Privacy Policy (Integritetspolicy) — GDPR / Dataskyddslagen

PRIVACY POLICY (INTEGRITETSPOLICY) (GDPR — Regulation (EU) 2016/679, as implemented by dataskyddslagen (2018:218))

✓Data controller name (org.nr Controller organisation number (organisationsnummer)), Controller address Effective date: Effective date

1. DATA CONTROLLER 1.1. ✓Data controller name is the data controller (personuppgiftsansvarig) for the personal data described below.

2. CATEGORIES OF DATA AND PURPOSES 2.1. Categories of personal data processed: Categories of personal data processed 2.2. Purposes and legal bases: Purposes and legal bases of processing

3. ⚠️ PERSONNUMMER (SWEDISH PERSONAL IDENTITY NUMBER) 3.1. Personnummer handling note 3.2. Under 3 kap. 10 § dataskyddslagen, personnummer may only be processed without consent where it is clearly justified by the nature of the processing, its importance for secure identification, or another significant reason — do not collect it by default. Note that personalliggare (staff ledger) records and guest/loyalty-card data are also personal data subject to this policy.

4. RETENTION 4.1. Retention periods

5. RECIPIENTS AND PROCESSORS 5.1. Recipients and processors

6. RIGHTS OF THE DATA SUBJECT 6.1. Data subject rights and contact 6.2. Includes the right to lodge a complaint with IMY (Integritetsskyddsmyndigheten), the Swedish data-protection authority.

— — — ⚠️ This is a boilerplate template, not legal advice. Swedish employment, data-protection, consumer-protection and food-safety law (lag (1982:80) om anställningsskydd — LAS, including the reform in force since 01.10.2022 that replaced "saklig grund" with "sakliga skäl" and allmän visstidsanställning with särskild visstidsanställning/SÄVA; 6 c–e §§ LAS implementing EU Directive 2019/1152 on written information about employment conditions; 11 § MBL on union negotiation; 47 § lagen om arbetslöshetsförsäkring; AFS 2023:1 on systematiskt arbetsmiljöarbete/SAM, in force since 01.01.2025; the GDPR/Regulation (EU) 2016/679 and dataskyddslagen (2018:218), supervised by IMY; distansavtalslagen (2005:59), e-handelslagen (2002:562) and prisinformationslagen (2004:347); konsumentköplagen (2022:260); livsmedelslagen (2006:804) and Regulation (EC) 852/2004; and 39 kap. skatteförfarandelagen on personalliggare) is highly procedural, tied to fixed statutory deadlines (e.g. skriftlig information within 7 calendar days of the start of employment, arbetsgivarintyg on request, kommun registration at least 2 weeks before opening a food business) and to unannounced Skatteverket kontrollbesök that can trigger a kontrollavgift of 12,500 kr plus 2,500 kr per unregistered worker (25,000 kr on a repeat violation within a year) — and there is NO statutory minimum wage in Sweden, so pay floors must always be checked against the applicable kollektivavtal (e.g. Gröna riksavtalet HRF–Visita for HoReCa, the Detaljhandelsavtalet Handels–Svensk Handel for retail, the Frisöravtalet Frisörföretagarna–Handels for salons). Have this document reviewed and adapted by a Swedish employment/legal advisor (jurist) or accountant (redovisningskonsult) and verified against current Skatteverket, Arbetsmiljöverket and IMY guidance before use.