Privacy and GDPR

Personal data policy
Your privacy matters to us at Ekonomico AB, and we work actively to protect and respect it in line with the General Data Protection Regulation (GDPR). We only use your personal data when it is necessary, and we make sure that security and documentation are handled professionally.

On this page we have gathered information about how we view privacy and the work we do to protect it. You will also find tools and information that may help with your own GDPR work. Please do not hesitate to contact us if you have any questions or suggestions for improvement.

Scope of this personal data policy
This policy applies to people who visit www.ekonomico.se, use any of our services or packages, and to our social media channels.

Personal data means information that, on its own or combined with other information, can be used to identify you as an individual. Examples of personal data are your name, your email address and your phone number.

Collection and use of information and data at Ekonomico AB
We process personal data mainly so that we can fulfil our commitments to you as a client. We also collect information about people who are not yet clients but would like us to contact them.

Security
Ekonomico AB protects your personal data through a combination of technical and organisational measures. All systems that handle personal data are protected by access control systems. Our staff, processors and sub-processors follow Ekonomico AB's internal information security policy.

Personal data sent to Ekonomico AB without our having asked for it, and which does not relate to an enquiry, an engagement or a job application, is deleted within one month.

Ekonomico AB as controller and processor
Ekonomico AB is the controller for data about our clients, contact persons and visitors. For personal data in your bookkeeping and payroll, we act as a processor on your behalf as the client. In such cases a data processing agreement between you as the client and Ekonomico AB is required. We always follow the instructions set out in the agreement. A data processing agreement is drawn up with every client of Ekonomico AB.

Why we process the data and how long we keep it

• Enquiries via forms, email and phone. Name, contact details and what you write. Legal basis: legitimate interest in replying to you. Kept for 12 months after the most recent contact if no engagement goes ahead.
• Client engagements. Contact persons and the information needed for the engagement. Legal basis: contract. Kept for the term of the agreement and thereafter for as long as the law requires.
• Customer due diligence. Identity details and beneficial owner. Legal basis: legal obligation under the Anti-Money Laundering Act (penningtvättslagen, 2017:630). Kept for five years after the client relationship has ended.
• Accounting records. Invoices, agreements and other vouchers containing personal data. Legal basis: legal obligation under the Bookkeeping Act (bokföringslagen, 1999:1078). Kept until the end of the seventh year after the end of the calendar year in which the financial year ended.
• Job applications and expressions of interest as a consultant. CV, contact details and whatever you send in. Legal basis: legitimate interest in assessing your application. Kept for 12 months after the recruitment has been completed, unless you consent to us keeping them for longer.

Transfer of information
Ekonomico AB and its sub-processors store their information within the EU. Bookkeeping data is stored in Sweden or in another EU country in accordance with the rules of the Bookkeeping Act. We do not sell any client information on to third parties. However, contact information needed for direct marketing may be handled by our sub-processors.

Changes to this personal data policy
Any updates and changes to this personal data policy will be published on this page.

Information about GDPR

What is GDPR?
GDPR, or the General Data Protection Regulation, is a data protection regulation adopted by the EU that governs how personal data is handled. It replaced the former Swedish Personal Data Act (personuppgiftslagen, PUL) and began to apply on 25 May 2018. GDPR places stricter requirements on documentation and transparency for those who process personal data.

Why was GDPR introduced?
The purpose of GDPR is to strengthen the protection of individuals' personal data and to create a single set of rules for the whole EU. It gives private individuals greater control over their personal data, while companies operating within the EU only need to follow one set of rules, whichever country they operate in.

Who is covered by GDPR?
GDPR applies to all companies, public authorities, organisations and in some cases also private individuals who process personal data in the EU or handle data about individuals within the EU. The regulation covers essentially all systematic processing of personal data, including electronic registers, databases and running text, as well as some manual handling, such as paper registers.

Your rights

As a data subject registered with Ekonomico AB, you have the following rights:

• You have the right to receive information about what personal data processing we carry out.
• You have the right to request, free of charge, a copy of your records showing what personal data we process about you specifically. If you request additional copies, we may charge a reasonable fee.
• You have the right to request correction if we have incorrect information registered about you.

Right to erasure
You have the right to request erasure under the following conditions:

– The data is no longer needed for the purpose for which it was collected.
– If the data is stored with your consent and you withdraw your consent.
– If the processing is based on a balancing of interests and there are no legitimate grounds that outweigh your interest.
– If the personal data has been processed unlawfully.
– If you object to processing for direct marketing purposes.

The right to erasure does not apply if we are required by law to keep the data (for example under the Bookkeeping Act).

Data portability
You have the right to data portability, which means having your personal data transferred to you or another party, provided that the legal basis is consent or contract, that the data concerns you personally, and that it is data you have provided yourself or that has been generated through your activities with us.

Restriction of processing
You have the right to request a restriction of the processing of your personal data. This applies, for example, while we check data that you consider to be incorrect, or while we look into an objection from you. The data is then marked so that it may only be used for certain limited purposes.

Objection to processing
You have the right to object to the processing of personal data. This applies to processing based on a balancing of interests. Ekonomico AB will then stop the processing unless we can demonstrate compelling legitimate grounds for continuing. You can always object to direct marketing.

Complaints
You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) if you believe that our processing of your personal data is incorrect.

If you wish to exercise any of your rights, please contact our customer service by phone on 031 - 52 40 00 or by email at info@ekonomico.se.