Privacy Notice

1. Who is responsible for your personal data

The data controller is Swed Fintech AB, Swedish company registration number 559499-7891, Artillerigatan 29, 114 45 Stockholm, Sweden (“Swed Fintech”, “we”, “us”).

For any question about this notice or about how we handle your personal data, or to exercise your rights, contact us at [email protected] or by post to the address above, marked “Data protection”.

We are not required to appoint a data protection officer and have not done so; the contact details above reach the people responsible for data protection at Swed Fintech.

2. Scope of this notice

This notice covers personal data we process through www.swedfintech.com, through the forms on it, and through the email addresses published on it (including [email protected], [email protected] and [email protected]). It applies under the EU General Data Protection Regulation (GDPR) and the Swedish Data Protection Act (lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning).

Websites of other companies that we mention or link to, including affiliated companies and LinkedIn, have their own privacy notices, which apply when you visit them.

3. What we collect, why, and on what legal basis

3.1 Contact form and emails to us

Data: first and last name, email address, organisation (if you give it), the type of inquiry, your message, your consent confirmation, and the page the form was sent from. If you email us directly, we receive your email address, name and whatever you choose to include.

Purpose: to read and answer your inquiry, and to follow up on it.

Legal basis: our legitimate interest in responding to people who contact us (GDPR Article 6(1)(f)). Where your inquiry concerns a possible engagement with us, processing is also necessary to take steps at your request before entering into a contract (Article 6(1)(b)).

3.2 Job applications, internships, master thesis placements and the Micro Lab

Data: name, email address, university and programme or current role, any LinkedIn or portfolio link you provide, your motivation text, the programme you apply for, and your consent confirmation. By email you may also send us a CV, university transcript, motivation letter and, for internships, a short video, together with any information those documents contain (for example education, work history and contact details). If you take part in our selection process we will also hold notes and results from written assignments, quizzes, screenings, Micro-Lab simulations and interviews.

Purpose: to assess your application, communicate with you about it, run the selection process and, if you are selected, prepare a placement or employment.

Legal basis: steps taken at your request before entering into an employment, internship or thesis agreement (Article 6(1)(b)), and our legitimate interest in recruiting suitable candidates (Article 6(1)(f)). Where we keep your application to consider you for future roles, we do so on the basis described in section 7.

Please do not send us sensitive personal data (for example information about health, ethnic origin, religion, political opinions or trade union membership), or a personal identity number, unless we specifically ask for it. We do not need it to assess your application. If a document contains such data, we will not use it in our assessment.

3.3 Newsletter

Data: your email address, your consent (“Yes, subscribe me to your newsletter”), and the date and page of sign-up.

Purpose: to send you news from Swed Fintech.

Legal basis: your consent (Article 6(1)(a)). You can withdraw consent at any time by emailing [email protected] or by using the unsubscribe option in any newsletter. Withdrawal does not affect processing that took place before it.

3.4 Visiting the website

Data: when your browser requests a page, our hosting provider automatically receives technical information such as your IP address, the date and time, the page or file requested, the referring page and your browser type. This is recorded in server logs.

Purpose: to deliver the website, keep it secure, and detect and fix faults and misuse.

Legal basis: our legitimate interest in operating a secure and working website (Article 6(1)(f)).

3.5 Spam protection

Our forms contain a hidden field that people do not see but automated bots tend to fill in. Submissions with that field filled in are discarded. No additional data about you is collected for this.

3.6 Legal obligations and legal claims

We may process the data described above where necessary to comply with a legal obligation (Article 6(1)(c)), for example bookkeeping rules if a contract follows, or to establish, exercise or defend legal claims, for example a claim relating to a recruitment decision (Article 6(1)(f)).

Where the data comes from

We collect this data from you. If someone else refers you to us or applies on your behalf, we receive your details from that person; as explained on our Internship page, we will then only communicate with you directly.

Giving us your data is voluntary. Without a name and email address, however, we cannot reply to an inquiry or consider an application, and without an email address we cannot send you the newsletter.

4. Cookies and tracking

This website does not use cookies, analytics, advertising or social media tracking, and does not store anything in your browser. Fonts, images and videos are served from our own hosting, so loading a page does not send your data to third parties such as font or video providers.

Personal data is sent to our form service (see section 5) only when you submit a form. The LinkedIn link in the footer opens LinkedIn’s own website, where LinkedIn’s privacy notice applies.

5. Who receives your personal data

We do not sell your personal data and do not use it for advertising.

Within Swed Fintech, access is limited to the people who need it for the purpose in question, for example those handling the inquiry or taking part in the recruitment.

We use the following service providers (data processors), who process personal data on our behalf, under our instructions, and under data processing terms:

• Our form-handling service provider: receives submissions from the forms on this website, keeps a log of them and delivers them to our inbox.
• Our email provider: stores emails you send to us and our replies.
• Railway (Railway Corporation): hosts the website and receives the technical data described in section 3.4.
• Our newsletter tool, if we use one to send the newsletter: receives subscriber email addresses.

We may also share personal data where the law requires it (for example with authorities), or where necessary to establish, exercise or defend legal claims, for example with legal advisers.

We are part of a group of affiliated companies. We do not pass your application or inquiry to an affiliated company unless it concerns a programme or matter run together with that company and you have been told this beforehand, or you ask us to.

6. Transfers outside the EU/EEA

Some of our service providers, or their subcontractors, are based in or access data from countries outside the EU/EEA, including the United States. Where personal data is transferred outside the EU/EEA, we make sure the transfer is covered by an appropriate safeguard under Chapter V of the GDPR:

• an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework for recipients certified under it; or
• the European Commission’s standard contractual clauses, with supplementary measures where needed.

You can ask us for more information about the safeguards used by writing to [email protected].

7. How long we keep personal data

We keep personal data only as long as necessary for the purpose it was collected for, and then delete or anonymise it:

• Contact inquiries: up to 24 months after our last correspondence with you, unless the inquiry leads to a contract, in which case we keep what is needed for as long as the contract and applicable law (for example the Swedish Bookkeeping Act) require.
• Applications that do not lead to a placement or employment: up to 24 months after the recruitment process has ended. This lets us handle any legal claim relating to the recruitment, and consider you for future roles, as described in our Internship FAQ. You can ask us to delete your application earlier; we will then delete it unless we need to keep it to defend a legal claim that has already been made.
• Applications that lead to a placement or employment: transferred to your personnel file and kept as long as the relationship lasts and applicable law requires afterwards.
• Newsletter: until you unsubscribe. We then delete your email address from the mailing list and keep a record of the unsubscription only as long as needed to respect it.
• Server logs: for a short period, no longer than needed for security and troubleshooting, after which they are deleted by our hosting provider.
• Form submission log: the same periods as the underlying inquiry, application or subscription.

8. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you and receive a copy of it;
• Rectification of inaccurate or incomplete data;
• Erasure of your data, for example when it is no longer needed or you withdraw consent;
• Restriction of processing, for example while we check a claim that data is inaccurate;
• Object to processing based on our legitimate interests, on grounds relating to your particular situation, and at any time to direct marketing;
• Data portability: receive data you gave us, processed on the basis of consent or contract, in a structured, commonly used and machine-readable format, or have it sent to another controller where technically feasible;
• Withdraw consent at any time, where processing is based on consent, without affecting earlier processing.

To exercise a right, email [email protected]. We may need to confirm your identity before acting on a request. We respond without undue delay and in any event within one month, which may be extended by two further months for complex or numerous requests; if so, we will tell you. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Every application is assessed by people.

9. Complaints

If you are unhappy with how we handle your personal data, please contact us first so we can try to put it right. You also have the right to lodge a complaint with a supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, www.imy.se (opens in a new tab). If you live or work in another EU/EEA country, you may also complain to the authority there.

10. Security

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including encrypted connections (HTTPS) for this website and its forms, access controls limiting who can see submissions and applications, and service providers bound by data processing terms. No method of transmission over the internet is completely secure; if you have reason to believe your interaction with us is no longer secure, please contact us straight away.

11. Other information

Children. This website and our programmes are aimed at students, graduates, professionals and businesses. They are not directed at children, and we do not knowingly collect personal data from children under 16. If you believe a child has sent us personal data, please contact us and we will delete it.

Language. This notice is written in English. On request we can explain its content in Swedish.

12. Changes to this notice

We may update this notice when our processing changes or the law requires it. The date at the top shows when it was last updated. If a change is significant, we will draw attention to it on this website and, where we have your email address and the change affects you, by email.