Privacy notice
This notice explains how Humly Solutions AB (“Humly”, “we”) processes personal data when you use the Humly Cloud Portal at humly.cloud – the web application that customers, partners and Humly staff use to manage Humly Cloud accounts, licences, devices and downloads – and its sign-in pages.
It covers the portal only. How Humly processes personal data in other contexts, for example on humly.com, in sales and support, or when you apply for a job, is described in Humly’s general Privacy Notice at humly.com/legal-information. Personal data that your organisation’s Humly services hold on its behalf, such as bookings, visitor registrations and text messages sent by your Humly Control Panel, is processed by Humly as a processor under the Humly Data Processing Agreement. For that data your organisation is the controller, and its own privacy notice applies.
1. Who is responsible
Humly Solutions ABCorporate identity number 559233-6480
Sveavägen 124
113 50 Stockholm, Sweden
For questions about this notice, or to use your rights, e-mail security@humly.com – the address Humly uses for security and personal-data matters – and write “Privacy” in the subject line.
2. What we process and why
Your user account
- What
- Your name, e-mail address (your user name), organisation, role and access rights, and your language and display preferences. Your password is stored only as a one-way hash.
- Why
- To give you access to the portal and show you what your role allows.
- Legal basis
- Our legitimate interest in providing the portal to the customers and partners we have agreements with (GDPR art. 6(1)(f)). Where you are our contracting party yourself: performance of that contract (art. 6(1)(b)).
Sign-in and account security
- What
- Your multi-factor method and what it needs (the secret your authenticator app uses, or the mobile number or e-mail address that codes are sent to); the devices you sign in from (IP address, device type, operating system and browser); sign-in events; and the devices you choose to trust.
- Why
- To protect your account, recognise sign-ins from new devices and investigate misuse.
- Legal basis
- Our legitimate interest in keeping the portal and our customers’ data secure (art. 6(1)(f)).
Customer and partner records
- What
- Names, business e-mail addresses and phone numbers of contact persons at customers, resellers and distributors (for example account, licence, technical and commercial contacts, including contacts reported by your Humly Control Panel), and who at Humly is responsible for the account.
- Why
- To administer accounts, licences, renewals and support, and to keep our customer records up to date.
- Legal basis
- Our legitimate interest in managing the customer or partner relationship (art. 6(1)(f)), and legal obligations such as accounting rules where they apply (art. 6(1)(c)).
Messages from the portal
- What
- E-mails and text messages the portal sends (account and licence notices, invitations, sign-in codes and password-reset links), and a record of what was sent, to whom and when.
- Why
- To send service communications and to sort out delivery problems.
- Legal basis
- Our legitimate interest in running the service (art. 6(1)(f)).
Logs and audit trail
- What
- IP address, browser, the pages requested and when; and who changed what in the portal, and when.
- Why
- Security, troubleshooting and accountability for changes.
- Legal basis
- Our legitimate interest in a secure and reliable service (art. 6(1)(f)).
You need a portal account with a name and an e-mail address to use the portal. We do not sell personal data, we do not use it for advertising, and we do not make decisions about you based solely on automated processing.
3. Signing in with Microsoft or Google
If you choose Sign in with Microsoft or Sign in with Google, the provider confirms who you are and shares your basic profile with us, such as your name, e-mail address and an account identifier. We use your e-mail address to find your portal account. We never receive your Microsoft or Google password, and we do not access your mail, files, calendar or contacts. The provider’s own privacy statement applies to its sign-in pages.
Humly’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Cookies and browser storage
The portal sets no advertising or analytics cookies and loads no third-party tracking. Its scripts, styles and fonts are served from humly.cloud itself.
| Name | Type | Purpose | Kept |
|---|---|---|---|
LtpaTokenCloud | Cookie | Keeps you signed in. | Until you sign out or close your browser. The session also ends after 2 hours without activity, and at the latest 6 hours after you signed in. |
lte-theme, hy-acc-cols1, hy-lic-cols1, hy-srv-view2, hmpScheme | Local storage | Remembers light or dark mode and how you arranged lists and previews. It stays in your browser and is not sent to us. | Until you clear your browser data. |
| Microsoft sign-in | Session storage | Holds the sign-in state while you sign in with Microsoft. | Until you close the tab. |
These are needed for the portal to work or to remember choices you make, so they are set without asking for consent. You can delete them in your browser at any time; you will then be signed out and your display choices will reset.
5. Who we share data with
- Humly staff and contractors who run and support the portal, when their work requires it.
- Your reseller or distributor, who can see the accounts, licences and contact persons of the customers it manages.
- Service providers that process personal data for us under data processing agreements: HubSpot (customer records, e-mail history and support cases), bestSMS in Sweden and Twilio (delivery of text messages), and Microsoft (e-mail and internal collaboration tools).
- Microsoft or Google, if you sign in with them (see section 3).
- Authorities, when the law requires us to.
6. Transfers outside the EU/EEA
The portal and its data are hosted in the EU. HubSpot and Twilio are based in the United States, and Microsoft and Google may also process personal data outside the EU/EEA. When personal data is transferred outside the EU/EEA, we rely on the EU–U.S. Data Privacy Framework for recipients certified under it, or on the European Commission’s standard contractual clauses.
7. How long we keep data
- Your user account: as long as you have access to the portal. When your access ends, we delete or deactivate the account and keep only what we are required to keep.
- Trusted devices: for the period shown when you choose to trust a device.
- Logs, sign-in records and message records: only as long as they are needed for security, troubleshooting, support and invoicing.
- Customer and partner records: for as long as the customer or partner relationship lasts, and afterwards as long as needed for licence history, legal claims and legal obligations. Swedish accounting rules, for example, require some records to be kept for seven years.
8. Your rights
You can ask us for access to your personal data and a copy of it, and ask us to correct or erase it or to restrict how we use it. You can object to processing that is based on our legitimate interests, and in some cases receive data you gave us in a machine-readable format. E-mail security@humly.com to make a request.
If you are unhappy with how we handle your personal data, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or to the data protection authority where you live or work.
9. Security
Access to the portal requires a personal account, what you can see and change follows your role, and sign-in with a password is protected by multi-factor authentication. Connections to the portal are encrypted (HTTPS). Humly is certified to ISO/IEC 27001 for information security management.
10. Changes to this notice
We update this notice when the portal, or the way we process personal data, changes. The date at the top shows when it last changed. The rules for using the portal are in its terms of service.