Privacy Policy

Effective date: Oct 12, 2026

1. Who we are

This Privacy Policy explains how R2E2 AB, trading as Stewark ("Stewark", "we", "us"), processes personal data and what rights you have.

Controller	R2E2 AB (trading as Stewark), org. nr 559548-5201
Address	c/o Mathias Eriksson, Kungshöjdsgatan 11 b, 411 20 Göteborg, Sweden
Contact for privacy matters	privacy@stewark.com
Data Protection Officer	Not appointed.

2. Scope and our role

This Policy applies where Stewark decides the purposes and means of processing (acts as controller): our website, our business relationships with customers, prospects, partners and suppliers, recruitment, and the public-domain governance research that powers the Stewark platform.

Where our customers use the Stewark platform, we process their users' account details and any data they provide to us on their behalf and on their documented instructions (we act as processor). That processing is governed by the Data Processing Agreement with the customer, and the customer's own privacy notice applies to its users. Requests concerning such data should be addressed to the customer; we will assist the customer in responding.

3. What we process, why, and on what legal basis

Who you are	Personal data	Purpose	Legal basis (GDPR Art. 6)
Website visitor	Technical data (IP address, browser and device information, pages visited, timestamps), cookie data	Operate, secure and improve the website	Legitimate interest (Art. 6(1)(f)) in running a secure website; consent for any non-essential cookies
Business contact at a customer, prospect, partner or supplier	Name, title, employer, work contact details, correspondence, meeting notes, contract and invoicing details	Manage the relationship, perform and administer contracts, respond to enquiries, send service communications	Performance of a contract or pre-contractual steps (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) in business communication; legal obligation (Art. 6(1)(c)) for bookkeeping
Prospect we contact for marketing	Name, title, employer, work contact details, source of the contact	Inform you about Stewark's services	Legitimate interest (Art. 6(1)(f)) in business-to-business marketing; you may object at any time
Platform user (authorised user of a customer)	Name, work email, authentication data, role, access and usage logs	Provide the platform to the customer, secure it, support users	Processor on behalf of the customer (see section 2); for security logging, legitimate interest (Art. 6(1)(f)) in protecting the service
Job applicant	Application documents, contact details, interview notes, references you provide	Evaluate your application	Pre-contractual steps (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)); consent (Art. 6(1)(a)) where we keep your application for future roles
Director, executive, board nominee or other individual named in public governance material	Name, role, biography, board and committee memberships, shareholdings, remuneration and other information disclosed in public filings, AGM materials, governance codes, voting records and media	Analyse corporate governance matters and provide voting recommendations and reporting to institutional investors	Legitimate interest (Art. 6(1)(f)) in providing governance and stewardship analysis; the data is taken from sources that are public by law or by the company's own disclosure

We do not process special categories of personal data (GDPR Art. 9) on purpose. If such data is contained incidentally in public documents, we do not use it to profile or evaluate individuals.

4. Where the data comes from

We receive personal data from you, from your employer (for example when a customer registers you as a user), from public sources (company websites, regulatory filings, AGM materials, professional networks and media), and from our customers where they share data with us under a Data Processing Agreement.

5. Who receives the data

We share personal data only as needed:

Service providers (processors) acting on our instructions, for cloud hosting (Microsoft Azure, EU regions), AI model providers that process data under data processing terms which prohibit training on our inputs, and business tools for email, collaboration, support and invoicing. Our list of subprocessors for customer data is available on request.
Professional advisers such as auditors, accountants and legal counsel, bound by confidentiality.
Authorities where we are legally obliged to disclose.
A successor in the event of a merger, acquisition or reorganisation, under the same obligations.

We do not sell personal data.

6. International transfers

The Stewark platform is hosted and operated in the European Union. Where a service provider processes personal data outside the EU/EEA, we rely on an adequacy decision of the European Commission or on the EU Standard Contractual Clauses together with supplementary measures where needed. You may ask us for details of the safeguards in place.

7. How long we keep data

Data	Retention
Business contacts and correspondence	For the duration of the relationship and up to 24 months after the last contact
Contracts, invoices and bookkeeping records	Seven years after the end of the financial year, as required by the Swedish Bookkeeping Act
Marketing contacts	Until you object or 24 months after the last interaction
Platform user accounts and logs	For the duration of the customer's contract plus a 30-day grace period; backups are overwritten within a further 30 days; security logs 12 months
Job applications	Until the recruitment is concluded, plus two years to defend legal claims; longer only with your consent
Public governance data	For as long as it is relevant to governance analysis; we re-collect from the public source rather than keep data that the source has withdrawn
Website technical logs	90 days

8. How we protect data

Stewark operates an information security management system aligned with ISO/IEC 27001, with documented policies and procedures. Measures include encryption in transit and at rest, individual accounts with access limited to what a role requires, logging and monitoring, regular backups with restore tests, and secure development practices. Personnel are bound by confidentiality.

9. Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. The Stewark platform provides decision support to our customers; voting decisions remain the customer's.

10. Your rights

Under the GDPR you may ask us to:

access the personal data we hold about you and receive a copy;
rectify inaccurate or incomplete data;
erase your data, where no legal ground for keeping it remains;
restrict processing in the circumstances set out in Art. 18;
receive data you provided to us in a portable format, where processing is based on contract or consent;
stop processing based on legitimate interest, including direct marketing, by objecting (Art. 21);
withdraw consent at any time, without affecting processing before the withdrawal.

To exercise a right, contact privacy@stewark.com. We may ask you to confirm your identity. We respond within one month, extendable by two months for complex requests, in which case we tell you why.

You may lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, www.imy.se, or with the supervisory authority of the EU/EEA country where you live or work.

11. Changes to this Policy

We review this Policy at least annually and when our processing changes. The current version is published at stewark.com/privacy. Material changes to how we process data of existing contacts are communicated directly.