Last updated: July 2026
This privacy policy explains how Patrik Sporre AB collects and uses personal data through patriksporre.se.
The website is the public home for Patrik Sporre, The Architecture of Commercial Performance, advisory work, speaking, writing, and the Commercial Performance Architecture Diagnostic.
Who is responsible
Patrik Sporre AB is responsible for the processing of personal data collected through this website.
Contact:
What personal data is collected
The personal data collected depends on how you use the website.
If you contact Patrik Sporre AB directly
If you contact Patrik Sporre AB by email or through another direct channel, the personal data you provide may be processed.
This may include:
- first name
- last name
- email address
- organisation
- role or job title
- message content
- related communication
This information is used to respond to your enquiry and handle advisory, speaking, editorial, book-related, or other professional communication.
If you use the Commercial Performance Architecture Diagnostic
The website includes the Commercial Performance Architecture Diagnostic, based on The Architecture of Commercial Performance.
The diagnostic contains twelve statements and provides an indicative profile based on your responses. The result may include:
- a six-dimensional diagnostic profile
- a primary commercial system leak
- a possible secondary leak
- what this usually means
- what leadership should inspect
- the relevant section of the book
The diagnostic result is shown on screen.
You may choose to receive the full report by email. If you do, you will be asked to provide:
- first name
- last name
- organisation
- role
- work email
You may also be asked to make separate choices about whether you want to:
- receive the diagnostic report by email
- receive occasional writing on commercial system design
- be contacted about the book and advisory work
These choices are recorded so that Patrik Sporre AB can respect your communication preferences.
The diagnostic is intended for professional and organisational self-assessment. It does not ask for home address, private phone number, personal identity number, or sensitive personal details.
How diagnostic data is stored
The diagnostic has been designed to separate anonymous research data from contact and report data.
Anonymous research record
When the diagnostic is completed, an anonymous research record may be stored in the WordPress database hosted by one.com.
This record may include:
- the twelve diagnostic answers
- computed scores
- primary and secondary commercial system leak
- a response quality flag
- the instrument version
- the completion date, rounded to the month
This anonymous research record does not include your name, email address, organisation name, IP address, exact completion time, report token, or any key that links it back to a contact record.
The purpose of this record is research, analysis, and the development of anonymised and aggregated insights about commercial system design and commercial performance architecture.
Report access record
If you request the full report by email, a separate report access record may be stored in the WordPress database hosted by one.com.
This record may include:
- first name
- diagnostic scores
- instrument version
- a hashed version of the access token
- creation date and time
The report access record does not include your email address, last name, organisation, role, IP address, or the actual access token.
The access token itself is not stored. Only a SHA-256 hash of the token is stored.
The working report link exists in the email sent to you and in your own inbox. Storing only the token hash reduces the risk that database records can be used to create usable report links.
Report access records are deleted after 90 days. After that, the report link will stop working.
The report link should be treated as personal to you. Anyone with access to the link may be able to view the report while the link remains active.
Email contact record
The report email and any optional email communication are handled through MailerLite.
If you request the report by email, MailerLite may process:
- email address
- first name
- last name
- organisation
- role
- primary and secondary commercial system leak
- report link
- group membership
- subscribe date and status
- consent and communication preferences
If email tracking is enabled, MailerLite may also process email delivery and engagement data, such as opens, clicks, bounces, unsubscribes, timestamps, IP address, and approximate location based on IP address.
This information is used to send the report, manage communication preferences, send optional writing where requested, and maintain email delivery and compliance records.
Use of diagnostic responses for research and analysis
Diagnostic responses may be used in anonymised and aggregated form for research, analysis, and published insights about commercial system design and commercial performance architecture.
This means that response patterns may be analysed to understand common commercial system challenges, recurring leadership issues, and broader trends across organisations.
The research dataset is designed not to identify individual participants or organisations. It does not include your name, email address, organisation name, IP address, exact completion time, report token, or any key or identifier that links the research data back to you or to a contact record.
Published insights will only be shared in aggregated or anonymised form and should not identify individual participants or organisations.
Where data has been properly anonymised so that individuals are no longer identifiable, it is no longer personal data.
Technical data
The website may process limited technical information through the hosting provider, WordPress, security tools, and other website functionality.
This may include:
- IP address
- browser information
- device or usage information
- timestamps
- security logs
- error logs
- information needed for website operation, maintenance, troubleshooting, and protection
This information is used to keep the website functional, secure, and reliable.
Cookies and tracking
The diagnostic plugin itself does not set cookies.
The website may use necessary cookies or similar technologies required for basic website functionality, WordPress operation, security, or maintenance.
MailerLite may use email tracking technologies in emails, such as open and click tracking, where enabled.
The website uses Plausible Analytics to understand how the website is used. Plausible is used to collect aggregate website statistics, such as page views, referral sources, visited pages, outbound link clicks, file downloads, and similar usage information.
Plausible does not use cookies and is not used by Patrik Sporre AB to identify individual visitors, create visitor profiles, or track visitors across other websites.
If marketing tracking, advertising pixels, or other non-essential tracking tools are introduced in the future, this policy will be updated and consent will be handled where required.
Why personal data is processed
Personal data may be processed to:
- respond to enquiries
- generate and send the diagnostic report when requested
- provide temporary access to the diagnostic report
- manage communication preferences and consent choices
- send occasional writing if you have asked to receive it
- contact you about the book or advisory work if you have asked for this
- improve and maintain the website
- understand aggregate website usage, such as which pages are visited and which links or downloads are used
- protect the website against misuse, spam, technical issues, and security threats
- analyse diagnostic responses in anonymised and aggregated form
- meet legal, accounting, or regulatory obligations where applicable
Legal basis for processing
Different legal bases may apply depending on the purpose.
Direct enquiries are processed based on legitimate interest. Patrik Sporre AB has a legitimate interest in responding to professional enquiries and maintaining relevant communication.
Diagnostic report requests are processed based on your request and consent. The personal data you provide is used to generate and send the report and manage related communication preferences.
Occasional writing and contact about the book or advisory work are processed based on your consent, where you have chosen to receive this type of communication. You can withdraw your consent at any time.
Consent records and communication preferences may be processed based on legitimate interest and, where applicable, legal obligation. Patrik Sporre AB has a legitimate interest in being able to document and respect your choices.
Technical and security data is processed based on legitimate interest. Patrik Sporre AB has a legitimate interest in maintaining a secure, functional, and reliable website.
Legal obligations may apply where data must be retained for accounting, tax, legal, or regulatory reasons.
Anonymised research data is not intended to identify you. Where data has been properly anonymised so that individuals are no longer identifiable, it is no longer personal data.
Automated processing
The Commercial Performance Architecture Diagnostic uses your responses to generate an indicative diagnostic result.
The result is an informational self-assessment. It is not a legal, financial, employment, credit, or similarly significant decision about you. It does not make decisions that produce legal effects or similarly significant effects concerning you.
Tools and service providers
The website is built on WordPress and hosted by one.com.
The WordPress database is hosted by one.com in Denmark within the EU.
MailerLite is used to send the diagnostic report by email and to manage optional email communication where you have asked to receive it. MailerLite stores relevant contact and email data in the EU.
one.com and MailerLite act as processors when they process personal data on behalf of Patrik Sporre AB.
Plausible Analytics is used for privacy-friendly website analytics. Plausible provides aggregate statistics about website usage, such as page views, referral sources, outbound link clicks, and file downloads. Patrik Sporre AB uses this information to understand how the website is used and to improve its content and structure.
Plausible is not used by Patrik Sporre AB to identify individual visitors, create visitor profiles, or track visitors across other websites.
Personal data may also be processed by service providers involved in website operation, security, email delivery, maintenance, or technical support. These providers may only process personal data as needed to provide their services.
No personal data is sold.
Transfers outside the EU/EEA
The current setup is designed to keep diagnostic, report, and email contact data in the EU.
If personal data is processed by a service provider outside the EU/EEA in the future, Patrik Sporre AB will take reasonable steps to ensure that appropriate safeguards are in place, where required by applicable data protection law.
How long personal data is kept
Personal data is kept only for as long as necessary for the purposes described in this policy.
Enquiries and related communication are kept for as long as relevant to handle the matter and maintain appropriate business records.
Anonymous research records from the diagnostic may be kept for a longer period. These records are designed not to identify individuals and do not include name, email address, organisation name, IP address, exact completion time, report token, or any key linking the response back to a contact record.
Report access records in the WordPress database are deleted after 90 days. These records allow the report link to work and do not include your email address. When the report access record is deleted, the report link stops working.
If you request the diagnostic report by email but do not ask to receive occasional writing or contact about the book and advisory work, your MailerLite contact record is normally kept for up to 90 days. This allows the report to be delivered, support questions to be handled, and communication preferences to be respected.
If you ask to receive occasional writing or to be contacted about the book and advisory work, your MailerLite contact record is kept until you unsubscribe, withdraw consent, or the data is no longer needed. Inactive contacts may be reviewed and deleted or suppressed after 24 months of inactivity.
If you unsubscribe, limited information may be retained where necessary to ensure that you are not contacted again.
Consent records may be kept for as long as needed to document communication preferences and compliance.
Technical and security logs are kept only for as long as necessary for website operation, troubleshooting, maintenance, and protection.
Your rights
Under GDPR, you have rights in relation to your personal data.
You may have the right to:
- request access to your personal data
- ask for incorrect data to be corrected
- ask for data to be deleted
- object to certain processing
- ask for processing to be restricted
- request a copy of data you have provided
- withdraw consent where processing is based on consent
You always have the right to object to the use of your personal data for direct marketing.
You can unsubscribe from optional email communication using the unsubscribe link in the email or by contacting Patrik Sporre AB.
To exercise your rights, contact:
Please note that anonymous research records cannot be retrieved, corrected, or deleted by reference to you, because they are designed not to identify you or link back to a contact record.
You also have the right to file a complaint with the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten, IMY.
Changes to this policy
This policy may be updated when the website, services, diagnostic, tools, processors, or legal requirements change.
The latest version will be published on this page.