Privacy Notice
At GREEN OWL AB (OWL), we want you to feel secure when you provide us with your personal information. We protect your privacy and always strive to maintain a high standard of data protection. All personal information is processed in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
This privacy notice contains information about how we, as the data controller, process personal data about you or the company where you are employed if you are a customer of ours, in connection with our marketing and offers, when you visit our website, and if you apply for a job with us. We describe how and for what purposes we use your personal data, the legal basis we rely on, and the measures we take to protect personal data. We also describe how you can exercise your rights regarding our processing of your personal data.
Who is responsible for your personal information?
GREEN OWL AB, corporate registration number 556921-4959 (“OWL,” “we,” “our,” or “us”), with an address at Ösk-vägen 10, 831 58 Östersund, is the data controller for the processing of personal data in the situations described below. This means that OWL determines the purposes and means of processing the personal data and is responsible for ensuring that the processing is carried out in accordance with applicable data protection regulations. When we process personal data on behalf of a customer in accordance with instructions and a data processing agreement, the customer is generally the data controller and OWL is the data processor.
Your Rights
Under the GDPR, as a data subject, you have several rights that you should be aware of, and you can contact us at any time if you wish to exercise any of them.
The rights you have in connection with our processing of personal data are described below. These rights are not unconditional and may be limited if the processing is necessary, for example, to enable us to comply with requirements under applicable law.
- Right of Access to Your Personal Data – You have the right to know whether we are processing your personal data and, if so, to access that personal data and related information.
- Right to Have Your Personal Information Corrected – If you believe that the information we have about you is incorrect, you have the right to have it corrected.
- Right to Have Your Personal Data Erased – You have the right to request that we erase your personal data, and we are required to comply with such a request provided that there are no compelling reasons for us to continue processing the data.
- Right to Restrict Processing – If you believe that the data is inaccurate, that our processing violates the law, or that we do not need the data for a specific purpose, you may request that we restrict the processing of your data. You may also request restriction while you await our review of whether our interest in processing your data outweighs your right not to have that data processed.
- Right to Object to Processing – You have the right to object to the processing of your personal data if our processing is based on our legitimate interest. If you do not want us to use your personal data for direct marketing, you have the right to object to such processing by contacting us. We will stop using your data for this purpose once we have received your objection.
- Right to Data Portability – In certain cases, when the legal basis is a contract or consent, you have the right to obtain your personal data and use it elsewhere.
- Right to File a Complaint with a Regulatory Authority – You have the right to file a complaint with the Swedish Data Protection Authority if you are not satisfied with our processing of your personal data. Their contact information is: Phone: 08-657 61 00, Email: [email protected], Mailing address: Swedish Data Protection Authority, Box 8114, 104 20 Stockholm.
Our Processing of Personal Information
We have a duty to describe and demonstrate how we comply with the requirements imposed on us when we process your personal data. This section provides a general overview of our personal data processing.
Legal Basis
Under the GDPR, in order to process personal data, the data controller must have a legal basis for the processing. We base our processing of your personal data on the legal grounds relevant to each specific purpose:
- Consent – You have given your explicit consent for us to process your personal information. You may withdraw your consent at any time, and we will then stop processing your personal information for the purpose for which you gave your consent.
- Agreement – The processing is necessary for us to fulfill an agreement we have with you or to enter into such an agreement.
- Legal Obligation – The processing of your personal data is necessary for us to comply with the legal requirements imposed on us in the course of our business operations.
- Legitimate interest – we have weighed our interests against yours and determined that our interest in processing your personal data outweighs your right not to be subject to such processing.
How long do we retain your personal information?
We retain your personal data only for as long as necessary for the purposes for which it was collected. Depending on the legal basis for our processing, this may be governed by a contract, require valid consent, be mandated by law, or result from an internal assessment based on a balancing of interests.
When we share your personal information with others
We may share your personal data with others in order to carry out any of the processing activities described in this document, such as data storage. We always enter into data processing agreements with the data processors we engage, in which we, among other things, provide the processor with instructions on how the personal data may be processed and what security measures are required for the processing. The processor may not process your personal data in any way that goes beyond these instructions.
If required by law, ordinance, regulation, a decision by a government agency, or any other regulation that is binding on us, we may disclose your personal information to various government agencies, such as the Swedish Tax Agency or the Police Authority.
Transfer of Personal Data Outside the EU/EEA
In cases where personal data is transferred to a country outside the EU/EEA, we take safeguards to ensure that the level of security is adequate and in accordance with applicable law. Such appropriate safeguards include, among other things, ensuring:
- that the European Commission has determined that the third country to which your personal data is transferred provides an adequate level of protection—in other words, that the protection of your personal data has been assessed as equivalent to the requirements of the GDPR—or
- that the European Commission’s standard contractual clauses have been entered into between us or our processor and the recipient outside the EU/EEA, meaning that we have contractually ensured that the protection of your personal data is equivalent to the requirements of the GDPR. In these cases, we also assess whether there is legislation in the recipient country that affects the protection of your personal data. Where necessary, we take specific measures to ensure that the protection of your data is maintained when it is transferred to the relevant country outside the EU/EEA.
Automated Decisions
“Automated decisions” means that certain decisions that have a significant impact on you are made entirely by automated means, without any human involvement.
When processing your personal data, we do not engage in any form of automated decision-making as referred to in Article 22 of the GDPR.
Profiling
“Profiling” refers to the automated processing of personal data to evaluate specific personal characteristics and behaviors, for example, by analyzing or predicting personal preferences.
We do not use profiling in our processing of your personal data in connection with the processing activities described in this notice.
Cookies
Cookies are small text files that may be stored in your browser when you visit a website. We use cookies on our website that are necessary for the website to function properly. On our website, we use the analytics tool Fathom Analytics to compile statistics on how the website is used. Fathom Analytics does not use cookies for this analysis. The tool does not track individual users and does not create personal profiles. The data is compiled in an aggregated and anonymized form.
Processing of Personal Data When Visiting Our Website
When you visit www.owl.se, we use Fathom Analytics to collect statistics about website usage. The purpose is to understand how visitors interact with the website so that we can improve the content and user experience. The statistics include, among other things, the number of page views, which pages are visited, referral sources (such as search engines or campaigns), device type, and approximate geographic region. Fathom Analytics is designed not to collect personally identifiable information about visitors. We do not use the tool to identify or track individual visitors.
The processing is carried out based on our legitimate interest in analyzing and improving the website. We use Fathom Analytics as our website analytics provider and have a data processing agreement in place that governs the processing. We strive to ensure that the data is processed within the EU/EEA. If a transfer to a country outside the EU/EEA occurs, we take appropriate safeguards in accordance with applicable data protection laws. Since the statistics we receive are aggregated and anonymized, we are generally unable to link them to a specific visitor or to fulfill a request that requires the identification of an individual visitor’s data.
Protection of Your Personal Information
We want you to feel confident about how we process your personal data. For all processing activities, we implement various security measures to protect your personal data against unauthorized access, alteration, or deletion, and ensure that this protection is maintained throughout the entire processing process. In cases where we process personal data that is sensitive in any way, we implement particularly strict security measures.
How Your Personal Information Is Processed
The sections below describe our processing of personal data based on the various categories of data subjects covered by the processing. We describe the categories of personal data we process and where the data is collected (source). We also specify the purposes for which the personal data is processed, the legal basis for the processing, how long it is processed—that is, when the purpose of the processing ceases—and with whom we share your personal data.
Processing of Personal Data for Customers and Representatives of Customer Companies
This section is intended for you if you are a customer or represent a company that is a customer of ours—such as the person with whom we maintain contact in our customer relationship, an authorized signatory, or a beneficial owner as defined by regulations governing anti-money laundering and counter-terrorism financing measures.
Categories of personal data and source
Categories of Personal Data | Source |
Contact and identification information—such as name, address, email address, phone number, social security number, nationality, and title | From you, your employer, the customer, or public records. |
Billing Information | From you, the customer, or the company you represent. |
Financial Information | From you or the company you represent, or from external sources. |
Payroll Information Related to Payroll Assignments | From the customer or the data subject, when we perform an assignment as a data processor. |
Communication and Transaction Information – Communication Regarding Existing or Future Business Relationships | From you, the customer, or other relevant contacts. |
AML/KYC and sanctions information – data required to comply with anti-money laundering regulations, such as beneficial ownership, PEP status, citizenship, and verification data | From you, the customer, public records, and external verification services. |
Social Security Number and information regarding customer identification, agreements, and authorizations | From you, the customer, and relevant registries. |
Specification of the Processing of Personal Data
Purpose | Personal Data Processed | Legal Basis | Retention period |
Provide financial and advisory services to clients and manage client relationships | Categories 1, 2, 3, and 5 above; Category 4 may also occur in client assignments | Contracts when you are a contracting party; otherwise, a legitimate interest in fulfilling and managing customer assignments | During the term of the assignment and, where applicable, for up to 10 years after the assignment ends |
Collaborate with other agencies within the Freedom Group on client projects | Relevant information in categories 1–5 above | Contract or legitimate interest, depending on the assignment; for processing on behalf of the client pursuant to a data processing agreement | According to the documented retention period specified in the assignment, normally no more than 10 years |
Billing and Financial Administration | Categories 1, 2, and, if necessary, 3 above | Legitimate interest and legal obligation (including accounting regulations) | Through the seventh year following the end of the calendar year in which the fiscal year ended |
Customer Due Diligence and Compliance with Anti-Money Laundering Regulations (AML/KYC) | Categories 1, 3, 6, and 7 above | Legal Obligation | Normally 5 years after the inspection is completed; in some cases, up to 10 years, in accordance with applicable regulations |
Parties with whom we share your personal information
When we process data as a data processor for a client, the relevant subprocessors and countries of processing are specified in the applicable data processing agreements. For our own administrative processing activities, we use, among others, IT and system providers, such as Microsoft and Fortnox, to the extent necessary for the respective purposes.
We may also share relevant personal data with other companies within the Freedom Group when collaborating on client assignments or where such sharing is necessary and permitted. The role of data controller or data processor is determined on a case-by-case basis for each processing activity. We also disclose information to competent authorities when required by law.
Processing of Personal Data in Connection with Our Marketing Activities
This section describes how we process personal data in connection with our marketing and promotional activities, such as when we host seminars and events, or send out newsletters or other marketing communications.
Categories of personal data and source
Categories of Personal Data | Source |
Contact information such as name, job title, employer, email address, and phone number; in the case of publication, also a photo and contact details | From you, your employer, existing business contacts, or publicly available sources, such as company websites and social media. |
Specification of the Processing of Personal Data
Purpose | Personal Data Processed | Legal Basis | Retention period |
Marketing activities and follow-up to promote OWL’s and the Group’s services | Contact Information | Legitimate interest | During the term of the engagement or for 2 years for prospects and contacts who are not customers |
Publish customer testimonials, photos, or other material in which a person can be identified on the website and on social media | Contact Information, Photographs, and Communication Details | Consent as per the treatment registry | Until such consent is withdrawn, taking into account any legal grounds for continued processing |
Parties with whom we share your personal information
Data Processor | Instructions (Scope of Use) | Treatment Region | Legal Basis for Transfers to Third Countries |
Freedom Group companies and relevant suppliers, including Microsoft | Marketing, customer relations, and follow-up | Primarily within the EU/EEA; any third-country access must be verified for the specific service | Applicable transfer mechanisms and safeguards where required |
Personal Information Processed in Connection with a Job Application
Categories of personal data and source
Categories of Personal Data | Source |
Contact, qualification, and application information, such as name, phone number, email address, resume, work experience, education, references, and correspondence. In the event of a special background check, records may be presented without being saved. | From the candidate, references obtained after contacting the candidate, recruitment agencies, and, where applicable, public sources. |
Specification of the Processing of Personal Data
Purpose | Personal Data Processed | Legal Basis | Retention period |
Manage recruitment processes and fill positions | Contact, Qualifications, and Application Information | Legitimate interest | To be deleted within 1 year of the position being filled, according to the processing log |
Handling Unsolicited Applications and Future Recruitment Contacts | Contact, Qualifications, and Application Information | Consent | Until consent is withdrawn, but for no longer than 1 year, according to the treatment registry |
Conduct reference checks and special background checks where warranted | Contact and educational information, as well as a copy of the criminal record | Legitimate interest as defined in the processing register; the processing of data regarding criminal offenses requires specific legal authorization | The candidate must present a copy of the registry extract; it is not stored by OWL |
Parties with whom we share your personal information
Data Processor | Instructions (Scope of Use) | Treatment Region | Legal Basis for Transfers to Third Countries |
Hailey and Microsoft; possibly other companies within the Freedom Group in relevant recruitment partnerships | Application Processing, Recruitment, and Communication | EU/EEA and any access/transfer to the U.S. via Microsoft | The appropriate safeguards for transfers to third countries must be verified |
Contact Information and Data Protection Officer
If you have any questions about how we process your personal information or would like to exercise any of your rights, you can always contact us at [email protected].
You can also contact the Freedom Group's joint data protection officer by email at [email protected]
If you prefer to contact us by mail, our address is:
GREEN OWL AB
10 Ösk Road
831 58 Östersund
Update to the Privacy Notice
We may make changes to this Privacy Notice. The most recent version will always be available on our website. If we make changes to this Privacy Notice that alter our commitments to you, we will notify you of this on our website and via any email address you have provided to us.