Privacy policy

In short. These sites set no cookies, run no tracking and have no user accounts. We count page views with a statistics service that works without cookies and without profiles (section 4). What is processed: technical connection data when a page is delivered, and whatever you send us through the contact form, by e-mail or by telephone. This policy applies to all websites of ef.next AB under ef-next.com, including its subdomains, so it exists once.

1. Controller

ef.next AB, Sunnanåvägen 14, 826 68 Bergvik, Sweden, organisation number 559572-5838 · [email protected] · +46 79 342 87 82. No data protection officer has been appointed; there is no obligation to appoint one under Art. 37 GDPR. Please address any request concerning your data to [email protected].

2. Hosting and delivery (Cloudflare)

The pages are hosted by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (Cloudflare Pages) and delivered through Cloudflare's global network. When a page is requested, Cloudflare processes technical connection data on our behalf: IP address, date and time, requested address, amount of data transferred, referrer, browser and operating system identifier. Purposes: delivering the pages, protecting them against attacks and abuse, and analysing faults. We keep no access logs of our own and only see aggregated statistics that cannot be traced to a person (for example page views per country). Cloudflare retains connection data only as long as these purposes require.

Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in operating the sites securely and reliably. Because Cloudflare answers each request from the location closest to the visitor, data may be processed outside the EU/EEA, in particular in the USA. Cloudflare is certified under the EU-US Data Privacy Framework; the EU standard contractual clauses apply in addition, and a data processing agreement (Cloudflare's Data Processing Addendum) forms part of its terms of service. Details: cloudflare.com/privacypolicy.

3. Encryption

All pages are delivered exclusively over HTTPS (TLS); this includes everything you enter in the contact form. You can recognise the encrypted connection by the padlock symbol in your browser's address bar.

4. No cookies, no tracking; visitor statistics

These sites set no cookies and use no advertising or tracking services, no social media plug-ins and no embedded third-party content. Your light/dark preference is stored only in your own browser (local storage), only when you choose it, and is never transmitted; you can delete it through your browser settings. The contact form records, invisibly, when the page was loaded in order to recognise automated submissions; that value leaves your browser only when you send the form. Links to external sites (for example GitHub or Packagist) take effect only when you click them; from then on the privacy policy of the respective site applies.

Visitor statistics (Cloudflare Web Analytics). To see which pages are read and where visitors come from, we use Cloudflare Web Analytics, a service of Cloudflare, Inc. (see section 2). When a page loads, a small script from Cloudflare (static.cloudflareinsights.com) sends Cloudflare the address of the page, the referring page, the browser, operating system and device type, and loading-time measurements; Cloudflare derives the country from the IP address. According to Cloudflare, the service sets no cookies, stores nothing in your browser, does not use fingerprinting, does not follow visitors across pages or websites and does not store the IP address for these statistics. We see only aggregated figures, for example page views per page, referrer or country, which cannot be traced to a person. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in knowing which content is used so that we can improve the sites. The transfer safeguards described in section 2 apply. You can prevent the measurement with a content blocker in your browser; you may also object under Art. 21 GDPR (section 8).

5. Fonts

The fonts Schibsted Grotesk and IBM Plex Mono are delivered from our own web space together with the pages (hosting: section 2). Your browser does not contact any font provider or other third party for them.

6. Contact: form, e-mail, telephone

Contact form. The forms on ef-next.com and on the Security Framework site send the fields you enter (name, company – optional –, e-mail address, topic, message) together with the page language to a small program running on Cloudflare's infrastructure. It checks the entries, discards automated submissions and forwards them as one e-mail through Cloudflare's e-mail sending service to our mailbox; your e-mail address is set as the reply address. The program stores nothing. Cloudflare processes the message in order to deliver it and keeps a sending log. To be able to deal with abuse, the IP address from which the form was sent is included in the e-mail. Name, e-mail address and message are required; everything else is voluntary. If the form cannot be used, the page offers to open the same message in your own e-mail program instead.

E-mail and telephone. Our mailboxes ([email protected], [email protected] and personal addresses under ef-next.com) are operated with Google Workspace by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, under a data processing agreement (Google Cloud Data Processing Addendum); a transfer to Google LLC in the USA is possible on the basis of the EU-US Data Privacy Framework and the EU standard contractual clauses. Messages you send us, including the e-mails generated by the contact form, are stored there. When you telephone us we note your name, number and request as far as needed to deal with it. Vulnerability reports sent to [email protected] are treated confidentially.

Purpose and legal basis. We process these data to answer your enquiry and, where it concerns our services, to prepare or perform a contract: Art. 6 (1) (b) GDPR for pre-contractual and contractual enquiries, otherwise Art. 6 (1) (f) GDPR, our legitimate interest in answering enquiries addressed to us. Retention. We keep enquiries until they have been dealt with and no follow-up questions are to be expected, then delete them. If a contract comes about, the correspondence is kept for as long as the contractual relationship and statutory retention obligations require (under the Swedish Bookkeeping Act, seven years for accounting records).

7. Recipients

Cloudflare (hosting, visitor statistics, e-mail sending) and Google (mailboxes) process data on our behalf as processors; we pass personal data on to nobody else unless we are legally obliged to. We do not sell data, and we make no automated decisions and no profiling.

8. Your rights

You have the right to access the personal data we hold about you (Art. 15 GDPR), to have it rectified (Art. 16) or erased (Art. 17), to have its processing restricted (Art. 18), to receive it in a structured, machine-readable format (Art. 20) and to object to processing based on Art. 6 (1) (f) GDPR for reasons arising from your particular situation (Art. 21). Write to [email protected]; we will reply within one month. You also have the right to lodge a complaint with a supervisory authority: for ef.next AB this is the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, imy.se; you may also contact the authority at your place of residence or work.

9. Changes

We will update this policy whenever the processing changes. The version published here applies.

Last updated: 1 November 2026