Privacy notice - for applicants of a job or internship

General information about personal data

To make it easy for you to find the sections you are interested in, we have divided the page into a number of headings. You can click on the different headings in the list on the right to go directly to a specific section.

What is personal data?

Personal data is any information that can be directly or indirectly linked to a living, natural person. Examples of personal data are: name, e-mail address, telephone number, professional experience. 

What is special about personal data?

All personal data is linked to a specific person. Most of us want to be able to control who we share our personal data with, and how it is used. For this reason, there are specific laws and rules governing how companies and other actors may process personal data, the so-called data protection legislation. Examples of such laws and regulations are the General Data Protection Regulation (2016/679, GDPR) and the Act containing supplementary provisions to the EU General Data Protection Regulation (SFS 2018:218). 

Data protection legislation governs how companies and other actors may process personal data, and what rights individuals have when their personal data is processed.

What is processing of personal data?

Processing of personal data is basically anything that is done with personal data - for example, collecting, creating, analyzing, or deleting personal data. 

What does it mean to be a data controller?

A controller is the actor, such as a company or a public authority, that determines the purpose(s) for which personal data is processed and how the processing is carried out. If a company decides what personal data is to be processed for a particular purpose and how the processing is to be carried out, in practical terms, the company is a controller. The controller is responsible for ensuring that the processing of your personal data is carried out in accordance with data protection legislation.

What does it mean to be a data processor? 

In certain situations, the controller may use a so-called processor, to process personal data on behalf of the controller.A processor may only process personal data as instructed by the controller, and may not use the personal data for its own purposes. 

Kivra is the controller

The controller for the processing of your personal data in connection with your application for a job or internship with us and/or participation in a recruitment process is:

Kivra AB, Reg. No. 556840-2266, (referred to in this information as "Kivra", "we" or "us")

Klara Norra kyrkogata 33, 111 22 Stockholm, Sweden

Email: dataskydd@kivra.se 

Why does Kivra process your personal data? 

Kivra processes your personal data in order to carry out an accurate and efficient recruitment process, and we use the data to evaluate your skills. When you apply for a job or internship at Kivra, we process the information you provide in your application, as well as information you provide during the recruitment process. If the purpose of processing your personal data changes to another purpose, you will be informed of this before we start the processing for another purpose. 

What personal data does Kivra process, and where do we get it from?

When you apply for a job or internship with Kivra, for example by contacting Kivra directly, applying internally, applying via the Kivra website or via a third party (e.g. LinkedIn), we will process the personal data you have provided to us. 

Such information usually includes your name, personal identity number, contact details (address, email address, and phone number), grades, references, certificates and other data you provide in your application (such as LinkedIn profile, professional experience, cover letter). Where you carry out tests or case studies, we will also collect your results. We may also collect data from other people or companies, such as people you receive references from, LinkedIn, and other public sources. 

What is Kivra's legal basis for processing your personal data? 

When Kivra processes your personal data, we must rely on one or more legal bases. When processing your personal data when you apply for a job or internship at Kivra, we base our processing on three legal grounds: 1) on a balance of interests 2) consent or 3) legal obligations: 

1) Based on a balancing of interests, we process your personal data for the purposes of: 

• collecting and reviewing your application (such as CV, cover letter, certificates and study results).

• assessing how well your application matches the advertised position, and comparing your application against other candidates' applications on the basis of education, skills, qualifications and experience.

• managing the recruitment process such as invitations to interview(s), booking meetings, updating you on the progress of the recruitment and providing a final decision. 

We have determined that we have a legitimate interest in processing your personal data in order to hire new colleagues and interns at Kivra, where our interest in receiving your application and conducting the recruitment process for the position or internship you applied for outweighs your privacy interest.

2) Based on your consent, your personal data will be processed for the purpose of: 

• Saving your contact details so that we can contact you about future recruitment opportunities that may be of interest to you. 

3) Based on Kivra's legal obligations, your personal data may also be processed for the purposes of:

• Ensuring that Kivra respects your rights and Kivra's obligations under law and collective agreements.

• Fulfilling our obligations and protecting our interests in accordance with labor law.

• Ensuring compliance with the provisions of the Anti-discrimination Act and to be able to assert our rights in the event of a claim.

You are under no obligation to provide us with your personal data. However, in cases where we are unable to access personal data in an application or during a recruitment process, we are unable to fulfill our commitment to you as a candidate, and are therefore unable to carry-out the recruitment process.

How long does Kivra keep your personal data?

We keep your personal data for as long as is necessary for the purposes specified above. As a general rule,  we do not process your personal data based on our legitimate interest once the recruitment process has been completed. 

Accordingly, your personal data will be deleted after the end of the recruitment process, unless:

• We consider it necessary to keep information about your recruitment case in order to exercise our rights under law and to defend ourselves in the event of a legal claim. In such a situation, we limit our processing to what is permitted by applicable legislation and delete the personal data as soon as the relevant purpose has ceased; or

• You consent to us keeping your personal data for future recruitments. In such cases, we will keep it for as long as you consent to it, or until our purpose has ceased.

Where is your personal data processed?

Kivra's processing of your personal data takes place both within and outside the EU/EEA. Where Kivra uses a supplier established in a country outside the EU/EEA, Kivra takes all appropriate legal, technical and organizational measures to ensure that your personal data is processed securely and with an adequate level of protection.

Who has access to your personal data?

Your personal data will never be sold. Your personal data will also not be passed on or used in any other way for purposes other than those we inform you of above.

• Only people who need access have access

Only persons who need to process your personal data in accordance with the purposes described above have access to your personal data, such as the recruiting manager, responsible recruiter or equivalent.

In situations where Kivra uses a processor to conduct the recruitment process, the processing may only be carried out in accordance with the purposes and instructions provided by Kivra for the processing. 

• Kivra's suppliers and companies in the same group as Kivra

Kivra may share your personal data with - or process it with the help of - other companies within the same group as Kivra and suppliers engaged by Kivra. Such actors can either be processors of Kivra, i.e. companies that process your personal data on behalf of Kivra according to Kivra's instructions (e.g. providers of IT and communication services), or independent controllers who are independently responsible for their processing of your personal data (e.g. a law firm or accounting firm that Kivra hires and that in the course of performing its work has access to your personal data and processes it according to its case management procedures and the documentation requirements applicable to the business). Kivra is responsible for ensuring that any such sharing of your personal data with such third parties for processing is done in accordance with data protection legislation.

• Authorities 

Kivra may disclose necessary information to public authorities if we are required to do so by law or if you have consented to us doing so.

What rights do you have?

Under the headings below, you can read about your rights when Kivra processes your personal data.  

• Right to information

Whenever Kivra collects personal data about you, you have the right to specific information about how we will process your personal data. You also have the right to get specific information if we plan to process your personal data for any purpose other than that for which it was originally collected. 

We provide you with the information you are entitled to and other information we believe is important to you through this privacy notice. We will also provide you with information about how we process your personal data by answering any questions you may have for us. 

You can read more about what information you are entitled to receive from us, the requirements for how the information should be provided etc. at the Swedish Authority for Privacy Protection’s website.

• Right of access to your personal data 

You have the right to obtain confirmation as to whether Kivra is processing personal data about you, and if so, to access to the personal data we are processing, together with certain information about the processing. 

You access your personal data by receiving a copy of the personal data we process, a so-called register extract. It is free of charge for you to obtain a copy of your register extract. For any additional copies you request, Kivra may charge a reasonable fee to cover administrative costs. 

As a general rule, if you are a Kivra user, we will send you your register extract in the Kivra service. It is also possible to send an encrypted register extract by e-mail or to your registered address.

You can read more about what information you are entitled to receive from us in connection with your request for a register extract, the requirements for the provision of the information and more at the Swedish Authority for Privacy Protection’s website.

• Right to rectification 

You have the right to request that we correct inaccurate information about you, and that we complete incomplete information about you. 

You can read more about the right to rectification, examples of when it applies and how you can exercise it at the Swedish Authority for Privacy Protection’s website. 

• Right to erasure

In certain circumstances, you have the right to have the personal data Kivra processes about you erased. This is the case, for example, if it is no longer necessary for Kivra to process the data for the purpose for which the data was collected, if you withdraw your consent, or if you have objected to the processing and there are no legitimate, overriding reasons for the processing.

Your right to have your personal data erased is not absolute, but applies when the conditions for erasure are met. Examples of situations where these conditions are not met, and where we do not comply with your request, are if the data is still necessary to process for the lawful purpose for which it was collected, or if Kivra has a legal obligation to retain the data.  

You can read more about the circumstances in which you have the right to have your personal data erased, in which cases Kivra has the right to refuse your request for erasure and more at the Swedish Authority for Privacy Protection’s website. 

• Right to object to processing

You have the right, for reasons relating to your specific situation, to object at any time to the processing of your personal data by Kivra on the basis of a balancing of interests. 

If you object to such processing, Kivra may no longer carry out the processing of your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms; or for the establishment, exercise or defense of legal claims.

You can read more about your right to object to personal data processing at the Swedish Authority for Privacy Protection’swebsite.

• Right to restriction of processing

You have the right to request that we restrict our processing of your personal data if you believe that personal data we hold about you is inaccurate, that our processing is unlawful (but you object to erasure of the data), that we no longer need the data for the purpose for which it was processed (but you need it to establish, exercise or defend legal claims), or if you have exercised your right to object to our processing of your personal data. 

Where processing of your personal data has been restricted, Kivra will, with the exception of storage, only process the data with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person, or for reasons relating to an important public interest. 

You can read more about the right to restriction of processing and find examples of when it can be invoked at the Swedish Authority for Privacy Protection’s website.

• Right to transfer your personal data to another recipient ("Right to data portability") 

You have the right to receive certain personal data about you in a structured, commonly used and machine-readable format, known as data portability. You have the right to transfer such data to another recipient. If technically feasible, as determined by Kivra, you also have the right to request that Kivra transfer the data to the other recipient.

The right to data portability covers personal data relating to you, which you have provided to Kivra, which Kivra processes automatically, and which you have consented to provide to Kivra or which you have provided to Kivra pursuant to a contract. 

You can read more about the right to data portability at the Swedish Authority for Privacy Protection’s website.

• Right to withdraw consent

Where we process your personal data based on your consent, you have the right to withdraw your consent at any time. When you withdraw your consent, we will stop the processing. The withdrawal of your consent does not affect the lawfulness of the processing that was based on your consent before it was withdrawn. 

• Right to lodge a complaint

If you have a complaint about Kivra's processing of personal data, you can contact the Swedish Authority for Privacy Protection, which is the supervisory authority for Kivra's personal data processing. 

For more information on how to lodge a complaint with the Swedish Authority for Privacy Protection, please visit the authority's website. 

How can you exercise your rights?

You can read more about your rights, how to exercise them and how to file a complaint on the Swedish Authority for Privacy Protection's website.

If you wish to get in touch with Kivra to exercise your rights under the GDPR you can reach us by email dataskydd@kivra.se or by phone: 077-045 70 00. 

If you wish to exercise any of your rights, we will inform you of the actions we have taken in response to your request within one month at the latest. This period may be extended by a further two months if necessary in view of the complexity of the request or the number of requests received. We will inform you of such an extension and the reasons for the extension within one month of receiving your request. 

Exercising your rights is free of charge for you, unless your requests are manifestly unfounded or unreasonable. In the latter case, we may charge a reasonable fee to cover our administrative costs in complying with your request, or refuse your request. 

If we do not take action on your request, we will, within one month of receiving it, inform you of the reason for the failure to take action and of the possibility of lodging a complaint with the Swedish Authority for Privacy Protection and requesting a judicial remedy.

Where do you turn if you have questions? 

All Kivra employees receive data protection training and information, and we have a dedicated team who will answer your data protection questions, receive feedback and allow you to exercise your rights. Kivra also has a Data Protection Officer (DPO) who monitors our compliance with the GDPR.

You are always welcome to contact Kivra by email dataskydd@kivra.seor by phone: 077-045 70 00 if you have any questions or feedback regarding how we handle your personal data. 

Kivra's DPO is Fredrik Haglund. Kivra's data protection team and DPO can be reached by email at dataskydd@kivra.se. If you wish to contact the DPO directly, please enter "DPO" in the subject line.