing data about you (section 2, above) is that while the GDPR gives you significant control over the data we process about you, your rights are dependent on the legal basis. For example, we cannot completely erase your data if we have a legal obligation to retain it. In such cases, instead of erasing the information when you ask to be forgotten - we restrict further use to fulfilling that obligation specifically.
When you request deletion, access, or use any other right under the GDPR, we will always explain to you the actions we’ve taken and the reasoning for it – so that you can ask follow-up question and exercise your right to complain to a supervisory authority should you suspect we are not in compliance.
Right of Access
You have the right to receive information about the personal data we process about you and to obtain a copy of this data. This includes a summary of:
-
The purpose of the processing
-
The source of the data
-
The lawful basis supporting the processing
-
Who may have accessed the data, such as partners or system providers
-
The period for which we plan to store the data
If we are unable to provide access to certain data, we will explain why. For example, we may need to restrict access if the data also concerns another individual and disclosing it would violate their rights or freedoms. Another example is if the data is subject to legal confidentiality or necessary to protect trade secrets. However, we always strive to provide as much information as possible without compromising these rights or confidentiality.
Right to Rectification
You have the right to request that we correct inaccurate or incomplete personal data about you. This means that if you notice any incorrect information in our records, you can contact us to have it updated or completed.
We will update your data as soon as possible after verifying that your request is valid. In some cases, we may need to ask for documentation or additional information to ensure the accuracy and relevance of the correction.
If, for any reason, we are unable to rectify the data (for example, if it would interfere with an ongoing investigation or legal process), we will inform you and explain why.
Right to Erasure
In certain circumstances, you have the right to request that we erase your personal data, which is sometimes referred to as “the right to be forgotten”. This may apply if:
-
The data is no longer necessary for the purposes for which it was collected.
-
You withdraw your consent, and we have no other lawful basis for continuing to process the data.
-
You object to the processing, and we have no overriding legitimate interest that outweighs your objection.
-
The processing is unlawful.
-
We are required to erase the data to comply with a legal obligation.
It is important to know that the right to erasure does not always apply. We may be required to retain certain data if there is a legal obligation for us to do so, for example according to the Bookkeeping Act, or if we need the data to establish, assert or defend legal claims.
Right to Restriction of Processing
In certain situations, you have the right to request that we temporarily restrict the processing of your personal data. This restriction means that, for a certain period, we are only allowed to store the data and may not use it for any other purpose than what is necessary to manage the current situation.
You can request that we restrict the processing of your personal data:
-
If you believe that the data about you that we are processing is incorrect and have requested rectification. The processing may then be restricted while we investigate and verify the accuracy of the data.
-
If we process your personal data based on a legitimate interest, and you object to the processing. In such cases, the processing may be restricted while we examine whether our legitimate interest outweighs your fundamental rights and freedoms.
-
If you require us to retain the data to be able to establish, assert or defend legal claims, even if we would otherwise erase the data.
-
If the processing is unlawful, but you prefer us to restrict the use of your data rather than erase it.
-
We will always inform you of the outcome of a request to restrict processing. If we cannot comply with your request, we will explain why.
Even if we are required in certain cases to retain data for a specific purpose (such as fulfilling a legal obligation), we will cease all other processing activities that no longer have a lawful basis. If we cannot fully erase your data, we will inform you thereof and explain why.
Right to Object to Processing
You may object at any time to processing of your personal data based on our legitimate interests, including any profiling on that basis. We must stop processing your data if we cannot demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms.
You always have the right to object to processing of your personal data for direct marketing purposes. If you do, we will immediately stop processing your data for that purpose.
Automated decision-making
If our processing involves automated decision-making, such as profiling, you also have the right to object to such decisions, especially if they produce legal effects for you or otherwise significantly affect you.
Right to Data Portability
In situations where our processing is based on your consent or a contract, and the processing is carried out by automated means, you have the right to receive the personal data you have provided us with in a structured, commonly used and machine-readable format, and to transmit that data to another data controller.
Where technically feasible, you also have the right to request that we transmit the data directly from us to another data controller.
It is important to note that the right to data portability does not automatically entitle you to have your data erased. Additionally, the right to data portability does not apply to processing activities with other lawful bases, such as legal obligations.
Contact Information for the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY)
We encourage you to contact us first if you have any questions or concerns about how we process your personal data. We take such matters very seriously and will do our best to resolve any misunderstandings or issues.
If you still believe that we are not meeting our obligations under the GDPR, you have the right to file a complaint with the supervisory authority. In Sweden, the Swedish Authority for Privacy Protection (IMY) is responsible for overseeing the processing of personal data. You can reach them via their website.
5. Contact Information
If you have any question about Melt&Marble’s privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us.
Email us at: info[at]meltmarble.com
Write to us at: Melt&Marble, Arvid Wallgrens backe 20, 413 46, Gothenburg, Sweden.
6. Changes to this Privacy Policy
We may update our privacy policy as needed to ensure it accurately reflects how we process personal data. All updates will be published on our website. In the event of significant changes that affect how we handle your personal data, we will inform you in advance via email where feasible.
Version History
Version 2026:1 We’ve updated our Privacy Policy to include more detail about how we process data, who it applies to, and your rights under the GDPR.