On this page we provide comprehensive information about the personal data processing operation for which we are responsible. You can also visit the Swedish Authority for Privacy Protection, www.imy.se, for further information on personal data processing.
Swedac protects your personal data with the necessary measures and you always have the right to contact us to find out what personal data we have registered about you.
Why does Swedac process your personal data and what are the legal grounds for it?
Swedac collects and process the personal data that you personally provide when you contact us, and the personal data that is forwarded to us from other persons in connection with for instance a complaint, an application or a request to obtain public documents etc. We may also collect and process information from public and/or public sources such as other authorities.
How do we handle your personal data?
Principle of public access
Swedac is an authority. Messages sent to us are therefore, as a general rule, public documents which are registered and which will be handed over on request unless the information is covered by confidentiality. In other words, personal data may be disclosed in accordance with the principle of public access. As long as it is not essential for the confidentiality assessment, we have not right to enquire to whom the data are disclosed.
The processing of personal data required in the Public Access to Information and Secrecy Act, the archival legislation and the Administrative Procedure Act for the correct handling of the authority´s public documents, and carried out under the EU Data Protection Regulation, is considered necessary for reasons of important public interest.
Enrolment to training sessions, seminars and conferences
We process personal data in the form of name and e-mail address when you register for trainings, seminars and conferences. We process your information in order for us to administer the enrolment application and to follow up the work. The legal basis for the process is to fulfil the contract concluded in connection to your enrolment application and to perform a task of public interest.
Application for work and contracts for other assignments with us
We process personal data when an application for work is submitted to us. The personal data is processed for us to be able to administer the application and fill the position. The procedure of filling the position is a part of our exercise of authority and other processes to carry out tasks of public interest. The data is saved for two years before they are culled except for the application that led to employment which is not culled at all.
We process your personal data if you have a contract with us to perform assessment services or if you have expressed interest in performing assessment assignments with us. In addition to our usual contact details, we also process information about your skills to staff our assessment assignments in an appropriate way. The processing of contracts for the performance of assessor services is carried out as part of our exercise of authority and is carried out as an act of public interest.
E-mail and e-services
We process personal data such as name, e-mail address and any further information submitted when you e-mail the authority. The processing takes place in order for us to be able to communicate with you and to meet availability and service requirements. The legal basis for the processing is to perform an act of public interest or to fulfil a legal obligation.
We process the personal data you provide and further submitted information, such as logs when you use our e-services. The legal basis for the processing is that it is necessary as part of our exercise of authority and for carrying out an act of public interest.
Processing and handling of matters
We process the personal data that we need to be able to process and handle all kinds of matters that are part of our operations. The personal data processed are those that we need to handle the matter, to communicate with the parties and contact persons and to be able to carry out the tasks we have in accordance with our instruction (Regulation (2021:1252) with instructions for the Swedish Board for Accreditation and Conformity Assessment). These processing operations are necessary in the exercise of authority.
Public procurement and conclusion of contracts
We process personal data in the form of names and contact information to communicate and process matters of procurement. The legal basis for the processing operation is to carry out a task of public interest. When we enter into an agreement, we process the data for the purpose of implementing the agreement follow-up, invoice management and financial follow-up. The legal basis for the processing is the fulfilment of the contract.
Personal data on social media
We have accounts with LinkedIn, Facebook and Instagram. The purpose of this is to provide information about the activities of the authority. If you write comments or contact us via social media, this information is transferred to the company that owns the social media. These companies are based outside of EU/EES, which means that the transfer takes place to what is known as third countries. The information will also become public documents. The legal basis is a task of public interest.
Subscriptions
We process personal data in connection with the subscription of our press releases and newsletters. The processing is done to enable us to administer the subscription and to send information. The legal basis is to fulfil the agreement entered into in connection with the notification as subscriber.
Councils and committees
We process your personal data if you are a member of one our various councils such as the Market Surveillance Council or the Transparency Council. The same thing goes if you are on any of the committees Swedac organised. The processing is necessary as part of our exercise of authority.
Who has access to your personal data?
Those who can access your personal data are employees at Swedac who need them in order to perform their tasks. We may also need to disclose documents that contain personal data to a party of a matter in order to comply with the rules on communication and party transparency.
Swedas has agreements with data processors for, among other things, certain IT services that access and process personal data on our behalf. These data processors may only process personal data according to the purposes and instructions we provide and Swedac is responsible for the processing. If the personal data is contained in a public document, they may be disclosed upon request for access to such document if they are not covered by confidentiality.
Do you transfer my personal data to a third country?
Personal data will not be transferred to third country except in those instances where you comment or like any of our social media posts. We do not sell personal data to third parties.
How long does Swedac keep data about you?
As an authority, the archival legislation requires the authority to keep public documents. We follow these rules of preservation and cull public documents in accordance with the applicable rules regarding culling and decisions. For Swedac, this means that at present no public documents are opened unless they are considered to be of minor or temporary importance. Personal data which are not part in a public document are stored only for as long as they are necessary for the purpose for which they are processed.
Documents not considered public include draft decisions and notes that have not been archived. When a matter has been closed, an assessment is made of what is to be kept according to the archival legislation. Documents containing personal data that are not to be kept are deleted or culled of personal data.
Your rights as registered
Right of access
You have the right to request information from us free of charge about which of your personal data we process and how we process it, a so-called register extract. Your request must include your social security number. The register extract will be sent to your residential address according to the national population register.
Requests for register extracts are sent to registrator@swedac.se or to Swedac, Box 878, 501 15 Borås.
Right to rectification and deletion
At your request or on our own initiative, we will correct personal data about you that is inaccurate or misleading or restrict the processing of such personal data. You have the right to have your personal data deleted under certain circumstances. If such a request is made, Swedac will conduct a review if there are reasons for deleting the personal data. When your personal data is needed for us to fulfil our assignment or if your personal data is shown in a public document, we have no possibility to delete the data unless we have support for such culling.
Right to object
You have the right to object to our processing of your personal data. You also have the right to object if you consider that your personal data is used for communication and information in an incorrect way. We will then review whether we should stop processing your personal data for such purposes.
Right to complain to the Swedish Authority for Privacy Protection
If you are dissatisfied with, or have comments on, how we process your personal data, you can submit a complaint to the Swedish Authority for Privacy Protection (www.imy.se).
Automated decision making
We do not perform any automated decision making or profiling based on your personal data.
Update of this information: This information has been established and updated in February 2024. We reserve the right to update and revise the information depending on new legal requirements and how we process personal data.
Contact Information
If you have any questions about our processing of your personal data, please feel free to contact us via registrator@swedac.se or by phone 0771-99 09 00.
Data Protection Officer
You are also welcome to contact Swedac Data Protection Officer at dataskyddsombud@swedac.se.