PRIVACY POLICY
Overview
Policy: Privacy Policy
Applies to: Accru Partners Group including all portfolio companies and their employees
Approved by: Board of Directors
Date: 2025-02-10
Version History
Version | Date | Changes | Approved by |
2025-1 | 2025-02-10 | Original version | Board of Directors |
2025-2 | 2025-04-09 | Minor adjustments | LT |
Contact Information
For questions or more information about this policy, please contact
Name: Therese Andersson, Head of Compliance & Quality
Email: therese.andersson@accrupartners.com
Phone: +46 (0)72 550 66 00
PRIVACY POLICY
The companies above are independent legal entities.
If you have any questions regarding how we, according to this information, process your personal data, please contact us by emailing gdpr@accrupartners.com.
For us, the trust of our partner agencies and providers is of utmost importance. As a contact person and employee at our partner agency or as a contact person at our provider, you should always feel secure when entrusting us with your personal data. We have established this Privacy Policy to inform you about how we process your personal data. The Privacy Policy is based on current legislation, including but is not limited to the General Data Protection Regulation (“GDPR”) ((EU) 2016/679) and clarifies how we work to safeguard your rights and your integrity.
The purpose of the Privacy Policy is for you to know how we process your personal data, what we use it for, who may access it and under what conditions, and how you can exercise your rights. We strive to be transparent with how we use your personal data.
We collect information about you through the details you provide directly to us when you apply for a job with us, act as a contact person or employee at one of our partner agencies with whom we have agreements and has acquired, is an employee at one of our partner agencies and you register for one of our events, or act as a contact person for one of our providers. We also collect information you share with us through communication, such as email correspondence and phone calls.
We are constantly working to improve our business, therefore the Privacy Policy may change from time to time. We may update the Privacy Policy as a result of changes in the legal, technical or business developments. You can see when it was last updated by checking the date at the bottom of this Privacy Policy.
We will process the personal data only for as long as is necessary to fulfil the purposes of the processing or to comply with our legal obligations. Under the subheadings below, you can read more about which storage period applicable for each purpose.
This Privacy Policy applies to information that the Companies processes about you. Certain pages on our website accrupartners.com may contain links to third party websites, for example, the websites of our partner agencies that we refer to on our website. Our partner agencies are themselves controllers for the processing of the personal data you share with them and have their own Privacy Policies that inform you about their processing. We are not responsible for their compliance with regulations as controllers. Therefore, we recommend that you read their own Privacy Policies when visiting their websites.
This Privacy Policy is structured as follows:
- Personal data that is processed when you apply for a job with us
- Personal data processed when you are a contact person at our partner agency – the Companies you are employed at – with which we have an agreement
- Personal data processed when you are an employee at our partner agency – the companies you are employed at
- Personal data processed when you are a contact person at our provider – the companies you are employed at – with which we have an agreement
- Personal data that we process after you have entered into an agreement with us
- Personal data processed due to legal obligation or to safeguard legal claims
- To whom do we share your personal data
- Transfers outside the EU/EEA
- How do we protect your personal data
- Your rights
The supervisory authority for the processing of personal data is the Swedish Authority for Privacy Protection (IMY). If you wish to lodge a complaint to the IMY regarding our processing of your personal data, you have the right to do so. Please visit IMYs website https://www.imy.se/ for more information on how to proceed.
1. Personal data that is processed when you apply for a job with us
Personal data being processed | Purpose | Legal basis | Storage time |
Name, personal identification number, address, email address, phone number, CV and other information the applicant provides when applying for a job. | We need to process this information to keep in touch with you and to assess your application based on the position you have applied for. We use your personal data to administer and process your application for employment, review CV, personal letter, references, grades and certificates as well as to communicate with you. | The processing is based on our legitimate interest. We have a legitimate interest in carrying out the necessary processing of the personal data in order to be able to evaluate your merits, personal characteristics and your personal background and enable selection in connection with decisions for recruitment/ employment. | We will process these personal data until the position is filled. |
Purpose | Legal basis | Storage time |
We need to process this information for future recruitment and to enable us to contact you early if necessary if a vacancy arises for which you are suitable and interesting for. | The processing is based on your consent. We obtain your consent to store your application for a period after the position has been filled, in case a vacancy or a need for a similar position arises which you are suitable and interested for. | We will process these personal data for a period of one (1) year from when the advertised position is filled or until you withdraw your consent, whichever occurs first. |
Purpose | Legal basis | Storage time |
We need to process this information to be able to defend any claims that may arise in connection with a recruitment process, to prove that discrimination has not occurred when filling the position. | The processing is based on our compliance with legal obligations. The period of limitation for filing a lawsuit is two (2) years in accordance with the Swedish Discrimination Act (2008:567). | We will process these personal data for a period of two (2) years from when the advertised position is filled, in accordance with the Discrimination Act. |
Personal data being processed | Purpose | Legal basis | Storage time |
Name, personal identification number, address, email address, phone number, CV and other information the applicant provides when the applicant submits a spontaneous application to us. | We need to process this information for future recruitment and to enable us to contact you early if necessary. | The processing is based on our legitimate interest. You also have an interest in us retaining your application for a period of time after it has been submitted, in case a vacancy or need for a suitable position arises. | We will process these personal data for a period of one (1) year after the spontaneous application was received. |
2. Personal data processed when you are a contact person at our partner agency – the Company you are employed at – with which we have an agreement
Personal data being processed | Purpose | Legal basis | Storage time |
Name, address, email address, phone number, title, and workplace. | We need to process this information in order to enter into a contractual relationship and fulfil our contractual obligations with the that employs you – our partner agency. We may use your personal information to communicate with you and store our communication. | The processing is based on our legitimate interest. We have a legitimate interest in processing your personal data in order to initiate and maintain a contractual relationship with the company by which you are employed. | We will process these personal data for a period of one (1) year from the day the contract between us and the Companies you are employed by ends. |
3. Personal data processed when you are an employee at our partner agency – the Company you are employed at
Personal data being processed | Purpose | Legal basis | Storage time |
Name, email address, phone number, workplace, title, job responsibilities, expertise, profile picture and published posts. | We need this information for our communication channels, to enable communication among employees, as well as for communication between employees at partner agencies, for networking, collaboration, exchange of knowledge and skills, cross-selling, and to facilitate information sharing. | The processing is based on our legitimate interest. We have a legitimate interest in creating a platform where all employees can network, collaborate, and share knowledge and expertise. | We will process these personal data for a period of one (1) month from the day the contract between us and the Companies you are employed by ends. |
Personal data being processed | Purpose | Legal basis | Storage time |
Name, email address, and, if necessary, special dietary requirements are processed in a participant list. | We need to process this information to manage and administer the registration and participation as such, as well as to provide and conduct the event.
| For the processing of sensitive personal data (dietary preferences/allergies), we obtain your consent. | We will process these personal data for a period of one (1) month from the day the contract between us and the Company you are employed by ends. Special dietary information will be deleted as soon as the event is concluded. |
4. Personal data processed when you are a contact person at our provider – the Company you are employed at – with which we have an agreement
Personal data being processed | Purpose | Legal basis | Storage time |
Name, email address, phone number, title, and workplace. | We need to process this information to enter into a contractual relationship and fulfil our contractual obligations with the Company you are employed by – our provider. We may use your personal data to communicate with you and to store our communication. | The processing is based on our legitimate interest. We have a legitimate interest in processing your personal data in order to initiate and maintain a contractual relationship with the company by which you are employed. | We will process these personal data for a period of one (1) year from the day the contract between us and the Company you are employed by ends. |
5. Personal data that we process after you have entered into an agreement with us
Personal data being processed | Purpose | Legal basis | Storage time |
Name, account details, address, email address, phone number, identification documents. | We need to process this information to carry out mandatory anti-money laundering checks. | The processing is based on our compliance with legal obligations in accordance with the Swedish law (2017:630) on measures against money laundering and the financing of terrorism (the Money Laundering Act). | We will process these personal data for a period of five (5) years from the time of the customer due diligence measures, in order to fulfil our legal obligations. If necessary to prevent, detect, or investigate money laundering or the financing of terrorism, we also have the right to retain your personal data for an additional five (5) years in accordance with the Money Laundering Act. |
Personal data being processed | Purpose | Legal basis | Storage time |
Name, Reference, Customer number, Invoice number, OCR are processed in our Management Fee. | We need to process this information to account for and invoice, collect payments, and report our financial data. | The processing is based on our compliance with legal obligations in accordance with the Swedish Accounting Act (1999:1078). | We will process these personal data until the seventh year after the end of the calendar year in which the financial year ended (retention period) in accordance with the Accounting Act. |
Personal data being processed | Purpose | Legal basis | Storage time |
Documentation regarding compensations such as contracts and invoices. | We need this information to fulfil our legal obligations according to the Swedish Limitation Act (1981:130). | The processing is based on our compliance with legal obligations in accordance with the general limitation period in the Limitation Act. | We will process these personal data for a period of ten (10) years from the day the contract was signed or the invoice was issued. |
6. Personal data processed due to legal obligation or to safeguard legal claims
Personal data being processed | Purpose | Legal basis | Storage time |
Personal data that has been processed because you have entered into an agreement with us. | We need to process your personal data in order for us to fulfil our legal obligations in accordance with law, ordinance, government regulations and guidelines. | The processing is based our compliance with legal obligations. In order to meet the existing legal requirements, we need to process this information. These legal requirements can, for example, be tax law or according to accounting obligations. | We will process these personal data for the time required by the legal obligation. |
Personal data being processed | Purpose | Legal basis | Storage time |
Personal data that has been processed because you have entered into an agreement with us. | In the event of a dispute, we may use your personal data to investigate, respond to, and/or establish legal claims or disputes related to our contractual relationship. | The processing is based on our legitimate interest. We have a legitimate interest in safeguarding our rights in the event of a dispute. | We will process these personal data for the time required until the legal claim has been established and the decision/judgment has become final and have gained legal force. |
In order to fulfil our obligations to you and to fulfil our agreement with you, we may transfer to or share information with third parties such as our providers.
Your personal data is processed by our Processors, which are companies and providers that help us deliver our services to you, such as billing, providing our website, IT systems and communication solutions.
We use IT and website providers that are necessary for us to market ourselves and to offer you our collaboration – to become our partner agency, as well as external providers of accounting and bookkeeping services so that we can invoice and bookkeep for our operations.
The execution of these aforementioned services may involve our providers gaining access to your personal data. We enter into data processing agreements with our providers, which means they are obligated to process the information securely, correctly and confidentially in accordance with the General Data Protection Regulation.
We may also share your personal data with our other partner agencies in order to offer you the expertise and services that the other partner agencies possess for you to utilize. We enter into data-sharing agreement with our partner agencies, which include obligations to handle the information securely, correctly and confidentially in accordance with the General Data Protection Regulation.
We may share your personal data with authorities and the judicial system when we, in good faith, believe it is necessary to fulfil our legal obligations or to respond to legal claims. We may also share your personal data when we, in good faith, suspect it is necessary for national security, police, and intelligence operations, or to prevent death or injury, provided these interests are not outweighed by your rights and freedoms to protect your personal data.
We may also disclose personal data to third parties when it has been specifically agreed between us and you, when it is necessary within the scope of a certain task to safeguard your or our rights, or when it is necessary for us to fulfil a legal obligation or comply with government or court decisions.
8. Transfers outside the EU/EEA
At present, we process your personal data only within the EU/EEA area. Should an exceptional situation arise where we need to process your personal data outside the EU/EEA area, we will take appropriate security measures in accordance with the General Data Protection Regulation (GDPR), such as a decision by the European Commission that the country in question ensures an adequate level of protection, or by using so-called appropriate safeguards. This includes, among other things, the use of standard contractual clauses adopted by the Commission, known as Standard Contractual Clauses (SCC), as well as various contractual solutions or obtaining your explicit consent for the transfer.
9. How do we protect your personal data?
Your security is of the outmost importance to us. Therefore, we have taken appropriate technical, organisational, and administrative security measures to protect your personal data from loss, abuse, disclosure, alteration, destruction, unauthorised access, and other unauthorised processing. We regularly analyse and evaluate the measures to ensure that the protection of your data is as safe as possible. We also continuously adjust our security measures in line with developments and advancements in the technical field.
We ensure that the personal data is handled responsibly and in accordance with applicable data protection legislation and internal security procedures, with the aim of protecting your privacy and ensuring the correct processing of information. Only individuals who have a legitimate need to handle your data, in accordance with their job responsibilities, will have access to this data.
Our employees, contractors, and providers are required to follow the Company’s rules, Privacy Policy, and other internal regulations that further govern the processing of personal data.
As part of the Company’s security efforts, we educate our employees to promote a strong data protection culture.
We have developed erasure procedures to ensure that your personal data is not stored longer than necessary, and only for the time required to fulfil the specific purpose, in compliance with the General Data Protection Regulation.
10.Your rights
It is not mandatory for you to provide us with your personal data, but in cases where the use of your personal data is based on the performance of a contract, we must have your data to fulfil our obligations. If you do not provide your personal data, there is a risk that we will not be able to undertake obligations under the contract.
In some circumstances, we may ask for your consent to use some of your personal data. It is not mandatory for you to give such consent if you do not want your personal data to be used for the specified purposes. You can withdraw the whole or part of your consent at any time by contacting us. If you withdraw your consent, the withdrawal is valid from the time of the withdrawal and does not affect the use of your personal data during the period before the withdrawal took place. The treatment performed before the consent was withdrawn is still considered lawful.
When we use your personal data, you, as a user, have several rights. You have the right to contact us at any time if you wish to exercise any of the rights described below. If you wish to exercise any of the rights described below, you can reach us most easily at gdpr@accrupartners.com.
According to applicable legislation, you have the following rights:
The right to information – You have the right to receive information about how we process your personal data. You have the right to know which personal data is collected, how it is used, stored, and shared, as well as the purposes for which it is collected.
The right to access – You have the right to contact us and request to know what personal data we process about you and to request a copy of this data.
The Right to rectification – You have the right to have incorrect, incomplete, or outdated information corrected and supplemented with accurate information. As a rule, you also have the right to receive information about where we have obtained the incorrect information. If such data has been provided to third parties in accordance with this Privacy Policy, we will also ask them to correct or update your personal data.
The right to erasure – Under certain conditions, you have the right to have your data deleted (the right to be forgotten). However, in some cases, we may not be able to delete certain data if there is a legal obligation for storage, such as accounting regulations.
The right to restriction of processing – Under certain conditions, you have the right to demand that we restrict processing of your personal data, for example, while a correction is made.
The right to object – Under certain conditions, you have the right to object to the processing of personal data that is performed for the purpose of performing a task of public interest, as part of the exercise of authority or after a balance of interests.
The right to data portability – Under certain circumstances, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and transfer the personal data you have provided to the Companies to another organization/ controller (if the processing has been carried out based on consent or contract).
The right to withdrawal of consent – If our processing of your personal data is based on your consent, you are always entitled to withdraw your consent at any time for the continued processing of the personal data that the Companies processes with such legal basis.
The right to lodge a complaint –You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) if you believe that we process your personal data incorrectly. You can read more about this on the IMYs website https://www.imy.se/.
This Privacy Policy was last updated on the 9th of April 2025.