Privacy
Notice
Effective 1 September 2026
Last updated 27 August 2026
Disrupt Synergies AB (“D3”, “Disrupt Synergies”, “we” or “us”) respects your privacy. This Privacy Notice explains how we process personal data when you visit our website, contact us, submit a capability assessment or programme application, participate in the D3 ICNR Program, register investor or partnership interest, or otherwise interact with Disrupt Synergies.
We process personal data in accordance with the General Data Protection Regulation (“GDPR”) and applicable Swedish law.
This Privacy Notice explains how we process personal data when you visit our website, contact us, submit a capability assessment or programme application, participate in the D3 ICNR Program, register investor or partnership interest, or otherwise interact with Disrupt Synergies.
We process personal data in accordance with the General Data Protection Regulation (“GDPR”) and applicable Swedish law.
01 Data Controller
Disrupt Synergies AB
Organisation no. 559081-7952
Sweden
Privacy enquiries: privacy@disruptsynergies.com
Disrupt Synergies AB is the data controller for the processing described in this notice unless otherwise stated.
02 Personal Data
We Process
Depending on how you interact with D3, we may process:
Identity and contact data
Name, professional role, company, business email, telephone number and country.
Professional data
Professional background, expertise, responsibilities and other relevant business information.
Application and programme data
Information provided when applying for or participating in an assessment, qualification, ICNR programme or related D3 engagement.
Investor and partner data
Organisation, investment interests, geographies, investment range, strategic interests and related professional information.
Commercial data
Contracts, services purchased, invoices, payment status and transaction records.
Communications
Emails, meeting requests, correspondence and information you choose to provide to us.
Technical data
IP address, browser/device information, security logs and related technical information.
Website and analytics data
Information collected through cookies or similar technologies where applicable and, for non-essential technologies, where the required consent has been provided.
D3 does not generally request special categories of personal data.
Do not submit classified information, unnecessary personal information or special-category personal data through our website or initial programme application forms.
03 Industrial Capability Information
The D3 ICNR Program evaluates companies and industrial capabilities, not individuals.
Information concerning technologies, production capacity, intellectual property, infrastructure, processes, products or other corporate capabilities is not necessarily personal data.
Where information submitted to D3 contains or can be linked to an identifiable person, this Privacy Notice applies to that personal-data element.
Commercially sensitive capability information, intellectual property and confidentiality are governed separately through applicable ICNR Application and Confidentiality Terms and, where relevant, contractual agreements.
04 Where We Obtain
Personal Data
We may obtain personal data:
- directly from you;
- from your organisation;
- through website forms, applications and correspondence;
- through professional referrals or nominations;
- from advisers, partners or business contacts; and
- from legitimate publicly available professional and business sources.
D3's work includes identifying companies and industrial capabilities that may have strategic relevance even where the company has not approached D3 first.
This may involve processing publicly available professional information concerning relevant executives, specialists, investors, advisers or company representatives.
Where personal data has not been obtained directly from you, D3 provides the information required under applicable data-protection law where and when required.
05 Why We Process
Personal Data
We process personal data for the following purposes:
Purpose
Responding to enquiries and meeting requests
Reviewing capability assessments and programme applications
Delivering ICNR and other D3 services
Identifying potentially relevant companies and professional contacts
Relevant business-to-business outreach
Managing investor, family-office, adviser and partner relationships
Processing payments and invoices
Accounting and statutory record keeping
Protecting our website, systems and information
Non-essential website analytics
Improving D3 methodologies, research and services
Establishing, exercising or defending legal claims
Legal basis
Legitimate interests or steps before entering into a contract
Steps before entering into a contract and legitimate interests
Performance of a contract
Legitimate interests
Legitimate interests, subject to applicable communications law
Legitimate interests or steps before entering into a contract
Performance of a contract and legal obligation
Legal obligation
Legitimate interests and, where applicable, legal obligation
Consent
Legitimate interests with appropriate safeguards
Legitimate interests
Where D3 relies on legitimate interests, we consider the purpose and necessity of the processing and balance those interests against the rights and interests of the individuals concerned.
06 Capability Assessment and Technology-Assisted Analysis
D3 may use analytical software, artificial intelligence and other technology-assisted tools to support activities such as:
research, information structuring, classification, summarisation, capability mapping, pattern identification and strategic analysis.
These tools support D3's professional work.
Material ICNR programme-admission decisions are not intended to be made about individuals solely through automated processing. Human judgement remains part of the assessment and decision process.
Where external technology providers process personal data on behalf of D3, appropriate data-processing and transfer arrangements are applied.
07 Business Communications
D3 may contact professional recipients where we reasonably believe that an assessment, programme, research finding, event or business opportunity is relevant to their organisation or professional responsibilities.
You may object to direct marketing at any time.
If you opt out, we may retain limited information necessary to ensure that your preference continues to be respected.
This does not prevent D3 from sending necessary contractual, programme, administrative or security communications.
08 When Providing
Information is Required
Providing personal data is generally voluntary.
Certain information may, however, be necessary to:
- process an application or capability assessment;
- enter into or perform a contract;
- process a payment;
- meet legal or regulatory requirements; or
- communicate with you about an engagement.
If required information is not provided, D3 may be unable to process an application, provide a requested service or enter into the relevant relationship.
09 Who May Receive
Personal Data
D3 does not sell personal data.
Where necessary, personal data may be shared with categories of service providers supporting functions such as:
- hosting and cloud infrastructure;
- website and application systems;
- CRM and business communications;
- payment processing;
- accounting and administration;
- analytics where consented to;
- cybersecurity;
- professional advice; and
- specialist programme delivery.
D3 may also disclose personal data where required by law or where necessary to establish, exercise or defend legal claims.
Service providers processing personal data on behalf of D3 are subject to appropriate contractual and data-protection requirements.
Participation in a D3 programme does not mean that one participant automatically receives another participant's personal or confidential information.
10 International Data
Transfers
Some service providers may process personal data outside Sweden or the European Economic Area (“EEA”).
Where personal data is transferred outside the EEA, D3 uses an applicable transfer mechanism where required, such as:
- an adequacy decision adopted by the European Commission;
- another recognised adequacy framework; or
- appropriate contractual safeguards, such as Standard Contractual Clauses, together with additional measures where required.
You may contact D3 for further information regarding safeguards applicable to a particular transfer.
11 Cookies and Similar Technologies
D3 uses cookies and similar technologies that are necessary for website operation, functionality and security.
Non-essential technologies, including analytics where applicable, are used only after the required consent has been obtained.
You can change or withdraw your choices through Cookie Settings.
Information about the cookies and similar technologies currently used, their purposes and applicable retention periods is provided separately in the D3 Cookie Policy and Cookie Settings.
12 How Long We Keep
Personal Data
D3 retains personal data only for as long as reasonably necessary for the purpose for which it was collected.
Retention is determined by factors including:
- whether an application, assessment or business relationship remains active;
- whether continued contact remains reasonably relevant;
- contractual requirements;
- statutory accounting or record-keeping obligations;
- security requirements;
- applicable limitation periods; and
- the need to establish, exercise or defend legal claims.
Personal data that is no longer required is deleted or anonymised in accordance with D3's retention procedures.
Limited information may be retained where necessary to honour an opt-out or other privacy preference.
13 Security
D3 applies appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.
Access to personal data is limited according to operational need.
D3 does not publicly disclose detailed security architecture, systems or controls where doing so could create unnecessary security risk.
14 Your rights
Subject to the conditions and exceptions under applicable law, you may have the right to:
- request access to your personal data;
- correct inaccurate personal data;
- request deletion;
- request restriction of processing;
- object to processing based on legitimate interests;
- object at any time to direct marketing;
- receive certain personal data in a portable format;
- withdraw consent where processing is based on consent; and
- request information regarding applicable international-transfer safeguards.
To exercise your rights, contact:
privacy@disruptsynergies.com
D3 may need to verify your identity before processing a request.
15 Complaints
If you have concerns about how D3 processes your personal data, please contact us so that we can investigate.
You also have the right to lodge a complaint with the competent supervisory authority.
In Sweden:
Integritetsskyddsmyndigheten (IMY)
Swedish Authority for Privacy Protection
16 Third-Party
Websites
The D3 website may contain links to independent third-party websites, organisations, events or services.
Those organisations are responsible for their own processing of personal data and their own privacy notices apply when you interact with them.
17 Children
D3's website, programmes and professional services are intended for organisations and professional users and are not directed at children.
D3 does not knowingly seek to collect children's personal data through its professional programmes.
18 Changes to This
Privacy Policy
D3 may update this Privacy Notice when our operations, services, technology or legal requirements change.
The current version will display its latest revision date.
Where a change materially affects how personal data is processed, additional notice will be provided where required.
19 Contact
Disrupt Synergies AB
Organisation no. 559081-7952
Sweden
Privacy enquiries
privacy@disruptsynergies.com
ARTICLES I INTERVIEWS
ARTICLE
Interview: Frank Schuil: “Can Sweden form a landscape where ICO’s can blossom? Connected to an e-crona?”
- 1
- 2