Mava
Privacy policy
Last updated 2026-09-24. This page describes how Mava handles personal data on the website and in the service.
Mava is provided by Burntbay AB, company registration number 559317-5374. Contact: hello@mava.solutions.
Two roles
For candidates and employees in the service, your employer is the controller. Burntbay AB processes the data as a processor under a data processing agreement with the employer and on the employer's instructions. Questions about what is collected, why and for how long go first to the employer's security officer, who is named in the service.
For customers and website visitors, Burntbay AB is the controller for what is described below.
What we process, why, and on what basis
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Creating and administering the customer account, giving administrators access | Name, email, phone, job title, company, chosen plan | Legitimate interest in performing the contract with the customer (Article 6(1)(f)); for sole traders: contract (Article 6(1)(b)) | As long as the account exists, then at most 12 months |
| Recording acceptance of the terms | Name, job title, email, IP address, time, terms version | Legitimate interest in being able to show what was agreed (Article 6(1)(f)) | The contract term and ten years after (limitation period) |
| Invoicing and bookkeeping | Billing details, invoices, payments | Legal obligation under the Swedish Accounting Act (Article 6(1)(c)) | Seven years after the end of the calendar year in which the financial year ended |
| Support | What you write to us and your contact details | Legitimate interest in helping customers and users (Article 6(1)(f)) | 24 months after the case is closed |
| Service notices and notice of changed terms | Name and email of the customer's administrators | Legitimate interest in informing about the service (Article 6(1)(f)) | As long as the account exists |
| Security and troubleshooting | IP address, time, browser, sign-in attempts | Legitimate interest in protecting the service (Article 6(1)(f)) | 90 days |
The website uses no tracking cookies and no third-party analytics. You may object to processing based on legitimate interest.
Sub-processors
Operations: Hetzner Online GmbH (Germany, EU). Email delivery: Mailjet (Sinch, EU). SMS: 46elks AB (Sweden). AI reading of CVs and certificates: Amazon Web Services EMEA SARL (AWS), in AWS's regions within the EU, under a data processing agreement; no data is passed to the model provider or used for training. Passports, criminal-record extracts and medical certificates are never sent to any AI.
For Mava's own support and customer administration: DNS and forwarding of email to hello@mava.solutions: Cloudflare, Inc. (USA). Support inbox: Google (USA and Ireland), where Google processes the email under its own terms. Billing and card payment: Stripe Payments Europe Ltd (Ireland). These three may process data in the USA, relying on the European Commission's adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses. Data in the service itself stays within the EU/EEA. The support address is not for information about candidates or employees; anything of that kind that arrives is deleted and the sender is referred to the service.
Data in the service
Data about candidates and employees is deleted automatically after the period the employer sets (default 90 days after a completed check; employees under continuous follow-up are kept for as long as the employment lasts).
Your rights
You have the right to access, rectification, erasure, restriction, portability and objection. Candidates can request export or deletion through their employer at any time; the service has built-in functions for both. You may lodge a complaint with the Swedish Authority for Privacy Protection (IMY).