# GDPR requests & data rights Version: 2026-11-02 Status: Customer guide Operator: Codaform AB, organisation number 559607-6504, Fagermon 315, 705 91 Örebro, Sweden Contact: info@codaform.se How employees, company contacts and former users can request access, correction or deletion. ## Make a request Email info@codaform.se with the subject ‘Privacy request’. You do not need a paid account. Include your account email, your relationship to the company if relevant, the right you want to exercise, and the information or time period concerned. Do not send passwords, payment-card details or identity documents in the initial request. Suggested message: ‘I am requesting [access / correction / erasure / restriction / portability / objection] concerning my Codaform account [email]. The scope is [description]. Please contact me at [reply address].’ A company representative should explain their authority. You can also write to Codaform AB, Fagermon 315, 705 91 Örebro, Sweden. ## Available rights - Access: learn what personal data is processed and obtain a copy, subject to others' rights and applicable exceptions. - Correction: correct inaccurate details and complete incomplete information. - Erasure: ask for deletion where a legal ground applies; this is not an unconditional right to erase invoices or other people's data. - Restriction and objection: ask us to limit processing or review legitimate-interest processing. Direct-marketing objections must be respected. - Portability: receive eligible data in a structured, commonly used, machine-readable form where the legal conditions apply. - Consent: withdraw consent for future processing without affecting earlier lawful use. ## What happens next We record the request and original receipt date, check identity or authority proportionately, and review the relevant systems and recipients. We normally respond within one month. A justified extension of up to two additional months must be communicated within the first month. Requests are normally free; any permitted exception must be explained. For employee data, your company may also need to respond as a separate controller. We will explain the relevant responsibilities rather than assuming that a company administrator can exercise every employee's rights. Exported data must be reviewed for third-party information and delivered through a suitable secure channel. ## Deletion, retained records and offline access Deleting an individual account does not automatically erase shared company billing history. Ownership transfers, financial obligations, lawful retention, provider records, support mail and backups may need separate handling. We explain retained categories, the basis and the review or deletion criteria in the response. Access restriction or erasure cannot immediately invalidate a signed desktop entitlement on a computer that is offline. Paid offline access can last until its signed expiry, currently up to seven days. This does not extend permission to use the service after an agreement has ended. ## Questions and complaints Contact info@codaform.se if you need clarification or disagree with the response. You can complain to IMY or another competent supervisory authority and seek a judicial remedy. The privacy policy supplies the controller's details and processing information. ## References - [IMY: your rights](https://www.imy.se/privatperson/dataskydd/dina-rattigheter/)