Data & Privacy Policy

When you, as the recipient, actively accept the Talent Search Data & Privacy Policy, you give Talent Search AB your consent to store and process your personal information as described below.

Background: Policy on the Processing of Personal Data

Talent Search AB, corporate registration number 559228-1298, (”the Company”/”the Business”) provides placement services for interim consultants (”the Service”). The Company targets companies (”the Client”) with temporary needs for qualified personnel, as well as consultants (”the Consultant”) who are interested in consulting assignments. The Company is the data controller for the personal data pertaining to the Client/Consultant that the Company collects and processes in connection with the storage of Clients’ and Consultants’ information for the purpose of providing the Service.

The Client’s and the Consultant’s personal data may be transferred to other companies in connection with background checks, credit checks, and reporting to, for example, the Swedish Tax Agency. Information is also transferred between the Client and the Consultant to the extent necessary for the provision of the Service. In this document, the Company describes how personal data is processed in accordance with the provisions of the General Data Protection Regulation (”GDPR”). For more information about the GDPR, please visit The Privacy Authority's website. The company’s processing of personal data requires the appointment of a data protection officer in accordance with Article 37.1(a)-(c) (DSF) 4.1:1.

Data Protection Officer for Talent Search AB
Linda Kvarnström (CEO)
Email: linda.kvarnstrom@talentsearch.se

The Rights of Data Subjects

Information must be provided to data subjects in an easily accessible form, using clear and plain language, and must include the following: information about the data controller, contact information for the data controller’s representative, and, where applicable, contact information for the data protection officer; the purpose and legal basis of the processing, if the processing is based on Article 6(1)(f); a definition of legitimate interests, recipients or categories of recipients, and the transfer of personal data to a third country. To further ensure fair and transparent processing, the following information must be provided: the retention period, if possible, or the criteria for determining that period, the data subject’s rights; if the processing is based on consent, that consent may be withdrawn; the right to lodge a complaint; whether the provision of personal data is a statutory or contractual requirement; and the existence of automated decision-making. Whether there are procedures in place to inform data subjects about the personal data being collected.

If you are registered in Talent Search’s database, you have the right at any time to know what personal information the Company has stored about you. You also have the right to update your information with us, and you have the right to have your data deleted or to be “forgotten” in the system. When you register your information with us, you actively consent to our processing of your personal data. You may withdraw your consent at any time, in which case we will delete your information from our records. We continuously delete data that no longer serves its purpose, as well as data that has not been updated in five (5) years.

As a Customer or Consultant, you have the right to request, free of charge, information about or correction of the personal data concerning you that is processed by the Company. As a Customer or Consultant, you also have the right to restrict our processing of your personal data, request that the processing cease, and receive the personal data you have provided to the Company in a structured, widely used, and digital format, and to transfer this data to another data controller without the Company preventing it. If the Customer or Consultant is dissatisfied with the Company’s processing of personal data, the Customer or Consultant has the right to file a complaint with the Privacy Policy department or with the equivalent authority in the country where the Customer lives or works. Procedures to accommodate your rights have been established, and all you need to do is contact Talent Search’s Data Protection Officer.

Company Principles: Processing of Personal Data

The company has established policies and procedures to ensure that personal data is processed in accordance with the requirements of Article 5 (DSF). The company’s management system includes instructions on how information may be collected, stored, processed, and shared. Under the General Data Protection Regulation (GDPR), Talent Search AB is the data controller for the processing of all personal data within the company, except in cases where the company processes personal data on behalf of another party and acts as a data processor. The processing of personal data within the company is permitted only if there is a legal basis for such processing and only for as long as the purposes of the processing remain valid. Processing personal data in a manner inconsistent with the original purpose is not permitted unless consent has been obtained from the data subject. Personal data shall only be processed by employees with expertise in the field and shall be handled, stored, updated, and deleted in accordance with established procedures and with sufficiently high security standards.

All individuals affected by this policy shall be informed about how and why their personal data is processed by the Company. As a data subject, you have the right to know who is the contact person responsible for the processing of personal data, as well as any data processors and their identities. When personal data is to be deleted, as well as the rights of data subjects under the GDPR. Personal data within the Company is processed lawfully based on the legal basis for each category pursuant to Articles 6 and 9 of the GDPR. Personal data within the Company is processed fairly for each category in accordance with Article 5.1(a) of the GDPR. This means that the Company has procedures in place to ensure the accuracy of the data.

Personal data within the Company is processed in a transparent manner, and the Company has procedures and policies in place to support each category under Article 5.1(a) (GDPR). Personal data within the Company is collected and processed only if there are specific, explicitly stated, and legitimate purposes, as required by Article 5.1(b) of the GDPR. Personal data within the Company must at all times be adequate, relevant, and not excessive in relation to the purposes for which it is processed, in accordance with Article 5.1(c) of the GDPR. All personal data collected is necessary for the Company to provide the Service. Personal data held by the Company is not stored for longer than is necessary for the purposes for which it is processed, Article 5.1(d) (GDPR). The Company has documented procedures for archiving and deletion in the Company’s Business Management System. Personal data within the Company is processed in a manner that ensures appropriate security of the personal data, in accordance with Article 5.1(f) of the GDPR.

Data Protection in the Processing of Personal Information

When the Company processes personal data, it shall assess the risks to individuals’ rights and freedoms based on the nature, scope, and purpose of the data. Sensitive personal data shall be given special consideration and handled via encrypted digital transmission. Pay stubs and the transfer of personal data to third parties must not be sent via email that is not encrypted or otherwise made unidentifiable to anyone other than the recipient with the key.

Security
Through an external system provider, Talent Search has access to systems with features that enable secure data management. The provider stores the information in encrypted form and performs continuous security updates to prevent breaches. The company has implemented the organizational and technical measures listed below to achieve an appropriate level of security for the processing of personal data:

The business uses encryption to process personal data. The business has restricted access to personal data so that only authorized individuals have access. To prevent data breaches, two-factor authentication is used for access to the database. In addition to standard encryption, the Company has an additional security program to quickly detect data breaches through the website (www.talentsearch.se and www.andcompany.se). The company, through its provider, continuously monitors any alerts received via email from the provider’s monitoring system and initiates troubleshooting in the event of a breach. The website is monitored around the clock by the provider’s monitoring system, which checks and issues alerts based on the following monitoring points when, according to the provider, they fall outside normal ranges.

Access to Data
Access to personal data shall be access-controlled and limited to authorized personnel and the data subject. To ensure confidentiality and privacy, everyone who has access to personal data within the organization has signed a confidentiality or non-disclosure agreement to ensure confidentiality and privacy. The following Employees, Partners, and Suppliers may be granted access to personal data relating to all categories: Employees, Suppliers, Consultants, and Customers.

Employees
All employees of the Company have signed the Personal Data Handling Policy to ensure that personal data is handled in accordance with the Talent Search Data & Privacy Policy.

Partners & Suppliers
All partners have signed a Data Processor Agreement to ensure that data processing is conducted in accordance with the Talent Search Data & Privacy Policy.

Access to recipients within the EU
Google Sweden AB
Stockholm
Corporate ID Number
556656-6880
Business: Data Processing & Hosting

Paloma in Sweden, Inc.
Hedemora
Corporate ID No. 556709-3090
Business Activities: Software Publishing

Gaffla AB
Stockholm
Corporate ID Number
559132-2051
Business: Advertising, Public Relations, Media Agency & Ad Sales

LilaTech AB
Stockholm
Corporate ID Number
559290-2380
Computer Programming

Actsec Security AB
Nacka
Corporate ID No. 556984-3872
Business Activities: Consulting services related to corporate organization.

GetAccept AB
Malmö
Corporate ID No. 559023-1402
Business Area: Computer Programming

UC Business Information AB
Stockholm
Corporate ID No. 556730-7367
Business: Web Portals

Creditsafe in Sweden AB
Gothenburg
Corporate ID No. 556514-4408
Business Activities: Debt Collection and Credit Reporting Services

Add & Subtract Redovisningspoolen AB
Stockholm
Corporate ID No. 556220-5467
Business: Accounting & Bookkeeping

Grant Thornton Sweden AB
Stockholm
Corporate ID No. 556356-9382
Audit Services

Access to Recipients Outside the EU
Zoho Corporation
4141 Hacienda Drive
Pleasanton,
California 94588, USA

Awareness within the organization

The company's management consists of
Linda Kvarnström, CEO
Stefan Granqvist, Owner
Wictor Bonde, Owner

The Board of Directors consists of
Stefan Granqvist
Wictor Bonde
Mia Klingvall

Employee Training
Company management and the board of directors are well-informed and aware of what the General Data Protection Regulation entails and what their responsibilities are. To ensure that all employees follow Talent Search’s guidelines regarding data collection, processing, and storage, one employee is responsible for conducting internal training sessions. These training sessions are a mandatory part of the company’s onboarding process for new employees and are a standing item on the agenda at the company’s annual meeting, which takes place in August. Both the onboarding training and the ongoing training sessions cover topics such as:

General Data Protection Regulation – What does the GDPR cover, what is its purpose, and how do we ensure compliance?
Search Criteria – How do we ensure that our selection process is in line with the company's policies against discrimination and unequal treatment?
Meeting Notes – What information is essential to collect for personnel evaluations, and how may it be processed?
Data Processing – How do we ensure that information obtained during background checks, reference checks, and interviews is processed and stored in a secure, ethical, and lawful manner?

Physical Storage of Personal Data
Talent Search is a paperless company to the greatest extent possible, in accordance with the company’s environmental policy. This means that a minimum amount of paper is printed. Information deemed necessary in physical format—such as resumes and meeting notes—is shredded immediately after being entered electronically. Documents containing personal information that are stored in binders are kept in lockable cabinets.

Inventory and Continuous Updating of Personal Data

The data controller responsible for the processing of personal data in the organization is Stefan Granqvist, CEO. This responsibility means that the data controller must implement, continuously review, and, when necessary, update appropriate technical and organizational measures to ensure and be able to demonstrate that the processing is carried out in accordance with the Data Protection Act.

The Company has designated an employee who continuously ensures that the data stored and processed by the Company is relevant and up-to-date. This employee reports to the Data Protection Officer, Stefan Granqvist. As part of this review, inaccurate data is corrected or supplemented, and it is routinely verified that consent has been given for the processing of personal data.

System Vendors
Aloq AB
Östersund
Corporate ID No. 556755-7078
Business Area: Computer Programming

Zoho Corporation
4141 Hacienda Drive
Pleasanton,
California 94588, USA
Business Operations CRM System

Awave AB
Yngligagatan 2, 113 47 Stockholm
Business: Web Design

Sale and Disclosure of Data
Talent Search does not sell or disclose any data to third parties other than the specified Suppliers & Partners.

How Long Data Is Stored
The general rule is that data is retained for a maximum of five (5) years from the date of its last update.

Email Management
All emails must be deleted or purged unless they are essential to an assignment, ongoing work, or in the Company’s interest. In the absence of another legal basis, consent must be obtained to retain the information. All web publishing is voluntary, and information is published only with consent. In the event of an incident, unless it is unlikely that the incident poses a risk to the freedoms and rights of individuals, a report must be filed with the supervisory authority within 72 hours. If the incident could result in individuals being exposed to serious risks, the data subjects must also be informed of the event.

Email Campaign
For recipients of email newsletters and/or email advertisements, Talent Search AB stores only the email address. No other information—such as personal details, employer information, or other data—is stored. We do not sell or distribute our email lists to third parties for commercial purposes, nor do we transfer data outside the EU. The legal basis and purpose of processing personal data for the above category is consent pursuant to Article 6(a) of the GDPR. The purpose is to highlight available consultants and news via email newsletters. The consultants featured have either given their active consent to be included in the email campaign (though always under a pseudonym) or are example profiles based on consultants whom Talent Search AB typically places with client companies. As a recipient, you have the right at any time to request information about what data is stored about you by emailing the Data Protection Officer. You also have the right to be forgotten and to have your personal data corrected. If at any time you wish to withdraw your consent, please contact the Data Protection Officer.

Access to recipients within the EU
Paloma in Sweden, Inc.
Hedemora
Corporate ID No. 556709-3090
Business Activities: Software Publishing

Personal Information for the EMPLOYEES Category

The organization processes personal data for the “Employees” category; the personal data processed for employees includes: Name, Social Security number, home address, email, phone number, bank account information, health information. The legal basis and purpose of the processing of personal data for the above category are: Consent pursuant to Article 6(a) (DSF). The data subject has given consent to the processing of his or her personal data for one or more specific purposes. That it is necessary for the performance of a contract pursuant to Article 6(b) (DSF). That it is necessary to protect the vital interests of the data subject or another natural person pursuant to Article 6(d) (DSF). The person responsible for the processing of personal data in the above category at the company is: Stefan Granqvist. The company does not engage any data processors for the processing of personal data in this category.

Access to recipients within the EU
Google Sweden AB
Stockholm
Corporate ID Number
556656-6880
Business: Data Processing & Hosting

Paloma in Sweden, Inc.
Hedemora
Corporate ID No. 556709-3090
Business Activities: Software Publishing

Gaffla AB
Stockholm
Corporate ID Number
559132-2051
Business: Advertising, Public Relations, Media Agency & Ad Sales

LilaTech AB
Stockholm
Corporate ID Number
559290-2380
Computer Programming

Actsec Security AB
Nacka
Corporate ID No. 556984-3872
Business Activities: Consulting services related to corporate organization.

GetAccept AB
Malmö
Corporate ID No. 559023-1402
Business Area: Computer Programming

Fortnox, Inc.
Växjö
Corporate ID No. 556469-6291
Business Activities: Software Publishing

UC Business Information AB
Stockholm
Corporate ID No. 556730-7367
Business: Web Portals

Creditsafe in Sweden AB
Gothenburg
Corporate ID No. 556514-4408
Business Activities: Debt Collection and Credit Reporting Services

Add & Subtract Redovisningspoolen AB
Stockholm
Corporate ID No. 556220-5467
Business: Accounting & Bookkeeping

Grant Thornton Sweden AB
Stockholm
Corporate ID No. 556356-9382
Audit Services

Access to Recipients Outside the EU
Zoho Corporation
4141 Hacienda Drive
Pleasanton,
California 94588, USA

The organization processes personal data for the above category in an IT system
The system provider acts as a data processor, and the processing must be governed by an agreement in accordance with Article 28(3) (DSF).

Recipients of personal data in the above category are
The Swedish Tax Agency, the Swedish Social Insurance Agency, and the specified recipients with access.

Recipients in third countries or international organizations
Personal data in this category is not transferred to recipients in third countries or to an international organization, except as specified by Zoho Corporation.

The data for the above category is collected from
Personal data for the above category is collected from the data subject; personal data for the above category is generated internally.

Personal Information for the CONSULTANTS Category

The Purposes of Processing Personal Data
Talent Search AB’s operations require us to collect, process, and store personal data in order to provide the Service. The company processes only information that is essential to the Service for both the Client and the Consultant. Examples of such information include a person’s place of residence, contact information, details about previous employers, and information disclosed during an interview. The latter may include, for example, a Consultant’s preferences regarding clients, availability, and compensation requirements. In all cases, the information must be treated with the utmost care and must not negatively impact the Consultant’s eligibility for future consulting assignments.

Data Storage
Personal data that is stored may not be older than five (5) years in order to remain stored in the system. This means that if you, as a Consultant, have not actively updated your information and the Company has not actively collected data by contacting you, your profile will be deleted from our database. We ensure this is done on an ongoing basis by sending systematic reminders to Consultants whose information is not up to date. The primary responsibilities of Talent Search’s administrative staff include maintaining the database and regularly contacting Consultants. If a Consultant fails to update their information despite being requested to do so, shows no interest in the Service, or has entered into employment and has no intention of continuing as a consultant in the future, their profile will be deleted.

The information stored for all consultants is:
Candidate ID: 1234
Candidate Name: Erik Eriksson
Personal Identification Number: 19YYMMDD-XXXX
Cell phone: 070-123 45 67
Email: exempel@exampel.com
Mailing Address: Exempelvägen 1, 111 22 Stad
Place of residence: Stockholm
Occupational Category: Economics
Current Position: Chief Financial Officer

Personal information: Name, Social Security number, home address, contact information
Career Information: resume, cover letter, employment certificate, tax form, employer's certificate, background check, attachments
Information created for assessments: meeting minutes, notes.

Information in meeting minutes
Talent Search employees take notes on an ongoing basis for both Clients and Consultants. The fundamental principle for all meeting notes is that: The information must be relevant to the performance of the Service. No confidential information regarding a company’s or individual’s situation may be stored in the system. Information regarding the assessment of a Consultant’s suitability may not be disclosed or made available in a way that prevents the individual from securing future consulting assignments through Talent Search. All information collected and stored must be in accordance with Talent Search’s anti-discrimination policies. Information regarding these policies is available in the company’s Management Information System, and it is mandatory for all employees to accept and comply with them.

For consultants placed through the Company, necessary data from Talent Search’s finance department. This information includes, for example, bank details, personal identification numbers, F-tax certificates, and insurance information. The legal basis and purpose of the processing of personal data for the above category is consent pursuant to Article 6a (DSF), which is provided in connection with the signing of the contract.

The organization processes personal data for the above category in an IT system provided by
Zoho Corporation
4141 Hacienda Drive
Pleasanton,
California 94588, USA

Legal Basis and Purpose of the Processing of Personal Data for the Above Category
The data subject has given consent to the processing of his or her personal data for one or more specific purposes in accordance with Article 6a (DSF). The basis for the collection, processing, and storage of data is that it is necessary to fulfill a contract under Article 6b (DSF), it is necessary to comply with a legal obligation under Article 6c (DSF), and it is necessary to protect the vital interests of the data subject or another natural person under Article 6d (DSF).

The business processes personal data for the above category in an IT system. The system provider acts as a data processor, and the processing must be governed by an agreement in accordance with Article 28.3 (DSF). The company does not process personal data in a manner that poses risks to the rights and freedoms of data subjects. Recipients of personal data in the above category are the Swedish Tax Agency, the Swedish Social Insurance Agency, and the following Suppliers & Partners: