1. Data Controller
Kontorsyta Väst AB ("we", "us", "our") is the data controller responsible for your personal data.
- Company: Kontorsyta Väst AB
- Organisation number: 559123-4567
- Address: Avenyn 22, 411 36 Göteborg, Sweden
- Email: [email protected]
- Phone: +46 31 711 4480
2. Scope
This Privacy Policy applies to personal data collected through our website (kontorsytavast.se), contact forms, email correspondence, phone calls, and during the provision of office planning services. It is designed to comply with the EU General Data Protection Regulation (GDPR), the Swedish Data Protection Act (Dataskyddslagen 2018:218), and supplementary guidance from Integritetsskyddsmyndigheten (IMY).
3. Personal Data We Collect
3.1 Data you provide directly
- Identity data: full name, job title, company name
- Contact data: email address, phone number, postal address
- Communication data: messages sent via contact forms, email, or phone
- Project data: floor plans, occupancy data, headcount figures, and workplace requirements you share during planning engagements
- Consent records: timestamps and scope of consents you have given
3.2 Data collected automatically
- Technical data: IP address, browser type and version, operating system, device type
- Usage data: pages visited, time spent, referral source, click patterns
- Cookie data: as described in our Cookie Policy
3.3 Data from third parties
- Business contact information from publicly available sources (e.g. company registries)
- Referral data from partners who introduce you to our services (with your knowledge)
4. Purposes and Legal Bases
We process personal data only where a legal basis under Article 6 GDPR applies:
- Contract performance (Art. 6(1)(b)): To deliver office planning services, issue invoices, and manage project communications.
- Legitimate interests (Art. 6(1)(f)): To respond to enquiries, improve our website, prevent fraud, and maintain business records. Our legitimate interests are balanced against your rights and freedoms.
- Consent (Art. 6(1)(a)): For non-essential cookies, marketing emails, and processing of occupancy/badge data where required. You may withdraw consent at any time.
- Legal obligation (Art. 6(1)(c)): To comply with Swedish accounting, tax, and employment law requirements.
5. Special Categories of Data
We do not intentionally collect special categories of personal data (e.g. health, ethnicity, trade union membership). If occupancy or workplace data you provide incidentally contains such information, we will process it only with your explicit consent (Art. 9(2)(a) GDPR) or as necessary for occupational health and safety obligations (Art. 9(2)(b)).
6. Data Sharing and Processors
We do not sell personal data. We may share data with:
- Service providers (processors): Cloud hosting (within the EU/EEA), email services, accounting software, and project management tools. All processors are bound by data processing agreements (DPAs) under Article 28 GDPR.
- Professional advisers: Lawyers and accountants, bound by confidentiality.
- Public authorities: When required by law (e.g. Skatteverket, Bolagsverket).
A current list of sub-processors is available on request at [email protected].
7. International Transfers
We store and process data primarily within the EU/EEA. If a transfer outside the EEA becomes necessary, we will ensure appropriate safeguards under Chapter V GDPR — such as Standard Contractual Clauses (SCCs) approved by the European Commission — and inform you of the transfer, its purpose, and the safeguards applied.
8. Retention Periods
- Enquiry and contact form data: 24 months after last contact, unless a project begins
- Project and contract data: duration of contract plus 7 years (Swedish accounting law)
- Marketing consent records: until consent is withdrawn, plus 3 years for audit purposes
- Website analytics: 26 months (aligned with standard analytics retention)
- Cookie consent logs: 12 months
After retention periods expire, data is securely deleted or anonymised.
9. Your Rights Under GDPR
As a data subject, you have the following rights:
- Right of access (Art. 15): Request a copy of personal data we hold about you.
- Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
- Right to erasure (Art. 17): Request deletion where data is no longer necessary, consent is withdrawn, or processing is unlawful.
- Right to restriction (Art. 18): Request that we limit processing in certain circumstances.
- Right to data portability (Art. 20): Receive your data in a structured, machine-readable format where processing is based on consent or contract.
- Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing.
- Rights related to automated decision-making (Art. 22): We do not use automated decision-making or profiling that produces legal effects.
To exercise any right, email [email protected] with the subject line "GDPR Request". We respond within 30 days. We may request identity verification before processing your request.
10. Right to Lodge a Complaint
If you believe we have not handled your data correctly, you have the right to lodge a complaint with:
- Integritetsskyddsmyndigheten (IMY)
- Box 8114, 104 20 Stockholm, Sweden
- Website: www.imy.se
We encourage you to contact us first so we can address your concern directly.
11. Data Security
We implement appropriate technical and organisational measures under Article 32 GDPR, including:
- TLS encryption for data in transit
- Access controls and role-based permissions
- Regular backups with encrypted storage
- Staff training on data protection and confidentiality
- Incident response procedures with 72-hour breach notification to IMY where required (Art. 33)
12. Data Protection Officer
Kontorsyta Väst AB has appointed an internal data protection contact. Reach them at [email protected] with the subject line "DPO".
13. Children's Data
Our services are directed at businesses and professionals. We do not knowingly collect data from individuals under 16. If we become aware of such data, we will delete it promptly.
14. Changes to This Policy
We may update this Privacy Policy to reflect legal or operational changes. Material changes will be posted on this page with an updated date. Where required, we will seek renewed consent.
15. Contact
For any privacy-related questions:
- Email: [email protected]
- Phone: +46 31 711 4480
- Post: Kontorsyta Väst AB, Avenyn 22, 411 36 Göteborg, Sweden