Privacy Policy

How we handle personal data on spotlight.cefeo.se

Last updated: 22 October 2026

This Privacy Policy explains how we handle personal data when you use Spotlight by CeFEO at spotlight.cefeo.se, including its search portal (Navigator) and its AI assistant (Spotty) (together, the “Website”). The Website is operated by the Centre for Family Entrepreneurship and Ownership (CeFEO) at Jönköping International Business School, Internationella Handelshögskolan i Jönköping AB, company registration number 556487-2728, VAT number SE556487272801, Box 1026, 551 11 Jönköping, Sweden, telephone +46 36 10 10 00 (“we”, “us”, “our”). We are the data controller for the processing described here.

Spotlight is a practitioner journal (ISSN 3119-365X) that publishes summaries of peer-reviewed family business research. You can read it without creating an account or giving us any personal data.

What we collect and why

Technical data (IP address, browser and device information) is processed automatically by our hosting providers to deliver the Website and keep it secure. Legal basis: our legitimate interest in operating a secure website (GDPR Art. 6(1)(f)).

Usage data (pages viewed, the referring page, your browser and device type, your country and a random visit identifier) helps us understand which research readers find useful and improve the Website. Legal basis: legitimate interest (Art. 6(1)(f)).

PDF downloads. When you download an article as a PDF, we record the article, the time, your browser type, the referring page and a one-way hash of your IP address. We use this to count downloads and to prevent abuse. Legal basis: legitimate interest (Art. 6(1)(f)).

Conversations with Spotty. When you use Spotty, we log your questions, Spotty’s answers, the page you asked from, your browser type, the links you click and a random identifier that groups your conversations. We do not ask for your name. Please do not enter personal or sensitive information in the chat. Spotty is an AI system and its answers can contain errors. Legal basis: legitimate interest (Art. 6(1)(f)).

Name and email address. We only hold these if you give them to us, for example when you contact us or the authors featured on the Website. We use them to respond to you. Legal basis: legitimate interest, or consent where you have given it (Art. 6(1)(a) and (f)).

We do not sell personal data and do not use it for advertising or for profiling that produces legal or similarly significant effects.

Who we share it with

We share personal data only with service providers who process it on our behalf:

  • Webflow, Inc. (United States) hosts the Website.
  • Cloudflare, Inc. (United States) provides the content delivery network through Webflow.
  • Hetzner Online GmbH (servers in Helsinki, Finland) hosts our database and server infrastructure, which we operate ourselves.
  • Anthropic PBC (United States) provides the language model behind Spotty. Chat messages are sent to Anthropic to generate responses. Under its commercial terms, Anthropic does not use this data to train its models.
  • Google LLC (United States) provides the Website’s fonts, which means your browser sends your IP address to Google when it loads them.

Cookies and browser storage

We do not use advertising or tracking cookies. Our hosting network (Cloudflare) sets one strictly necessary cookie, _cfuvid, to protect the Website against abuse. We also keep a few items in your browser’s storage: _sp, a random visit identifier that is deleted when you close the tab. If you send Spotty a message, we also store sc_user_token, a random identifier that groups your conversations, and sc_chat_session, which keeps your current conversation for 15 minutes so it survives a page reload. You can clear these at any time in your browser settings.

Analytics

We use our own analytics, hosted on our server in Finland. We do not use Google Analytics or any other third-party analytics service. For each page view we record the page address, the referring page, your browser and device type, your country and a random visit identifier. We do not store your IP address for this purpose.

Links to other websites

Spotlight articles link to the original studies on publisher and DOI websites, and to social media such as LinkedIn. We do not control these websites and are not responsible for their privacy practices. Please read their privacy policies.

Children

The Website is intended for a professional adult audience and is not directed at children. If we learn that we have received personal data from someone under 18, we will delete it.

Retention

We keep usage data, PDF download records and Spotty conversation logs for up to 24 months. We keep correspondence for as long as needed to handle your enquiry. We then delete or anonymise the data.

International transfers

Some of our providers (Webflow, Cloudflare, Anthropic and Google) are based in the United States. Transfers rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission’s Standard Contractual Clauses with supplementary safeguards.

Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you
  • have inaccurate data corrected
  • have your data erased
  • restrict our processing
  • receive your data in a portable format
  • object to processing based on legitimate interest
  • withdraw consent at any time, where processing is based on consent

To exercise these rights, contact us using the details below. We may need to verify your identity. We respond within one month. If a request is complex, we may extend this by up to two further months, and we will tell you if we do.

Complaints

You can complain to us directly. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at www.imy.se, or with the supervisory authority in your own EU/EEA country.

Contact

Massimo Baù
Director, CeFEO, and Editor, Spotlight by CeFEO
infocefeo@ju.se
Box 1026, 551 11 Jönköping, Sweden