Privacy Policy

Data controllers

The company within Eleda that you interact with, for example when you apply for a job at such a company, visit such a company’s website, or enter into an agreement with such a company – either directly or as a contact person or representative for a company, is the data controller for the processing of your personal data. A list of all platform companies can be found on Eleda’s website.

In some cases, it may be necessary to transfer personal data from one company within Eleda to another company within Eleda. This can occur in the following situations: if a company’s customer or a contract is to be handled by another company, then customer data can be transferred between the companies. All such transfers will be carried out in strict compliance with the Data Protection Regulation and other applicable data protection rules to ensure the security and confidentiality of the personal data.

What personal data do we process about you?

Personal data we may process about you in our capacity as a representative or contact person for a customer, prospective customer, or supplier is:

• Identity data, i.e., first and last name, title, position, and the company or organisation you represent.
• Contact information, i.e., email address, telephone number, and address.
• If you are a sole trader: bank account number, personal identity number, and other necessary invoice information.

Personal data we may process about you when you contact us via the website or otherwise is:

• Identity data, i.e. first and last name.
• Contact information, i.e. email address, telephone number, address.
• Other information you provide to us.

Personal data we may process when you apply for work is:

• Identity data, i.e. first and last name, date of birth or social security number, title.
• Contact information, i.e. email address, telephone number, address.
• Other information that you provide to us in connection with your application.
  

Personal data we may process in connection with whistleblowing (you can also choose to remain completely anonymous) is:

• Identity data, like first and last name.
• Contact information, i.e. email address and telephone number.
• Other information that you provide to us in your report.
  
  

For what purposes and legal basis do we process your personal data?

Information about our various personal data processing is set out below.

• Eleda processes your identity and contact information to enter into an agreement with the company/organisation that you represent or are the contact person for. The legal basis for such processing is to enter contracts.
• Eleda also processes your identity and contact information for the purpose of fulfilling contracts and administering a contractual relationship. The legal basis for such processing is our legitimate interest in fulfilling our agreements and administering contractual relationships.
• For you as a sole trader, Eleda processes your identity and contact information, as well as invoice information, to fulfil and administer a contractual relationship with you.
• For you as a sole trader, we process information about your bank account number, invoice information, and, for some banks, your social security number to make payments. The legal basis for the processing is the performance of a contract. If your personal identity number is your bank account number, it is justified to process such information to pay you.
• For you as a sole trader, we process your identity information and bank account number as well as invoice information to meet legal requirements such as tax and auditing law requirements for documentation and preservation of documentation (bookkeeping). The legal basis for such processing is a legal obligation.
• If you are a contact person or representative of another company/organisation, we process your identity data to comply with legal requirements such as tax and auditing law requirements for documentation and retention of documentation (bookkeeping). The legal basis for such processing is a legal obligation.
• Eleda also processes your identity and contact data to market Eleda’s services and conduct surveys. Such processing is based on our legitimate interest in marketing our services and conducting surveys and surveys.
• Eleda processes personal data about you to identify you and communicate with you if you contact us via our communication channels. This is done based on the legal basis of legitimate interest.
• Eleda processes the personal data listed above when applying for a job. Because of the legal basis for entering into an agreement, Eleda processes your data to administer and ensure a qualified application process. If necessary, Eleda also obtains references within the framework of the application process. Information that a reference person provides about you and contact information for the reference person is processed based on the legal basis of legitimate interest.
• Eleda processes the personal data mentioned above in whistleblower cases. The data is processed based on the legal ground of legal obligation. You can read more about our whistleblower function on the website.

If a company within the group has deviations or additions to this list, this must be stated in the specific company’s own policy.

Who do we share personal data with?

In order to administer, perform, and deliver as well as invoices for our services and pay invoices, and handle applications for work, we may share your personal data with the following categories of recipients:

• Service providers providing IT, ERP and system administration services. Data processing agreements are signed with such actors.
• Authorities such as the Swedish Tax Agency and the Swedish Work Environment Authority upon request or voluntarily if we have a legal obligation to do so. The legal basis for such disclosure is that the processing is necessary for compliance with a legal obligation.
• Professional advisors such as lawyers, accountants, and banking service professionals. This can happen, for example, if a dispute should arise between the company that you represent or are the contact person for or with you as a sole trader and Eleda or if we, for some other reason, need the support of a lawyer. The legal basis for the processing is our legitimate interest in safeguarding our interests in a dispute or otherwise safeguarding our legal interests. If the company you represent or are the contact person for, or you as a sole trader, is a customer or supplier for us, your personal data may be shared with our authorized accountants. The legal basis for the processing is a legal obligation.
• Recruitment companies, suppliers of CRM systems, to administer work applications, administer invitations to events or send out newsletters.

However, your personal data will not be forwarded, sold, exchanged or shared with other companies, organisations or private individuals without your consent.
We require all third parties to respect the security of your personal data and to process the personal data in accordance with applicable laws and regulations. We do not allow third-party service providers to process your personal data for their purposes.

Some third parties may be established outside the EU/EEA, and in these cases, we take steps to ensure that adequate security is in place so that your data protection rights remain protected as set out in this policy. Such measures include the European Commission assessing that the country in which the data recipient is located has an adequate level of protection of personal data or that adequate contractual obligations are incumbent on the recipient.

Contractual obligations mean that we and the third party have entered into agreements to transfer personal data using the European Commission’s standard contractual clauses. You can read the European Commission’s standard contract clauses here https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj. Personal data may be transferred to the United States based on the European Commission’s adequacy decision, the EU-US Data Privacy Framework. Data is only transferred to the United States if the recipient complies with the EU-US Data Privacy Framework.

In countries outside the EU/EEA, the General Data Protection Regulation (GDPR) does not apply, which may entail an increased risk in terms of privacy regarding, among other things, the possibility for authorities in the third country to gain access to your personal data and for the ability to exercise control over the personal data.

How long do we keep personal data?

Eleda saves your personal data until the data is no longer needed or considered to be out of date. Eleda only saves personal data necessary to fulfil the purpose for which it was collected. Information on contact persons and representatives of customers and suppliers is stored for 5 years after the customer or supplier relationship has ended.
The personal data we process in a recruitment process is stored for 3 years after the recruitment process has ended because we have a legitimate interest in defending ourselves against any claims from job applicants who believe they have not been given a position due to, for example, discrimination.
Accounting records are stored for seven years after the calendar year in which the financial year ended.

Data Subject Rights

As a data subject, you have several rights listed below. If you want to exercise any of your rights, you can always contact us using the details found at the end of this section. You can read more about your rights on the Swedish Data Protection Authority’s (IMY) website www.imy.se.

Right to information and access: You have the right to know if we process personal data about you. You have the right to receive a copy of your personal data, known as a register extract, at no cost.

Right to rectification: The personal data that Eleda processes about you must be accurate and complete. Therefore, we are obliged to correct or complete any information you believe is incorrect, incomplete, or misleading upon your request.

Right to erasure: You have the right to have your personal data erased in certain cases. This applies, for example, if the personal data is no longer necessary for the purposes for which it was collected. It also applies if you have objected to the processing of your data based on our legitimate interest and there are no overriding legitimate grounds for processing your data. You also have the right to have your data erased if it has been processed unlawfully.
If Eleda has a legal obligation to process the personal data, it will not be erased even if any of the above situations apply. The data will also not be erased if we need it to establish, exercise, or defend legal claims.

Right to restriction: You have the right to request that the processing of your personal data be restricted in certain cases. For example, if you believe that your data is incorrect and you have requested its rectification, you can ask for the processing to be limited while the matter is being investigated. You can also request a restriction if the processing of your personal data is unlawful but you oppose its erasure. Additionally, processing can be restricted if we no longer need the personal data but you need it to establish, exercise, or defend legal claims. Finally, you can request a restriction if you have objected to processing based on our legitimate interest while we assess whether our interest outweighs your interest in having your personal data protected.
If processing has been restricted under any of the above situations, we may only process the data, in addition to storage, to establish, exercise, or defend legal claims, to protect someone else’s rights, or if you have given your consent.

Right to data portability: You have the right to have your personal data transferred to another data controller under certain circumstances (known as data portability). Data portability applies if you have consented to provide your personal data or if we process your personal data based on the legal ground of fulfilling a contract. Data will only be transferred if it is technically feasible.

Right to object: You have the right to object to Eleda processing your personal data if we do so based on the legal ground of legitimate interest. If we cannot demonstrate compelling legitimate grounds to continue processing the data, we will cease the processing. However, we may still process the data to establish, exercise, or defend legal claims.

Contact

If you wish to exercise any of your above-mentioned rights or have any concerns about our processing of personal data, please contact us as set out below.

Eleda
Eleda Management AB, Org Nr: 559457-5226
Kungsgatan 3, 111 43 Stockholm, Sweden
Email address: info@eleda.se

Complaint

If you are dissatisfied with how Eleda processes your personal data, you have the right to file a complaint with the Swedish Data Protection Authority, which oversees Eleda’s data processing. You can find more information on the Data Protection Authority’s website at www.imy.se.

Changes to this privacy policy

This personal data policy may be updated to meet new legal or technical requirements. The latest updated version can always be found on this website. Last updated 2024-09-30