EFFSO and personal data
Effective Sourcing EFFSO AB and its sister companies (EFFSO) safeguard your integrity and endeavour to maintain secure handling of personal data. This integrity policy describes how EFFSO collects and processes data and what rights you have as a data subject in accordance with the GDPR, which came into effect on May, 25th 2018.
As the leading purchasing consultancy in the Nordic countries, EFFSO offers a wide range of services and products to help procurement organizations achieve their targets. This in turn means that EFFSO processes a large amount of personal data and that the purpose of the processing varies. What applies in the case of all personal data is that EFFSO considers it to be a loaned resource, meaning that we only process personal data when this is necessary, we have procedures for deleting it when the purpose and lawful basis no longer exist, and we ensure, through both procedures, technical solutions and data security measures, that only those individuals who need access to the data have such access.
EFFSO, with its head office in Stockholm, Sweden, has all legal entities within the EU/EEA. We enter into data processor agreements with all suppliers who process personal data on our behalf and with regard to those suppliers based in the USA whom we use (systems and cloud services) we require them to comply with the EU-U.S. Privacy Shield Framework, which ensures that the data subject’s rights as provided for in the GDPR are maintained throughout the entire processing process.
How is your personal data processed?
In order to make clear how EFFSO protects your integrity we begin with your relationship to EFFSO.
Candidates (recruitment to or consultant or job applicant with EFFSO)
When you are registered at EFFSO as a candidate we obtain your consent. This constitutes a lawful basis for processing and is valid for 18 months, after which a new request for consent is sent. You have the right to rescind your consent at any time, after which all data about you is erased or anonymised. You also have the right to receive an extract for you to see what information about you we process, have inaccurate information rectified, and finally you have the right to have your information provided to you for transfer to another party. Contact us if you wish to make a request as stated above at integritet@effso.se.
How is the data collected?
Personal data about you as a candidate is primarily collected from you personally, but it may also consist in data that you have chosen to publish on LinkedIn. According to GDPR, processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation is prohibited. EFFSO therefore ask you as a candidate never to submit such information.
What personal data is processed?
The personal data that EFFSO may come to process about candidates includes name, address, e-mail address, telephone number, personal identity number, grades, certificates, educational qualifications, work experience, photograph, test results, details from interviews, assignments applied for and references.
Why is personal data processed?
The information is used to match you to future recruitments and/or consultancy assignments, depending on what you are interested in, which means that the information can be used to:
- Create and handle your candidate profile in EFFSO’s candidate database
- Find search terms that match your profile and your preferences
- Compile a presentation of you that is adapted to a specific assignment
- When you have given your consent, share your information with clients
- For distribution of newsletters
EFFSO employees
EFFSO collects and processes information about you as an employee with agreements as the lawful basis. Information that does not need to be stored by law is deleted and/or anonymised when agreements expire.
How is the data collected?
Personal data about EFFSO employees is collected from you personally.
What personal data is processed?
The personal data that EFFSO may come to process about you as an employee (both persons permanently employed and persons on project contracts) includes name, address, e-mail address, telephone number, personal identity number, grades, certificates, educational qualifications, work experience, photograph, test results, details from interviews, assignments applied for, references, salary details, bank details, income tax deduction certificate, notes from appraisal dialogues, and vital information such as information about allergies and similar. For sub-consultants, details about subcontractor’s tax certificate and insurance policies are also processed. The list is not exhaustive but may be added to.
Why is personal data processed?
The information is processed to secure your possibility to work and develop, which means that the information can be used to:
- Draw up user information and similar for access to both physical and system-based work environments
- The data controller or the data subject shall be able to fulfil their obligations and exercise their specific rights under labour law and within the areas of social security and social protection.
- Handle time reporting and salary payment
- Pursue and document your development
- Compile presentations of you adapted to specific client assignments, which are shared with clients
- With your consent publish your personal data, such as photo and contact details, on EFFSO’s websites for marketing purposes
Clients and their employees who purchase services from EFFSO
EFFSO collects and processes personal data about you as a client with agreements as the lawful basis. Information that does not need to be stored by law is deleted and/or anonymised when agreements expire.
How is the data collected?
Personal data about clients and their employees is primarily collected from you personally, but it may also be collected from public websites such as company homepages.
What personal data is processed?
The personal data that EFFSO may come to process about clients and their employees includes name, e-mail address, telephone number and professional role/title. The list is not exhaustive but may be added to.
Why is personal data processed?
The data is use to start, carry out and report on the services that EFFSO contracted to perform, which means that the data may be used:
- For contracting
- For invoicing
- To carry out and report on a contracted service
- For distribution of newsletters
Clients and their employees who purchase systems from EFFSO
EFFSO collects and processes personal data about you as a client with agreements as the lawful basis. Information that does not need to be stored by law is deleted and/or anonymised when agreements expire.
How is the data collected?
Personal data about clients and their employees is primarily collected from you personally, but it may also be collected from public websites such as company homepages.
What personal data is processed?
The personal data that EFFSO may come to process about clients and their employees includes name, e-mail address, telephone number and professional role/title. The list is not exhaustive but may be added to.
Why is personal data processed?
The data is used to authorise access to systems and to provide support in connection with these systems in the best possible way, which means that the data may be used:
- For contracting
- For invoicing
- To comply with book-keeping legislation
- To create and handle user information
- In case of requested support
- For distribution of newsletters
Suppliers and their employees
EFFSO collects and processes personal data about you as a supplier with agreements as the lawful basis. Information that does not need to be stored by law is deleted and/or anonymised when agreements expire.
How is the data collected?
Personal data about suppliers and their employees is primarily collected from you personally, but it may also be collected from public websites such as company homepages.
What personal data is processed?
The personal data that EFFSO may come to process about suppliers and their employees includes, name, e-mail address, telephone number and professional role/title. The list is not exhaustive but may be added to.
Why is personal data processed?
The data is used to draw up agreements and ensure that the collaboration takes place in accordance with the laws and regulations in force:
- For contracting and drawing up of data processor agreements
- For invoice handling
- To comply with book-keeping legislation
Potential clients
EFFSO sells services and products by contacting potential clients by telephone and e-mail. Contact data is collected from official sources such as the companies’ websites and is stored with interest consideration as the lawful basis. EFFSO does not carry out any mass marketing without the recipient’s consent and stores only contact data during the sell-in phase. The data is then erased or anonymised.
How is the data collected?
Personal data about potential clients is collected from public websites such as company homepages.
What personal data is processed?
The personal data that EFFSO may come to process about potential clients includes, name, e-mail address, telephone number and professional role/title. The list is not exhaustive but may be added to.
Why is personal data processed?
The data is used to sell in products, which means that the data may be used:
- For contact for sales purposes
- For forecast and strategy work
- Follow-ups of history
Visitors to EFFSO’s websites
With your consent EFFSO uses session coolies on its websites to facilitate navigation. These cookies are not saved for a long period but disappear when you end your session. The websites also offer the possibility to reach EFFSO by means of a contact form where after giving your consent you are asked to provide your contact details. No data from the form is saved on the website and your data is used solely to contact you. It is erased as soon as the matter is concluded, but no later than six months after registration.
What personal data is processed?
The personal data that EFFSO may come to process about website visitors includes IP address, name, e-mail address and telephone number. The list is not exhaustive but may be added to.
Why is personal data processed?
The data is used to give you a good experience of EFFSO’s websites and to enable personal contact with EFFSO, which means that the data may be used:
- For contact when it is requested
- For website development
Contact details
If you have questions or comments about how EFFSO protects your integrity, please contact us as follows:
Effective Sourcing EFFSO AB
E-mail: integritet@effso.se
Integrity Manager
Landsvägen 50 A
172 63 SUNDBYBERG, SWEDEN
Telephone (switchboard): +46 (0)8-440 39 30