1.  PERSONAL DATA CONTROLLER

LAB English AB (company registration number 559315-0914), hereinafter referred to as “LAB” or “We” is the personal data controller as set forth in this privacy statement. Contact us at info@labenglish.se or at the address below for any questions regarding our processing of personal data.

Andrew Davies, LAB English AB, Johannesfredsvägen 62, 168 68  Bromma.

2.  TERMINOLOGY AND DEFINITIONS

This policy statement used the following terms and definitions listed below for your ease of reference.

Personal Data refers to all information that can be directly or indirectly attributed to a living natural person. Such information includes images and sound recordings that are processed electronically. LAB does not for the most part have natural persons as clients. However, LAB interacts with natural persons which are contact persons or company representatives or employees of client companies that participate in courses or seminars.

Processing of Personal Data refers to any operation regarding personal data. Every operation undertaken with regard to personal data constitutes a processing; irrespective of whether it is performed automatically or not. Examples of common operations are collection, registration, organisation, structuring, storage, processing or rectification, transfer and deletion.

The data subject is the person to whom the personal data refers, i.e., we will continually refer to the data subject as “you” or “your” in this privacy statement.

Sensitive data refers to personal data regarding racial or ethnic origin, personal opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data etc. for the purpose of uniquely identifying a natural person.

Rights refer to the rights of the data subject under the GDPR. Your rights are listed below in section 5. These rights are also described in more detail on the Swedish Authority for Privacy Protection website.

3. INFORMATION REGARDING OUR PROCESSING OF PERSONAL DATA

3.1 General Information
As a specialised language training and translation company, we provide consultations, translation and proofreading services as well as legal English and business English training, and support clients in their professional English language matters. Within the scope of our business, we process personal data with regard to the contact person/representative/course-participating employee, the contact person/representative of prospective clients, suppliers/business partners, and job applicants.

Information on our responsibility for the processing of personal data within the scope and function of the abovementioned areas is set forth in Sections 3.2 to 3.9 below.

As we are fundamentally a business-to-business company we may process personal data for the contact person/representative/course-participating employee of legal persons only, as we do not have a client portfolio of natural persons as clients. Legal persons include companies, associations and institutions within the EU/EEA.

3.2 Responding to inquiries and making offers
Purpose and legal basis
We process personal data for the purpose of legal certainty and effectiveness in handling inquiries from a client (legal person) that may wish to engage our services. The legal basis for this processing consists of a prospective agreement to supply our language services, and a legitimate interest in being able to respond to inquiries and send fee estimates for our work (in the balancing of interests, we have taken into account that it is the prospective client who chooses to contact us).

It is not a requirement to provide us with your personal data. However, without this data, we will be able to neither fulfil our agreement nor obligations in relation to you.

Categories of personal data
We process the following categories of personal data for a client or prospective client which is a legal person: name, address, email address and telephone number of the contact person/representative/course-participating employee.

We do not have, or seldom have, any contact with a client or prospective client that is a natural person.

In individual cases, a description of the assignment provided to us by a prospective client may also contain personal data for example information sent out on a document that may be translated or proofread if an agreement is reached by said client to engage our services.

Recipients of personal data.
information is stored on our cloud-based service provider for document storage.

Storage of personal data
Personal data, which is processed with regard to an offer that results in a client relationship is stored for ten years in accordance with current legislation under the Swedish Limitations Act (SFSS 1981: 130). In the event that our offer does not result in a client relationship, we store the information for one year based on our legitimate interest in retaining information on the company name and the contents of the offers made to such companies.

3.3 Client Registration
Purpose and legal basis
We process personal data for the purpose of entering into agreements with clients and registering clients in our system. The legal basis for this processing consists of the oral, or written, agreements to be entered into. 

The provision of your personal data is not a statutory requirement; however, it is a requirement that is necessary in order to enter into an agreement with us. If you do not provide your personal information to us, we will be able to neither fulfil our agreement nor our obligations in relation to you.

Categories of personal data
We process the following categories of personal data:
(i) Name, email address and telephone number of the contact person/representative/course-participating employee.
(ii) No Swedish national id. number, or similar, of the contact person/representative/course-participating employee is processed. 

Recipients of personal data
Information is stored on our cloud-based service provider for document storage.

Storage of personal data
The personal data is stored for a period of ten years from the date of completion of the assignment, or for a longer period as required by the nature of the assignment.

3.4 Administration of client assignments
Purpose and legal basis
We process personal data in order to perform and administer the assignment and to safeguard our client’s interests.

We process your personal data for the following purposes on the basis of our legitimate interest (in the balancing of interests, we have assessed that the client has a legitimate interest in the assignment being handled in a satisfactory manner):
(i) To be able to perform and administer the assignment and to safeguard the client’s interests (legal entity).
(ii) To be able to manage and administer our accounting procedures.
(iii) To safeguard our rights should legal claims be made against us.

Categories of personal data
We process the following categories of personal data: name, email address and telephone number of the client or contact person/representative/course-participating employee of the company.

Recipients of personal data
 We store data related to the execution of the assignment in our cloud-based service for document storage. We do not share your data with other IT and system vendors. 

We may also share information with counterparties, counterparty representatives and business partners within the scope of the execution of the assignment but only in accordance with our client’s instructions. Other parties engaged by the client, may also receive information but only in accordance with our client’s instructions.

In addition to the above, information may be shared with an arbitral tribunal, a court, and governmental authorities if such disclosure is prescribed by law.

Storage of personal data
The personal data is stored for a period of ten years from the date of completion of the assignment, or for a longer period as required by the nature of the assignment. 

3.5 Accounting and invoicing regarding client assignments
Purpose and legal basis
We need to process personal data in order to be able to handle outgoing and incoming invoices. The processing that takes place for accounting and invoicing purposes is based partly on our fulfilment of agreements with clients, and partly on our obligation to fulfil legal requirements that are incumbent on us.

We process your personal data for the following purposes in order to fulfil contractual obligations:
(i) To be able to handle and administer invoicing and reminders.
(ii) To be able to handle and administer accounts receivable that arise within the scope of an assignment.

We process your personal data to handle our accounting in order to fulfil our legal obligations pursuant to the Swedish Bookkeeping Act (1999: 1078).

It is not a requirement to provide us with your personal data. However, without this data, we will be able to neither fulfil our agreement nor obligations in relation to you.

Categories of personal data
We process the following categories of personal data:
(i) name, address, email address and telephone number of the contact person/representative/course-participating employee, and
(ii) invoice and payment information.

Recipient of personal data
The information is shared with our accounting firm (solely the personal data of the name of the invoice reference person of the legal person) and these invoices are stored in a bookkeeping system.

Storage of personal data
Personal data is stored for the purpose of fulfilling legal requirements regarding taxation, accounting, or to defend legal claims. In these cases, data is stored for seven years from the time of invoicing (regarding accounting) and ten years (regarding taxation and limitation periods).

3.6 Newsletter mailing and direct marketing
We do not maintain any mailing lists for marketing purposes, and neither do we participate in any form of direct marketing. However, course-participating employees of legal persons may agree to have their name, company name, photograph and personal quote, regarding the use of our services on our website as a reference. The legitimate interest is to provide information on course participants’ experience which may assist prospective clients in determining whether we would be an appropriate language-service provider. The balancing of interests is that those offering testimonials would be marketing their own visibility regarding their own services.

LAB English has no social media presence e.g. on Facebook, Instagram etc. due to the highly sensitive nature of our company’s work, especially with regard to law firms within the EU/EEA and C-level executives of private and publicly-owned companies.

3.7 Recruitment
Purpose and legal basis
We collect and process personal data in order for us to be able to handle applications, interview, and make decisions in a recruitment process. The overall purpose of a recruitment process is that we should be able to employ people with the right skillset for a vacancy. We may also save the personal information in our in-house CV database in order to contact the applicant for a future recruitment process. The legal basis for the processing consists of entering into an agreement and our legitimate interest in being able to receive and handle an application for employment.

It is not a requirement to provide us with your personal data. However, without this data, we will not be able to fulfil our obligations to you in the performance of our recruitment process.

Categories of personal data
Within the scope of a recruitment process, we process the following categories of personal data:
(i) name, address, email address and telephone number of the applicant,
where applicable, a photograph of the applicant,
(ii) information about the applicant’s previous work experience and certificate(s) of employment.
(iii)education and education certification, as well as
(iv) contact information for any references provided by the applicant.

It is important that you as an applicant do not provide information that is not relevant to the application. When applying, you do not need to provide sensitive data. CVs that are sent by email are stored in a cloud-based storage system.

Storage of personal data
We retain personal information during the recruitment process. Erasure of information received from unsuccessful applicants takes place after two years in accordance with the Swedish Discrimination Act (2008: 567).

We may also save applications in our CV database from candidates who are interested in a future recruitment process. In such cases, the data is stored for a maximum of two years. However, the data subject reserves the right not to be contacted in the future by declining such processing.

3.8 Contact with suppliers and business partners
Purpose and legal basis
We process personal data in order to administer our contractual relationship with suppliers and business partners. The processing of personal data of contact persons/representatives/employees of suppliers/business partners is for the purposes of performing the agreement, fulfilling our obligations towards our suppliers/business partners, as well as handling deliveries, and communication.

The legal basis for our processing in these cases is our legitimate interest in being able to perform and fulfil our agreements with our suppliers/business partners. In the balancing of interests, we have assessed that the contact person/representative has an interest in the fulfilling of our obligations to our suppliers/business partners.

Categories of personal data
We process names, telephone numbers and email addresses regarding the contact person/ representatives/ of suppliers/business partners with whom we have a business relationship, as well as for those employees that attend our courses and seminars.

Recipient of personal data
We store the data in  our cloud-based service provider for document storage. We do not share the information with other IT and system vendors.

Storage of personal data
We save personal data in order to fulfil our agreement with each supplier/business partner. Information regarding the contact person/representative/course-participating employee is therefore processed for the time that is deemed necessary for us to be able to administer the contractual relationship, exercise our rights and fulfil our obligations in relation to each supplier/business partner.

In the event that your employment or your assignment with the supplier/business partner ends, we will terminate our processing of your personal data as soon as we have received such information. Agreements that contain your personal information are stored for ten (10) years from the termination of our business relationship in accordance with the limitation period set forth in the Swedish Limitation Act.

3.9 Handling suppliers’ invoices
Purpose and legal basis
We need to process personal data In order to be able to handle invoices. The processing is for accounting purposes regarding invoicing or payment of services or products, which is based on the fulfilment of legal requirements that are incumbent on us under the Swedish Bookkeeping Act.

It is not a requirement to provide us with your personal data. However, without this data, we will be able to neither fulfil our agreement nor obligations in relation to you.

We process your personal data for the following purposes in order to fulfil our contractual obligations:
(i) To be able to handle invoicing.
(ii) To be able to make payments for services or products.
(iii) To be able to perform our accounting in accordance with the Swedish Bookkeeping Act (1999: 1078).

Categories of personal data
We process the following categories of personal data:
(i) name, address, email address and telephone number of the contact person/representative of suppliers/business partners with whom we have a business relationship, and
(ii) invoice and payment information.

Recipient of personal data
We store the data in our cloud-based service provider for document storage and the booking database that we use.

Storage of personal data
We save personal data in order to fulfil our agreement with each individual supplier/business partner. Information regarding the contact person/representative is therefore processed for the period that is deemed necessary for us to be able to administer the contractual relationship, exercise our rights and fulfil our obligations in relation to each supplier/business partner. In the event that your employment or your assignment with the supplier/business partner ends, we will terminate our processing of your personal data as soon as we have received such information. Information regarding payments, and any processing that is required under the Bookkeeping Act is stored for seven (7) years in accordance therewith.

4. USE OF COOKIES

LAB’s website does not use cookies.

5. RIGHTS OF THE DATA SUBJECT

The right to access (so-called extract from the register)
You are entitled to be informed about the processing that we perform regarding you. This must include a description of the purpose and legal basis of the processing, which categories of personal data it concerns and who receives the personal data. We have compiled this information in this privacy statement for your ease of reference. An extract from the register means that you are provided herein with an overview of the processing so that you may understand if, and for what purpose, your personal data is processed.

Right to rectification, erasure or restriction
If you believe that we have processed your personal data incorrectly, or that it may need to be rectified, you have the right to request that we correct the data, and, if you do not want us to continue processing the personal data, you have the right to request that we erase the data. We will rectify or delete the personal data if it is possible in respect of our purpose for the processing and the legal requirements that we are under a duty to follow.

The right to object in certain circumstances
You have the right to object at any time to the processing of your personal data if the legal basis for the processing consists of the performance of a task in the public interest, or a balancing of interests.

The right to data portability
The data subject has the right to retain the personal data that has been provided to the personal data controller, and has the right to transfer this data to another personal data controller subject to:
(i) it being technically feasible; and
(ii) the legal basis for the processing consists of consent, or that the processing was necessary for the fulfilment of an agreement.

The right to withdraw consent
If the processing of personal data is based on the data subject’s consent, he or she has the right to withdraw their consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal.

The right to lodge a complaint regarding the processing of personal data
The data subject always has the right to contact the Swedish Authority for Privacy Protection in order to lodge a complaint linked to our processing of personal data. The Swedish Authority for Privacy Protection can be contacted by phone (08-657 61 00) or email (imy@imy.se)

If you, as a data subject, wish to exercise your rights or have a response to other questions, you can find our contact information in Section 1 above. The data subject has the right to contact us as an alternative to contacting the Swedish Authority for Privacy Protection.

6. PROTECTION OF PERSONAL DATA
We strive to protect the confidentiality, privacy and access to personal data. Access is granted only to those persons that need to process your personal data in order for us to fulfil the purposes set forth in this privacy statement.

7. TRANSFER OF DATA TO THIRD PARTIES
We do not disclose information to third parties other than those specified in Section 3. 

8. TRANSFER TO THIRD COUNTRIES
We mainly process personal data within the EU/EEA. In the event of a transfer to a third country, we will ensure that such a transfer takes place in accordance with applicable data protection legislation. In addition, it should be noted that the supplier of our cloud storage system may have servers located in a third country. 

9. INTERNAL GOVERNANCE
We have established internal guidelines for the processing of personal data.

10. AMENDMENTS
We reserve the right to amend and update this privacy statement. We will provide information in an appropriate manner, and on this page of our website, in the event of material changes to the privacy statement, or if existing data is to be processed in another way than stipulated herein.

This privacy statement was drawn up and published on 5 September, 2021, and was reviewed without any material amendments being made on 10 May, 2023 and on 1 March, 2024.