Privacy Policy

Information about our processing of personal data

1. Introduction

We want you to feel secure when you provide us with personal information. We respect your privacy and are committed to processing your personal information securely. This policy is intended for anyone who has a relationship with us through our business—either as an individual or as a representative of an organization, such as a customer, supplier, or partner. We also address you if you visit our website or contact us in any other way.

Personal data is any information that identifies or could identify you; this includes both information that can identify you directly and indirectly. Examples include your name, address, Social Security number, or a photo of you. Processing of personal data refers to everything we do with your personal data, such as collecting, using, compiling, or deleting it. We process the data necessary for us to deliver and charge for the services we provide to you, as well as the data necessary to maintain contact with you.

Motum AB, corporate ID no. 556935-8053, is the data controller responsible for the processing of your personal data in accordance with the EU General Data Protection Regulation (GDPR). Phone number: 020-520 052. Email: gdpr@motum.se.

The purpose of this document is to provide you with information about how we process your personal data. In the introductory section, you can see who is the data controller, the purposes for which we process your data, and the rights you have regarding our processing activities. If you would like to learn more about the processing we perform, you can read more in Section 2, where we explain what personal data we collect, how long we retain the data, and the legal basis for the various processing activities. That section also includes information about who we share your personal data with and whether we transfer your data to a third country, i.e., a country outside the EU/EEA.

1.1 Data Controller


, a division of Motum AB (Corporate ID No. 556935-8053), is the data controller responsible for the processing of your personal data in accordance with the EU General Data Protection Regulation (GDPR).

Contact Information
Phone: 020-520 052
Email: gdpr@motum.se

1.2 Why do we process your data?

In order for us to have the right to process your data, we must have a legitimate purpose for doing so. We process your data in the following situations. In the section for each situation, you can read more about the purposes for which we process your data.

– Personal data processed in connection with our client assignments (for more information, see section 2.1.1)
– Personal data of employees or contractors at our suppliers (for more information, see section 2.2.1)
– Personal data processed when you contact us (for more information, see section 2.3.1)

1.3 Your rights

You have the right to receive information about how we process your personal data. Among other things, you have the right to know the purposes for which your personal data is processed, the legal basis for the processing, how long we will process the personal data in question, who will have access to the personal data, your rights under the General Data Protection Regulation (GDPR), whether we transfer your data to a country outside the EU/EEA, that you can file a complaint with the Swedish Data Protection Authority (IMY), that you can withdraw any consent you have provided, and contact information for the data controller and data protection officer. We provide you with all this information in this text. If you have any questions about how we process your personal data, you can always contact us. You can find our contact information above in section 1.1.

In addition to the right to information about how we process your personal data, you also have a number of rights regarding our processing of your personal data. Below is a list of your rights. You can also find more information about your rights on IMY’s website (www.imy.se).

  • Right of access – you have the right to contact us to find out whether we are processing your personal data. This also means that you have the right to access your personal data. This may involve providing you with a document containing your personal data. It may also involve providing you with a summary of the personal data we process. The summary must be structured in such a way that you can verify the accuracy and lawfulness of the data. You can find more information about the right of access on IMY’s website.
  • Right to rectification – if the information we have about you is inaccurate, you have the right to contact us and ask us to correct the information or to supplement it with personal data that is relevant to the processing but is missing. You can find more information about the right to rectification on IMY’s website (www.imy.se).
  • Right to erasure – you also have the right to ask us to erase your personal data. For example, we must erase your personal data if it is no longer necessary for the purposes for which it was collected, if the processing is unlawful, or if we have conducted a balancing of interests and your interest in privacy outweighs our legitimate interest in processing the data. There are exceptions to the right to erasure. For example, if there is a legal requirement that requires us to retain the data or if it is still necessary to process it for the purpose we had when we collected the data. You can find more information about the right to erasure on IMY’s website. If you would like us to delete your contact information, please contactgdpr@motum.se.
  • Right to restriction – In certain cases, you have the right to request that we restrict the processing of your personal data. This applies, for example, if you believe the data is inaccurate and have requested a correction. In such cases, you may request that we restrict our processing of the data while we verify or investigate its accuracy. You can find more information about the right to restriction on IMY’s website.
  • Right to object based on legitimate interests – when processing is based on the grounds that it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, pursuant to Article 6(1)(f) of the GDPR, you have the right to object to the processing at any time. We may then continue to process the data only if we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms. Or if the processing is necessary for the establishment, exercise, or defense of legal claims.

We may process personal data on the grounds that such processing is necessary for purposes related to our legitimate interest in:

  • Promote our services and share information with existing and new customers
  • Manage the relationship with you as a customer or other party within the scope of our assignment
  • Be able to analyze completed work and improve our services
  • Be able to manage contracts and fulfill our obligations to our suppliers
  • To manage our communication with you and
  • To market our business.

You can read more about the treatments below in sections 2.1–2.3. For more information about your right to object, please visit the IMY website.

  • Right to data portability – the right to data portability is also known as the right to transfer your personal data. This right means that you have the right to receive the personal data we process about you so that you can transfer your personal data to another recipient. This applies to data that you yourself have provided to us and that we process after you have given your consent, or that we process to fulfill a contract with you. You can find more information about the right to data portability on IMY’s website.
  • Right to lodge a complaint with a supervisory authority – if you believe that our processing of your personal data does not comply with the requirements of EU data protection legislation, you have the right to lodge a complaint with a supervisory authority. In Sweden, the supervisory authority is the Swedish Data Protection Authority (IMY).
  • Right to withdraw consent – if you have given your consent to any of the processing activities we carry out, you always have the right to withdraw your consent.

2. Our processing of personal data

Below is a summary of the various types of personal data we collect about you and why we collect them. This summary is based on the reasons for our processing and the purposes for which we process the data. For each purpose, we explain the types of processing we perform, the categories of personal data we use in the processing, the legal basis for the processing, and how long we retain the data. You will also receive information about whether we share your data with anyone in connection with our processing and whether we transfer data to a third country in connection with the processing.

2.1 Personal data processed in connection with our client assignments

As part of our client engagements, we process your data in order to fulfill our engagement and to communicate with you and other individuals associated with the engagement.

2.1.1 Purpose and legal basis for processing

We process personal data for the following purposes in order to fulfill our contractual obligations:

  • To manage and administer invoicing, reminders, and payments related to our assignments.
  • To manage our customer relationship, such as fulfilling our obligations to you as a customer and providing information, products, and services.

We process your personal data for the following purposes based on our legitimate interest:

  • For internal and external marketing via the intranet, website, and social media.
  • To share information about our activities through newsletters.
  • To be able to communicate with you via email, mail, and phone.
  • To analyze our operations with the aim of improving our services and for general business development.
  • For documentation, administration, and processing of the assignment.

Our legitimate interest in this processing is:

    • To market our services and share information with existing and new customers
    • To manage our relationship with you as a customer or other party within the scope of our engagement, as well as
    • To be able to analyze completed work and improve our services

2.1.2 What personal data we process about you

  • Information about the customer’s clients, employees, or contractors.

Name
Social Security Number (individual customer)
Employer
Title
Contact Information (phone, email address)
Home Address (individual customer)
Billing Information
Payment Information
Photo
Video
Statements from interviews

  • Other individuals
    We process information about other individuals who are relevant to our assignments. These individuals may include consultants, employees of companies with which our client has business dealings, or similar parties.

2.1.3 Who we share your information with

We may share your personal data with vendors who process personal data on our behalf, known as data processors. For example, IT and systems vendors who provide development and support for our systems and cloud services.

We may also share your personal data with, for example, government agencies if required to do so by law.

2.1.4 How long do we process and store your data?

We process your data for as long as necessary to administer the contractual relationship on which our customer relationship is based, and for as long as necessary to exercise our rights and fulfill our obligations in relation to you or the customer for whom you work as an employee or contractor.

Any data relating to payments that must be processed in accordance with the Accounting Act is retained for seven (7) years in accordance with the Accounting Act.

2.1.5 Transfer to a third country

When distributing invoices, we use a data processor that relies on Microsoft to operate the service. This involves a transfer of personal data to the United States, which is carried out using standard contractual clauses as a safeguard.

We use Microsoft 365 for email communication. This involves a transfer of data to the United States, which is carried out using standard contractual clauses as a safeguard.

2.2 Personal data of suppliers and employees or contractors of our suppliers

When we engage suppliers, we process your personal data in connection with the business relationship between us and your employer or client, or as you provide it to us within the framework of that business relationship.

2.2.1 Purpose and legal basis for the processing

  • We process personal data for the following purposes in order to fulfill contractual obligations and legal obligations:
  • To manage and administer payments related to contracts.
  • To manage the supplier relationship, including documentation, administration, and handling of the assignment.

We process your personal data for the following purposes based on our legitimate interest:

  • To protect our rights in the event of legal claims brought against us.
  • To be able to communicate with you via email, mail, and phone.

We need to process your data as described above based on the contractual relationship we have with you, your employer, or your client. In such cases, we process your personal data based on a balancing of interests, where our legitimate interest is to administer contracts and fulfill our obligations to our suppliers.

2.2.2 What personal data we process about you

The data we may process includes
, Name
, Social Security Number (Supplier with a business name)
, Title
, Employer
, Contact Information (phone number, email address)
, Billing Information
, Payment Information

2.2.3 Who we share your information with

We may share your personal data with other service providers who process personal data on our behalf, known as data processors. For example, IT and systems providers who provide development and support for our systems and cloud services.

We may also share your personal data with, for example, government agencies if required to do so by law.

2.2.4 How long do we process and store your data?

We process your data for as long as necessary to administer the contractual relationship with the supplier, and for as long as necessary to exercise our rights and fulfill our obligations in relation to you or the supplier for whom you are an employee or contractor.

Any data relating to payments that must be processed in accordance with the Accounting Act is retained for seven (7) years in accordance with the Accounting Act.

2.2.5 Transfer to a third country

To process supplier invoices, we use a data processor that relies on Microsoft to operate the service. This involves a transfer of personal data to the United States, which is carried out using standard contractual clauses as a safeguard.

We use Microsoft 365 for email communication. This involves a transfer of data to the United States, which is carried out using standard contractual clauses as a safeguard.

2.3 Personal data processed when you contact us

When you contact us via email, phone, or our website, we process the personal data you provide to us in connection with that communication. We also process your personal data when you apply for a job with us, sign up for job alerts, and when you attend trade shows and events in which we participate.

2.3.1 Purpose and legal basis for the processing

We process your personal data for the following purposes based on our legitimate interest:

  • To be able to communicate with you via email, mail, and phone.
  • To reach out to and recruit new employees.
  • For documentation, administration, and processing of any matters arising from the communication.
  • To reach potential new customers through newsletter marketing and by participating in trade shows and events.
  • To distribute press releases.

When you contact us, we need to process your personal data in order to maintain communication with you. We process your personal data based on a balancing of interests, where our legitimate interest is to manage our communication with you. We may also process your personal data when marketing our services to reach new customers, where our legitimate interest is to promote our business.

2.3.2 What personal data we process about you

The information we may process includes:
Name
Contact information (phone number, email address)
Other personal information you provide in the body of the text.
Date of birth (in connection with recruitment/expression of interest)
Employer
Place of work
Title

2.3.3 Who we share your information with

We may share your personal data with vendors who process personal data on our behalf, known as data processors. For example, IT and systems vendors who provide development and support for our systems and cloud services.

We may also share your personal data with, for example, government agencies if required to do so by law.

2.3.4 How long do we process and store your data?

We process your data for as long as necessary to manage our communications with you, and for as long as necessary to exercise our rights and fulfill our obligations in connection with our interactions with you.

2.3.5 Transfer to third countries

In order to provide job alerts and the option to submit unsolicited applications, we use a data processor, We Select, which in turn has sub-processors where data is or may be transferred to the United States; this transfer is carried out using standard contractual clauses as a safeguard.

We use Microsoft 365 for email communication. This involves a transfer of data to the United States, which is carried out using standard contractual clauses as a safeguard.