This Privacy Policy describes how Statisticon AB (corporate ID no. 556558-2185, email address dataskydd@statisticon.se; hereinafter “Statisticon” or “we”) processes your personal data.
This Privacy Policy, which is based on applicable data protection legislation, applies when Statisticon provides services and products, during contact with Statisticon, and when visiting our websites.
We protect your privacy. You should feel secure when entrusting your personal data to Statisticon or our clients. The purpose of our privacy policy is to inform you about how we process your personal data, what we use it for, who has access to it and under what conditions, and how you can exercise your rights.
Fundamental to Statisticon’s processing of personal data are confidentiality, accuracy, purpose-driven processing, and the minimization of privacy-sensitive data.
Statisticon acts as a data processor for personal data that we process on behalf of our clients. Statisticon processes such personal data in accordance with instructions from the data controller, who bears ultimate responsibility for how the personal data is processed and for ensuring your rights are upheld.
In cases where Statisticon collects data on behalf of a client, the documentation will always indicate who the data controller is.
Statisticon also maintains an internal register of data controllers for assignments where Statisticon acts as a data processor.
Statisticon is the data controller for personal data that we collect and process ourselves, such as contact details for customers and suppliers, as well as personal data processed for marketing purposes.
4.1 Basic concepts
Two fundamental concepts regarding the processing of personal data are "processing" and "personal data"; we therefore describe these in greater detail below.
Personal data refers to any information that can be linked to a living person. A single piece of information does not necessarily have to constitute personal data on its own; it is sufficient if a combination of different pieces of information allows a person to be identified, in which case each individual element also constitutes personal data.
Typical examples of personal data include personal identity numbers, names, addresses, telephone numbers, email addresses, IP addresses, individual passwords, voice recordings, moving images, photographs, biometric information, and genetic information.
Processing of personal data refers to any action performed involving the personal data. Any action performed involving personal data constitutes processing, regardless of whether it is carried out automatically or not, and whether it takes place digitally or otherwise.
Examples of typical personal data processing include the collection, recording, organization, structuring, storage, processing, transfer, and deletion of personal data.
4.2 Collection of personal data
We primarily gain access to your personal data from our clients in cases where we act as data processors. We may also gain access to personal data in the following ways:
Data that you provide to us directly
Data that we receive when we, or a third party acting on our behalf or on behalf of our clients, collect data during surveys
Data that we receive from public registers
Data recorded when you visit our website
Data that we receive when you register for our events or seminars
Data that we receive when you sign up for newsletters and other mailings
Data that we receive when you contact us, apply for a job with us, visit us, or otherwise communicate with us
To improve our web services, we also use cookies that may contain personal data. You can read more about how we use cookies in our full cookie policy (www.statisticon.se/cookie)
4.3 What types of personal data do we process?
Personal data is always de-identified whenever possible.
4.4 Why and on what grounds do we process your personal data?
We primarily process personal data on behalf of our clients in the capacity of data processor; in such cases, it is the data controller who determines the applicable legal basis as well as which personal data is to be collected, for what purposes, and how the processing is to be carried out.
In cases where Statisticon itself acts as the data controller, we process personal data when we have a legal basis for doing so—a so-called legal obligation—such as, for example, requirements under the Accounting Act, labor law legislation, or pursuant to an agreement.
In certain cases, we also process personal data based on a so-called balancing of interests. This primarily occurs during processing for marketing or informational purposes.
For the processing of personal data that is not based on law, a balancing of interests, or the fulfillment of an agreement with you, we will request your consent at the time we collect such personal data. You have the right to withdraw your consent to such processing at any time. We will then no longer process your personal data or collect new data, provided that such processing is not required to fulfill our obligations under an agreement or the law.
Described below are the personal data we process, the purposes and legal bases for such processing, and how long we may store your personal data.
Purpose | Personal data that may be processed | Legal basis | Retention period |
Handling our payments to suppliers and contractors and receiving payments from clients and customers | Contact details such as name, address, telephone number, and email address. Payment details such as payment history and account information. | Balancing of interests based on the fact that we must fulfill our rights and obligations in relation to our contractual counterparties (where you are a contact person/reference) and our interest in being able to comply with agreements outweighs your interest in the protection of your freedoms and rights, including your privacy. | The data will be processed for this purpose for eight years to enable us to fulfill our legal obligations regarding accounting and tax registration and/or to establish, defend, or assert a legal claim, e.g., in the event of a payment dispute. |
Providing our services to our clients and customers | Contact details such as name, address, telephone number, and email address. Payment details such as payment history and | Balancing of interests based on the need to exercise our rights and fulfill our obligations vis-à-vis our contractual partners (where you act as a contact person/reference); our interest in being able to fulfill contracts outweighs your interest in the protection of your freedoms and rights, including your privacy. | The data will be processed for this purpose for as long as we have a contract with your employer (or equivalent) and for six months thereafter. Payment details are retained for seven years in accordance with the Accounting Act. |
To market and provide information about our services, e.g., via newsletters. | Contact details such as name, address, telephone number, and email address. Browsing habits and visit history such as which pages you visited on our websites and the duration of the visit. | Balancing of interests, as we assess that our interest in being able to market and provide information about our services outweighs your interest in the protection of your fundamental rights and freedoms, including your privacy. | The data will be processed for this purpose for as long as we have an interest in being able to send such marketing to you. Data is purged annually. |
To provide information about our operations and services, and to market them | Name, title, contact details, experience, education, assignments, photographs/images, video footage, and recordings | Balancing of interests in cases where we use our employees' personal datater Consent from the individual in cases where we use personal data belonging to you as a non-employee. |
|
To send out information about and invitations to our events, training sessions, and seminars, and to conduct such events | Contact details such as name, address, telephone number, and email address. Payment details such as payment history and account information. Browsing habits and visit history such as which pages you visited on our websites and the duration of the visit | Balancing of interests, as we assess that our interest in inviting you to various types of events outweighs your interest in the protection of your freedoms and rights, including your privacy. Information regarding dietary preferences and allergies is processed based on your consent | The data will be processed for this purpose for as long as we have an interest in sending such invitations to you and managing your attendance at an event. Data is purged annually. Information regarding dietary requirements and allergies is deleted within 14 days of the event. |
Procedures for storage, purging, and deletion
Regarding personal data that we process as a data processor, we store your personal data in accordance with the instructions we receive from the data controller.
Where we act as the data controller, your personal data will not be retained for longer than is necessary for the purposes of the processing, and we will otherwise delete personal data in the manner specified in the table above.
4.5 Is your personal data processed securely?
Statisticon operates according to an internal information security management system, including associated policy documents and procedures for work methods, handling, information protection, and the granting of access rights.
Our security systems are developed with your privacy in mind and protect against unauthorized access, destruction, and other incidents that could pose a risk to your privacy. We have agreements and data processing agreements with our IT suppliers regarding IT security to ensure that your personal data is processed securely.
Data that Statisticon processes in the capacity of a data processor is stored and processed
in Sweden unless otherwise agreed with the data controller. Statisticon does not use suppliers outside the EU/EEA.
4.6 When do we share your personal data with another party?
As a data processor, Statisticon may not disclose your personal data to anyone other than the client acting as the data controller for your specific personal data, unless you have consented to this, or if it is necessary to fulfill our legal obligations, or if it is stipulated in our agreement with the data controller.
In cases where we act as the data controller for the processing of your personal data, we share your personal data with our suppliers of HR systems and internal finance and IT services.
Statisticon never sells data to third parties.
As a general rule, we never transfer personal data to any recipient outside the EU/EEA. In exceptional cases, we may transfer personal data to a recipient in a third country (i.e., a country outside the EU/EEA); in such instances, we verify whether the country has an adequate level of protection (e.g., the UK, Japan, and Switzerland) or whether any of the transfer mechanisms specified in the GDPR can be used in a reliable and secure manner.
When we use software and services, e.g. ...regarding email management from leading global providers, we have ensured that their commitments meet GDPR requirements, and we mandate the highest possible level of security and ensure that personal data is not stored outside the EU/EEA.
However, situations may arise where personal data could be transferred...to the USA—even if we have ensured that all our data processors process (including storing) personal data only within the EU/EEA—if a data processor is owned by a US parent company and a US authority has access to the personal data under US law. We monitor developments in data protection legislation in this area in order to take measures to further protect personal data that might be at risk of being transferred to the USA.
See more regarding data processors/sub-processors in section 5 below.
The data controller bears ultimate responsibility for how your personal data is processed and for ensuring that your rights are upheld. As previously mentioned, Statisticon acts as a data processor in most cases.
Statisticon engages a number of data processors (sub-processors) for services such as IT operations, cloud services, banking, auditing, and invoicing. If you wish to know which processors handle your specific personal data, please contact us as described in section 7 below.
Through data processing agreements, Statisticon ensures that our data
processors/sub-processors process personal data in accordance with this policy.
We do not use automated processes to make decisions that significantly
affect you.
6.1 Your rights as a Data Subject
The data subject rights listed below apply in relation to us when we act as the data controller. In cases where Statisticon processes personal data on behalf of another party and in the capacity of a data processor, Statisticon may not disclose details regarding the processing of your personal data but instead refers you to the respective data controller. For questions regarding this, you may contact us using the contact details in section 7 below.
The rights set out below apply to you as a data subject (i.e., you as an individual) where we process personal data as the data controller.
If you wish to exercise any of these rights, the easiest way is to contact us using the contact details in section 7 below.
Statisticon reserves the right to take measures to verify the identity of the person requesting an extract from the register or exercising any other right to which you are entitled as a data subject.
Full information regarding your rights is available on the Swedish Authority for Privacy Protection’s website www.imy.se
6.2 Right to information
You have the right to receive information about how Statisticon processes your personal data. We provide this information through this policy on the processing of personal data and by answering your questions.
6.3 Request for rectification or erasure of personal data (the right to be
forgotten)
You have the right to request that personal data concerning you be rectified or erased in accordance with the General Data Protection Regulation or Swedish privacy laws. Following such a request, we will assess whether there are grounds to carry out the requested change. If Statisticon concludes that we are permitted and able to correct or delete personal data in accordance with your request, we will promptly carry out such an action.
6.4 Request to restrict our processing of personal data
You also have the right to restrict the processing of your personal data in accordance with the General Data Protection Regulation or Swedish data protection rules. Following such a request, Statisticon will examine whether there are grounds to implement the requested change and inform you of the outcome of the examination. If Statisticon concludes that we are permitted and able to restrict our processing in accordance with your request, we will promptly implement such a restriction.
6.5 Right to object to our processing of personal data
Furthermore, you have the right to object to our processing in accordance with the General Data Protection Regulation or Swedish data protection rules. Following such a request, Statisticon will examine whether there are grounds to implement the requested change. If Statisticon concludes that we are permitted and able to carry out the requested change, we will promptly implement the measure.
6.6 Request for an extract from the register
You have the right to request an extract from Statisticon and our registers/systems where personal data concerning you is processed, and to receive information in such extracts regarding which personal data concerning you we process and how we process that data. We are required to send you an extract of your personal data within one month—or, in exceptional cases, within two months—of your request.
6.7 Right to data portability
The right to transfer information (data portability) incl...means that you can request that your personal data be transferred to another party. However, this right applies only in cases where we have processed your personal data based on consent or where you yourself have provided us with the personal data you wish to move (and we have no other legal basis for our processing).
6.8 Withdrawal of consent
To the extent that the legal basis for our processing of your personal data is consent, you have the right to withdraw this consent at any time by contacting us using the contact details set out in section 7 below. We will thereafter no longer process such personal data or collect any new data, and all personal data that we have processed based on your consent will be deleted. The withdrawal does not affect the lawfulness of the processing prior to the withdrawal.
6.9 The Swedish Authority for Privacy Protection (IMY)
The Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) is the supervisory authority for the processing of personal data and data protection in Sweden. You have the right to lodge a complaint with IMY regarding the processing of personal data. Contact details for the Swedish Authority for Privacy Protection can be found at www.imy.se and below:
Integritetsskyddsmyndigheten
Box 8114
104 20 Stockholm
Telephone: +46 (0)8-657 61 00
E-mail: imy@imy.se
Statisticon AB, org. no. 556558-2185
Address: Östra Ågatan 31, 753 22 Uppsala.
Telephone number: 010 – 130 80 00.
Email address: dataskydd@statisticon.se
Page updated: 31 July 2023