Privacy policy

About the policy

Complior is committed to protecting your privacy. This information is for visitors to our website, people registered with us as contacts and anyone who has been in contact with a member of our sales team. The policy explains how Complior collects and uses your personal data. It also describes your rights in relation to us and how to exercise them.

Contact us at sales@complior.se or +46 8 535 24 100 with questions about privacy and data protection. This website provides contact by email and telephone, rather than web chat or a contact form. The information below also covers personal data that may remain from earlier contacts.

This policy is based on Complior's published policy dated 16 December 2025. Contact methods, language and information about the website's functions were adapted on 13 October 2026.

What are personal data and processing?

Personal data is any information that can be linked to you directly or indirectly. This may include your name or personal identity number, but also your email address or telephone number. Images are also personal data if you can be clearly identified in them.

Processing means everything we at Complior do with your personal data, for example collecting, organising or otherwise processing it.

How do we collect personal data?

Your personal data may be recorded when you call us, send an email, request information materials, submit feedback or a question, or when your company is our customer and our companies exchange contact details. Earlier contact may also have taken place through web chat or contact forms.

If you contact us, we may occasionally send you relevant marketing information. The lawful bases and ways to object are described below.

Avoid sending privacy-sensitive information through channels such as email and social media. This may include information about ethnic origin, religious or political views, health, personal identity numbers or trade union membership.

Who is responsible for the personal data?

Complior is the controller for the processing described here because we determine its means and purposes. We also use processors: external providers that help us carry out the processing. More information is available under Who can see your personal data?

Why do we process personal data?

To offer our services and fulfil our commitments, we need to process data about you. The purposes, data, lawful bases and retention periods under Complior's policy are set out below.

Complior does not carry out profiling or automated decision-making using your personal data. Here, automated decision-making means processing data to make decisions without human involvement, for example through a program that makes decisions according to an algorithm.

Contact with prospects and customers

Purpose: identifying and managing prospects and customers for contact with our sales team.

Data: name, email address, work telephone number, job title and the salesperson's notes.

Legal basis: legitimate interest and consent.

Retention period: for as long as we have a customer relationship with you and you do not object to the processing. The customer relationship ends one year after the contractual obligations have been fulfilled. Prospect data is retained for as long as we consider there to be a specific interest in our products and services, but for no more than two years.

Newsletters and marketing communications

Purpose: newsletters to customers and marketing communications to contacts and prospects. If you read our communications, we may also see whether you click through to our website.

Data: name and work email address.

Lawful basis: legitimate interests, described in the policy as soft opt-in, and consent, opt-in.

Retention period: for as long as we have a customer relationship with you and you do not object or unsubscribe. The customer relationship ends one year after the contractual obligations have been fulfilled. For those who have given consent, data is erased when the subscription ends.

Data from the previous web chat

The new website has no web chat. For data collected through the previous function, the policy described the following processing.

Purpose: to answer visitors' questions and identify potential business opportunities. The function could show which pages a visitor had viewed.

Data: IP address, email address and name provided, and country and town or city. Legal basis: legitimate interest.

Retention period: a maximum of six months, unless the person has been registered as a prospect. In that case, the section Contact with prospects and customers applies.

Customer contacts

Purpose: to manage and contact customer representatives. This includes, for example, ticket handling, visitor administration, contract signing, email correspondence, meeting notes, meeting bookings and operational documentation.

Data: name, job title, work email address and telephone number. Personal identity numbers are used only for visitors to our data centres, for secure identification.

Lawful basis: fulfilment of contractual obligations and legitimate interests.

Retention period: for as long as the service agreements with the customer remain current. Personal identity numbers are deleted when the matter is closed.

Customer invoicing

Purpose: to fulfil obligations under service agreements and provide other services and product sales, such as consultancy and sales of templates.

Data: name, telephone number, email address and company registration number.

Lawful basis: performance of contractual obligations and legitimate interest.

Retention period under the policy: data is retained for seven years as required by the Swedish Bookkeeping Act. After that, deletion is completed within a maximum of one year.

Recruitment

Purpose: processing job applications.

Data: information provided in a CV, such as name, personal identity number, photograph, telephone number, email address, address, experience and previous occupations.

Legal basis: legitimate interest and consent.

Retention period: while the recruitment process is ongoing. If we see potential in a candidate, the data may be retained afterwards only with consent, and then for no more than three years.

How long do we retain data?

We retain personal data only when there is a purpose for keeping it. We are also required to retain certain data for specified periods under legislation, such as the Swedish Bookkeeping Act. Retention periods for the different processing activities are stated above.

Who can see your personal data?

The data is accessible only to people who need it to carry out their work. Data may also be transferred to system providers that help us with IT operations and support.

Complior may provide necessary information to the Swedish Police Authority, the Swedish Tax Agency or other authorities if we are required to do so by law.

Where is personal data processed?

Complior aims to process your personal data within the EEA, the European Economic Area. In some situations, data may be transferred to and processed in countries outside the EEA because some providers or subcontractors are international organisations.

Complior will take all reasonable legal, technical and organisational measures to ensure that data is handled securely and with an adequate level of protection within and outside the EEA. Contact sales@complior.se if you would like to know whether or where your data is transferred outside the EEA.

Access and exercising your rights

You have the right to receive information about the personal data Complior holds about you. Contact sales@complior.se to request a copy of the data we process and a description of the processing. This is normally sent within one month.

Your rights apply under the conditions set out in data protection legislation. When you contact us to exercise them, we need to verify your identity; our staff may ask verification questions.

Rectification and restriction

If you believe personal data is inaccurate or misleading, you may request rectification or, in some cases, restriction of its use. Contact sales@complior.se and explain what you believe is wrong and why.

Erasure

You may request the erasure of personal data when at least one of the following conditions is met:

• The data is no longer needed for the purposes for which it was collected.
• The processing is based on consent and you withdraw it.
• You object to the use of the data for direct marketing.
• You object to processing based on legitimate interests and there are no overriding legitimate grounds.
• The data has been processed unlawfully.
• Erasure is necessary to comply with a legal obligation.

When data may need to be retained

The right to erasure is not unlimited. Complior's policy explains that data may, for example, need to be processed for a task within a contractual relationship, for archiving purposes, for freedom of expression and information, to meet a legal obligation or to defend legal claims. The exceptions that apply must be assessed in each individual case.

Data portability

In certain circumstances, you have the right to receive your personal data in a commonly used, structured and machine-readable format and to have it transferred to another organisation where technically feasible. This applies when processing is based on consent or a contract and is carried out by automated means. Contact sales@complior.se.

Objections and complaints

You have the right to object to Complior's processing of your personal data and to lodge a complaint with the Swedish Authority for Privacy Protection, IMY. You can object to direct marketing at any time; Complior will then stop the marketing.