What data do we process?
For ordinary website visits we process only the technical information required to deliver and protect the service. When you contact us, we process the contact details and the information you choose to provide.
For experts in the portal we may process name, contact details, company details, professional background, competence, languages, geography, availability, commercial profile, CV, assignment descriptions, reference information, consent status and the portal activity needed for administration and security.
Why do we process the data?
We use data to handle enquiries, enter into and administer agreements, assess and administer the expert network, match competence to assignments, meet legal obligations and protect the website and the portal.
Legal bases
Processing required to handle an application, or to prepare or perform a contract, may be based on contract or on steps taken prior to entering into a contract. Certain security and administrative processing may be based on legitimate interest following an assessment. Legal obligation is used where the law requires processing. Optional AI-assisted processing of an expert profile and CV is based, where consent is used, on separate consents that can be withdrawn.
AI
AI is not used for automated decisions about who is admitted to the expert network, receives an assignment, is passed over or receives a particular fee. Optional AI choices are described separately on the page AI & data.
Who has access?
Only people and suppliers who need the data for their task are to have access. Necessary IT, hosting and security suppliers may process data as processors. If an external AI supplier is used for optional AI processing, the supplier in question and the relevant terms are to be documented before use.
Transfers outside the EU/EEA
We aim for processing based in the EU/EEA. If a supplier entails a transfer outside the EU/EEA, the transfer must have an applicable legal mechanism and documented safeguards before personal data is transferred.
How long is the data kept?
We do not keep personal data longer than the purpose requires. An unsuccessful expert application should normally be deleted or anonymised no later than 12 months after the process has ended, unless there is a documented reason to keep it longer. Active expert profiles are kept for the duration of the network relationship and should be reconfirmed regularly. Data that must be kept by law is retained for as long as the law requires. Security logs should have short, documented retention periods.
Your rights
Depending on the situation and the legal basis, you can request access, rectification, erasure and restriction, object to certain processing, and receive a copy of your data. Consents can be withdrawn without affecting the lawfulness of processing that has already taken place. Experts can export their portal profile and request account deletion directly in the portal.
Complaints
If you believe personal data is being handled incorrectly, you can contact us. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).
Special categories of personal data
The Expert Portal is not intended for data concerning, for example, health, religion, political opinions, ethnicity, sex life or trade-union membership. Do not provide such information in free-text fields or in your CV unless it is absolutely necessary and legally justified.