Personuppgiftspolicy

How we process personal data

Version 2022:1

Skarp AB, registration number 556763-6609, (hereinafter referred to as "Skarp," "we," "our," or "us") is the data controller for the processing of personal data in our operations.

This information text is intended for clients, counterparties, and other external parties whose personal data we process within the scope of our legal services. The purpose of this information text is primarily to provide information to data subjects in accordance with applicable data protection legislation. In exceptional cases, as a data subject, you may receive additional, more specific information in connection with the collection of data or when obtaining your consent. In such cases, such more specific information shall prevail over this general information text.

1. What personal data do we process?

We process personal data about data subjects primarily in three different categories:

1. Contact persons for clients, counterparties, or other stakeholders with whom we communicate in connection with assignments, or whom we process when preparing, handling, or otherwise administering the assignment.
2. Contact persons for potential clients and other law firms.
3. Employees and individuals applying for employment with us, or individuals expressing an interest in our services or business.

‍

The personal data we collect and process include contact information (e.g., name, title, postal address, email, and telephone number), identification information (e.g., personal identification number and passport details), category of data subject, and in some cases, an image. In specific assignments, the personal data may also include other information, such as a sequence of events or other circumstances and data relevant to the assignment. We may also process personal data in the form of audio or visual recordings in connection with court and arbitration proceedings or other assignments.

The majority of the personal data is provided by you or your employer. Data may also arise in the course of providing our services. We also collect personal data from external sources such as public company and address registers, searchable and public websites, newsletters, social media, and credit reference agencies. You are not obliged to provide personal data to us. In certain cases, when we have requested personal data in connection with the acceptance of an assignment, the fact that you do not provide the personal data may result in us being unable to accept the assignment because we cannot carry out necessary conflict-of-interest and anti-money laundering checks.

2. Purposes of processing

and anti-money laundering checks, carry out and administer assignments, safeguard your or our client's interests, for accounting and invoicing purposes, and to meet the legal requirements and regulations imposed on us by law and the Swedish Bar Association. The personal data may also be used for other legitimate purposes, such as business and method development, marketing, market analysis, statistics, recruitment, and risk management.

3. Legal basis

We process personal data because it is necessary for us to (i) fulfill agreements with you or take steps prior to entering into an agreement, (ii) fulfill a legal obligation that applies to us, and/or (iii) pursue a legitimate interest where we have determined that our legitimate interest outweighs the data subject's interests or fundamental rights and freedoms, and that the processing is necessary for the purposes of the processing (balancing of interests).

Processing for the purpose of developing and analyzing our business as well as for marketing purposes is based on our legitimate interest in developing our business and communicating with our contacts.

4. Transfer of personal data

Personal data may be transferred to other companies within our organizational structure for the purposes stated above. We will transfer your personal data to external suppliers, such as providers of IT services or administrative services, who process personal data on our behalf and under a data processing agreement.

In our operations, we use a selection of cloud services. This means that personal data processed on our behalf in these systems may be transferred outside the EU/EEA, where the same level of protection for your personal data is not provided. However, we always strive to take measures to ensure that your data and rights are protected through approved methods in accordance with relevant data protection legislation.

In addition to the above, we will not disclose personal data to external parties except when:

1. It has been specifically agreed between you and us, or provided according to specific consent,
2. Within the framework of an assignment, it is necessary to safeguard your or our client's rights and interests (e.g., to courts, authorities, counterparts, and their representatives),
3. It is necessary for us to fulfill a statutory obligation, comply with a court order or decision by an authority, or follow the regulations of the Swedish Bar Association, or
4. Otherwise permitted by applicable law.

‍

Apart from the above, we will not transfer or process personal data outside the EU/EEA, except to the extent necessary within the scope of our business.

5. Retention period for personal data

Personal data processed within the scope of assignments will be stored, in accordance with our obligations under the Guiding Rules of Good Conduct for Advocates, for a period of ten years from the date of the completion of the matter or for a longer period required by the nature of the matter.

Personal data processed for the purpose of developing, analyzing, and marketing our business will be stored for a period of twelve months after the last contact with you. Personal data regarding job applicants will be stored during the ongoing recruitment process and for an additional two years if necessary.

Otherwise, we only retain personal data for as long as necessary for the specific purposes for which we process the personal data, unless the data must or may be stored for a longer period under applicable law.

6. Your rights

You have the right to request information from us, free of charge, about the use of the personal data concerning you. Upon your request or on our own initiative, to the extent that we are not entitled to continue the processing, we will rectify or erase any inaccurate personal data or restrict the processing of such personal data. You also have the right, under certain conditions and to a certain extent, to receive your personal data in a machine-readable format.

Please note that the aforementioned rights may be limited with regard to the confidentiality obligation and archiving obligation applicable to lawyers. In some cases, the limitation or erasure of personal data may also mean that we are unable to fulfill our obligations, such as providing certain invitations or specific information. In connection with recruitment, the limitation or erasure of personal data may prevent us from proceeding with an individual's application.

If you are dissatisfied with our processing, you can lodge a complaint with the Swedish Authority for Privacy Protection (www.imy.se). If you reside or work in another country, you may also contact the supervisory authority in that country.

7. Contact

If you have any questions about our processing of personal data or wish to exercise your rights as described above, please feel free to contact us at info@skarplaw.se.