Privacy Policy
This personal data policy contains rules and guidelines for the processing of personal data carried out by Prefeo AB as data controller and data processor, regardless of the type of personal data or whose personal data it concerns.
1. Data Controller
Prefeo AB, organization number 559476-5207, phone number 072-55 55 712, Drottninggatan 32, 111 51 Stockholm, support@prefeo.se
2. Data Protection Officer
The officer is Håkan Olsson, contact details hakan.olsson@prefeo.se or 072-55 55 712
3. What personal data do we process, for how long and for what purpose?
3.1 General
Prefeo AB (hereinafter Prefeo, us or we) collects and processes personal data within the areas and functions listed below. Personal data refers to all types of information that can be directly or indirectly attributed to a natural person.
3.2 Recruitment
3.2.1 What is the legal basis for the processing?
The information you provide to us by registering your CV or applying for a specific position is registered, processed and used by us to potentially create employment or, where applicable, a consultancy assignment for you with Prefeo's clients, and for us to carry out selections, interviews and assessments.
We use your consent as the legal basis for the processing of your personal data and in some cases a legitimate interest assessment.
When you register your CV with Prefeo, you need to consent to us processing your personal data in accordance with data protection legislation, particularly the General Data Protection Regulation (GDPR) and other applicable legislation.
By giving your full consent, you approve that the information in your application or CV is used by us to match you with the specific jobs or, where applicable, consultancy assignments you apply for through us, and to have the opportunity to be presented to potential employers and clients in Prefeo's network.
You can also give limited consent, which only gives us the right to use the information you provided in your application for the specific job or assignment you are applying for.
Please note that you can withdraw your consent at any time by contacting us (see section 2).
3.2.2 What personal data is processed and who is the recipient?
The personal data we process mainly includes name, address, personal identification number, title, basis for compensation and benefits, information about relatives, qualifications, references from previous employers, experience and development. All information in your CV and application will be processed.
Your personal data will be received and used by Prefeo's employees and communicated to Prefeo's clients, mainly HR managers, supervisors and, where applicable, authorities (when required).
3.2.3 For what purposes is the personal data processed?
We collect and process your personal data to fulfill statutory or contractual requirements and requirements necessary for us or our clients to enter into an agreement with you as an employee of the client or as a consultant. Mainly applications, interviews and decision-making in a recruitment process. The data may also be used in connection with market research.
In communications with Prefeo (for example via email or phone calls), we may save information in such communications to be able to perform and improve our services.
We do not disclose information to third parties unless consent is given or if we are obligated to do so by law, regulation or as a result of a court or authority decision. If you give your full consent, we will present your CV and the personal data contained therein to potential employers or clients in our network.
3.3 Employees, consultants and staffing
3.3.1 What is the legal basis for the processing?
Our employees' and consultants' personal data is collected and processed to fulfill obligations under law, collective agreements and/or for the conclusion and performance of individual agreements and staffing assignments.
3.3.2 What personal data is processed and who is the recipient?
The information you provide to us by registering your CV or applying for a position with us or a staffing assignment with one of our clients is registered, processed and used by us to fulfill obligations under law, collective agreements and/or for the conclusion and performance of individual employment agreements or consultancy agreements.
Those who receive the data are HR managers at our company and our clients' HR managers, supervisors and, where applicable, authorities (when required).
3.3.3 For what purposes is the personal data processed?
Personal data is required for, among other things, payment of compensation and benefits, personnel administration (including occupational health and safety, pensions, life insurance and health insurance), time reporting, fees, maintaining emergency and disaster planning, next of kin contact, occupational health services, vacation, absence and also more generally to ensure compliance with legal obligations (including, but not limited to, income tax and social insurance legislation and labor law).
3.4 Clients
3.4.1 What is the legal basis for the processing?
In order to enter into and manage agreements with our clients, we process personal data belonging to the persons who represent Prefeo's clients. Certain personal data may be processed because we are obligated to do so, for example personal data on invoices due to accounting obligations.
3.4.2 What personal data is processed and who is the recipient?
We process personal data for representatives of companies with which we have contractual relationships. Personal data processed may include name, phone number, email, personal identification number. We may also process personal data regarding representatives of companies that are potential customers. Personal data processed may include name, phone number, address and email. Those who receive the data are mainly representatives relevant to the contractual relationship.
3.4.3 For what purposes is the personal data processed?
We only process personal data that is relevant to the relationship with the client or for a potential client and that is required for the performance of an agreement. Personal data such as representatives' names, email and phone numbers are processed for communication with the client. Representatives' personal data may also be processed for the purpose of sending interesting offers to the client.
4. Source of data
In addition to the personal data provided in your application or registration of your CV with us, we may supplement with information provided in or appearing from public sources and social media (e.g., LinkedIn).
5. Retention period
5.1 General
Your personal data is not stored longer than necessary to fulfill the purposes of the processing as described in this personal data policy.
5.2 Recruitment
The storage of your personal data will take place as long as necessary to perform the service for which you gave us your consent. For this reason, data in a recruitment process is deleted when a specific employment process has been completed, this deletion occurs continuously but never later than six months.
However, if there are legal requirements for Prefeo to retain the personal data, we will do so. An example of such a case is when a candidate (who gave limited consent for a specific job application) appeals a decision that they did not get the job.
In order for us to use the personal data you provided in connection with an application or registration of a CV for a longer period, for example for future recruitments, you must have given us your full consent.
Information with such a choice is provided via email after a completed employment process and in connection with the registration of your CV.
5.3 Employees, consultants and staffing
When an employment or assignment ends, there is generally no reason to retain the former employee's/contractor's personal data. This includes the email account and information about the employee/contractor on our website. Deletion should in such cases be done as soon as possible after the end of the employment. There are exceptions to this. To fulfill obligations in accordance with labor law, tax law and social insurance legislation, we need to retain certain data about, for example, an employee even for a period after the end of the employment. For example, data must be retained to fulfill legal obligations regarding taxation or accounting, obligations regarding the employee's priority right to re-employment under the Employment Protection Act (1982:80) and to handle legal claims that may be directed against us. It is sometimes also necessary to retain data for payment of, for example, pensions or severance pay. We may also process data in connection with employee surveys. Such surveys are conducted so that we can identify shortcomings and subsequently work to ensure a better work environment. In these cases, automated decision-making, including profiling, may occur.
Some of the personal data we process as a result of the employment may constitute sensitive data. This includes medical conditions or trade union membership.
5.4 Clients
We store data as long as necessary with regard to the purposes of the processing. We therefore conduct regular reviews of stored personal data and delete data that is no longer needed after the relationship with the client has ended.
However, we may need to store personal data after the relationship with the client has ended, among other things to administer, e.g., warranty periods or legal claims that may be directed against us or to market ourselves and send offers that we believe may be of interest.
Previous clients. Exceptionally, personal data is therefore retained for some time after the end of the customer relationship or until the person objects to marketing.
Personal data regarding representatives of potential clients is deleted when the dialogue has ended, provided that no assignment has been initiated, or immediately if the person objects to marketing.
Personal data may also more generally need to be stored to ensure compliance with legal obligations, for example regarding accounting. If such an obligation exists, personal data may be stored for up to 10 years.
6. Your rights
There may be associated conditions and limitations regarding these rights.
- the right to access information regarding the processing of your personal data,
- the right to correct inaccurate personal data,
- the right to have your personal data deleted if they are no longer required to fulfill the purpose,
- the right to restrict the processing of your personal data,
- the right to object to the processing of your personal data for direct marketing; and,
- the right to object to the processing of your personal data and request limited processing of your personal data.
To exercise your rights or if you have questions about our processing of your personal data, please contact us (see section 2).
If and when the processing of personal data is based on the data subject's consent, you can withdraw your consent at any time.
7. Automated decision-making
We do not use automated decision-making.
8. Data processors
We occasionally use sub-processors and suppliers for certain services and for, e.g., cloud and database solutions. We commit to having data processing agreements with such sub-processors when required, where it is stated that they also comply with applicable data protection legislation and in particular the GDPR.
9. Special provisions regarding sensitive data
Sensitive data in this policy refers to personal data that reveals race or ethnic origin, personal opinions, religion or trade union membership, health data or data about a natural person's sex life or sexual orientation, etc.
We never process sensitive data without the consent of the data subject or without legal support, for example to fulfill obligations or exercise special rights in labor law, social security and protection, or when processing is necessary to protect the vital interests of the data subject or another person, when the data subject is physically or legally unable to give consent, in certain cases within the framework of trade union activities, if the data has already been made public by the data subject, if necessary with regard to an important public interest, if necessary for reasons related to, among other things, assessment of employees' work capacity or provision of health and medical care, or if necessary with regard to statistical purposes.
For each processing of sensitive data, we take appropriate security measures to protect the data.
Personal data is never accessible to more persons than necessary. This applies when we act as data controller as well as data processor.
10. Changes to the policy
We may change and update this policy.
In case of significant changes or if information is to be processed differently than stated in the policy, we will inform those affected by the changes.
Do you have questions?
Please contact us to learn more about our personal data policy or other questions.