PRIVACY STATEMENT
PERSONAL DATA CONTROLLER
LAB English AB (company registration number 559315-0914) (“LAB English/we”) is the personal data controller as set out in this privacy statement. Contact us at info@labenglish.se or at the address below for questions regarding our processing of personal data.
The Data Controller, LAB English AB, Johannesfredsvägen 62, 168 68 Bromma.
Tel: + 46 (0) 733 888 533
1. TERMINOLOGY AND DEFINITIONS
This policy uses the following terms and definitions:
Personal data refers to all kinds of information that can be directly or indirectly attributed to a living natural person. Such information includes images and sound recordings that are processed electronically regarding which no names need to be mentioned. Encrypted information and various forms of electronic identification (e.g., IP numbers) are deemed as personal information if they can be linked to natural persons. LAB English does not have natural persons as clients. However, LAB English interacts with natural persons which are contact persons/representatives of companies or employees which attend our courses or seminars.
Processing of personal data refers to any operation regarding personal data. Every operation undertaken with regard to personal data constitutes a processing; irrespective of whether it is performed automatically or not. Examples of common operations are collection, registration, organisation, structuring, storage, processing or rectification, transfer and deletion.
The data subject is the person to whom the personal data refers, i.e., we will continually refer to the data subject as “you” or “your” in this privacy statement.
Sensitive data refers to personal data regarding racial or ethnic origin, personal opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a natural person’s sex life or sexual orientation.
Rights refer to the rights of the data subject under the GDPR. Your rights are listed below in section 5. These rights are also described in more detail on the Swedish Authority for Privacy Protection website.
2 INFORMATION REGARDING OUR PROCESSING OF PERSONAL DATA
2.1 General information
As a specialised language training and translation company, we provide consultations, translation and proofreading services as well as legal English and business English training, and support clients in their professional linguistic matters. Within the scope of our business, we process personal data with regard to the contact person/representative/course-participating employee of clients, the contact person/representative of prospective clients, suppliers/business partners, and job applicants.
Information on our responsibility for the processing of personal data within the scope and function of the abovementioned areas is set forth in Sections 2.2 to 2.9 below.
As we are fundamentally a business-to-business company we may process personal data for the contact person/representative/course-participating employee of legal persons only, as we do not have a client portfolio of natural persons as clients. Legal persons include companies, associations and institutions wihin the EU/EEA.
2.2 Responding to inquiries and making offers
Purpose and legal basis
We process personal data for the purpose of legal certainty and effectiveness in handling inquiries from a client (legal person) that may wish to engage our services. The legal basis for this processing consists of a prospective agreement to supply our language services, and a legitimate interest in being able to respond to inquiries and send fee estimates for our work (in the balancing of interests, we have taken into account that it is the prospective client who chooses to contact us).
It is not a requirement to provide us with your personal data. However, without this data, we will be able to neither fulfil our agreement nor obligations in relation to you.
Categories of personal data
We process the following categories of personal data for a client or prospective client which is a legal person:
-
name, address, email address and telephone number of the contact person/representative/course-patricipating employee.
We do not have any contact with a client or prospective client that is a natural person:
In individual cases, a description of the assignment provided to us by a prospective client may also contain personal data for example information sent out on a document that may be translated or proofread if an agreement is reached.
Recipients of personal data
The information is stored in Apple Cloud, which is our cloud-based service provider for document storage.
Storage of personal data
Personal data, which is processed with regard to an offer that results in a client relationship is stored for ten years in accordance with current legislation under the Swedish Limitations Act (SFSS 1981: 130). In the event that the offer does not result in a client relationship, we store the information for one year based on our legitimate interest in retaining information on the company name and the contents of the offers made to these companies.
2.3 Client registration
Purpose and legal basis
We process personal data for the purpose of entering into agreements with clients and registering clients in our system. The legal basis for this processing consists of the oral, or written, agreements to be entered into.
The provision of your personal data is not a statutory requirement; however, it is a requirement that is necessary in order to enter into an agreement with us. If you do not provide your personal information to us, we will be able to neither fulfil our agreement nor our obligations in relation to you.
Categories of personal data
We process the following categories of personal data:
-
Name, email address and telephone number of the contact person/representative/course-participating employee.
-
No Swedish id. number, or similar, of the contact person/representative/course-participating employee is processed as agreements are not signed by an electronic signature such as Bank ID. Agreements are either oral agreements or executed in wet ink or concluded by way of agreement in email correspondence.
Recipients of personal data
The information is stored in Apple Cloud, which is our system for storing all documentation
Storage of personal data
The personal data is stored for a period of ten years from the date of completion of the assignment, or for a longer period as required by the nature of the assignment.
2.4 Administration of client assignments
Purpose and legal basis
We process personal data in order to perform and administer the assignment and to safeguard our client’s interests.
We process your personal data for the following purposes on the basis of our legitimate interest (in the balancing of interests, we have assessed that the client has a legitimate interest in the assignment being handled in a satisfactory manner):
-
To be able to perform and administer the assignment and to safeguard the client’s interests (legal entity).
-
To be able to manage and administer our accounting procedures.
-
To safeguard our rights in other legal claims against us.
Categories of personal data
We process the following categories of personal data:
-
name, email address and telephone number of the client or contact person/representative/course-participating employee of the company.
Recipients of personal data
We store data related to the execution of the assignment in Apple Cloud, which is our cloud-based service for document storage. We do not share your data with other IT and system vendors.
We may also share information with counterparties, counterparty representatives and business partners within the scope of the execution of the assignment but only win accordance with our client’s instructions. Other parties engaged by the client, may also receive information but only in accordance with our client’s instructions.
In addition to the above, information may be shared with an arbitral tribunal, a court, and governmental authorities if such disclosure is prescribed by law.
Storage of personal data
The personal data is stored for a period of ten years from the date of completion of the assignment, or for a longer period as required by the nature of the assignment.
2.5 Accounting and invoicing regarding client assignments
Purpose and legal basis
We need to process personal data in order to be able to handle outgoing and incoming invoices. The processing that takes place for accounting and invoicing purposes is based partly on our fulfilment of agreements with clients, and partly on our obligation to fulfil legal requirements that are incumbent on us.
We process your personal data for the following purposes in order to fulfil contractual obligations:
- To be able to handle and administer invoicing and reminders.
- To be able to handle and administer accounts receivable that arise within the scope of an assignment.
We process your personal data for the following purposes in order to fulfil legal obligations:
- To be able to handle our accounting in accordance with the Swedish Bookkeeping Act (1999: 1078).
It is not a requirement to provide us with your personal data. However, without this data, we will be able to neither fulfil our agreement nor obligations in relation to you.
Categories of personal data
We process the following categories of personal data.
- name, address, email address and telephone number of the contact person/representative/course-participating employee, and
- invoice and payment information.
Recipient of personal data
The information is shared with our accounting firm (solely the personal data of the name of the invoice reference person of the legal person) and these invoices are stored in the bookkeeping system used (Fortnox).
Storage of personal data
Personal data is stored for the purpose of fulfilling legal requirements regarding taxation, accounting, or to defend legal claims. In these cases, data is stored for seven years from the time of invoicing (regarding accounting) and ten years (regarding taxation and limitation periods).
2.6 Newsletter mailing and direct marketing
We do not maintain any mailing lists for marketing purposes, and neither do we participate in any form of direct marketing. However, course-participating employees of legal persons may agree to have their name, company name, photograph and personal quote, regarding the use of our services on our homepage. The legitimate interest is for us to provide information on course participants’ experience which may assist prospective clients in determining whether we would be an appropriate language-service provider. The balancing of interests is that those offering testimonials would be marketing their own visibility regarding their own services.
LAB English has no social media presence e.g. on Facebook, You Tube, Instagram, Tik-Tok, Twitter due to the highly sensitive nature of our company’s work, especially with regard to law firms within the EU/EEA and C-level executives of private and publicly-owned companies. In the event that an employee has a personal LinkedIn page then work-related content in connection therewith is supervised by LAB English in accordance with our internal governance routines.
2.7 Recruitment
Purpose and legal basis
We collect and process personal data in order for us to be able to handle applications, interview, and make decisions in a recruitment process. The overall purpose of a recruitment process is that we should be able to employ people with the right skillset for a vacancy. We may also save the personal information in our in-house CV database in order to contact the applicant for a future recruitment process. The legal basis for the processing consists of entering into an agreement and our legitimate interest in being able to receive and handle an application for employment.
It is not a requirement to provide us with your personal data. However, without this data, we will not be able to fulfil our obligations to you in the performance of our recruitment process.
Categories of personal data
Within the scope of a recruitment process, we process the following categories of personal data:
-
name, address, email address and telephone number of the applicant,
-
where applicable, a photograph of the applicant,
-
information about the applicant’s previous work experience and certificate(s) of employment.
-
education and education certification, as well as
-
contact information for any references provided by the applicant.
It is important that you as an applicant do not provide information that is not relevant to the application. When applying, you do not need to provide sensitive data. CVs that are sent by email are stored in our subscription to Apple Cloud.
Storage of personal data
We retain personal information during the recruitment process. Erasure of information received from unsuccessful applicants takes place after two years in accordance with the Swedish Discrimination Act (2008: 567).
We may also save applications in our CV database from candidates who are interested in a future recruitment process. In such cases, the data is stored for a maximum of two years. However, the data subject always has the opportunity not to be contacted in the future by declining the processing.
2.8 Contact with suppliers and business partners
Purpose and legal basis
We process personal data in order to administer our contractual relationship with suppliers and business partners. The processing of personal data of contact persons/representatives/employees of suppliers/business partners is for the purposes of performing the agreement, fulfilling our obligations towards our suppliers/business partners, as well as handling deliveries, and communication.
The legal basis for our processing in these cases is our legitimate interest in being able to perform and fulfil our agreements with our suppliers/business partners. In the balancing of interests, we have assessed that the contact person/representative has an interest in the fulfilling of our obligations to our suppliers/business partners.
Categories of personal data
We process names, telephone numbers and email addresses regarding the contact person/ representatives/ of suppliers/business partners with whom we have a business relationship, as well as for those employees that attend our courses and seminars.
Recipient of personal data
We store the data in Apple Cloud, which is our cloud-based service provider for document storage. We do not share the information with other IT and system vendors.
Storage of personal data
We save personal data in order to fulfil our agreement with each supplier/business partner. Information regarding the contact person/representative/course-participating employee is therefore processed for the time that is deemed necessary for us to be able to administer the contractual relationship, exercise our rights and fulfil our obligations in relation to each supplier/business partner. In the event that your employment or your assignment with the supplier/business partner ends, we will terminate our processing of your personal data as soon as we have received such information. Agreements that contain your personal information are stored for ten (10) years from the termination of our business relationship in accordance with the limitation period set forth in the Swedish Limitation Act.
2.9 Handling suppliers’ invoices
Purpose and legal basis
In order for us to be able to handle invoices, we need to process personal data. The processing is for accounting purposes regarding invoicing or payment of services or products, which is based on the fulfilment of legal requirements that are incumbent on us under the Swedish Bookkeeping Act. It is not a requirement to provide us with your personal data. However, without this data, we will be able to neither fulfil our agreement nor obligations in relation to you.
We process your personal data for the following purposes in order to fulfil our contractual obligations:
• To be able to handle invoicing.
• To be able to make payments for services or products.
We process your personal data for the following purposes in order to comply with legal requirements:
• To be able to perform our accounting in accordance with the Swedish Bookkeeping Act (1999: 1078).
Categories of personal data
We process the following categories of personal data.
• name, address, email address and telephone number of the contact person/representative of suppliers/business partners with whom we have a business relationship, and
• invoice and payment information.
Recipient of personal data
We store the data in Apple Cloud, which is our cloud-based service provider for document storage.
Storage of personal data
We save personal data in order to fulfil our agreement with each individual supplier/business partner. Information regarding the contact person/representative is therefore processed for the period that is deemed necessary for us to be able to administer the contractual relationship, exercise our rights and fulfil our obligations in relation to each supplier/business partner. In the event that your employment or your assignment with the supplier/business partner ends, we will terminate our processing of your personal data as soon as we have received such information. Information regarding payments, and any processing that is required under the Bookkeeping Act is stored for seven (7) years in accordance therewith.
3 USE OF COOKIES
LAB English website (www.labenglish.se) does not contain cookies. As part of our internal governance routine we regularly ask our website hosting supplier whether cookies have been inserted onto our website. Should such an event arise, we request that they are removed. In addition, as part of our internal governance routines, we use a cookie-scanning tool to observe whether cookies are operating on our website.
4 THE RIGHTS OF THE DATA SUBJECT
The right to access (so-called extract from the register)
You are entitled to be informed about the processing that we perform regarding you. This must include a description of the purpose and legal basis of the processing, which categories of personal data it concerns and who receives the personal data. We have compiled this information in this privacy statement for your ease of reference. An extract from the register means that you are provided with herein with an overview of the processing so that you may understand if, and for what purpose, your personal data is processed.
Right to rectification, erasure or restriction
If you believe that we have processed your personal data incorrectly, or that it may need to be rectified, you have the right to request that we correct the data, and, if you do not want us to continue processing the personal data, you have the right to request that we erase the data. We will rectify or delete the personal data if it is possible in respect of our purpose for the processing and the legal requirements that we are under a duty to follow.
The right to object in certain circumstances
You have the right to object at any time to the processing of your personal data if the legal basis for the processing consists of the performance of a task in the public interest, or a balancing of interests.
The right to data portability
The data subject has the right to retain the personal data that has been provided to the personal data controller, and has the right to transfer this data to another personal data controller subject to:
a) it being technically feasible; and
b) the legal basis for the processing consists of consent, or that the processing was necessary for the fulfilment of an agreement.
The right to withdraw consent
If the processing of personal data is based on the data subject’s consent, he or she has the right to withdraw their consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
The right to lodge a complaint regarding the processing of personal data
The data subject always has the right to contact the Swedish Authority for Privacy Protection in order to lodge a complaint linked to our processing of personal data. Below you will find the contact information for the Swedish Authority for Privacy Protection.
Telephone number: 08-657 61 00
Email address: imy@imy.se
If you, as a data subject, wish to exercise your rights or have a response to other questions, you can find our contact information set out in Section 1. The data subject has the right to contact us as an alternative to contacting the Swedish Authority for Privacy Protection.
5 HOW IS YOUR PERSONAL DATA PROTECTED?
We use IT systems to protect the confidentiality, privacy and access to personal data. Access is granted only to those persons that need to process your personal data in order for us to fulfil the purposes set forth herein.
6 TRANSFER OF DATA TO THIRD PARTIES
We do not disclose information to third parties other than those specified in Section 3. However, (including, but not limited to, situations where we have a legal obligation to do so). In order to ensure that personal data is processed in a safe and secure manner in each case, we have a routine of drawing up a personal data assistant agreement with each external party that processes personal data on our behalf. The sharing of personal data with third parties is to be found in Section 2.
7 TRANSFER TO THIRD COUNTRIES
We mainly process personal data within the EU/EEA. In the event of a transfer to a third country, we will ensure that such a transfer takes place in accordance with applicable data protection legislation. In addiction, it should be noted that our data storage system is Apple Cloud, and Apple’s servers may be located in a third country. LAB English has researched that Apple has servers for EU customers operating in Athenry, Ireland and Viborg, Denmark.
8 INTERNAL GOVERNANCE
We have established internal guidelines for the processing of personal data.
9 AMENDMENTS TO THE PRIVACY STATEMENT
We reserve the right to amend and update this privacy statement. We will provide information in an appropriate manner, and on our website, in the event of material changes to the privacy statement, or if existing data is to be processed in another way than stipulated herein.
This privacy statement was drawn up and published on 5 September, 2021. The latest update was on 10 May, 2023.