This privacy policy contains the rules and guidelines for the processing of personal data by Kallax Flyg in its capacity as data controller, regardless of the type of personal data or whose personal data is involved. The purpose of the privacy policy is to establish the framework for the new General Data Protection Regulation (GDPR).
In several cases where we request personal data, we do so in order to meet statutory or contractual requirements, or requirements necessary to enter into an agreement with an employee. In cases where the data subject does not provide the requested data, it may in some cases result in our inability to enter into or fulfill our obligations under an agreement with the data subject.
What is the legal basis for the processing?
Employees’ personal data is collected and processed to fulfill obligations under law, collective agreements, and/or for entering into and fulfilling individual contracts.
What personal data is processed and who are the recipients?
The personal data processed mainly includes name, personal identity number, telephone number, bank details, basis for compensation and benefits, address, information about relatives, qualifications, experience and development, absence, illness, and any rehabilitation. Recipients of the data include the HR manager, managers, the finance department, and internal or external parties who administer salaries and other benefits, etc., and authorities where required.
For what purposes is the personal data processed?
The employee’s personal data is required for the following purposes, among others: salary payment, calculation of bonuses and commissions, salary reviews and other compensation and benefits, general personnel administration, time reporting, board fees, maintaining emergency and contingency planning, contacting relatives in connection with incidents/accidents involving the employee, providing occupational health care, vacation, administering employment benefits (including pensions, life insurance, and health and medical insurance), maintaining records of illness and absences for the calculation of sick pay and participation in rehabilitation investigations in accordance with the Work Environment Act, making decisions on suitability for certain work, enabling evaluation and review of performance (including information on performance capacity and other assessment information and development discussions with the employee), and more generally to ensure compliance with legal obligations (including, but not limited to, income tax and social security legislation and all relevant labor law legislation, such as to comply with redundancy rules applicable in case of termination or to issue employer certificates).
In addition, data on persons and bonuses is processed for statistical purposes intended for Statistiska Centralbyrån (SCB).
When an employment ends, there is generally no reason to retain the former employee’s personal data. This includes the employee’s email account and information about the employee on Kallax Flyg’s website. Deletion should in such cases be carried out as soon as possible after the termination of the employment.
However, there are important exceptions to this. To fulfill its obligations in accordance with labor, tax, and social security legislation, Kallax Flyg must retain certain information about the employee even for a period after the termination of the employment. For example, data must be retained to meet legal obligations concerning taxation or accounting, obligations regarding the employee’s right of priority for re-employment under the Employment Protection Act (1982:80), and to handle legal claims that may be directed against Kallax Flyg. Sometimes it is also required that data is retained for the payment of, for example, pensions or severance pay. In these exceptional cases, the data is stored for 10 years (regarding accounting, taxation, and limitation periods).
Some of the personal data that Kallax Flyg processes as a result of the employment may constitute sensitive data. These may include health conditions or trade union membership.
Recruitment
What is the legal basis for the processing?
In order for Kallax Flyg to handle applications submitted by data subjects, conduct interviews, and make decisions in a recruitment process, Kallax Flyg must process certain personal data. The basis for this processing is a balancing of interests, or alternatively, contract.
What personal data is processed and who are the recipients?
Personal data processed by Kallax Flyg includes, among other things, name, date of birth, address, information about experience and skills, and possibly a photograph, etc. Recipients of the data are mainly the HR manager, managers, and contracted recruitment firms. In cases where recruitment firms handle the recruitment, a data processing agreement is always established with the external party; please see below regarding this with Kallax Flyg.
For what purposes is the personal data processed?
To handle applications, interviews, and decision-making in a recruitment process, Kallax Flyg collects and processes personal data.
How long is the personal data stored?
Kallax Flyg never stores data longer than necessary in relation to the purposes of the processing. Kallax Flyg therefore regularly deletes stored personal data and removes data that is no longer needed. However, Kallax Flyg may need to retain personal data after the recruitment process has ended if it is deemed necessary to retain legal claims that may be directed at Kallax Flyg. The retention period is therefore 2 years.
Special Note on Sensitive Data
In this Policy, sensitive data refers to personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation.
Kallax Flyg never processes sensitive data without the data subject’s consent or without a legal basis as outlined in Article 9 of the GDPR, for example, to fulfill obligations or exercise specific rights in employment, social security, and social protection law or when the processing is necessary to protect the vital interests of the data subject or another person when the data subject is physically or legally incapable of giving consent, in certain cases within the scope of trade union activities, if the data has been made public by the data subject, if necessary for reasons of important public interest, if necessary for reasons relating to, among other things, the assessment of an employee’s work capacity or the provision of health care, or if necessary for statistical purposes.
For each processing of sensitive data, Kallax Flyg always takes appropriate security measures to protect the data. Personal data is never accessible to more individuals than necessary.
WHAT RIGHTS DOES THE DATA SUBJECT HAVE?
Right of Access
The data subject has the right to contact Kallax Flyg in its capacity as data controller and request access to the personal data that Kallax Flyg processes and also be informed, among other things, of the purposes of the processing and who has received the personal data.
Kallax Flyg, as data controller, shall provide the data subject with a free copy of the personal data being processed.
Right to Rectification, Erasure, or Restriction
The data subject has the right to have their personal data corrected without undue delay or, under certain conditions, restricted or erased. If the data subject believes that Kallax Flyg processes personal data about them that is incorrect or incomplete, they can request correction or completion.
The data subject also has the right to have their data erased, for example, if it is no longer necessary or if the processing is based on consent and the consent has been withdrawn.
Right to Object
The data subject has the right to object at any time to the processing of their personal data if the legal basis for the processing is public interest or legitimate interests under Article 6.1 of the GDPR. The data subject also has the right to object at any time to the processing of their personal data for direct marketing purposes.
Right to Data Portability
The data subject has the right to receive the personal data they have provided to the data controller and has the right to transmit those data to another data controller. However, this applies only if it is technically possible and the legal basis for the processing is consent or that the processing was necessary for the performance of a contract.
Right to Withdraw Consent
If the processing of personal data is based on the data subject’s consent, they have the right to withdraw this consent at any time. Such withdrawal does not affect the legality of the processing before the consent was withdrawn.
Right to Lodge a Complaint with the Swedish Authority for Privacy Protection
The data subject has the right to lodge a complaint with the Swedish Authority for Privacy Protection.
Contact Details
Phone number: +46 8-657 61 00
Email address: datainspektionen@datainspektionen.se
CONTACT DETAILS
If you have questions regarding the handling of your personal data, you are welcome to email us at: personuppgift@kallaxflyg.se
CHANGES TO THE POLICY
Kallax Flyg reserves the right to change and update the Policy. In the event of material changes to the Policy or if existing information is to be processed in a different way than stated in the Policy, Kallax Flyg will inform of this in an appropriate manner.