Privacy policy
In the event of errors, ambiguities or discrepancies arising from translation, the original Swedish version shall be used as the reference.
Introduction
All processing of personal data carried out by Acetec AB (company reg. no. 556787–6536) (hereinafter ”Acetec”, ”we” or ”us”) is performed in accordance with applicable data protection legislation.
At Acetec, we value your privacy and strive to maintain a high level of data protection. In this privacy policy, we explain how we collect and process your personal data and describe your rights.
Contact details
If you have any questions or concerns regarding our processing of personal data, please contact us at:
Email: info@acetec.se or via our contact page.
Address: Fabriksgatan 9, 942 36 Älvsbyn, Sweden
Telephone: +46 10-28 80 110
1. Accounting, events, customer administration and leads
1.1 Financial closing process and annual report
Purpose: The purpose is to comply with the Swedish Accounting Act and the Swedish Companies Act.
Categories of personal data: Name, email address, personal identity number, telephone number, salary details, holiday days and holiday pay liability lists, and benefit details and terms.
Legal basis: The processing of personal data is based on the legal basis of legal obligation in connection with the Swedish Accounting Act and the Swedish Companies Act.
Retention period: The personal data is deleted seven (7) years after the end of the relevant financial year in accordance with the Swedish Accounting Act.
1.2 Training/Conferences/Events
Purpose: The purpose is to administer and hold events in order to create customer relationships.
Categories of personal data: Name, telephone number, address and email address.
Legal basis: The processing of personal data is based on a balancing of interests, where the legitimate interest is to create new customer relationships.
Retention period: The personal data is collected and retained for seven (7) years after the end of the calendar year in which the financial year ended, in accordance with the Swedish Accounting Act. Balancing of interests, where the legitimate interest is to create new customer relationships.
1.3 Customer administration
Acetec processes personal data in order to carry out and administer assignments and fulfil our contractual obligations with our business partners.
Purpose: To administer customer care, contract management and increase sales.
Categories of personal data: Name, personal identity number, telephone number, email address, and position.
Legal basis: The processing of personal data is based on the legal basis of contract in order to fulfil our contractual obligations with business partners.
Retention period: The personal data is collected and retained for seven (7) years after customer contact has ended.
1.4 Leads
Purpose: To get in contact with new customers.
Categories of personal data: Name, telephone number and email address.
Legal basis: The processing of personal data is based on a balancing of interests in order to establish new customer contacts.
Retention period: The data is retained for 5 years after contact has been established.
2. Recruitment process
2.1 Recruitment through a recruitment agency
Purpose: The purpose is to find a competent candidate with specialist expertise.
Categories of personal data: Name, age, telephone number, address, email address, CV (information about ethnicity due to language skills may occur), personal identity number and cover letter.
Legal basis: The processing is based on the legal basis of a balancing of interests, where our legitimate interest is to assess which candidate best meets our competence profile.
Retention period: Documents and supporting materials are retained during the ongoing recruitment process and are deleted 24 months after the recruitment process has ended.
2.2 Job application
Purpose: The purpose is to find the right candidate for the advertised position.
Categories of personal data: Name, age, telephone number, address, email address, CV (information about ethnicity due to language skills may occur), personal identity number and cover letter.
Legal basis: The processing is based on the legal basis of consent.
Retention period: A consent request is sent annually to candidates after recruitment has ended (applies only to the function, Teamtailor). When recruitment has ended, candidates' personal data is deleted after 24 months. Personal data stored in remarkable is deleted 1 month after recruitment has ended.
2.3 Interview process
Purpose: The purpose of the processing is to find a suitable candidate for the intended role who meets our candidate profile.
Categories of personal data: Name, age, address, email address, CV (information about ethnicity due to language skills may occur), cover letter, family situation, personal identity number and name.
Legal basis: The processing is based on the legal basis of a balancing of interests, where our legitimate interest is to assess which candidate best meets our competence profile.
Retention period: A consent request is sent annually to candidates after recruitment has ended (applies only to the function, Teamtailor). When recruitment has ended, candidates' emails are deleted after 24 months. Personal data stored in remarkable is deleted 1 month after recruitment has ended.
2.4 Test results in connection with recruitment
Purpose: The purpose of the processing is to find a suitable candidate for the intended role who meets our candidate profile.
Categories of personal data: Results of personality traits and logistics tests, name and email address.
Legal basis: The processing is based on the legal basis of a balancing of interests, where our legitimate interest is to assess which candidate best meets our competence profile.
Retention period: After recruitment has ended, personal data is deleted after 24 months.
2.5 Credit report
Purpose: The purpose of the processing is to find a suitable candidate for the intended role who meets our candidate profile.
Categories of personal data: Name, address and financial information.
Legal basis: The processing is based on the legal basis of a balancing of interests, where our legitimate interest is to assess which candidate best meets our competence profile.
Retention period: When recruitment has ended, the data is deleted after 24 months.
2.6 Obtaining an assessment from a reference person for a job applicant
If a candidate has named you as a reference in connection with a recruitment process, we will collect your personal data from the candidate for the purpose of contacting you.
Purpose: The purpose of the processing is to be able to contact the specified reference person who has previously worked with the job applicant or can otherwise comment on their competence, personality and work experience (obtain an assessment), in order to find a candidate for the intended role who meets our candidate profile.
Categories of personal data: Personal data collected concerning the reference person consists of their name, telephone number, email address and position.
Personal data collected concerning the candidate consists of information about their characteristics, experience(s) and any absence.
Legal basis: The processing is based on the legal basis of a balancing of interests. Our legitimate interest is to assess which candidate best meets our competence profile by contacting you as the stated reference in order to obtain an assessment of the candidate in connection with the recruitment process.
Retention period: When recruitment has ended, personal data is deleted after 24 months.
3. Social media
3.1 Social media
Purpose: The purpose of the processing is to present new employees.
Categories of personal data: Name, email address, telephone number, position and image.
Legal basis: The processing is based on the legal basis of a balancing of interests, where our legitimate interest is to market the company and present new employees.
Retention period: The personal data is collected at the start of employment, retained during employment and, when employment ends, the image and contact details are removed immediately.
4. Who do we disclose your personal data to?
As a starting point, your data is processed only by us. For certain processing of personal data that takes place with the assistance of subcontractors or business partners, we need to share your data. By this, we mean that they are given access to your data but may only process it in accordance with our instructions (data processing agreement).
We share data with providers of the following types of systems:
- Email software,
- File management provider,
- Email automation tools,
- Accounting software,
- Video meeting software,
- Storage tools.
5. Transfer of your personal data outside the EU/EEA
In cases where Acetec uses, or will use, subcontractors or cooperates with partners established outside the EU/EEA area, we are responsible for ensuring that these parties can guarantee a level of security equivalent to that maintained within the EU.
In order to ensure adequate protection of your personal data when transferred to countries outside the EU/EEA where there is no adequacy decision from the European Commission, Acetec has, where applicable, entered into agreements with the respective recipients of personal data containing standard contractual clauses adopted and approved by the European Commission, including but not limited to the standard clauses adopted through Commission Decision (EU) 2021/914, and has ensured protection of personal data through the Data Privacy Framework (DPF).
In addition, where the level of protection in the recipient country cannot be considered equivalent to that within the EU/EEA, Acetec takes additional safeguards such as pseudonymisation, IP anonymisation and encryption.
6. Your rights
If you have provided your personal data to us, you can exercise the rights set out below free of charge by contacting us. If we receive such a request, we may need to verify your identity using appropriate security measures in order to prevent unauthorised persons from gaining access to your personal data. We will respond to your request without undue delay and no later than one (1) month after we receive your request. You have the following rights:
a) Right of access
You have the right to request access to and information about which categories of personal data are processed about you by means of a register extract. The information provided must be easy to understand and provided free of charge in electronic form.
b) Right to rectification
You have the right to request rectification of your personal data if it is incomplete or otherwise incorrect.
c) Right to erasure (right to be forgotten)
In certain cases, you have the right to request that your data be deleted. For example, if:
- the data is no longer needed for the purposes for which it was processed,
- the processing is carried out for direct marketing and you object to the data being processed for this purpose,
- you object to processing carried out on the basis of a balancing of interests and there are no legitimate grounds that override your interests,
- the personal data has been processed unlawfully, or
- erasure is required to comply with a legal obligation.
If Acetec needs the personal data in order to fulfil a contract with you or comply with a legal requirement, we will not delete the data.
d) Right to restriction
You have the right to request that we temporarily restrict the processing of your personal data. Restriction of personal data may, for example, be relevant:
- during the time it takes us to verify that your data is accurate,
- during the time it takes us to verify whether our legitimate interest in processing overrides your interests and fundamental rights,
- to enable you to establish, exercise or defend legal claims,
- if the processing is unlawful but you want the processing to be restricted instead of us deleting the personal data in question.
e) Right to object
You have the right to object to the processing of personal data based on our legitimate interest. If you make such an objection, Acetec will consider your objection and make an overall assessment of our legitimate interests and your rights related to the processing of personal data.
f) Right to data portability
You have the right to receive your personal data in a structured, commonly used and machine-readable format for personal data that is based on consent or contract and that you yourself have provided to us. You also have the right to request that we transfer your personal data directly to another data controller.
Withdrawal of consent and objection
Where we process your personal data on the legal basis that you have given your consent, you may withdraw the consent given at any time by contacting us; such withdrawal may be made in whole or in part. If you do not want marketing from us, you can object to the processing by contacting us.
7. Contact details for the Swedish Authority for Privacy Protection (IMY)
Please contact us if you have any questions or concerns regarding the processing of personal data. You always have the right to contact the responsible supervisory authority with a complaint if you believe that we are not meeting the requirements placed on us. The Swedish Authority for Privacy Protection (IMY) is the supervisory authority responsible for the processing of personal data in Sweden, and you can contact them here.
8. Changes to the privacy policy
Acetec may amend its privacy policy when necessary; updates will be published on our website.
9. Version history
Version 23/8–2024.
