BRANN AB – Privacy Policy

Last updated: 19 October 2026

1. General

BRANN AB (“Brann”, “we” or “us”) is committed to protecting your privacy. This privacy policy describes how we collect, use, store and protect personal data, and explains your rights under the EU General Data Protection Regulation (GDPR).

This policy applies to personal data processed in the course of our activities as a patent law firm and intellectual property adviser, including patent, trademark and design matters, intellectual property disputes, licensing and other legal services, as well as when you contact us or visit our website.

Brann is a member of the Association of Swedish Patent Attorneys (SEPAF) and complies with its applicable rules on ethics and professional conduct. Our authorised patent attorneys and European patent attorneys are also subject, where applicable, to specific statutory and professional conduct rules governing their respective engagements, including rules applicable to representation before the European Patent Office (EPO) and the Unified Patent Court (UPC).

BRANN AB is the controller responsible for the processing described in this policy, unless otherwise expressly stated.

2. What type of personal data do we process?

We process the personal data necessary for our activities. This may include:

  • Contact details: Name, address, telephone number, email address, job title and employer.
  • Client and matter information: Information provided to us or obtained by us in the course of our engagements, such as information about clients, opposing parties, inventors, representatives and other individuals concerned.
  • Financial information: Billing information, payment details and other information needed to administer client engagements.
  • Recruitment information: CVs, application documents, references and other information provided during recruitment.
  • Website information: IP address, device information, browser details and information about how our website is used.

In the course of our activities, we may also need to process sensitive personal data or personal data relating to criminal convictions and offences. Such processing takes place only where there is a legal basis and the processing is necessary, for example for the establishment, exercise or defence of legal claims.

Personal data may be collected directly from you or obtained from sources such as clients, opposing parties, public authorities, public registers and other sources relevant to our engagements.

3. Why do we process personal data?

We process personal data for the following purposes:

  • Client engagements: To provide advice, represent clients and administer our engagements concerning intellectual property.
  • Conflict checks: To identify and prevent conflicts of interest and comply with applicable professional conduct obligations.
  • Legal obligations: To comply with legal requirements and other applicable rules, for example those relating to accounting and, where applicable, anti-money laundering measures.
  • Administration and communication: To manage contacts with clients, suppliers and other business partners.
  • Recruitment: To administer and assess job applications.
  • Marketing: To send newsletters, information about our activities and invitations to seminars and other events.
  • Website statistics: To analyse the use of our website and improve its content and functionality.

4. Legal basis for processing

We process personal data on one of the following legal bases under Article 6 GDPR:

Contract (Article 6(1)(b))

Where processing is necessary for the performance of a contract with you as an individual or to take steps at your request before entering into a contract.

Legal obligation (Article 6(1)(c))

Where processing is necessary to comply with legal obligations, such as accounting requirements and applicable anti-money laundering legislation.

Legitimate interests (Article 6(1)(f))

Where processing is necessary for our legitimate interests and those interests are not overridden by the interests or fundamental rights of the data subject. This applies, for example, to administering engagements for corporate clients, communicating with business partners, recruitment, conflict checks and certain marketing activities.

Consent (Article 6(1)(a))

Where processing is based on your freely given consent, for example when using Google Analytics on our website.

Where special categories of personal data are processed, a relevant exception under Article 9 GDPR also applies. Personal data relating to criminal convictions and offences is processed only subject to the conditions laid down in Article 10 GDPR and supplementary Swedish legislation.

5. How long do we retain personal data?

We retain personal data only for as long as necessary for the purposes for which it is processed or as required by applicable rules.

Documents and personal data processed in connection with client engagements are retained for as long as necessary, taking into account the nature of the engagement, applicable legal obligations, professional conduct rules and the need to safeguard the legitimate interests of clients and Brann.

When determining retention periods, we take into account, among other things, the need to document and monitor intellectual property rights, manage conflicts of interest, comply with applicable record retention requirements, and establish, exercise or defend legal claims.

Information needed for conflict checks may be retained for as long as necessary to identify and prevent conflicts of interest.

Accounting records are retained in accordance with applicable accounting legislation.

Data processed for recruitment or marketing purposes is retained for as long as there is a legitimate need or another legal basis for the processing.

If you unsubscribe from our newsletters, we will stop sending them to you. However, we may retain limited information to ensure that you are not contacted again contrary to your request.

6. Security and confidentiality

We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, alteration and unauthorised disclosure.

Brann conducts its activities in accordance with the confidentiality and professional conduct requirements arising from its membership of SEPAF, as well as the specific rules applicable to authorised patent attorneys, European patent attorneys and representatives before the Unified Patent Court (UPC).

Only individuals who need access to the data to perform their duties are permitted to process it.

7. Disclosure of personal data

We may disclose personal data where necessary to carry out our engagements or comply with legal obligations.

Recipients may include courts, public authorities, opposing parties, their representatives, foreign patent attorneys, legal representatives and others who need access to the data in connection with an engagement.

We may also engage external service providers for purposes such as IT operations, document management, communication and administration. Where service providers process personal data on our behalf, we ensure that the necessary data processing agreements and appropriate security measures are in place.

Any disclosure is made with due regard to applicable confidentiality rules and our obligations towards our clients.

8. Transfers of personal data outside the EU/EEA

In the course of our international activities and when using certain IT services, personal data may be transferred to countries outside the EU/EEA.

Such transfers take place only where permitted under the GDPR, for example on the basis of an adequacy decision, the European Commission’s standard contractual clauses or other permitted transfer mechanisms.

Where necessary, we implement supplementary safeguards to ensure an appropriate level of protection.

Information about the applicable safeguards may be requested using the contact details below.

9. Cookies and Google Analytics

Our website uses cookies and similar technologies to enable certain functions and analyse how the website is used.

Some pages contain embedded maps from Google Maps. These maps are loaded only if you have consented to functional cookies, as Google may then process data such as your IP address and information about your device.

We use Google Analytics 4, a service provided by Google, to compile statistics on visits to and use of the website.

Google Analytics may process data such as pages visited, visit duration, device, browser, approximate geographical location and online identifiers.

Processing for website statistics is based on your consent under Article 6(1)(a) GDPR. Google Analytics is activated only after you have given your consent. You can withdraw or change your consent at any time through the website’s cookie settings.

Google may process data outside the EU/EEA, including in the United States. Such transfers must be covered by applicable safeguards under the GDPR.

Further information about the cookies used, their retention periods and how to manage your settings is available in our cookie policy.

10. Newsletters and other communications

We may use your contact details to provide information about our activities, legal developments, seminars and other events.

Such communications are based on legitimate interests or consent, depending on the circumstances and applicable rules on electronic marketing.

You can unsubscribe from our communications at any time by using the unsubscribe link in the message or by contacting us at brann@brann.se.

11. Your rights

Under the GDPR, and subject to the conditions set out in the Regulation, you have the right to:

  • Access the personal data we process about you.
  • Request rectification of inaccurate or incomplete data.
  • Request erasure of personal data that no longer needs to be processed.
  • Request restriction of processing in certain circumstances.
  • Object to processing based on legitimate interests and to direct marketing.
  • Request data portability where the relevant conditions are met.
  • Withdraw consent where processing is based on consent, without affecting the lawfulness of processing carried out before its withdrawal.

These rights may in certain cases be limited by applicable legislation, obligations to retain data, or specific duties of professional secrecy and confidentiality applicable to our activities and our representatives.

We normally respond to a request within one month of receiving it. This period may be extended in certain cases in accordance with the GDPR.

If you consider that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se. You may also contact the competent supervisory authority in another EU/EEA country.

12. Contact

If you have any questions about our processing of personal data or wish to exercise your rights, please contact us:

BRANN AB
Email: brann@brann.se
Postal address: Box 3690, SE-103 59 Stockholm, Sweden
Website: www.brann.se

13. Changes to this privacy policy

We may update this privacy policy to reflect changes in our activities or applicable legislation. The latest version is always available on our website.