Privacy policy.

01 Who we are

Remos Space Systems AB is the data controller for the personal data described here. We are registered in Sweden at Aurorum 1 C, 977 75 Luleå.

For anything in this policy — including access, correction or deletion requests — write to [email protected]. We answer within one month, which is the deadline the GDPR sets.

02 What we collect

We collect as little as the site can function on. There is no account system, no profiling, and no advertising network.

Contact form. Your name, email, and whatever you write, plus optional company and phone. This is emailed to us — the site does not keep a copy in its own database.

Newsletter. Your email address, sent to our mailing provider so we can send the newsletter and so you can unsubscribe.

Job applications. Covered separately in section 03, because it is the most sensitive thing we hold.

Site measurement. Only after you consent. Covered in sections 06 and 07.

03 Job applications

When you apply through our careers pages we collect your name, email address, and — depending on the application — your phone number, links you give us, your CV, and anything you write in the message field.

Why we may process it. For a specific role, we process your application to take steps at your request before entering a contract. For keeping your details on file after that decision, and for open applications where no role is attached, the basis is your consent — which is why the form asks you to tick a box.

Who sees it. The people involved in hiring at Remos. Applications are stored in our own database; CVs are held in private storage and can only be downloaded by a signed-in administrator. We do not attach CVs to email, and we do not share applications outside the company.

Please leave out special category data. We do not ask for a photograph, date of birth, health or disability information, ethnicity, religion, or union membership, and we do not need any of it to assess you. If you send it anyway it is deleted with the rest of your application on the schedule below.

No automated decision-making. Applications are read by people. Nothing is scored, filtered or rejected by software.

You can withdraw an application or ask us to delete it at any point, without giving a reason.

04 How long we keep things

Job applications: six months from the day you apply. After that the record, the CV file and the related administrative log entries are deleted automatically on a schedule — not by someone remembering. If you are still in an active hiring conversation when the six months pass, we hold your application until that conversation ends, then the same clock applies.

Contact messages live in our email, not in the site's database, and are kept only as long as they are useful for the conversation you started.

Newsletter subscriptions are kept by our mailing provider until you unsubscribe, which every newsletter links to.

Consent choices are stored in your own browser, not on our servers. Clearing your browser storage clears them.

Server logs at our hosting and CDN providers are kept on a short rolling window set by those providers, and are used for security and debugging only.

Backups lag deletion. A record removed today can persist in an encrypted database backup for a short period before those backups rotate out.

05 Lawful basis

Consent — optional analytics and marketing technologies, newsletter subscriptions, and keeping a job application on file. You can withdraw consent at any time without losing access to the site.

Steps prior to a contract — processing your application for a role you applied to.

Legitimate interests — replying to a message you sent us, and keeping the site secure against spam and abuse. We have weighed these against your interests and consider them proportionate to what they achieve.

06 What we store in your browser

When you interact with the consent interface, the site stores a first-party record of your consent choices in local storage. That record includes the consent categories you selected, the time of your decision, and the consent version used at the time.

Necessary storage stays active so the site can function, protect against abuse, and remember the privacy choices you make.

07 Optional analytics and marketing

Optional analytics and marketing technologies are blocked by default. They only load after you grant consent. When enabled, Google Tag Manager may load Google technologies that help us measure traffic, understand site usage, or evaluate campaigns.

If optional tracking is enabled, Google may process related measurement data on its own infrastructure. See Google's privacy documentation before enabling those categories.

08 How to change or withdraw consent

Revisit your settings at any time through the Cookie settings control in the site footer. Changing your settings updates future tracking behaviour from that point onward.

To withdraw consent for a newsletter, use the unsubscribe link in any newsletter. To withdraw consent for a job application held on file, email us.

09 Form protection

To prevent automated abuse of our forms (spam, scraping, brute-force submissions), we run several lightweight checks on each submission, including a hidden field and a timing check. Where a challenge is enabled, Cloudflare Turnstile is used.

These checks are necessary for site security and operate under our legitimate interest in keeping the site usable.

Uploaded files are checked by type and size before being stored, and are only ever served as downloads to signed-in administrators.

10 Processors and international transfers

Running this site requires processing some data through infrastructure providers. These providers act as data processors under our instructions and only see what is required to deliver the service.

Heroku (a Salesforce company) hosts the application and its database. Our production environment runs in Heroku's United States region.

Amazon Web Services, through Heroku's Bucketeer add-on, stores uploaded media and job-application CVs. Production storage is in the AWS us-east-1 region.

Cloudflare sits in front of the site as a content-delivery network and security layer. It receives the IP address, request headers, and any cookies attached to each request.

Google delivers our outgoing email, and — only with your consent — provides the measurement technologies in section 07.

Mailchimp (an Intuit company, United States) stores newsletter subscriber email addresses and sends the newsletter.

This means personal data you give us, including job applications and CVs, is transferred to and stored in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses and, where a provider is certified, the EU–US Data Privacy Framework. If you would rather not have your data processed in the US, please do not submit it — and contact us if you want to discuss alternatives.

11 Your rights

Under the GDPR you can ask us to: give you a copy of the personal data we hold about you; correct it if it is wrong; delete it; restrict how we use it; provide it in a portable format; or object to processing based on legitimate interests. Where processing is based on consent, you can withdraw that consent at any time.

Send any of these requests to [email protected]. We will not charge you, and we will not ask why.

If you think we have handled your data badly, you can complain to the Swedish authority for privacy protection, Integritetsskyddsmyndigheten (IMY), at imy.se. You can complain to them without contacting us first, though we would rather hear from you.

12 Contact

Remos Space Systems AB, Aurorum 1 C, 977 75 Luleå, Sweden. [email protected].