Fortis Lumen Advisory AB

Privacy Notice

This Privacy Notice explains how Fortis Lumen Advisory AB processes personal data when you visit our website, contact us, make a business enquiry or interact with us in connection with our professional services.

Last updated: 21 September 2026
Public enquiry channel

Our public contact form is intended for brief, non-confidential business enquiries only.

The sender is responsible for ensuring that information submitted through this channel is appropriate for the channel, that the sender is authorised to provide it, and that the enquiry contains no confidential, sensitive, restricted or security-critical information.

If confidential or sensitive information is required for an agreed professional engagement, appropriate handling arrangements will be established separately.

1. Who is responsible for your personal data?

For personal-data processing relating to this website and ordinary business enquiries, Fortis Lumen Advisory AB is the data controller.

Where personal data is processed as part of a separately agreed professional engagement, the applicable data-protection roles may depend on the nature of the processing and the agreed arrangements.

Fortis Lumen Advisory AB
Org.nr: 559582-8301
Säte: Göteborg, Sweden
Email: info@fortislumenadvisory.com

2. Information we may process

Depending on how you interact with us, we may process:

  • your name and business contact information;
  • your company or organisation;
  • the service or subject of your enquiry;
  • information you voluntarily provide in your enquiry or correspondence;
  • information reasonably required to prepare, perform or administer an agreed engagement; and
  • website or device information generated through normal website operation, where applicable.

If information reasonably necessary to respond to or progress an enquiry is not provided, we may be unable to respond to or progress that enquiry.

3. Why we process personal data

We may process personal data to:

  • receive and respond to business enquiries;
  • communicate with prospective and existing customers;
  • evaluate and prepare potential engagements, proposals or quotations;
  • perform and administer agreed professional services;
  • review information and documentation provided for those services;
  • manage invoicing, accounting and business records;
  • operate and protect our website and business systems;
  • establish, exercise or defend legal claims; and
  • comply with applicable legal obligations.

4. Legal bases

The legal basis depends on the purpose and circumstances of the processing and may include:

  • Legitimate interests — for example, responding to ordinary B2B enquiries, conducting business communications and operating and protecting our business and website, where applicable.
  • Contract or steps relating to a contract — where applicable to the individual concerned.
  • Legal obligation — where processing is necessary to comply with applicable legal requirements.
  • Consent — where consent is specifically requested and is the applicable legal basis.

5. Public enquiries and information provided to Fortis Lumen

Public enquiries

The public contact form is an initial business-enquiry channel. Submitting the form does not create a professional engagement, constitute an order or acceptance of an engagement, or expand the scope of an existing engagement.

The sender is responsible for selecting information appropriate for this public enquiry channel, ensuring that the sender is authorised to disclose it, and ensuring that confidential, sensitive, restricted or security-critical material is not submitted through this channel.

Material submitted contrary to these instructions does not, merely by being submitted, create or expand an engagement or constitute acceptance of that material as technical, assessment or other professional evidence.

Where submitted information contains personal data, applicable data-protection law continues to apply.

Use of information provided to Fortis Lumen

By submitting information to Fortis Lumen through an approved channel, the sender acknowledges that Fortis Lumen may receive, store, review and otherwise process that information to the extent reasonably necessary to respond to the enquiry, evaluate a potential engagement, or perform and administer the professional services for which the information was provided.

Such processing is subject to this Privacy Notice and, where applicable, the agreed scope and engagement terms.

The sender is responsible for ensuring that they are authorised to provide the information and that the information is appropriate for the channel used.

Providing information to Fortis Lumen does not grant Fortis Lumen permission to use that information for unrelated purposes and does not, by itself, create or expand a professional engagement.

Confidential, sensitive, restricted or security-critical information must not be submitted through the public enquiry form. Where such information is required for an agreed professional engagement, appropriate handling arrangements will be established separately.

6. Recipients and service providers

Personal data may be processed by service providers supporting functions such as website operation, communications, hosting, security and business administration.

Depending on the service and circumstances, such providers may act as processors or independent controllers under applicable data-protection law.

Information may also be disclosed where required by applicable law or where necessary for the establishment, exercise or defence of legal claims.

7. International transfers

Where Fortis Lumen uses a service provider that processes personal data outside the European Economic Area, we will address the transfer in accordance with applicable data-protection requirements and use an applicable transfer mechanism or safeguard where required.

8. Retention

Personal data is retained only for as long as reasonably necessary for the purpose for which it is processed, taking into account applicable legal, accounting, contractual, security and claims-related requirements.

Retention periods may therefore vary depending on the nature and context of the information.

9. Data minimisation and sensitive information

We seek to limit the personal information requested through the public enquiry channel to information reasonably necessary for the enquiry.

The public contact form must not be used to submit:

  • passwords, credentials or cryptographic keys;
  • source code;
  • unreleased vulnerability information or active security-incident details;
  • detailed network, system or security configurations;
  • confidential technical or assessment evidence;
  • restricted or confidential supplier information;
  • sensitive personal data; or
  • other confidential, restricted or security-critical material.

The sender is responsible for ensuring that information submitted through the public enquiry form is appropriate for that channel and that the sender is authorised to provide it.

If an agreed engagement requires information of this nature, appropriate handling arrangements will be established separately.

10. Cookies and website technologies

Our website may use technologies necessary for website operation, security and spam prevention. Other technologies may also be used depending on the website configuration.

Where consent is required under applicable law, such technologies will be used subject to the applicable consent requirements.

11. Your data-protection rights

Subject to the conditions and limitations of applicable data-protection law, you may have rights including:

  • access to personal data concerning you;
  • rectification of inaccurate personal data;
  • erasure in applicable circumstances;
  • restriction of processing in applicable circumstances;
  • objection to certain processing;
  • data portability where applicable;
  • withdrawal of consent where consent is the legal basis; and
  • the right to lodge a complaint with a supervisory authority.

These rights are subject to the conditions and exceptions provided by applicable law.

To make a data-protection request concerning Fortis Lumen, contact info@fortislumenadvisory.com .

12. Complaints

If you have questions or concerns about how Fortis Lumen processes your personal data, please contact us at info@fortislumenadvisory.com .

You also have the right to lodge a complaint with the competent supervisory authority. In Sweden, this is Integritetsskyddsmyndigheten (IMY).

Swedish Authority for Privacy Protection (IMY)

13. Changes to this Privacy Notice

We may update this Privacy Notice when our website, services, processing activities or applicable requirements change. The current version and its last-updated date are shown on this page.

Contact

Fortis Lumen Advisory AB
Org.nr: 559582-8301
Säte: Göteborg, Sweden
Email: info@fortislumenadvisory.com

This Privacy Notice describes how Fortis Lumen processes personal data. Commercial terms applicable to professional engagements are addressed separately in the applicable terms and engagement documentation.

Cookies & Privacy

This website uses cookies to ensure you get the best experience on our website.