Why and for whom?

At Agntho's AB, organisation number 556534‑5344 ("Agntho's AB", "AgnThos AB", "AgnThos", "agnthos.se", "we", "us", "our"), we care about personal privacy. We respect and safeguard your privacy and your right to control and have transparency when we process your personal data. This Privacy Policy ("Policy") applies to the processing for which AgnThos AB is the controller. The Policy describes, at a high level, why we need your personal data, the legal bases we rely on, and the measures we take to protect your personal data. We also explain how you can exercise the rights you have in connection with our processing. The Policy covers our handling of personal data when you communicate with us or when you use or visit our website agnthos.se (together, the "Features").

Definitions

"Processing" of personal data — means any operation that can be performed on personal data, e.g., storage, alteration, reading, disclosure, etc.

"Applicable law" — means the legislation applicable to the processing of personal data, including the General Data Protection Regulation (GDPR), supplementary national legislation, and practice, guidance, and recommendations issued by a national or European supervisory authority.

"Personal data" — means any information relating to an identified or identifiable living individual.

"Controller" — means the company/organisation that determines the purposes and means of the processing of personal data and is responsible for ensuring that personal data is processed in accordance with applicable law.

"Processor" — means the company/organisation that processes personal data on behalf of the controller and therefore only processes the personal data in accordance with the controller's instructions and applicable law.

"Data subject" — means the living natural person whose personal data is processed.

AgnThos AB's responsibility as controller

The information in this Policy covers the processing of personal data for which AgnThos AB is the controller; that is, the processing for which we determine the purposes (why a processing is carried out) and the means (how, which personal data, for how long, etc.). This Policy does not describe how we process personal data in the role of processor—i.e., when we process personal data on behalf of our customers.

AgnThos AB's processing of personal data

We are responsible for describing and demonstrating how we meet the requirements that apply when we process your personal data. This section aims to give you an understanding of which categories of personal data we process about you and for which purposes.

Data subjects and retention periods

Users of the Service: Users' personal data will be stored for as long as they use the service and to fulfil legal obligations, e.g., to handle alleged defects in the service.
Employees of prospective customers: Personal data of employees at prospective customers will be stored for the time required to determine whether the prospective customer wishes to enter into an agreement.
Employees of existing customers: Personal data of employees will be stored for the time necessary to provide the service and to fulfil legal obligations, e.g., to handle alleged defects in the service.

Cookies

Personal data relating to visitors to our website will be processed in accordance with our Cookie Policy. AgnThos AB uses cookies and similar tracking technologies to, among other things, analyse how the Features are used so that we can give you the best possible user experience.

Processing activities and purposes

The primary purpose of the personal data processing we carry out is to provide, perform and improve our services to you. We mainly process personal data for the following purposes:

Contact and identification details to confirm your identity, verify your information and communicate with you.
Information about your use of the service or product to improve your customer experience.
IP address to perform customer analysis and to ensure that content on our site is presented effectively for you and the device you use.
Consumption patterns to provide you with specific offers.

How do we obtain your personal data?

We collect personal data in several ways, including when you use our contact forms or order forms. We may also collect personal data through other channels or in connection with other types of services we offer.

Legal bases

We must have a legal basis for each processing activity. In our operations, we mainly process your personal data on the following bases:

Consent: AgnThos AB processes your personal data after we have obtained your consent to the processing. Information about the processing is always provided when we ask for consent.
Contract: The processing is necessary for us to fulfil obligations in a contract between us or to take steps at your request prior to entering into a contract.
Legitimate interests: AgnThos AB may process personal data where we have assessed that there is a legitimate interest that outweighs the data subject's interest in the protection of personal privacy, and if the processing is necessary for the relevant purpose, e.g., for direct marketing.
Legal obligation: We are required by applicable laws and regulations to process personal data as a result of our operations.

If you would like further information about the legal basis or bases on which we process your personal data, you always have the right to request a copy of your data (a "register extract"). Read more under "How to exercise your rights" below.

Your rights

You control your personal data. We always strive to ensure that you can exercise your rights as efficiently and smoothly as possible.

Access. You always have the right to obtain information about the processing of personal data that concerns you in a register extract. The extract shows, among other things, which of your personal data we have stored and for what purposes and on which legal bases. We only disclose data once we have verified that it is actually you requesting it.

Rectification. If you discover that the personal data we process about you is incorrect, contact us and we will fix it.

Erasure. Want us to forget you completely? You have the right to request erasure of your personal data when it is no longer necessary for the purpose for which it was collected. If we are required to keep your data under law or a contract we have with you, we will ensure that it is only processed for the specific purpose stated by the law or contract. We will then erase the data as soon as possible.

Objection. Do you disagree that our interest in processing your personal data outweighs your interest in the protection of personal privacy? If so, we will review our legitimate‑interest assessment and check that it still holds. We will take your objection into account when reassessing whether we can continue to justify our processing. If you object to direct marketing, we will remove your personal data immediately without reassessing.

Restriction. You can also ask us to restrict our processing of your data:

While we handle a request from you concerning any of your other rights.
If, instead of requesting erasure, you want us to mark that the data must not be processed for a certain purpose. For example, if you do not want us to send you advertising in the future, we still need to keep your name to know not to contact you.
In cases where we no longer need the data for the purpose for which it was collected, provided that you have an interest in us keeping the data so that you can establish, exercise or defend a legal claim.

Data portability. We can provide you with the data that you have given to us or that we have received from you in connection with entering into a contract. You receive your data in a commonly used and machine‑readable format that you can then take to another controller.

Withdraw consent. If you have consented to one or more specific processing activities, you have the right to withdraw your consent at any time and ask us to stop the processing immediately. Please note that you can only withdraw your consent for future processing and not for processing that has already taken place.

How to exercise your rights

Disclosure and transfers of personal data

To run our business, we engage others to process personal data on our behalf (so‑called processors). We process all personal data within the EU/EEA. We have entered into data processing agreements (DPAs) with all our processors. The DPA regulates how the processor may process personal data and which security measures are required for the processing. We may also need to disclose your personal data to certain specified public authorities to fulfil obligations under law or decisions by authorities.

Categories of processors

Providers of marketing services, e.g., advertising agencies to produce campaigns, or vendors that help with postal or email mailings.
Providers of HR systems or HR services, e.g., systems for contract management or salary payments.
IT providers, e.g., business systems and case management. To be able to perform our assignments and services, we store your data in our business systems (a system used to administer our customers and contacts).
Systems for customer analysis and statistics to contribute to industry statistics and to improve the customer experience.

Security

AgnThos AB has implemented technical and organisational measures to ensure that your personal data is processed securely and protected from loss, misuse, and unauthorised or unlawful access.

Our security measures

Organisational security measures: Measures implemented through working methods and routines within the organisation. Our organisational measures include:

Internal governing documents (policies/instructions)
Login and password management
Information security policy

Technical security measures: Measures implemented through technical solutions. Our technical measures include:

Encryption
Access list
Access log
Secure network
VPN
Firewall
Back‑up
Regular reviews of the security level

If we don't live up to our commitments

If you believe that we are processing your personal data incorrectly, even after you have alerted us to this, you always have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY). More information about our obligations and your rights is available on IMY's website (imy.se). You can also contact the authority at [email protected].

Changes to this Policy

We reserve the right to make changes to this Policy. If a change affects our obligations or your rights, we will inform you in advance so that you have the opportunity to review the updated Policy.

Contact

Get in touch if you have questions about your rights or any other questions about how we process your personal data: [email protected]