Bravida is committed to ensure the privacy of those who use our services, and we want to ensure that your personal data is protected in the best possible way. With this policy, we want to explain what personal data we collect and what it may be used for to show how we ensure that your personal data is handled in accordance with applicable legislation.
1.1 Introduction
Bravida is committed to ensure the privacy of those who use our services, and we want to ensure that your personal data is protected in the best possible way. With this policy, we want to explain what personal data we collect and what it may be used for to show how we ensure that your personal data is handled in accordance with applicable legislation.
1.2 Personal Data Controller
Bravida Holding AB (556891–5390) or Bravida Sverige AB (556197-4188) or the company within the Bravida Group with which you have entered into an agreement or are in contact with is the personal data controller for the processing of your personal data.
Bravida Holding AB
Mikrofonvägen 28 (visiting address)
126 81 Stockholm
Sweden
Bravida Sverige AB
Mikrofonvägen 28 (visiting address)
126 81 Stockholm
Sweden
For contact information to other companies within the Group, see https://www.bravida.se/en/invoicing/invoicing-addresses/
Cases where joint controllership applies are stated under the current processing activities below.
1.3 Who do I contact if I have any questions or want to exercise my rights?
Questions/rights
If you have any questions about our processing of your personal data, you are welcome to contact us by email gdpr@bravida.se or by phone +46 8 695 20 00. If you have specific questions to our Data Protection Officer, you can contact dpo@bravida.se.
Data Protection Officer
Bravida have appointed a Data Protection Officer for Bravida Holding AB, Bravida Sverige AB, Bravida Säkerhet AB, Bravida Prenad AB, Bravida Norge AS, Bravida Finland OY and Bravida Danmark A/S, to ensure that your personal data is processed in an open, correct and lawful manner. You can contact our Data Protection Officer by e-mail to: dpo@bravida.se.
Complaints
If you have any comments on our processing or if you are not satisfied with our answers, you have the right to file a complaint to the Swedish Authority for Privacy Protection, www.imy.se
We process the personal data provided to us, for example in connection with the signing of a customer agreement or by people contacting us, through a contact form, a notification on our website or if someone uses our digital channels. If you are a private customer, we also process personal data that we have retrieved from, for example, credit reporting companies, SPAR (the Swedish state personal address register) or equivalent registers in other Nordic countries in which we operate.
The information is divided into different categories so that you easily can find what applies to you. If you are employed by Bravida, you can find the corresponding information on Bravida's intranet. If you are a user of Bravida Charge APP, you will find information about the processing of personal data directly in the app.
2.1 Private customers (customer = natural person)
Purpose of the processing and legal basis
If you are a natural person and enter into an agreement with us, your personal data will be processed to the extent necessary for the following purposes:
The processing of personal data in connection with credit checks is based on our legitimate interest in being able to check your creditworthiness in connection with entering into an agreement with you where we have assessed that Bravida's interest in ensuring your ability to pay outweighs the privacy impact of the processing. The processing of your personal data that is required for us to be able to fulfil our obligations in the agreement with you is based on the agreement between Bravida and you. Some of your personal data we must process according to the law, such as the Swedish accounting act (Bokföringslagen). In those cases, the processing is based on a legal obligation. Processing of your personal data for the purpose of testing and improvement of our processes and systems is based on our legitimate interest in being able to improve the services we provide to you. We also have a legitimate interest in processing your personal data to prevent misuse or inappropriate use of our services. We will also process your personal data in marketing of our services, for example through marketing mailings and the provision of newsletters. The legal basis in those cases is your consent, in case we have obtained such consent, or our legitimate interest of the marketing our services.
Recipients of personal data
The information may be disclosed to authorities in accordance with requirements by law, to any partners who deliver support services to the company, including marketing, finance, and IT services and in the manner and to the extent necessary for us to fulfill our obligations to our customer. Your personal data may also be shared between companies within the Bravida Group.
Transfer of data to third countries
See Section 3 below for third-country transfers.
Storing and erasure
Your personal data is stored for as long as the customer relationship remains and thereafter the time required or permitted by applicable legislation and practice at any given time. If your personal data is found as a reference in invoice documentation, it will be retained for seven years after the end of the calendar year when the financial year ended in accordance with the Swedish accounting act (Bokföringslagen). Agreements and documents regarding a project that we have carried out for you are saved for the duration that rights and obligations (including any liability and claims) remain according to our agreement, according to law and current practice.
Your rights
As a data subject, you have certain rights. The rights can be found in section 4 below.
2.2 Customer contact persons (companies and other organizations)
Purpose of the processing and legal basis
If you are a contact person and employee of one of our customers or potential customers, your personal data will be processed to the extent necessary to contact the customer, administer the customer relationship and for us to be able to fulfill our commitments to the customer. The processing is based on our legitimate interest in being able to live up to the agreement or customer relationship that arises from, for example, an order that the customer makes. We will also process your personal data to in marketing of our services to the customer based on our legitimate interest.
Recipients of personal data
The information may be disclosed to authorities in accordance with requirements by law, to any partners who deliver support services to the company, including marketing, finance, and IT services and in the manner and to the extent necessary for us to fulfill our obligations to our customer. Your personal data may also be shared between companies within the Bravida Group. Contact persons to customers and potential customers are processed in a CRM system where there is joint controllership.
Transfers to third countries
See section 3 below for third-country transfers.
Storing and erasure
Your personal data is stored for as long as the customer relationship remains and thereafter the time required or permitted by applicable legislation and practice at any given time. If your personal data is found as a reference in invoice documentation, it will be retained for seven years after the end of the calendar year when the financial year ended in accordance with the Swedish accounting act (Bokföringslagen). Agreements, correspondence, and documents regarding a project that we have carried out for your employer which contain personal data are stored for the time that rights and obligations (including any liability and claims) remain according to the agreement we entered into with your employer, according to law and current practice. If you terminate your employment with our customer, we will replace your contact details with your successor's details when we receive information about it from you or your employer.
Your rights
As a data subject, you have certain rights. The rights can be found in section 4 below.
2.3 Supplier contact persons
Purpose of the processing and legal basis
If you are a contact person and employee of one of our suppliers, your personal data will be processed to the extent necessary to contact the supplier, administer the supplier relationship and for us to be able to fulfill our obligations to the supplier. The processing is based on our legitimate interest in being able to live up to the agreement or supplier relationship that arises from, for example, an order that we make to the supplier.
Recipients of personal data
The information may be disclosed to authorities in accordance with requirements by law, to any partners who deliver support services to us, such as IT services and in the manner and to the extent necessary for us to be able to fulfill our obligations to you as a data subject. Your personal data may also be shared between companies within the Bravida Group.
Transfers to third countries
See section 3 below for third-country transfers.
Storing and erasure
Your personal data is stored for as long as the supplier relationship remains and thereafter the time required or permitted by applicable legislation and practice at any given time. If your personal data is found as a reference in invoice documentation, it will be retained for seven years after the end of the calendar year when the financial year ended in accordance with the Swedish accounting act (Bokföringslagen). Agreements, correspondence, and documents regarding a delivery from your employer containing personal data are stored for the time that rights and obligations (including any liability and claims) remain according to the agreement we entered into with your employer, according to law and current practice. If you terminate your employment with our supplier, we will delete your personal data when we receive information about it from you or your employer.
Your rights
As a data subject, you have certain rights. The rights can be found in section 4 below.
2.4 Candidates (recruitment)
If you apply for a job with us, we will process your personal data.
Purpose of the processing and legal basis
If you apply for a job with us, we will process your personal data to the extent necessary for the current recruitment process. It is important that the information you provide to us is factual and that you avoid providing sensitive information unless these are relevant to the current employment.
We will process your personal data based on legitimate interest. The processing includes the documentation you send us, information from reference persons, recruitment companies, information from other people who have tipped us about you or companies that help us with various forms of personality and competence tests, notes from interviews and any work samples and tests.
We would like to save your information for future recruitments. When you register your application, we ask for your consent to save your information for future recruitments for a period of 12 months. It is completely voluntary to give your consent and you can withdraw your consent at any time.
Recipients of personal data
The information may be disclosed to any partners who deliver support services to the company, such as IT services, and in the manner and to the extent necessary for us to be able to fulfill the commitments to you as a candidate. Depending on the type of service, your personal data may be shared with recruitment companies hired by us and companies that help us with various forms of personality and competence tests. The data may also be shared between different companies within the Bravida Group.
Transfers to third countries
See section 3 below for third-country transfers.
Storing and erasure
Your personal data is saved as long as the recruitment for a specific position is ongoing and another two years with reference to the Swedish discrimination act (Diskrimineringslagen), for us to be able to show on what grounds the employment decision was made.
If you have submitted a spontaneous application or made an expression of interest via our website, we will keep your application in our candidate bank for 12 months before we delete it.
If someone has tipped us about you regarding a vacant position, we might get in touch with you. We will delete your personal data immediately if you are not interested in a position at Bravida or if you do not want to remain in our candidate bank. If we decide that we do not want to continue with the tip about you, we will also delete your information immediately. If you want to remain in our candidate bank, we will ask for your consent to save the information for 12 months. When the consent expires, the data is deleted.
If you are a member of our candidate bank and have an interesting profile, we may ask for your consent to save your information for longer than 12 months.
If your personal data is in invoice documentation, it will be stored in our accounting for seven years after the end of the calendar year when the financial year ended in accordance with the Swedish accounting act (Bokföringslagen).
Your rights
As a data subject, you have certain rights. The rights can be found in section 4 below.
2.5 Our website visitors
We may process your personal data if you visit our website. If and what personal data of yours we process depends partly on your browser settings, partly on what settings you chose when you entered our website. We use cookies on our website. Cookies are small text files that collect different types of information about how you as a visitor use our website. You can read about our use of cookies and what cookies we use in our Cookie Policy, which you can find here: https://www.bravida.se/en/about-bravida/cookies/
We also process your personal data when you contact us through our website, for example if you fill in a contact or order form on the website to, for example, subscribe to newsletters, order printed material or ask us to contact you because you want a quotation or order a product or service.
Purpose of the processing and legal basis
The purpose of the processing is that we want to obtain information about how our website is used to be able to evaluate and improve the website, understand how visitors use it and to ensure the functionality of the website. We rely on the legal basis legitimate interest in the use of strictly necessary cookies since they are needed to provide you with a functioning website. The processing of your personal data with the help of analytical or marketing cookies takes place, where applicable, is based on the legal basis consent. You are not obliged to consent to these cookies for access to the website, but some services and functions require the use of such cookies, and these may be limited or inaccessible without your consent. You can choose your own settings and withdraw or change your consent at any time by clicking on "Details" in our Cookie Policy.
When you contact us via the website, we process your personal data based on our legitimate interest in being able to handle your case or order and to communicate with you.
Recipients of personal data
The data may be disclosed to partners who deliver support services to the company, such as marketing services and other technical services in connection with the provision of the website. Your personal data may also be shared between companies within the Bravida Group. The processing of cookies takes place through joint controllership between Bravida Holding AB and the company whose website you are visiting.
Transfers to third countries
See section 3 below for third-country transfers.
Storing and erasure
See our Cookie policy which you can find here:
https://www.bravida.se/en/about-bravida/cookies/
Personal data that you have provided us with through contact or order forms is deleted when we no longer have a legitimate interest in saving this information, for example when we have processed your request for printed material. If you have contacted us to order a product and / or service, we refer to the abovementioned section about information for private customers and if you are the contact person for a corporate customer, we refer to the section about contact persons at corporate customers above.
Personal data that you have provided us with when choosing to subscribe to newsletters is saved until you unsubscribe from a newsletter list for which you have registered.
Your rights
As a data subject, you have certain rights. The rights can be found in section 4 below.
2.6 Visitors to our social media channels
We are the personal data controller for the personal data we publish in our social media channels on LinkedIn, Facebook, and Instagram. We have a responsibility for that not inappropriate nor offensive posts are being published in our channels. In that case, we will remove such posts.
Purpose of the processing and legal basis
The purpose of our social media channels is to spread information about our business and services to existing customers and to potential new customers. If you interact with any of our social media channels, you also agree to receiving our posts in your own feed. You can stop liking the Page or hide individual or all the posts we make at any time. We may use the information to contact the company or organization you represent and inform about our goods / services. The legal basis is our legitimate interest.
If you want to receive more information about how your personal data is processed, we refer to the respective channel LinkedIn, Facebook, and Instagram.
Recipients of personal data
The information may be disclosed to partners who, on our behalf, deliver support services to the company, such as marketing services. Your personal data may also be shared between companies within the Bravida Group.
Transfers to third countries
The use of social media channels means that your personal data may be transferred to third parties located in a third country (the US).
For more information about third-country transfers and actions we take regarding third-country transfers, see section 3 below.
Storing and erasure
Your personal data that you provide in the form of interactions or comments where it appears that you as an individual are the sender will be retained until further notice or until you delete the interaction or comment yourself. We will remove unsolicited comments on an ongoing basis where applicable.
Your rights
As a data subject, you have certain rights. The rights can be found in section 4 below.
2.7 Participants in our trainings, webinars & events
When you participate in our trainings, webinars, or other events, we will process the personal data that you provide to in us in connection with the registration.
Purpose of the processing and legal basis
The purpose of the processing is to provide training, disseminate information or otherwise interact with employees of our existing or prospective customers and suppliers. We rely on the legal basis of legitimate interest.
Recipients of personal data
The information may be disclosed to partners who deliver support services to us, primarily financial, IT and marketing services. Your personal data may also be shared between companies within the Bravida Group.
Transfers to third countries
See section 3 below for third-country transfers.
Storing and erasure
We will retain your personal data for up to 12 months after the event has taken place to meet our legitimate interest in following up on participation and evaluating trainings, webinars, or other events, interacting with existing or prospective customers and suppliers and for planning future trainings, webinars or other events. Potential information about food preferences will be deleted as soon as possible after the activity has been carried out.
If your personal data is in invoice documentation, it will be stored in our accounting for seven years after the end of the calendar year when the financial year ended in accordance with the Swedish accounting act (Bokföringslagen).
Your rights
As a data subject, you have certain rights. The rights can be found in section 4 below.
2.8 External consultants
Purpose of the processing and legal basis
We will process your personal data to manage the consulting relationship. This means that we process your personal data to give you access to our IT systems and to our premises, if necessary. We can check logs from IT systems and entry systems in accordance with our information security policy and our guidelines regarding the handling of personal data.
The processing is based either on our legitimate interest in being able to live up to the agreement established between us and your employer or on the consulting agreement that is established between us and you.
Recipients of personal data
The information may be disclosed to authorities in accordance with requirements by law, to any partners who deliver support services to the company, such as finance and IT services, and in the manner and to the extent necessary for us to be able to fulfill our obligations to our consulting relationship. Your personal data may also be shared between companies within the Bravida Group.
Transfers to third countries
See section 3 below for third-country transfers.
Your rights
As a data subject, you have certain rights. The rights can be found in section 4 below.
2.9 Camera surveillance
Purpose of the processing and legal basis
We collect personal data through camera surveillance with cameras that are located outside and inside some of Bravida's offices. Information about camera surveillance can be found on signs adjacent to the area.
We rely on the legal basis of legitimate interest. The processing is necessary for purposes related to our legitimate interest in preventing and investigating crime. We have an interest in achieving increased safety and security for our employees, customers, suppliers, and others who stay in our areas. Camera surveillance is an important part of this together with other measures such as access control systems and other technical and organizational protection measures. Camera surveillance is justified both based on the location of the property and the importance of keeping the property and its values well protected which outweighs the individual's interest in not being subject to personal data processing in connection with camera surveillance. Our processing aims not to be more extensive than the purpose requires both in terms of time for storing the data and the amount of data collected.
There is no obligation of camera surveillance by law or agreement.
Recipients of personal data
We transfer recorded material to e.g., our partners for camera surveillance and, where applicable, to authorities in connection with criminal investigations.
Transfers to third countries
We do not transfer your personal data outside the EU/EEA.
Storing and erasure
The information in the form of moving picture is collected through camera surveillance and stored for a maximum of 7 days from the time of collection in case nothing occurs that lead to the need of storing the material for a longer period, for example to be able to exercise our rights or assert or defend legal claims. Material that an investigating authority requests us to disclose and/or store according to government decisions will be stored for as long as necessary to meet such a request.
Your rights
As a data subject, you have certain rights. The rights can be found in section 4 below.
2.10 Whistleblowing
Purpose of the processing and legal basis
We process personal data to fulfill the legal requirements imposed on Bravida to provide a whistleblowing function and conduct investigations of reported cases. Personal data may be processed concerning the individual reporting a case, if they choose not to remain anonymous, those individuals mentioned in a report, or those in an administrative role responsible for investigating reported cases. The purpose also includes processing personal data when necessary to follow-up on cases. This means that we may need to process personal data to:
- Manage reported whistleblowing cases,
- Safeguard Bravida’s rights and obligations based on irregularites revealed in whistleblowing cases,
- Fulfill the legal requirements imposed on Bravida.
The legal basis for processing personal data in connection with whistleblower cases is a legal obligation pursuant to chapter 5, section 2 of the Swedish Act on Whistleblowing. The legal basis for processing personal data in connection with following up on whistleblower cases and other measures taken in response to a reported case is the fulfillment of a legal obligation or Bravida’s legitimate interest in safeguarding its rights in light of suspected or established irregularities.
Recipients of personal data
Personal data may be disclosed to authorities in connection with a potential criminal investigation. Information may also be disclosed to other companies within the corporate group in connection with the investigation, follow-up, and remedial actions related to a whistleblower case. Personal data may also be disclosed to companies assisting Bravida in investigating the circumstances that led to the whistleblower report, such as a law firm or auditor.
Transfers to third countries
See section 3 below for third-country transfers.
Storing and erasure
Your personal data involved in a whistleblower case will be stored for two years from the conclusion of the case. Personal data used for administrative and authorization purposes will be retained for the duration of the authorization. When the storage period expires, all personal data will be deleted.
If a case requires ongoing internal investigation, we will continue to process your personal data for as long as required to conduct the investigation. Material required by law enforcement authorities that we are obligated to disclose and/or store according to an official decision will be stored for as long as necessary to comply with such a decision.
Your rights
As a data subject, you have certain rights. The rights can be found in section 4 below.
We and our personal data processors store personal data on servers located within the EU/EEA. However, we use third-party cookies on our website. The use of third-party cookies may lead to your personal data being transferred to a third party located in a third country (e.g., the US). You have the possibility to limit the use of cookies yourself and you can find more information about this in our cookie policy, which you can find here.
Even if the personal data is stored within the EU/EEA, the personal data may in some cases be transferred to a third country when for instance a contracted IT supplier needs to process the personal data outside the EU/EEA to provide its’ service (e.g., through a group company in the US).
If personal data is transferred to third countries (including the US) we always ensure that appropriate safeguards are in place to ensure the secure processing of your personal data. Such appropriate safeguards may include:
You can contact us via gdpr@bravida.se and request a copy of the safeguards.
As a data subject you have certain rights. Those rights originate from the General Data Protection Regulation, and they are stated below. To exercise any of your rights please contact us, contact details can be found under section 1.2 of this Policy.
When you want to exercise any of your rights, we strive to replay to your request within a month from contacting us. The handling of your request may take up to three months depending on the volume of the request or its complexity. If so, we will notify you thereof. We will always reply to your request in writing.
Below the various rights that you may have when we process personal data about you are described.
Depending on what legal basis we support our processing on and for what purpose we process your personal data, there might be exceptions or limitations of your possibility of exercising your rights.
If the request is manifestly unreasonable or unfounded, especially if it is made recurrently, we will either charge a fine or refuse to meet the request. In such circumstances we will have to be able to prove that the request is manifestly unfounded or unreasonable.
4.1 Right to access, register extracts
You have the right to obtain a confirmation from us about how we process personal data concerning you, and if so, request access to the personal data we process about you, a so-called register extract.
More information about the right to access can be found on IMY’s website https://www.imy.se/privatperson/dataskydd/dina-rattigheter/ta-del-av-dina-personuppgifter/
4.2 Right to erasure (‘right to be forgotten’)
You have the right to obtain from us the erasure of your personal data. By such request, we will erase personal data that is no longer necessary to process or store in relation to the purposes for which they were collected. We will also erase your personal data if you withdraw your consent on which the processing is based. In some cases, we will not have the possibility to erase your personal data. That depends on if the personal data either still is necessary to process for the purpose they were collected for, if our interest of continuing the processing outweighs your interest of getting them erased, or if we have a legal requirement of retaining them.
More information about the right to erasure can be found on IMY's website https://www.imy.se/privatperson/dataskydd/dina-rattigheter/radering/
4.3 Right to restriction of processing
You have the right to request that our processing of your personal data be restricted in certain circumstances.
The possibility of restriction applies if: a) the data subject contest the accuracy of the personal data; b) the processing is unlawful and the data subject oppose the erasure of the personal data and request the restriction of their use instead; c) the data controller no longer needs the data, but the data subject needs the data in order to establish, exercise or defend legal claims; or d) the data subject has objected to processing pursuant to Article 21(1) pending verification whether the controller's legitimate grounds override the legitimate grounds of the data subject.
More information about the right to restriction of processing can be found on IMY's website: https://www.imy.se/privatperson/dataskydd/dina-rattigheter/begransning/
4.4 Right to data portability
You have the right to request the collection of personal data, which you have provided to us, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller.
More information about the right to data portability can be found on IMY's website https://www.imy.se/privatperson/dataskydd/dina-rattigheter/flytta-dina-personuppgifter/
4.5 Right to rectification
You have the right to request that the personal data controller obtain the rectification of inadequate personal data concerning you, without undue delay. Considering the purposes of the processing, you also have the right to have incomplete personal data completed.
More information about the right to rectification can be found at IMY’s webpage
https://www.imy.se/privatperson/dataskydd/dina-rattigheter/rattelse/
4.6 Right to object
You have on grounds relating to your specific situation, the right to object at any time to the processing of personal data concerning you based on Article 6.1 (f) (legitimate interest). The right to object applies, among other things, to processing that involves profiling.
More information about the right to object can be found on IMY's website https://www.imy.se/privatperson/dataskydd/dina-rattigheter/att-gora-invandningar/
4.7 Right to object to automated individual decision-making
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
More information about the right regarding automated processing can be found on IMY's website https://www.imy.se/privatperson/dataskydd/dina-rattigheter/automatiserade-beslut/
We reserve the right of amending this policy at any time if deemed necessary when we change the processing of personal data processing and to meet new requirements by law, interpretations of law, technical requirements or to remedy problems or disruptions. The policy in force at any given time is made available on Bravida's websites.