Privacy Notice

Last modified: 2025-09-04

Arkivia AB, Reg. No. 559491-9739 (”Arkivia”, ”we”, ”our” or ”us”) respects and safeguards your personal privacy. This privacy notice (”Privacy Notice”) aims to describe how we, in our capacity as data controller, process your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (”GDPR”) and other applicable data protection legislation. It also describes the rights you have under the GDPR and how you can exercise them.

1. Who is covered by this Privacy Notice?

1.1 Individuals whose personal data we may process

This Privacy Notice applies when Arkivia, as data controller, processes personal data belonging to you as someone who:

• visits our website www.arkivia.se or contacts us via email, telephone, our social media accounts, or in any other way,

• is a representative, contact person, or other employee of an existing or potential corporate customer of Arkivia, and

• is a representative, contact person, spokesperson, or other employee of an existing or potential supplier or partner of Arkivia.

2. Contact details of the data controller

Arkivia is the data controller for the processing of your personal data as described in this Privacy Notice. As data controller, we are responsible for ensuring that our processing of your personal data is carried out in accordance with the GDPR and other applicable data protection legislation.

If you have any questions regarding this Privacy Notice, our processing of your personal data, or if you wish to exercise your rights, please contact us at info@arkivia.se or via the contact details provided below.

Arkivia AB, Reg. No. 559491-9739
Postal address: Engelbrektsgatan 35A, 114 32 Stockholm
Email: info@arkivia.se

3. How do we collect your personal data?

We process personal data provided by you when you contact us via, for example, email, our corporate social media accounts, or if you enter into an agreement on your own behalf (if, for example, you operate a sole proprietorship) or on behalf of your employer (i.e., the company you represent). In addition to the personal data you provide yourself, we may receive information from your employer if your employer is a (potential) corporate customer or (potential) supplier or partner of Arkivia. We may also obtain your personal data from publicly available sources such as your employer's website.

When you visit and interact with our website, we may collect information such as your IP address, browser type, time zone settings, and information about how you use our website from your device. We collect this personal data from your device through the use of cookies, server logs, pixels, and similar technologies (”Cookies”).

4. If you do not provide your personal data

If you are a representative, contact person, spokesperson, or other employee of a (potential) corporate customer, supplier, or partner, we process information about you to be able to enter into an agreement with you as a sole proprietor or with the company you represent. In order to enter into an agreement, you must provide certain personal data to us. Providing personal data is of course voluntary, but if you do not provide the necessary information, we will not be able to enter into an agreement with you as a sole proprietor or with the company you represent, and we will not be able to administer the relationship with the company you represent.

5. Summary of processing activities performed

In the sections below, you will find a summary containing information on why we process your personal data, the categories of personal data processed for the specified purpose, how long we process your personal data, and the legal basis on which we base the processing. Where we base the processing on a balancing of interests, we have also specified the legitimate interest.

5.1 To enter into agreements and administer the customer agreement, including the customer relationship

Purpose of processing:

We process your personal data in order to enter into agreements with you as a sole proprietor or with the company you represent, and to administer the agreement as well as the customer relationship. This includes, for example, processing personal data to deliver and improve our services or assignments to you, and to enable invoicing and communication regarding the agreement, payment, or services and assignments/orders.

Categories of personal data:

• First and last name

• Employer/company name and your job title

• Business telephone number and email address

• Your personal identity number (only sole proprietors)

• Bank account number and payment details (only sole proprietors)

This processing applies to:

• Corporate customers

• Potential corporate customers

Legal basis: Balancing of interests.

The processing is necessary for our legitimate interest to enter into agreements with you as a sole proprietor or with the company you represent, and to administer the agreement as well as the customer relationship. We have assessed that our interest overrides your right not to have your personal data processed for this purpose.

Retention period: Your personal data is processed throughout the term of the contractual relationship and for up to 1 year after the contractual relationship has terminated, provided that there are no statutory requirements prescribing a longer retention period. For personal data that must be retained in accordance with the Swedish Accounting Act, see section 5.10.

5.2 To enter into agreements and administer the supplier or cooperation agreement, including the supplier relationship or cooperation

Purpose of processing:

We process your personal data in order to enter into agreements with the supplier or partner you represent, and to administer the agreement as well as the supplier relationship or cooperation.

Categories of personal data:

• First and last name

• Employer/company name and your job title

• Business telephone number and email address

• Your personal identity number (only sole proprietors)

• Bank account number and payment details (only sole proprietors)

This processing applies to:

• Suppliers and partners

• Potential suppliers and partners

Legal basis: Balancing of interests.

The processing is necessary for our legitimate interest to enter into agreements with the company you represent, and to administer the agreement as well as the supplier relationship or cooperation. We have assessed that our interest overrides your right not to have your personal data processed for this purpose.

Retention period: Your personal data is processed throughout the term of the contractual relationship and for up to 1 year after the contractual relationship has terminated, provided that there are no statutory requirements prescribing a longer retention period. For personal data that must be retained in accordance with the Swedish Accounting Act, see section 5.10.

5.3 To send information and marketing to you

Purpose of processing:

We process your personal data to send information and marketing to you as a corporate customer, potential corporate customer, supplier, partner, or potential supplier and partner.

This may, for example, concern product updates, new product launches, new partners, or additions to our service offering to you, or to your end customer (relatives).

Categories of personal data:

• First and last name

• Employer/company name and your job title

• Business telephone number and email address

This processing applies to:

• Corporate customers

• Potential corporate customers

• Suppliers and partners

• Potential suppliers and partners

Legal basis: Balancing of interests.

The processing of your personal data is necessary for our interest to send information and marketing to you as a corporate customer, potential corporate customer, supplier, partner, or potential supplier and partner. We have assessed that our interest overrides your right not to have your personal data processed for this purpose.

Retention period: As a corporate customer, supplier, and partner, your personal data is processed throughout the term of the contractual relation, provided that there are no statutory requirements prescribing a longer retention period. As a potential corporate customer or potential supplier and partner, your personal data is processed for up to 1 year. For personal data that must be retained in accordance with the Swedish Accounting Act, see section 5.10.

5.4 To conduct customer surveys and monitor internal procedures and policies

Purpose of processing:

We process your personal data to conduct customer surveys and monitor our internal procedures and policies.

Categories of personal data:

• First and last name

• Employer/company name and your job title

• Business telephone number and email address

• Your correspondence with us

This processing applies to:

• Corporate customers

• Potential corporate customers

Legal basis: Balancing of interests.

The processing of your personal data is necessary for our interest to carry out customer surveys and follow up on our internal procedures and policies. We have assessed that our interest overrides your right not to have your personal data processed for this purpose.

Retention period: Your personal data is processed throughout the term of the contractual relationship, provided that there are no statutory requirements prescribing a longer retention period. For personal data that must be retained in accordance with the Swedish Accounting Act, see section 5.10.

5.5 To enable communication with you when you contact us

Purpose of processing:

We process your personal data to answer any questions or otherwise communicate with you when you contact us via email, telephone, text message, or via our corporate social media accounts.

Categories of personal data:

• First and last name

• Employer/company name and your job title

• Telephone number and email address

• Your correspondence with us

This processing applies to:

• You who contact Arkivia

Legal basis: Balancing of interests.

The processing is necessary for our interest to answer any questions or otherwise communicate with individuals and representatives of companies who contact us. We have assessed that our interest overrides your right not to have your personal data processed for this purpose.

Retention period: The personal data is saved for up to three months unless circumstances clearly indicate otherwise and we need to save your data for a longer period of time in order to follow up on the correspondence, such as in ongoing matters that have not been concluded, or if we need to save the data for another purpose specified in this Privacy Notice.

5.6 To ensure basic website functions

Purpose of processing:

We process your personal data to provide, administer, and maintain our website for you as a website visitor, e.g., to remember whether you choose to consent to or decline the use of Cookies on our website.

This purpose is linked to Necessary Cookies. For more information, please see our cookie policy.

Categories of personal data:

• IP address

This processing applies to:

• Website visitors

Legal basis: Balancing of interests.

The processing of your personal data is necessary for our interest to ensure website functionality, i.e., to provide, administer, and maintain our website. We have assessed that our interest overrides your right not to have your personal data processed for this purpose.

Retention period: Please see our cookie policy for more information on how long we process your personal data for this purpose.

5.7 To compile statistics about our website

Purpose of processing:

We process your personal data to gain an understanding of how you and other website visitors use our website in order to further improve and develop our website.

This purpose is linked to Cookies for statistics. For more information, please see our cookie policy.

Categories of personal data:

• IP address

• Device data and usage data, such as browser, time zone, date and time of visit, page navigation, and clicks on pages, links, and videos

This processing applies to:

• Website visitors

Legal basis: Consent.

We process your personal data for the specified purpose based on your consent.

Retention period: Please see our cookie policy for more information on how long we process your personal data for this purpose.

5.8 To optimize page navigation and your visitor experience

Purpose of processing:

We process your personal data so that the website can remember information that changes the way the website behaves or looks to you. This is done in order to optimize page navigation and improve your visitor experience.

This purpose is linked to Cookies for statistics. For more information, please see our cookie policy.

Categories of personal data:

• IP address

• Device data and usage data, such as browser, time zone, date and time of visit, page navigation, and clicks on pages, links, and videos

This processing applies to:

• Website visitors

Legal basis: Consent.

We process your personal data for the specified purpose based on your consent.

Retention period: Please see our cookie policy for more information on how long we process your personal data for this purpose.

5.9 Behavioral analysis to enable the display of advertisements etc.

Purpose of processing:

We process your personal data to enable us and our third-party providers and advertisers to track you across devices and websites and to collect and process behavioral data and interactions in order to show you relevant advertisements and to save preferences.

This purpose is linked to Cookies for marketing. For more information, please see our cookie policy.

Categories of personal data:

• IP address

• Device data and usage data, such as browser, time zone, date and time of visit, page navigation, and clicks on pages, links, and videos

This processing applies to:

• Website visitors

Legal basis: Consent.

We process your personal data for the specified purpose based on your consent.

Retention period: Please see our cookie policy for more information on how long we process your personal data for this purpose.

5.10 To fulfill our legal obligations under the Swedish Accounting Act

Purpose of processing:

We may need to process information about you to comply with our legal obligations under the Swedish Accounting Act. This may involve reference details in invoices where the invoices constitute accounting records, or personal data in an agreement or other documentation that serves as a voucher for a bookkeeping entry that must be retained under the Swedish Accounting Act.

Categories of personal data:

• First and last name

• Employer/company name and your job title

• Business telephone number and email address

• Your personal identity number (only sole proprietors)

• Bank account number and payment details (only sole proprietors)

This processing applies to:

• Corporate customers

• Suppliers and partners

Legal basis: Legal obligation.

The processing of your personal data is necessary to fulfill our legal obligations under the Swedish Accounting Act.

Retention period: We retain your personal data for as long as required by law. Under the Swedish Accounting Act, accounting information must be retained for seven years, calculated from the end of the calendar year in which the financial year to which the information related was concluded.

5.11 To safeguard our interests in the event of a dispute

Purpose of processing:

We may need to process your personal data to safeguard our interests in the event of a dispute, such as to establish, exercise, or defend legal claims, e.g., in a dispute regarding payment.

Categories of personal data:

• First and last name

• Employer/company name and your job title

• Business telephone number and email address

• Your personal identity number (only sole proprietors and individuals)

• Bank account number and payment details (only sole proprietors and individuals)

• Other relevant information that you have provided

This processing applies to:

• Corporate customers

• Suppliers and partners

• You who contact Arkivia

Legal basis: Balancing of interests.

We process your personal data on the basis of a balancing of interests, as we assess that our interest in being able to establish, exercise, or defend legal claims overrides your rights and interest in not having your personal data processed for this purpose.

Retention period: Your personal data is saved for as long as necessary for us to safeguard our interests in the event of a dispute. For example, during the time the dispute is ongoing, until it is finally resolved.

5.12 To enable restructuring, sale, or winding up of Arkivia or our assets

Purpose of processing:

If Arkivia is to be restructured (e.g., divided into several different businesses) or if an external party wishes to acquire Arkivia or our customer database, Arkivia will disclose your personal data to the acquiring company. This may also occur in the event of a merger or if Arkivia is liquidated or enters into bankruptcy. In such cases, the acquiring company will continue to process your personal data for the same purposes as set out in this Privacy Notice, unless you receive other information in connection with the transfer. Certain personal data will also be shared with other companies as part of the process to enable a restructuring, sale, or winding up. In such cases, these parties have undertaken to observe confidentiality.

Categories of personal data:

• First and last name

• Employer/company name and your job title

• Business telephone number and email address

• Your personal identity number (only sole proprietors and individuals)

• Bank account number and payment details (only sole proprietors and individuals)

This processing applies to:

• Corporate customers

• Suppliers and partners

• You who contact Arkivia

Legal basis: Balancing of interests.

We process your personal data based on our legitimate interest to enable the restructuring, sale, or winding up of Arkivia or our assets, which we assess overrides your right not to have your personal data processed for this purpose. This is, however, subject to the condition that the acquiring or potentially acquiring company operates a business similar to Arkivia's.

Retention period: If Arkivia ceases to exist, e.g., through winding up such as merger, division, liquidation, or bankruptcy, or if Arkivia's customer database is transferred to an acquiring company, we will delete your personal data as long as we do not need to retain it to comply with legal requirements.

6. Balancing of interests

When Arkivia has specified ”balancing of interests” as the legal basis in the section above, it means that we have assessed that we or a third party have a legitimate interest in the processing. In addition to identifying the legitimate interest, we have also weighed this interest against your interests or fundamental rights and freedoms which require the protection of personal data. We can only base the processing on a balancing of interests if we have carried out this assessment and concluded that our or the third party's interest overrides your interests or fundamental rights and freedoms.

If we process your personal data on the basis of a legitimate interest, you can contact us via the contact details specified in section 2 to obtain further information about the balancing of interests assessment carried out. Please note that the balancing of interest assessments are general (e.g., based on an average individual in the relevant category) and that no individual assessment has been made.

7. Automated decision-making

We do not use automated processes to make decisions that significantly affect you.

8. How long do we retain your personal data?

We only retain your personal data for as long as it is needed for the purposes for which we collected the data in accordance with this Privacy Notice, provided that there are no statutory requirements prescribing a longer retention period. When we no longer need to retain your data, we remove it from our systems, databases, and backups unless we have a legal obligation to retain your personal data for a longer period. Read more about the specific retention periods in the sections above under section 5.

9. Which categories of recipients may we share your personal data with?

Arkivia may disclose your personal data to the following categories of recipients. For a detailed list of the recipients to whom we have disclosed data, please contact us via the contact details provided in section 2.

9.1 Data Processors

Arkivia may engage third parties to process your personal data on our behalf in their capacity as data processors. Such parties may only process your personal data in accordance with our instructions. We enter into data processing agreements with these parties and ensure that a high level of security is maintained to protect your personal data. We use the following types of data processors:

• IT and system providers - Arkivia may share your personal data with IT and system providers to manage necessary operation, technical support, and maintenance of our IT services.

• Marketing and communication agencies - and other companies providing marketing services - Arkivia may share your personal data with marketing and communication agencies and other companies providing marketing services engaged to assist Arkivia with marketing communication, e.g., to send a request for a review or a recommendation.

• Cookie providers - Arkivia may share your personal data with the cookie providers specified in our cookie policy.

• Other suppliers - Arkivia may share your personal data with suppliers of customer management systems, invoicing systems, communication solutions (including email), databases, financial systems, printing, and distribution to Arkivia.

9.2 Independent Data Controllers

Arkivia may share personal data with parties who are independent data controllers. Independent data controller means that the party independently determines the purposes for which and the means by which the personal data is processed. When sharing occurs with these parties, their privacy notice applies to the processing of personal data they perform, and they have an obligation to inform you of the processing:

• Public authorities and law enforcement - Arkivia may in certain cases need to disclose data to courts and law enforcement and investigative authorities (e.g., the Swedish Police Authority) in accordance with law or within the framework of a legal process. In some cases, we may also need to disclose data to other parties within the framework of court proceedings or similar. Such disclosure is made on the basis of a balancing of interests as the legal basis or to comply with a legal obligation under the law.

• External advisors - Arkivia may share your personal data with external advisors such as auditing firms or law firms in accordance with law or to obtain advice. These parties typically act as independent data controllers, and disclosure usually takes place on the basis of a balancing of interests as the legal basis.

• Acquiring companies - If Arkivia is to be restructured (e.g., divided into several different businesses), or if an external party wishes to acquire Arkivia or our customer database, Arkivia will disclose your personal data to the acquiring company. This may also occur in the event of a merger or if Arkivia is liquidated or enters into bankruptcy. In such cases, the acquiring company will continue to use your personal data for the same purposes as set out in this Privacy Notice, unless you receive other information in connection with the transfer, provided that the acquiring company operates a business similar to Arkivia's. Certain personal data will also be shared with other companies as part of the process to enable a restructuring, sale, or winding up of Arkivia or our assets. This is described in more detail under section 5.12.

• Social media - If you contact Arkivia via our corporate social media accounts, the social media platforms will process your personal data in accordance with their respective privacy notices as independent data controllers.

10. Where do we process your personal data?

Arkivia strives to process your personal data within the EU/EEA. Under certain circumstances, we may need to transfer your personal data to a country outside the EU/EEA (”Third Country”). In the event of a transfer to a Third Country, Arkivia always ensures that the same high level of protection applies even when the data is transferred to a Third Country.

Please contact us via the contact details provided in section 2 for more information about our transfers or to obtain a copy of relevant documentation regarding the protective measures taken. You can also read more on the Swedish Authority for Privacy Protection's website regarding what applies under the GDPR for transfers to Third Countries and appropriate safeguards.

Adequate level of protection for transfers outside the EU/EEA

We may transfer your personal data to recipients in countries that the European Commission has decided ensure an adequate level of protection. This means that the European Commission has assessed that the level of protection in that country corresponds to that within the EU/EEA, and that it is therefore possible to transfer personal data to such a country without taking further security measures. You can find more information about which countries are covered by adequacy decisions on the European Commission's website.

The European Commission has also decided that the USA ensures an adequate level of protection provided that the recipient is covered by the so-called EU-US Data Privacy Framework (”DPF”). Arkivia may transfer your personal data to the USA and, in such cases, ensures that the receiving party (the data importer) is certified under the DPF, if no other appropriate safeguards are in place.

Appropriate safeguards for transfers outside the EU/EEA

If your personal data is transferred to a Third Country outside the EU/EEA that is not covered by a decision of the European Commission on an adequate level of protection or certified under the DPF, we will ensure that appropriate safeguards are in place. Appropriate safeguards may consist of the party transferring the personal data to a Third Country (the data exporter) and the party importing the personal data into a Third Country (the data importer) having entered into the European Commission's standard contractual clauses for international transfers, or that other protective measures have been taken. In the event that these safeguards are not sufficient, we will ensure that supplementary contractual, technical, or organizational measures are also taken to ensure a level of protection substantially equivalent to that within the EU for the personal data transferred to the Third Country. You can find more information about the European Commission's standard contractual clauses on the Swedish Authority for Privacy Protection's website.

11. Your rights

11.1 Our responsibility for your rights

In its capacity as data controller, Arkivia is responsible for ensuring that your personal data is processed in accordance with applicable data protection legislation and that you are able to exercise your rights under the GDPR. You can find more information about your rights in the sections below and on the Swedish Authority for Privacy Protection's (IMY's) website. You can contact us at any time via the contact details specified in section 2 of this Privacy Notice to exercise your rights. If you wish to exercise any of your rights, do not forget to specify which right your request refers to.

Timeframes

Arkivia is obliged to respond to your request to exercise your rights within one month of receiving your request and to inform you of the measures we have taken. In the event that a request is complex or if we have received a large number of requests, we have the right to extend the period by a further two months (i.e., at the latest three months from receipt of the request). We will notify you of any such extension, including the reason for the extension, within one month. If we do not take any action in response to your request, we are obliged to notify you within one month of receiving your request at the latest of: i) the fact that action has not been taken, ii) the reason for this, and iii) your right to lodge a complaint with the supervisory authority and seek a judicial remedy.

As a rule, it is free of charge

All information, communication, and all measures we carry out are free of charge for you. If requests made in connection with your rights are manifestly unfounded or excessive, we have the right to either charge a reasonable administrative fee to provide the information or carry out the requested action. We may also refuse to comply with your request.

We may need to identify you

If we have reasonable doubts concerning the identity of the person making the request, we may request additional information necessary to confirm your identity. We will not collect more information than is necessary.

11.2 Your right of access, rectification, erasure, and restriction

Under the GDPR, you have certain rights in relation to the data we process about you, which are described below. Some of these rights apply under certain conditions, which you can read more about below. You have the right to request the following rights.

a) Access to your personal data ("register extract") - To enable you to check whether processing of your personal data is taking place and whether the processing is lawful, you have the right to request a register extract. This means that you have the right to obtain confirmation as to whether we process your personal data and, if so, to obtain a copy free of charge of the personal data we process about you. If you are only interested in a certain type of data or data processed for a specific purpose (such as direct marketing), please specify this in your request. In connection with the register extract, you will also receive information about the processing, such as why we process your personal data, how long the personal data will be stored (if possible), to whom your personal data has been or will be disclosed, etc. For any further copies you request, we have the right to charge a reasonable administrative fee to cover our administrative costs. If you make a request in electronic format, e.g., via email, we will provide you with the information in a commonly used electronic format, unless you request otherwise.

b) Rectification of your personal data - If we process personal data that is inaccurate, you have the right to request to have it rectified. We will also, on our own initiative, rectify or erase data that we discover is inaccurate. You also have the right to supplement incomplete personal data by providing a supplementary statement.

c) Erasure of your personal data - In certain cases, you have the right to have your personal data erased. This applies if:

• the personal data is no longer necessary for the purposes for which it was collected or otherwise processed,

• we process your personal data based on your consent and you withdraw your consent, provided that there is no other legal basis for the processing of the personal data,

• we process your data for direct marketing purposes and you object to this processing,

• you object to our processing of your data which takes place after a balancing of interests or on the basis of a public interest, and we lack legitimate grounds for the processing that override your interests, rights, and freedoms,

• we have processed the personal data unlawfully, or,

• we have a legal obligation to erase the personal data.

There are exceptions to the right to erasure

There may be requirements in law or other compelling legitimate grounds that prevent us from erasing your personal data. A compelling legitimate ground may, for example, be to establish, exercise, or defend against legal claims, or for archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes.

d) Restriction of processing - This means that we temporarily restrict the processing of your personal data so that it is only processed for certain limited purposes. We will inform you before the restriction of processing is lifted. You have the right to request restriction when:

• you believe your data is inaccurate and you have requested rectification under point 11.2 b), during the time we verify the accuracy of the data,

• the processing is unlawful and you do not want the data erased,

• we, as data controller, no longer need to process the personal data for the purposes of the processing, but you need it to be able to establish, exercise, or defend a legal claim, or,

• you have objected to use under section 11.3, pending verification of whether our legitimate grounds override your legitimate grounds.

We will take all reasonable steps we can to notify all recipients who have received personal data in accordance with section 9 above if we have rectified, erased, or restricted access to your personal data after you have requested us to do so, provided that this is not impossible or would involve a disproportionate effort. At your request, we will inform you about the parties to whom we have disclosed personal data.

11.3 Your right to object to our processing of your personal data

You have the right to object to such processing of your personal data that takes place on the basis of a balancing of interests or public interest as a legal basis (see section 5 above). You must specify the grounds for your objection relating to your specific situation. If you object to processing, we will only continue the processing if we have compelling legitimate grounds to continue the processing and these override your specific grounds, other interests, rights, and freedoms, or if the processing is necessary to establish, exercise, or defend legal claims.

11.4 Your right to object to direct marketing, including profiling

If you do not want us to process your personal data for direct marketing, which includes profiling carried out for direct marketing purposes, you always have the right to object to such processing, including profiling, by contacting us. Once we have received your objection, we will cease processing your personal data for this purpose. In the event that you receive marketing mailings from us via email and text message, you can also click on our opt-out link which you will find at the bottom of each email and text message mailing.

11.5 Your right to withdraw your consent

If we process your personal data on the basis of your consent as the legal basis (see section 5 above), you have the right to withdraw your consent at any time by contacting us. We will then not be entitled to continue the processing in question unless there is another legal basis for the processing. You can find our contact details in section 2 of this Privacy Notice.

Marketing mailings

In the event that you wish to withdraw a consent you have given us to receive our marketing mailings via email or text message, you can choose between contacting us to withdraw your consent or clicking on our opt-out link which you will find at the bottom of each email mailing.

Cookies

If you have given your consent to the placement of Cookies on our website, you can withdraw your consent by clicking on the icon at the bottom of our website and then clicking on ”necessary only”.

11.6 Your right to data portability

You have the right to data portability when we process your personal data by automated means and if we base our processing of your personal data on the legal basis of consent or to perform an agreement you have entered into with us. Your right to data portability means that you have a right to obtain a portion of your personal data in a structured, commonly used, and machine-readable format and to transfer this personal data to another data controller. You can also request that we transfer the personal data directly to another data controller, provided that such direct transfer is technically feasible.

11.7 Your right to lodge a complaint with the relevant supervisory authority

You always have the right to lodge a complaint with the relevant supervisory authority if you consider that our processing of your personal data violates the GDPR. This applies in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement. The supervisory authority in Sweden is the Swedish Authority for Privacy Protection (IMY). You can contact IMY via imy@imy.se or via the contact details specified on IMY's website.

12. We protect your personal data

You should always feel secure when we process your personal data. We have taken both technical and organizational security measures, which include access restrictions and regular internal checks, to protect your personal data against, for example, unauthorized access, alteration, and loss. If a personal data breach should occur that may affect you or your personal data in a significant way, e.g., in the event of a risk of fraud or identity theft, we will contact you to explain what has happened and advise you on how you can mitigate the risk of potential adverse effects.

13. Cookies and similar technologies

We use Cookies on our website and in our services to, among other things, improve your experience with us and adapt our services to your needs and preferences. In our cookie policy, we explain in more detail how we use Cookies and the choices you have made regarding our Cookies. See our cookie policy for more information.

14. Changes to this Privacy Notice

Arkivia may amend this Privacy Notice. In the event of an amendment, you will receive clear information about the amendment and what it means for you in good time before the amended version takes effect. This applies provided that the amendment is not merely linguistic or editorial but involves a fundamental change to the processing itself, or in the event that the amendment is not a fundamental change but we assess that it is relevant and affects you. If a change to the processing of your personal data requires consent to be obtained, you will be notified of this and given the opportunity to provide your consent.

You will always find the latest version of the Privacy Notice on our website, and we specify the date of the latest update at the top of the Privacy Notice.