What we keep, why, and for how long
Who we are
B2B Factory AB (org.nr 559515-4476), Västertorp 12, 179 97 Färentuna, Sweden, is the controller for the personal data described here. Questions and requests: privacy@b2bfactory.io. We are a small company and have not appointed a data protection officer; that address reaches the founder directly.
In short
- We keep what you send us through this site, and what we need to answer you and to work with you.
- To prepare a free audit we look up public information about your company, including the ads it runs in LinkedIn’s public Ad Library.
- In the EU and EEA, the UK, Switzerland, Quebec and Brazil, analytics and advertising tools load only if you agree to them; elsewhere they run unless you opt out. One choice covers this site, nForce’s site and nForce’s connector.
- Our emails note when you click their links only if you ticked “Tell us when you open what we send”.
- We never sell personal data, and we never use one client’s data for another client.
- You can ask to see, correct or delete what we hold about you at any time.
Who this policy covers
Visitors to b2bfactory.io; people who ask for a free audit or a strategy call; business contacts we reach out to; and the people we work with at our clients. When we run a client’s LinkedIn ad account, we handle the data in that account on the client’s behalf, as their processor, under our engagement agreement and its data processing terms. Our software product, nForce, has its own privacy policy.
What we collect, why, and for how long
| When | What | Why, and the legal basis | How long |
|---|---|---|---|
| You ask for a free audit | Your work email. From it, your company’s name and domain; company facts such as size, industry and funding from Apollo.io; and the ads your company runs, from LinkedIn’s public Ad Library. | To prepare and send the audit you asked for, and to invite you to a full audit. Steps taken at your request before a possible contract (GDPR art. 6(1)(b)). | 12 months after our last contact, unless we start working together. |
| You book a strategy call | Your name, work email, company, role, and your answers in the form. | To prepare the call and decide together whether we are a fit. Art. 6(1)(b). | 12 months after our last contact, unless we start working together. |
| We work together | Names, roles and contact details of the people we work with; the agreement; invoices and payments. | To deliver the work (art. 6(1)(b)) and to keep accounting records the law requires (art. 6(1)(c), Swedish Bookkeeping Act). | Contact details for the engagement plus 12 months. Accounting records 7 years. |
| We run your ad account | What the work needs from your LinkedIn ad account: campaigns, settings, targeting, ad text and images, and aggregate results. We do not export the people who fill in your lead forms or build audiences from LinkedIn members’ data. | On your behalf, as your processor, under our agreement (GDPR art. 28). | As our agreement sets out; deleted or returned when the engagement ends. |
| We reach out to you | Your name, work email, job title and company, and your public LinkedIn profile address, from Apollo.io and from public sources such as company websites and LinkedIn’s Ad Library. | To offer services relevant to your role at your company. Legitimate interest in business-to-business marketing (art. 6(1)(f)). You can object at any time, and we stop. | 12 months from when we found you if we have not been in touch. If you object, we keep only your email on a do-not-contact list so we never contact you again. |
| You email us | Your message, and your name and email address. | To answer you. Legitimate interest (art. 6(1)(f)). | As long as the conversation is relevant, at most 12 months after it ends, unless it becomes part of an engagement. |
| You visit the site | Technical data our host records to run the site securely, such as IP address, browser and the pages requested. | Security and keeping the site working. Legitimate interest (art. 6(1)(f)). | Kept by Netlify for a short period, under its terms. |
| You tick “Tell us when you open what we send” | When you click a link in an email we send you: which link, and when. | To know which of our emails help and when to follow up. Your consent (art. 6(1)(a)), which you can withdraw at any time by replying to any of our emails. Without the tick, the links in our emails go straight to their page and nothing is recorded. | 12 months after our last contact, unless we start working together. |
| You visit, with analytics and marketing on | Usage data from Google Analytics; ad measurement data from LinkedIn’s Insight Tag; and, from Apollo with its partners LiveIntent and ID5, the company you browse from and, where they can match it, who you are. See Cookies. | To see which pages help, to measure and improve our own LinkedIn ads, and to know which companies and people show interest. In the EU and EEA, the UK, Switzerland, Quebec and Brazil: your consent (art. 6(1)(a)), which you can withdraw at any time. Elsewhere these run unless you opt out from “Your privacy choices” or your browser sends Global Privacy Control. | Google Analytics keeps the usage data 14 months. Cookies: see the cookie table. |
Where the data comes from
Mostly from you. For an audit and for outreach we also use: Apollo.io, a business-data provider, for company facts and business contact details; LinkedIn’s Ad Library, the public record of ads on LinkedIn, which we read through Apify; and public company websites. We do not buy contact lists. When we contact you with data we did not get from you, our first message, and at the latest within one month, says who we are, where we found your details and how to say no, and links to this policy. We have weighed our interest in contacting business buyers against your privacy before doing so, and keep that assessment on file.
How we use AI
Our own agents, nForce, help prepare audits, plans and reports. They run on AI models from Anthropic, through its commercial service, which does not train its models on this data. AI never makes a decision about you on its own: a person reviews every audit and every message before it is sent, and nothing here has legal or similarly significant effects on you.
Who processes data for us
- Netlify: hosts this site and stores the form entries.
- Google: Google Workspace for our email and documents; Google Tag Manager and Google Analytics, only with your consent.
- LinkedIn: the Insight Tag, under the Marketing choice. For this data LinkedIn and we are joint controllers, as LinkedIn’s terms describe; LinkedIn’s own privacy policy applies to its part.
- Apollo.io: company facts and business contact details; and, under the Marketing choice, its website visitor tag, with its partners LiveIntent and ID5, which tells us which companies and people visit. Apollo, LiveIntent and ID5 also use this data for their own services and decide for their own part how they handle it; their privacy policies apply there.
- Apify: retrieves pages from LinkedIn’s public Ad Library.
- Anthropic: the AI models our agents use.
- Fortnox: our bookkeeping system, for invoices and accounts, and our accountant.
Each works under a data processing agreement or equivalent terms. We keep this list current, and add a provider here before we start using it.
Transfers outside the EU
Some of these providers process data in the United States. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, or otherwise on the European Commission’s standard contractual clauses, as each provider’s data processing terms set out.
What we never do
- Sell personal data for money. (Apollo, LiveIntent and ID5 do receive data about visits for their own services, which some US state laws count as selling or sharing; see Cookies for how to opt out.)
- Use one client’s data for another client.
- Read, export or keep the people who fill in your lead forms.
- Train AI models on your data.
Your rights
You can ask for a copy of the data we hold about you, and have it corrected, deleted, restricted or moved to another provider. You can object to processing based on legitimate interest, and always to direct marketing, and we will stop. Where we rely on your consent, you can withdraw it at any time; for cookies, use “Cookie settings” at the bottom of every page. Write to privacy@b2bfactory.io; we answer within one month.
If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se), or to the authority where you live or work. IMY’s postal address is Box 8114, 104 20 Stockholm, Sweden.
Questions about data that one of our clients holds, such as their own customer or lead lists, go to that client: for that data we act only on their instructions.
Cookies
Under the Swedish Electronic Communications Act (lagen om elektronisk kommunikation, chapter 9, section 28), cookies that are not strictly necessary need your consent first. What happens depends on where you are, which our host tells from your connection, without reading anything on your device. In the EU and EEA, the UK, Switzerland, Quebec and Brazil (or if we can’t tell), this site sets no cookies until you choose, and if you agree, Google Tag Manager loads the tools below; if you say no, none of them load. Anywhere else, the tools load when you arrive, a notice says so, and you can opt out from “Your privacy choices” at the bottom of every page; if your browser sends the Global Privacy Control signal, the marketing tools stay off unless you choose otherwise. The fonts are served from our own site, so no third party is contacted for them. Your choice is kept in one cookie, b2bf_consent, for 12 months. It is set for b2bfactory.io and its subdomains, so the same choice applies on nForce’s site (nforce.b2bfactory.io) and nForce’s connector (connect.b2bfactory.io), and you can change it on any of them. If you arrive from one of our ads and browse before choosing, the ad’s parameters and the page you landed on stay in the page address as you go (nothing is stored), so that a later yes still counts the visit to the ad.
Apollo records the pages you visit, the page you came from and an ad’s campaign tags, with an anonymous ID kept in your browser, and identifies the company you browse from by your IP address. Where Apollo allows it, its partners LiveIntent and ID5 match your visit to identifiers they hold, such as a hashed email address, which can tell us who you are. They set their own cookies and browser storage under this site’s address, listed below. If you withdraw or opt out, we delete the analytics and marketing cookies and browser storage under b2bfactory.io and its subdomains; cookies LinkedIn, Apollo, LiveIntent and ID5 keep under their own domains can be cleared in your browser settings.
| Name | Provider | Purpose | Kept for | Type |
|---|---|---|---|---|
| b2bf_consent | B2B Factory | Remembers your cookie choice on b2bfactory.io, nForce’s site and nForce’s connector | 12 months | Necessary |
| _ga, _ga_* | Google Analytics | Counts visits and how pages are used | Up to 2 years (the data in Google Analytics: 14 months) | Analytics |
| li_sugr, bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory, li_fat_id, li_giant, li_adsId (and li_adsId, li_hem in browser storage) | Measures how our LinkedIn ads perform and who visits after seeing them | From 1 day to 1 year | Marketing | |
| apolloAnonId, …_eventQueue, …_canTrack, liveIntentData (browser storage) | Apollo.io | Recognises your browser and sends Apollo the pages you visit, so it can tell us which companies and people visit | Until you clear it or withdraw; the last two 1 day | Marketing |
| _lc2_fpi, _lc2_fpi_js, _li_ss, _li_dcdm_c, lidids.* (and _li_duid, _li_ss in browser storage) | LiveIntent, for Apollo | Matches your visit to identifiers LiveIntent holds, such as a hashed email address | Up to 2 years | Marketing |
| id5id, id5id_last, id5id_privacy (browser storage) | ID5, through LiveIntent | Matches your visit to an identifier ID5 holds | 90 days; id5id_privacy 30 days | Marketing |
If we add a tool, it appears in this table before it is switched on.
If you are in the United States
We apply this policy to everyone, wherever they live. The LinkedIn Insight Tag and Apollo, with its partners LiveIntent and ID5, described above, may count as selling or sharing personal information for cross-context behavioural advertising as US state privacy laws define those terms. In the US they load when you arrive; you can opt out any time from “Your privacy choices” at the bottom of every page, and we treat your browser’s Global Privacy Control signal as that opt-out. You can use the rights above in the same way.
Security
The site runs over HTTPS only. Access to the data is limited to the founder and the processors above, behind two-step sign-in where the provider offers it.
Changes
When this policy changes, we update the date at the top. If a change affects how we use data you already gave us, we tell you before it applies.