Last Updated: October 14, 2026
Introduction
Kristensson i Skåne AB (“we“, “us” or “our“) respects your privacy and is committed to protecting your personal data. This Privacy Notice explains how we collect, use, and safeguard personal information when you visit our website or engage with our services. We adhere to the EU General Data Protection Regulation (GDPR) and applicable Swedish data protection laws in all our data processing activities.
We are committed to making our privacy information accessible. If you require this notice in another format due to a disability, please contact us.
Data Controller and Contact Information
Kristensson i Skåne AB, a company registered in Sweden (Org. No. 556963-2317), is the data controller for the personal data we process. Our contact details are provided in the “Contact Us” section below.
Personal Data We Collect
Depending on how you interact with us, we may collect and process the following categories of personal data.
- Contact Information: If you contact us (for example, via phone, email or a contact form), we may collect your name, email address, phone number, job title, or other information you provide. If you contact us by email, your message and any attachments will be processed via Microsoft 365.
- Inquiry or Service Data: Details related to your inquiries or requests, such as the content of messages you send us or information about the services you inquire about.
- Business Contact Data: When we contact companies and organisations to present our services, we process the contact person’s name, job title, work email address and work phone number, and the organisation they work for. This data comes from publicly accessible sources, such as the organisation’s website, Allabolag and LinkedIn, and AI services that compile publicly available information. We contact you only in your professional capacity.
- Electronic Signing Data: When we send agreements, quotes and other documents for electronic signature, we process the name, email address and, if you have given it, phone number of each person who is to sign, the content of the document, and the signing log (times and IP address). This concerns representatives of and contact persons at customers, suppliers and other counterparties, private individuals who are themselves a party to an agreement, and our own staff. If you sign with BankID, we also process your Swedish personal identity number so that you can be identified securely (Swedish Data Protection Act (2018:218), Chapter 3, Section 10). BankID is provided by the bank that issued your BankID, and that bank is itself responsible for the processing that takes place in the BankID service. Documents are signed in Zigned (see the tables below).
- Job Application Data: If you apply for a job or express interest in employment with us (for instance, by sending a CV or cover letter), we will collect the personal data you include in your application. This typically includes contact details, professional qualifications, employment history, and any other information you choose to provide about yourself in the context of recruitment. We will use this data only for recruitment and hiring purposes. If you send us job applications by email, your message and any attachments will be processed via Microsoft 365.
- Website Usage Data: When you visit our website, we gather basic analytics data through Plausible Analytics. This may include your IP address (which we do not store in identifiable form), general geographic region (e.g. country or city), device type, browser type, operating system, referring website, pages viewed, and the dates/times of access. This information is collected in an aggregated or anonymised format and does not directly identify you. If you consent to analytics cookies, we also use Google Analytics, which uses cookies to recognise your browser and collects the pages you visit, how you interact with them, device and browser data and your approximate location (see “Cookies and Tracking Technologies”).
- Advertising Data: If you have consented to our advertising cookies, we may collect data about how you interact with our ads. This could include whether you arrived at our site by clicking an advertisement, and technical data captured via advertising pixels/tags (as described in the Processing overview table and under “Cookies and Tracking Technologies”).
We do not intentionally collect any sensitive personal data (such as information about health, political opinions, or religious beliefs) through our website. We also do not knowingly collect personal data from children under 16 years of age; our website and services are aimed at business and professional audiences.
Processing Overview (Purposes, Legal Bases, Recipients, Transfers, Retention)
The table below summarises how we process personal data, including the purposes of processing, categories of data involved, legal bases under the GDPR, recipients or processors, information about international transfers, and applicable retention periods.
| Processing activity | Categories of personal data | Purpose | Legal basis | Key recipients | International transfers & safeguards | Retention / storage period |
|---|---|---|---|---|---|---|
| Handling enquiries and contact requests (phone, email, contact form) | Name, email, phone number, job title, and other information you provide; message content and attachments | Respond to enquiries; provide requested information/services; communicate with you; improve offerings and user experience | Legitimate interests (and/or performance of a contract where discussions lead to a client relationship) | Microsoft 365 (email, message content and attachments); Amazon SES (transmission of contact-form notification emails) | Microsoft 365 is configured to store and process customer data within the EU/EEA where available for our tenant. Where processing occurs outside the EEA (e.g., certain support/operations scenarios), transfers are safeguarded as described in ‘International Data Transfers’ and our contractual safeguards. | If you do not become a client: generally up to 12 months after we respond, then delete/anonymise unless a longer retention is required |
| Marketing to companies and organisations (contacting prospective clients) | Name, job title, work email address and phone number, organisation; notes on our contact, such as which mailings were sent and whether you have declined further mailings | Present our services; follow up interest; make sure that anyone who has declined is not contacted again | Legitimate interests (marketing our services to companies and organisations). You can object at any time, and the mailings then stop | Microsoft 365 (email); our internal systems, which run on our servers at Amazon Web Services (EU/Stockholm) | No transfers outside the EEA are expected: our servers at Amazon Web Services are hosted in Sweden, and Microsoft 365 is configured to store and process customer data within the EU/EEA where available for our tenant. See “International Data Transfers” | We regularly review the details of prospects who have not been in contact with us for a year and delete those we no longer need. Anyone who has asked not to receive mailings is kept on a suppression list so that we can respect that. |
| Delivering consulting services and managing client relationships | Contact details and project information; business communications; (where applicable) invoicing/contact details on financial records | Enter into and fulfil the contract; deliver services | Performance of a contract | Microsoft 365 (email, document storage and collaboration); our internal systems (Amazon Web Services, EU/Stockholm) | Microsoft 365 is configured to store and process customer data within the EU/EEA where available for our tenant. Where processing occurs outside the EEA (e.g., certain support/operations scenarios), transfers are safeguarded as described in ‘International Data Transfers’ and our contractual safeguards. | Duration of contractual relationship + thereafter as needed; accounting records may be kept 7 years as required by Swedish accounting/tax laws |
| Electronic signing and agreement archive (Zigned) | Name, email address and phone number (if you have given it); content of the document; signing log (times, IP address); personal identity number when signing with BankID | Send agreements, quotes and other documents for electronic signature; have them signed securely and traceably; be able to prove them afterwards | Legitimate interests (getting agreements and quotes signed securely and traceably, and being able to prove them); performance of a contract where you are a party as a private individual. The personal identity number is processed for secure identification under the Swedish Data Protection Act (2018:218), Chapter 3, Section 10 | Zigned AB (processor, Sweden), where the sealed signed document, with its verification and event log, is archived and shared with the parties; our internal systems (Amazon Web Services, EU/Stockholm, and Microsoft 365), where we keep a copy of each signed document; the other parties to the agreement; with BankID, the bank that issued the BankID (an independent controller) | Zigned is a Swedish company and our internal systems are hosted within the EU/EEA. Zigned’s hosting and storage are in the EU. Invitations to sign are sent via Mailgun in the USA, and Zigned’s support tools are in the USA. These transfers are safeguarded by the EU–US Data Privacy Framework (the Commission’s adequacy decision) or the European Commission’s Standard Contractual Clauses (SCCs). Zigned’s current sub-processors: zigned.se/villkor/pub/underbitraden. See “International Data Transfers” | 10 years after the agreement has ended, both at Zigned and in our own copy, so that we can prove the agreement if claims are made (Swedish Limitation Act (1981:130), Section 2; Swedish Bookkeeping Act (1999:1078), Chapter 7, Section 2). We then review the data and delete it |
| Recruitment (job applications) | Contact details; CV/cover letter; professional qualifications; employment history; other information provided in recruitment context; recruitment correspondence | Evaluate candidacy; manage recruitment process; make hiring decisions | Legitimate interests | Microsoft 365 (email, attachments, recruitment correspondence) | Microsoft 365 is configured to store and process customer data within the EU/EEA where available for our tenant. Where processing occurs outside the EEA (e.g., certain support/operations scenarios), transfers are safeguarded as described in ‘International Data Transfers’ and our contractual safeguards. | Applications not resulting in employment are deleted within 6 months unless consent is given or legal obligations apply. If an application is needed to establish, exercise or defend a legal claim, for example if a recruitment decision is disputed, we keep it until the matter is resolved and then delete it. |
| Website analytics (Plausible) | Website usage data in aggregated/anonymised form; includes IP-derived location (IP not stored in identifiable form), device type, browser type, operating system, referrer, pages viewed, access times | Understand how visitors use the website; improve user experience and content | Legitimate interests | Plausible Analytics | No transfers outside the EU are expected for this processing. Plausible states that website analytics data for their hosted service does not leave the EU. See “International Data Transfers” for our general approach if this changes. | Aggregated analytics may be retained indefinitely; Plausible stores data on servers in the EU |
| Website analytics (Google Analytics) — only if you consent | Online identifiers (cookie identifier); device/browser data; pages viewed and interactions; approximate location; referrer; access times | Understand how visitors use the website and improve content; where you have also consented to advertising cookies, measure our Google Ads campaigns and support remarketing | Consent | Google (Google Ireland Limited in EU/EEA + Google LLC in the US) | May involve transfers to the United States. Transfers are safeguarded as described in “International Data Transfers” (EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses). | Analytics cookies (_ga, _ga_*) are kept for up to about 13 months; event data in Google Analytics is kept for at most 14 months |
| Cookie consent management (CookieYes CMP) | Consent preferences/status; timestamp; country; consent ID; pseudonymised IP in consent log/proof of consent | Display cookie banner; store cookie choices; keep proof of consent | Legal obligation (where required to record consent) and/or legitimate interests (consent management) | CookieYes | CookieYes uses hosted infrastructure (including AWS). Where processing involves transfers outside the EEA/UK, transfers are safeguarded using the mechanisms described in “International Data Transfers” (e.g., adequacy decisions and/or Standard Contractual Clauses). | 1 year |
| Language preference (Polylang) | Language preference cookie (commonly “pll_language”) | Provide multilingual content; remember selected language | Legitimate interests (providing language functionality) | None — the language preference cookie is set and read within our own website environment (hosted at Amazon Web Services, EU/Stockholm). No third party receives this data. | No international transfer is expected. The language preference cookie is stored in your browser to remember your selection. See “International Data Transfers” for our general approach if this changes. | 1 year |
| Website hosting and security logs (Amazon Web Services) | Website content; technical logs; contact form data (if submitted); server log data for security/troubleshooting | Operate and secure the website; troubleshooting; security and network management | Legitimate interests (security/operations) | Amazon Web Services | No transfers outside the EEA are expected for this processing, as hosting and log storage are in Sweden/EU/EEA. See “International Data Transfers” for our general approach if this changes. | Logs generally kept for a limited period (weeks) unless required for security investigations |
| Advertising measurement and marketing (Google Ads) — only if you consent | Online identifiers (IP address, advertising identifiers); device/browser data; interaction data (ad clicks, page visits); conversion events | Advertising; conversion tracking; remarketing; measure campaign effectiveness | Consent | Google (Google Ireland Limited in EU/EEA + Google LLC in the US) | May involve transfers to the United States. Google may process data via Google Ireland Limited and transfer data to Google LLC in the U.S. Transfers are safeguarded as described in “International Data Transfers” (e.g., EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses). | Advertising cookies are kept for between 15 minutes and about 13 months depending on the cookie (for example _gcl_au 3 months, IDE about 13 months; see the current list in our cookie settings); aggregated reports retained per Google settings |
| Advertising measurement and marketing (LinkedIn Insight Tag) — only if you consent | Online identifiers; LinkedIn user ID (if logged in) or unique visitor identifier; IP address; device/browser data; website interaction data; timestamps and pages visited | Measure effectiveness of LinkedIn ads; obtain aggregated insights; improve ad targeting | Consent | LinkedIn Ireland Unlimited Company (EEA) + LinkedIn Corporation (US processing) | May involve transfers to the United States. Transfers are safeguarded as described in ‘International Data Transfers’, including Standard Contractual Clauses (SCCs) and other lawful transfer mechanisms, as applicable. | Cookies are kept for between 1 day and 1 year depending on the cookie (for example lidc 1 day, li_gc 6 months, bcookie 1 year; see the current list in our cookie settings); aggregated analytics retained per LinkedIn policies |
| Legal compliance, security, dispute handling, enforcement | Data depends on the matter (e.g., necessary correspondence or identifiers) | Comply with legal obligations; respond to lawful requests; prevent fraud; resolve disputes; enforce agreements; detect/prevent security incidents | Legal obligation and/or legitimate interests | Authorities (where required), relevant parties as needed | Case-dependent. Transfers depend on the specific situation (e.g., legal requests or security incidents). See “International Data Transfers” for our general approach and safeguards where transfers outside the EEA are required. | As long as necessary for the specific legal/security purpose. |
We will only use your personal data for the purposes listed in the Processing overview table above or for closely related purposes. If we need to use your data for any other purpose, we will inform you and ensure there is a valid legal basis for that new processing.
If you have questions about the specific legal basis applicable to a particular processing activity, feel free to contact us for more information.
Cookies and Tracking Technologies
Our website uses cookies and similar tracking technologies in a limited manner:
- Strictly Necessary Cookies: We may use essential cookies that enable core site functionality (such as language selection, cookie preference tools, security and network management). These cookies do not require consent. We also use a web hosting provider (Amazon Web Services) to operate and secure our website, which may involve processing limited server log data for security and troubleshooting purposes.
- Cookie Consent Management (CookieYes): We use CookieYes as our cookie consent management platform (CMP) to display our cookie banner and store your cookie choices. CookieYes sets a necessary cookie (e.g., “cookieyes-consent”) to remember your preferences so they are respected on subsequent visits.
- Language Preference (Polylang): We use the Polylang plugin to provide multilingual content. Polylang may set a cookie (commonly “pll_language”) to remember your selected language and show the website in that language on subsequent pages/visits. The language preference cookie is stored for 1 year.
- Analytics: We use Plausible Analytics to understand how visitors use our website and to improve content and user experience. Plausible does not use cookies or persistent identifiers and does not store IP addresses in identifiable form. If you consent to analytics cookies, we also use Google Analytics, which sets cookies (_ga and _ga_*) to recognise your browser and measure visits; it sets no cookies and collects no data before you have given consent. Further details regarding legal basis, recipients, international transfers and retention are set out in the Processing overview table above.
- Advertising Cookies: We use third-party advertising tools (Google Ads and LinkedIn Insight Tag) which may set cookies or similar trackers on your device, but only if you have given consent via our cookie consent banner. These tools are used to measure advertising effectiveness and, where enabled, support remarketing. You can withdraw your consent or change your choices at any time in the cookie settings. Further details regarding legal basis, recipients, international transfers and retention are set out in the Processing overview table above.
The full, current list of the cookies on our website, with their name, provider, purpose, category and storage period, is shown in our cookie settings. Open it with the “Cookie settings” link at the bottom of every page (“Cookieinställningar” on our Swedish pages) or with the cookie icon in the lower left corner. Our consent tool, CookieYes, keeps that list up to date when the website is scanned; if it differs from the examples in this notice, the list shows the current state. You can also manage or delete cookies at any time through your browser settings.
For more information about how these providers process data, please refer to their privacy and cookie policies:
- Plausible Analytics (Data Policy): https://plausible.io/data-policy
- Google (Privacy Policy): https://policies.google.com/privacy
- Google (How Google uses cookies): https://policies.google.com/technologies/cookies
- LinkedIn (Privacy Policy): https://www.linkedin.com/legal/privacy-policy
- LinkedIn (Cookie Policy): https://www.linkedin.com/legal/cookie-policy
- CookieYes (Privacy Policy): https://www.cookieyes.com/privacy-policy/
- CookieYes (Cookie Policy): https://www.cookieyes.com/cookie-policy/
- Amazon Web Services (Privacy Notice): https://aws.amazon.com/privacy/
- Amazon Web Services (GDPR and Data Processing): https://aws.amazon.com/compliance/gdpr-center/
- Microsoft (Privacy Statement): https://www.microsoft.com/en-us/privacy/privacystatement
Data Sharing and Disclosure
We treat your personal data with care and confidentiality. We do not sell or rent personal data to third parties. However, we may share your information in the following circumstances:
- Service Providers: We use trusted third-party service providers to assist us in operating our website and delivering our services. These include our analytics providers (Plausible and, if you consent, Google Analytics) and advertising partners (Google and LinkedIn) described above, as well as web hosting or IT support services. We use Amazon Web Services (AWS, hosted in the EU/Stockholm region) for website hosting, Amazon SES (EU/Stockholm) for automated outbound email, Microsoft 365 for email and document handling, and Zigned for electronic signing and archiving of agreements. Details are provided in the “Service Providers and Recipients” section below. Our processors handle data on our behalf only for the purposes described in this Privacy Notice and under our instructions, and we have agreements in place with them to ensure your data is protected (for example, Data Processing Agreements that bind them to confidentiality, security measures and GDPR compliance). Google and LinkedIn also use advertising data for their own purposes, as described in that section.
- Legal Requirements: We may disclose personal data if required to do so by law or in response to valid requests by public authorities (e.g., law enforcement, courts, or regulatory agencies). For example, if we receive a subpoena or a legally binding request, or need to report data breaches to authorities, we will comply with our legal obligations.
- Business Transfers: In the event of a reorganization, merger, acquisition, or sale of all or part of our business or assets, personal data relevant to that transaction may be transferred to the acquiring or merging entity. We will ensure the recipient of the data is obligated to protect your personal information in line with this Privacy Notice and applicable law.
- Protection of Rights: We may share information as necessary to enforce our terms of service or other agreements, or to protect the rights, property, or safety of Kristensson i Skåne AB, our employees, our clients, or others. This may include exchanging information with other companies and organisations for the purposes of fraud protection or credit risk reduction (in accordance with data protection laws).
In all cases, we only share the minimum personal data necessary for each purpose and ensure that any third party we share it with has a legitimate need to know and will handle the data with appropriate security and confidentiality.
Service Providers and Recipients
To ensure transparency, the table below provides an overview of our key service providers and other recipients, including the purpose of processing, categories of personal data involved, data location and retention principles. Most of them are processors: they process personal data on our behalf, only on our instructions and under data processing agreements. Two of them are not only processors. For Google Ads, Google acts as an independent controller under its own privacy policy, and LinkedIn also uses data collected through the Insight Tag for its own advertising under its privacy policy (links above). Both apply only if you have consented to advertising cookies.
| Provider (Service) | Purpose of Processing | Categories of Personal Data | Data Location | Retention / Storage Period | Safeguards |
|---|---|---|---|---|---|
| CookieYes Limited (CookieYes CMP) UK Ownership | Cookie consent management (banner, consent preferences, and consent logs/proof of consent) | Consent preferences, consent status, timestamp, country, consent ID, pseudonymised IP as part of consent log/proof of consent. | Hosted infrastructure (AWS) – Region not publicly specified by CookieYes | 1 year | Data Processing Agreement (DPA), UK Adequacy, Standard Contractual Clauses (SCCs) |
| Google Ads (Google LLC) USA Ownership | Advertising, conversion tracking, and measuring campaign effectiveness | Online identifiers (IP address, advertising identifiers), device and browser data, interaction data (e.g. ad clicks, page visits) | United States (EU–U.S. Data Privacy Framework) | Advertising cookies are kept for between 15 minutes and about 13 months depending on the cookie; aggregated reports retained according to Google’s standard retention settings | EU–U.S. Data Privacy Framework, Standard Contractual Clauses (SCCs) |
| LinkedIn Ads (LinkedIn Corporation / LinkedIn Ireland UC) USA Ownership | Advertising, analytics, and measurement of LinkedIn ad performance (Insight Tag) | Online identifiers, LinkedIn user ID (if logged in), IP address, device and browser data, website interaction data | United States (EU–U.S. Data Privacy Framework) | Cookies are kept for between 1 day and 1 year depending on the cookie; aggregated analytics retained per LinkedIn’s policies | EU–U.S. Data Privacy Framework, Standard Contractual Clauses (SCCs) |
| Google Analytics (Google Ireland Limited / Google LLC) USA Ownership | Website analytics and measurement of our Google Ads campaigns — only if you consent | Online identifiers (cookie identifier), device and browser data, pages viewed and interactions, approximate location | United States (EU–U.S. Data Privacy Framework) | Analytics cookies up to about 13 months; event data at most 14 months | EU–U.S. Data Privacy Framework, Standard Contractual Clauses (SCCs) |
| Plausible Analytics (Plausible Insights OÜ) EU (Estonia) | Website analytics — understanding how visitors use the website in order to improve content and user experience | Website usage data in aggregated/anonymised form: IP-derived location (IP not stored in identifiable form), device type, browser type, operating system, referrer, pages viewed, access times | EU — Plausible states that website analytics data for their hosted service does not leave the EU | Aggregated analytics may be retained indefinitely; no set expiration stated. No cookies or persistent identifiers are used. | EU/EEA hosting, GDPR-compliant data processing agreement; cookieless measurement |
| Amazon Web Services EMEA SARL (Web hosting) EU (Stockholm, Sweden) | Website hosting, infrastructure, and data storage, and our internal systems | Website content, technical logs, contact form data (if submitted), contact details and notes in our internal systems, and copies of signed documents | Sweden / EU / EEA | Data retained as long as necessary for website operation; logs generally kept for a limited period (weeks) unless required for security investigations | EU/EEA hosting, GDPR-compliant data processing agreement |
| Amazon SES (Amazon Web Services EMEA SARL) EU (Stockholm, Sweden) | Sending automated outbound email from the website (contact-form notifications, system emails) | Recipient email address; email content | Sweden / EU / EEA | Message data retained only as long as needed for delivery and logging (short period) | EU/EEA hosting, GDPR-compliant data processing agreement |
| Microsoft 365 (Microsoft Corporation) USA Ownership | Email communication, document storage, collaboration and internal business operations and recruitment processes | Contact details, email content, attachments, documents, business communications, job application data (CVs, cover letters, professional history, recruitment correspondence) | EU / EEA (EU-based data centres) | Data retained according to contractual relationship and legal requirements (e.g. up to 7 years for accounting-related records under Swedish law). Recruitment data is generally retained only for the duration of the recruitment process and for a limited period of 6 months, unless consent is given or legal obligations apply. If an application is needed to establish, exercise or defend a legal claim, for example if a recruitment decision is disputed, we keep it until the matter is resolved and then delete it. | EU Data Boundary, Standard Contractual Clauses, Microsoft GDPR commitments |
| Zigned AB (Zigned) Sweden | Electronic signing and archiving of agreements, quotes and other documents (agreement archive) | Name, email address, phone number (if you have given it), content of the document, signing log (times, IP address) and, when signing with BankID, personal identity number | Zigned AB, Sweden. Hosting and storage in the EU (Heroku, Google Cloud); email delivery (Mailgun) and support tools in the USA | 10 years after the agreement has ended. We then review the data and delete it | Data processing agreement; EU–US Data Privacy Framework or Standard Contractual Clauses for sub-processors in the USA |
International Data Transfers
Whenever we transfer or store your personal data outside of the European Economic Area (EEA), we take steps to ensure it remains protected in line with EU standards. The GDPR requires that when personal data is exported to countries outside the EEA that may not have the same data protection laws, appropriate safeguards are in place.
Some of our service providers are based in, or have servers in, countries outside the EEA:
- United States: Some of our service providers and partners may process personal data in the United States or otherwise outside the EU/EEA, depending on the service used and your choices (for example, if you consent to analytics or advertising cookies). Where personal data is transferred outside the EU/EEA, we ensure that an appropriate transfer mechanism under the GDPR is in place. This may include relying on an adequacy decision by the European Commission (where applicable), and/or implementing EU Standard Contractual Clauses (SCCs) and, where necessary, supplementary measures to ensure an essentially equivalent level of protection. Details about which providers may involve transfers and the safeguards used are set out in the Processing overview table and in the Service Providers and Recipients section.
- Other Countries: We primarily use service providers with processing in the EU/EEA. If in the future we need to transfer personal data to any other country outside the EU/EEA, we will ensure that a GDPR-approved transfer mechanism is in place before the transfer takes place. Depending on the circumstances, this may include relying on an EU adequacy decision (where applicable) and/or implementing EU Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or other safeguards permitted under the GDPR. Where required, we will also implement supplementary measures to ensure an essentially equivalent level of protection. If an appropriate safeguard cannot be ensured, we will not carry out the transfer unless a limited GDPR derogation applies in a specific case. We will reflect any material changes in this Privacy Notice and in the Processing overview table.
You can contact us if you would like more information about our international data transfer practices or the safeguards we apply (for example, to obtain a copy of the Standard Contractual Clauses we use with third-party service providers).
Data Security
We take data security seriously. We have implemented appropriate technical and organisational measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction. These measures include, for example, using firewalls and encryption to protect data, maintaining secure servers, using HTTPS (SSL/TLS) encryption to secure data in transit on our website, and enforcing access controls so that only authorised personnel and contractors (who are bound by confidentiality obligations) can access personal data on a need-to-know basis. We also maintain internal policies and conduct training to ensure that staff handle personal data with care and integrity.
We regularly review our security practices and update them in line with technological developments and industry standards. Additionally, we ensure that any third-party processors handling personal data on our behalf (such as our analytics or hosting providers) are also employing strong security measures.
Please note that while we strive to protect your information with a high degree of care, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee absolute security of your data. However, in the unlikely event of a data breach affecting your personal data, we will follow all applicable breach notification laws. This means we will notify you and the relevant supervisory authority (e.g., IMY in Sweden) without undue delay when required by GDPR, and we will take all reasonable steps to mitigate any potential harm.
Data Retention
We retain personal data in accordance with the retention periods specified in the Processing overview table above and only for as long as necessary to fulfil the purposes for which it was collected, or to satisfy legal, accounting, or reporting requirements.
Once the applicable retention period is over, or if the data is no longer needed for the purpose it was collected, we will either securely delete the personal data or anonymise it (so it can no longer be associated with an identifiable individual). If deletion is not immediately feasible (for example, because the data is stored in backups), we will ensure the data remains securely stored and isolated from further active use until deletion is possible.
Your Rights Under GDPR
As an individual in the European Union (or in other jurisdictions with similar data protection laws), you have certain rights regarding your personal data. These rights, subject to certain conditions and exceptions, include:
- Right of Access: You have the right to request confirmation of whether we are processing your personal data, and if so, to request a copy of the personal data we hold about you. This allows you to know and verify the lawfulness of our processing.
- Right to Rectification: You have the right to request that we correct or update any inaccurate or incomplete personal data we hold about you. We strive to keep your data accurate and will address correction requests promptly.
- Right to Erasure: You have the right to request deletion of your personal data in certain circumstances. This right (also known as the “right to be forgotten”) applies, for example, if the data is no longer necessary for the purposes it was collected, if you withdraw consent and no other legal basis for processing exists, or if you believe we are unlawfully processing your data. Please note that this right is not absolute – we may need to retain certain information where required by law or where we have compelling legitimate grounds to keep it (e.g., for legal claims or fraud prevention).
- Right to Restrict Processing: You have the right to request that we limit the processing of your personal data under certain conditions. For instance, you can request restriction if you contest the accuracy of the data (while we are verifying it), or if you object to our processing based on legitimate interests (while we assess the request), or when processing is unlawful but you prefer we restrict use of the data rather than delete it. When processing is restricted, we will store your data but not use it further until the restriction is lifted (except for exempted purposes like legal claims or protecting others’ rights).
- Right to Data Portability: For data that you have provided to us and which we process by automated means based on your consent or to perform a contract, you have the right to request a copy in a structured, commonly used, machine-readable format (for example, CSV or JSON file). You also have the right to transmit that data to another controller, or have us transfer it for you where technically feasible. This right facilitates moving your business or services elsewhere if you choose.
- Right to Object: You have the right to object to our processing of your personal data in certain situations. You can always object to processing for direct marketing purposes, and if you do, we will stop processing your data for that purpose. If we are processing your data based on legitimate interests, you can object if you believe your rights and interests outweigh our interests; we will then re-evaluate our reasons for processing your data. If your objection is valid and we have no compelling reason to continue processing, we will stop the processing in question.
- Right to Withdraw Consent: If we are processing any of your personal data based on your consent, you have the right to withdraw that consent at any time. For example, if you consented to cookies, you can change your mind and disable them (via our site or your browser). Withdrawing consent will not affect the lawfulness of processing that occurred before the withdrawal. If you withdraw consent for a specific purpose, we will stop the processing of your data for that purpose unless we have another lawful basis to continue (which we would communicate to you).
- Right to Lodge a Complaint: If you believe that we have infringed your data protection rights or GDPR obligations, you have the right to file a complaint with a supervisory authority. Kristensson i Skåne AB is established in Sweden, so our lead supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). You can contact IMY or visit their website for information on how to submit a complaint. If you reside in another EU/EEA country, you may choose to contact your local data protection authority instead.
To exercise any of your rights, please contact us using the information in the next section. We will respond to your request as soon as possible, and no later than one month from receipt of your request (this may be extended by an additional two months for complex requests, but we will inform you if an extension is needed). Please note that we may need to verify your identity before fulfilling certain requests, to ensure that we do not disclose data to the wrong person. This could involve asking for additional information or identification. There is no fee for exercising your rights unless the requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request.
Contact Us
If you have any questions about this Privacy Notice or our data practices, or if you wish to exercise your rights or raise a concern, please contact us.
Kristensson i Skåne AB
Postal address: Hällavägen 14, SE-244 95 Dösjebro, Sweden
Email: dataprotection@kiskane.se
Phone: +46 70 32 48 128
We will be happy to assist you and address any requests or concerns you may have regarding your personal data.
Updates to this Privacy Notice
We may update or revise this Privacy Notice from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. When we make changes, we will update the “Last Updated” date at the top of this Notice. If the changes are significant, we may also notify you by additional means (for example, by posting a prominent notice on our website or, if we have your email on file, by sending you an email notification).
We encourage you to review this Privacy Notice periodically to stay informed about how we are protecting your information.
By using our website, you trust us with some of your personal information. We value that trust and are committed to using your data responsibly and transparently. If anything in this Privacy Notice is unclear or if you need further information, please do not hesitate to reach out to us at the contact details provided above.
Thank you for reading our Privacy Notice.