MIL privacy notice

Who is responsible

The controller is Demir Chakirov, a sole trader in Trelleborg, Sweden, who operates MIL (www.milquery.com).

Contact for all privacy matters: lordfreez@gmail.com.

Whose data MIL processes

1. Owners of Swedish sole traders (enskild näringsidkare), whose business is registered in the public company registers. A sole trader is not a separate legal person: its organisationsnummer is the owner's personnummer or samordningsnummer.

2. Contact persons of MIL's registered business customers (billing).

3. People who call the API (technical request data).

Data about limited companies (aktiebolag) and other legal persons is generally not personal data and is not the subject of this notice.

Where the register data comes from

Statistics Sweden (SCB), the general business register (Företagsregistret, AFR).

The Swedish Companies Registration Office (Bolagsverket), its open data (Värdefulla datamängder) and filed annual reports.

MIL does not collect data from the people concerned and does not buy data from data brokers.

What MIL publishes about a sole trader

Only to a caller who already supplies the organisationsnummer: the registered business name (företagsnamn), legal form, whether the business is active or deregistered, registration dates, industry codes (SNI), whether it is registered for VAT, F-tax and as an employer, employee size class, postal code, locality and municipality, and the dated history of these register facts.

Never published, in any product tier: the owner's own name (also where a workplace is named after the owner), telephone, e-mail, street or c/o address, map coordinates and turnover size class. MIL receives some of these from the registers and holds them, but withholds them in every answer.

Never listed: a sole trader does not appear in name, industry, locality or workplace searches, browse results, related-company lists or event feeds. A name can therefore never be turned into a personnummer through MIL.

Never assessed: MIL computes no signals, scores, risk indicators or other assessments about a sole trader. MIL makes no automated decisions about anyone (GDPR art. 22).

Where the register holds no business name, the legal name field is empty and marked as withheld.

Why, and on what legal basis

Purpose: to let businesses and their software verify a counterparty they already know -- that the business exists, is active and is registered for VAT, F-tax or as an employer -- with the source and date of each fact.

Legal basis: legitimate interests (GDPR art. 6(1)(f)): MIL's and its customers' interest in reliable, sourced verification of business counterparties, which the registers themselves exist to support. MIL has weighed this against the owners' interests and limits the processing to what is described above: no listing, no person name, no contact details, no profiling.

Personnummer: the identifier is processed only because it is the business's organisationsnummer, which is needed for secure identification (3 ch. 10 sec. of the Swedish Data Protection Act, 2018:218). MIL never discloses it to anyone who does not already supply it.

Customer contact data: performance of the contract and MIL's bookkeeping obligations (art. 6(1)(b) and (c)). API request data: legitimate interest in operating, securing and measuring the service (art. 6(1)(f)).

Who receives the data

API customers: businesses and automated systems that query MIL, who receive only what is described above. Customers may be located outside the EU/EEA.

Service providers acting for MIL: Supabase (database, hosted in Ireland, EU); Vercel Inc. (hosting of the API); Stripe (card payments of registered customers); the x402 payment facilitator for crypto payments. Vercel and Stripe are US companies; MIL relies on their data processing agreements and the transfer safeguards they provide.

MIL does not sell or license register data for direct marketing.

How long

Register data is kept while the business is in the source registers, and its dated history for as long as it is needed to answer accurately about the past. MIL is setting a fixed deletion period for businesses that have been deregistered; until it is in force you can ask for erasure at any time.

Billing records are kept for seven years as required by the Swedish Bookkeeping Act. API request data is kept in pseudonymised form (a keyed hash; raw IP addresses are not stored).

Your rights

You can ask for access to your data, rectification, erasure or restriction, and you can object to the processing (GDPR art. 15-18 and 21). If you object, MIL stops publishing data about your business unless there are compelling legitimate grounds.

Rectification at the source: the data comes from public registers. Correct it at verksamt.se, Bolagsverket or SCB, and MIL follows at its next refresh. Tell MIL as well, and MIL will act on an error it holds.

Write to lordfreez@gmail.com and state the organisationsnummer of the business. MIL answers within one month and may ask you to confirm your identity.

You may complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se).

Changes to this notice

The version date above changes whenever this notice changes.