Bryntum Privacy Policy

Last Updated: 2026-09-01

Welcome to Bryntum’s Privacy Policy.

Your privacy is important to us.

At Bryntum, we are fully committed to protecting your personal data and complying with all data privacy laws.

This policy serves as a guide and reference point for how we may collect and use personal information, and the rights and choices available to all our website visitors and customers.

We strongly recommend you read our policy and understand what we collect, how we collect it, what we do with it, how we protect it, and your rights regarding information, before you use or access any of our services.

1. Introduction
2. What Data Do We Collect About You
3. Purposes Of Processing And Legal Bases
4. How We Collect Your Personal Data
5. Marketing Communications
6. Disclosures Of Your Personal Data
7. International Transfers
8. Data Security
9. Data Retention
10. Your Legal Rights
11. Third-Party Links
12. Cookies

This privacy notice provides you with details of how we collect and process your personal data through your use of our website at bryntum.com, when we communicate with you as a prospective customer and/or where you are a customer and your personal data is used to provide and administer our services.

Bryntum AB is the data controller and we are responsible for your personal data (referred to as “we”, “us” or “our” in this privacy notice).

Contact Details

Our full details are:

Full name of legal entity: Bryntum AB
Email address: dpo@bryntum.com
Postal address: Bryntum AB, Malmskillnadsgatan 44a, 111 57 Stockholm, Sweden.

It is very important that the information we hold about you is accurate and up to date. Please let us know if at any time your personal information changes by emailing us at dpo@bryntum.com.

Our website and services are not targeted to children. If you are under 16 years of age, please do not use our website or our services. If we become aware you are under the age of 16 we will delete any personal information about you that we hold.

Personal data means any information capable of identifying an individual. It does not include anonymised data.

We may process the following categories of personal data about you:

Communication Data that includes any communication that you send to us whether that be through the contact form on our website, through email, text, social media messaging, social media posting or any other communication that you send us.

Identity Data that includes your name, title, email address, phone number, billing address, delivery address and other contact details. Where you are acting on behalf of your employer or another organisation, Identity Data may also include the name of that organisation and your role within it. In a business-to-business context, Identity Data will typically relate to an individual acting as a representative of a corporate customer. If you visit our premises we may also retain visitor logs.

Transaction Data that includes data relating to purchases of goods and/or services, such as details of the products or services purchased, order history, payment card details and billing information. In a business-to-business context, payment card details will typically relate to a corporate payment method rather than a personal card.

Lead Data that includes information relating to your interest in our products or services, the source or channel through which you were identified as a prospective customer, company-level firmographic information obtained from third-party business data providers (such as company size, industry and revenue band), and any lead scoring or qualification status assigned to you.

User Data that includes data about how you use our website and any online services together with any data that you post for publication on our website or through other online services.

Technical Data that includes data about your use of our website and online services such as your IP address, your login data, details about your browser, length of visit to pages on our website, page views and navigation paths, details about the number of times you use our website, time zone settings, data relating to cookies and similar technologies, and other technology on the devices you use to access our website. The source of this data is from our analytics tracking system.

Marketing Data that includes data about your preferences in receiving marketing from us and our third parties and your communication preferences.

Professional Data that includes your CV, records of your expertise, professional history, practising details and qualification details, information about your experience, participation in meetings, seminars, information about your professional relationships with other individuals or institutions, language abilities, and other professional skills.

We do not knowingly collect any sensitive data about you. Sensitive data refers to data that includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. We do not knowingly collect any information about criminal convictions and offences.

We set out below the purposes for which we process personal data, the categories of data used for each purpose and the legal basis on which we rely.

Where we are required to collect personal data by law, or under the terms of the contract between us and you do not provide us with that data when requested, we may not be able to perform the contract (for example, to deliver goods or services to you). If you don’t provide us with the requested data, we may have to cancel a product or service you have ordered but if we do, we will notify you at the time.

We will only use your personal data for the purposes for which it was originally collected, or for further purposes that are not incompatible with that original purpose. For more information on this please email us at dpo@bryntum.com. In case we need to use your details for an unrelated new purpose we will let you know and explain the legal grounds for processing.

We may process your personal data without your knowledge or consent where this is required or permitted by law.

We do not carry out automated decision making or any type of automated profiling that results in legal effects or similarly significant effects.

We may collect data about you by you providing the data directly to us (for example by filling in forms on our site or by sending us emails). We may automatically collect certain data from you as you use our website by using cookies and similar technologies. Please see our Cookie Policy for more details about this.

We may receive your personal data in the course of business dealings with your employer or organisation. We may receive data from third parties such as analytics providers such as Google based outside the EU, advertising networks such as LinkedIn based outside the EU, and providers of technical, payment and delivery services.

Bryntum also receives personal data from AG Grid Ltd (70 Wilson Street, London, EC2A 2DB, United Kingdom) (“AG Grid”), including Identity Data and Lead Data relating to individuals who have registered interest in either AG Grid’s or Bryntum’s products and services. Bryntum uses this data to support its marketing activities and to cross-market AG Grid’s products. AG Grid’s privacy policy at https://www.ag-grid.com/privacy/ provides details of how AG Grid collects and uses your personal data.

In addition to the data sharing described in Section 6, we also send data to AG Grid. When you enter your details into the Bryntum website (via contact, download and pricing forms), your Lead Data and Identity Data is transmitted to AG Grid. AG Grid and Bryntum are joint controllers for the collection of this information via the Bryntum website. The essence of the joint controller arrangement between Bryntum and AG Grid is as follows:

Bryntum is responsible for providing this privacy notice to you at the point of collection via the Bryntum website. This privacy notice is the primary source of information about how your personal data is collected and used by Bryntum.

AG Grid’s privacy policy at https://www.ag-grid.com/privacy/ is the primary source of information about how AG Grid uses your personal data once it has received it from Bryntum. AG Grid uses the data it receives to conduct commercial follow-up as Bryntum’s authorised reseller.

Both Bryntum and AG Grid rely on legitimate interests as the legal basis for the collection of your data in this way. Both parties will comply with applicable data protection laws in respect of the personal data they process.

Consent to marketing, where required, is collected at the time your personal data is collected via the Bryntum website. Regardless of the arrangement between Bryntum and AG Grid, you may exercise your data subject rights (as described in Section 10 below) against either Bryntum or AG Grid directly, using the contact details set out in this privacy notice or in the AG Grid Privacy Policy.

Our legal basis for processing your personal data to send you marketing communications depends on the circumstances.

Where you have given us your specific consent to receive marketing communications from us and our group companies, we will rely on that consent.

Where you are:

• an existing customer who has previously purchased goods or services from us (or enquired about them); or

• an individual contacted in your capacity as an employee or representative of a company, and we are marketing our goods and services to that company (a corporate subscriber),

we may rely on our legitimate interests (namely to grow our business). In these cases you can still opt out of receiving marketing emails from us at any time.

The marketing you will receive from Bryntum will usually relate to our own goods and services. Where we think it may be of interest to you, you may also receive marketing that promotes the goods and services of AG Grid. Marketing promoting AG Grid will be sent on the following bases:

• Where we rely on consent to send you marketing about Bryntum, we will send marketing relating to AG Grid on the basis of this consent.

• If we do not rely on your consent to send you marketing about Bryntum then we will only send you marketing about AG Grid if you have not opted out of our marketing messages and you are a corporate subscriber. In this case we will continue to rely on our legitimate interests (namely to grow our business) to send you marketing.

You can ask us to stop sending you marketing communications at any time by following the opt-out links on any marketing message sent to you or by emailing us at dpo@bryntum.com. If you opt out of receiving marketing communications, this does not affect the lawful processing of your personal data for other purposes (such as the performance of a contract or the provision of services you have requested).

Before we share your personal data with any third party for their own marketing purposes we will get your express consent.

If you opt out of receiving marketing communications this opt-out does not apply to personal data provided as a result of other transactions, such as purchases, warranty registrations etc.

We may disclose your personal data with the parties set out below:

• You and, where appropriate, your appointed representatives.

• Service providers who provide IT and system administration services, including customer relationship management (CRM) platform providers, cloud hosting and infrastructure providers, and website analytics providers.

• Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.

• Government and regulatory bodies, tax authorities and other authorities who require us to report processing activities or where disclosure is required by law.

• AG Grid, in connection with the activities described in this privacy notice (see Section 5 above).

• Any relevant third party acquirer(s) or successor(s) in title, in the event that we sell, transfer, or merge all, or any part of, our business or our assets.

• Advertising networks and marketing platform providers who assist us in delivering and measuring the effectiveness of our advertising.

• Payment and delivery service providers who assist in fulfilling transactions.

• Any relevant party, regulatory body, governmental authority, law enforcement agency or court, to the extent necessary for the establishment, exercise or defence of legal claims.

• Any relevant party, regulatory body, governmental authority, law enforcement agency or court, for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.

We require all third parties to whom we transfer your data to respect the security of your personal data and to treat it in accordance with the law. We only allow such third parties to process your personal data for specified purposes and in accordance with our instructions.

Countries outside of the European Economic Area (EEA) do not always offer the same levels of protection to your personal data, so data protection law restricts transfers of personal data outside of the EEA unless the transfer meets certain criteria.

Bryntum AB is based in Sweden (within the EEA). Some of our third-party service providers are based outside the EEA, including in the United Kingdom and the United States. We also share personal data with AG Grid Ltd, which is based in the United Kingdom. The transfer of personal data from the EEA to the United Kingdom is covered by the European Commission’s adequacy decision for the UK. We also have a group company in the United States.

Whenever we transfer your personal data outside of the EEA, we ensure that an appropriate safeguard is in place, including one or more of the following:

• the transfer of your personal data is to a country that has been recognised as providing an adequate level of protection for personal data by the European Commission; or

• we have entered into specific contracts approved for international transfers (such as EU Standard Contractual Clauses).

We have put in place security measures to prevent your personal data from being accidentally lost, used, altered, disclosed, or accessed without authorisation. We also allow access to your personal data only to those employees and partners who have a business need to know such data. They will only process your personal data on our instructions and they must keep it confidential.

We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach if we are legally required to.

We take every reasonable step to ensure that your personal data are only retained for the minimum period necessary for the purposes set out in this policy. The criteria for determining the duration for which we will retain your personal data are as follows:

1. we will retain personal data in a form that permits identification only for as long as:

   1. we maintain an ongoing relationship with you (e.g., where you are a user of our services, or you are lawfully included in our mailing list and have not unsubscribed); or

   2. your personal data are necessary in connection with the purposes set out in this policy, for which we have a valid legal basis (e.g., where your personal data are included in a contract between us and your employer, and we have a legitimate interest in processing those personal data for the purposes of operating our business and fulfilling our obligations under that contract; or where we have a legal obligation to retain your personal data),

plus:

2. the duration of:

   1. any applicable limitation period under applicable law (i.e., any period during which any person could bring a legal claim against us in connection with your personal data, or to which your personal data are relevant); and

   2. an additional two (2) month period following the end of such applicable limitation period (so that, if a person brings a claim at the end of the limitation period, we are still afforded a reasonable amount of time in which to identify any personal data that are relevant to that claim),

and:

3. in addition, if any relevant legal claims are brought, we continue to process personal data for such additional periods as are necessary in connection with that claim.

When deciding what the correct time is to keep the data for we look at its amount, nature and sensitivity, potential risk of harm from unauthorised use or disclosure, the processing purposes, if these can be achieved by other means and legal requirements. Once the periods listed above have all expired, we will either:

• permanently delete or destroy the relevant personal data; or
• anonymize the relevant personal data.

For tax purposes the law requires us to keep basic information about our customers (including Identity Data, Communication Data and Transaction Data) for seven (7) years after they stop being customers.

In some circumstances we may anonymise your personal data for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

Under data protection laws you have rights in relation to your personal data that include:

• The right not to provide your personal data to us: You are not required by law to provide personal data to us – however, as noted above, if you choose not to do so, we may be unable to provide the affected services to you

• Right of access: to request a copy of the personal data we hold about you

• Right to rectification: to request that we correct inaccurate or incomplete personal data

• Right to erasure: to request that we delete your personal data in certain circumstances

• Right to restriction: to request that we restrict our processing of your personal data in certain circumstances

• Right to data portability: to receive personal data you have provided to us in a structured, commonly used, and machine-readable format, or to have it transmitted to another controller, where processing is based on consent or contract

• Right to withdraw consent: where processing is based on your consent, to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal

• Rights in relation to automated decision-making: not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects on you, except where permitted by law

If you wish to exercise any of the rights set out above, please email us at dpo@bryntum.com. As Bryntum and AG Grid are joint controllers for the collection of your information via the Bryntum website, you may also exercise your data subject rights against AG Grid directly by contacting them at privacy@ag-grid.com.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive or refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you.

If you have concerns about how we handle your personal data, you have the right to complain to us using the contact details mentioned in Section 1. We will acknowledge your complaint within 30 days of receipt, investigate and respond to you without undue delay and keep you informed of progress.

You also have the right to lodge a complaint with the supervisory authority in your country of residence or place of work, or in the country where you consider an infringement of data protection law has occurred.

In relation to the UK, the relevant authority is the Information Commissioner’s Office (https://ico.org.uk/). In relation to the EU, the relevant authority is the Data Protection Authority for EU Member State in which you live, or in which you work, or in which the alleged infringement occurred (see the list here: https://edpb.europa.eu/about-edpb/about-edpb/members_en).

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see our Cookie Policy.