Privacy Policy (2026-10-09)

Data Controller

Rojs Software AB (reg. no. 559573-3501), Kongahällagatan 7, 442 36 Kungälv, is the data controller for the processing described in this policy.

Data protection enquiries can be sent to support@vardbemanningsguiden.se.

Personal Data Processed

We process contact details, account identifiers, session and security data, application details, timesheet data, billing records, and moderation data required for the service.

For BankID sign-in, we process strong identity attributes, short-lived BankID attempt state, and the minimum identity binding needed for account access and abuse-prevention security. Raw personnummer is processed transiently to derive keyed identifiers and is not persisted in platform records. BankID identity data is not sent to analytics or marketing.

For manual company authority review, we may process an uploaded registration certificate, signing email, BankID signing state, BankID display name, derived identifiers/fingerprints, encrypted BankID signature and OCSP response, and selected evidence ids.

For interest leads, we also process selected work categories, regions, optional messages, and accepted document versions. For matched interest leads, we additionally process the single assignment, delivery state, and first authorized access.

We do not process sensitive health data for ad targeting or other marketing purposes.

Legal Basis and Purpose

Core product functions such as account access, applications, invitations, timesheets, approvals, and support handling are processed to perform a contract or to take steps before entering into a contract.

BankID is used as necessary strong identity for Swedish member sign-in and is processed to deliver account access, protect against unauthorized use, and bind verified identity to the correct member account.

Manual company authority review is processed to verify that a company can be activated with appropriate authority evidence before or during the customer relationship.

Matched interest leads are processed to provide the matching requested by the consultant and share the request with exactly one eligible firm. If no firm is eligible, the request remains unassigned for manual handling.

Security logging, abuse prevention, moderation, disputes, and auditability are processed under legitimate interests.

Billing, bookkeeping, and other required business records are processed to comply with legal obligations.

Consent is used only for analytics and future marketing categories where consent is required under applicable rules.

Consent is not used as the legal basis for core processing required for matched interest leads.

BankID and Strong Identity

The BankID service is purchased through Danske Bank. When an identification or signing order starts, we send the end-user IP address to BankID. BankID also receives the orderRef when we collect status or request cancellation. For company-authority signing, BankID receives the visible signing text and technical references that bind the text to the correct request.

When BankID completes, we receive data including the name and raw personnummer. Raw personnummer is processed transiently for validation and keyed derivation and is not persisted in platform records. The name may be stored as the account display name or as part of the signing evidence.

The member browser that starts the flow receives orderRef and autoStartToken. The company-authority signing browser receives autoStartToken. Both flows may receive animated QR data containing the QR start token, elapsed time, and an HMAC authentication code. Only the start and QR values listed above are returned to the browser. The raw QR secret, encrypted provider envelopes, raw identity, signature, and OCSP response remain server-side.

For company authority, a link valid for seven days is sent through Resend to the intended email address. The link acts as a bearer key to the limited signing page and may be visible in the recipient mailbox and browser history. It contains no BankID identity data, and a BankID signature never activates the company automatically.

Authorized operators can see the signatory email, signed statement, BankID orderRef, manual signing link, BankID display name, and keyed provider-subject and personnummer fingerprints during manual review. The BankID signature and OCSP response are encrypted and are not shown in the ordinary evidence view.

The 30-day member session and the 10-minute completion proof are signed but not encrypted. They may contain internal user, attempt, site-profile, and purpose references plus expiry, but no BankID provider payload or raw personnummer. HttpOnly prevents ordinary page code from reading them but does not hide them from the browser user or another person sharing the browser profile. Full cookie details are available in Cookies and Similar Technologies.

The minimum identity binding is retained while the member account exists. A pseudonymous BankID identity that is no longer linked to an account, an interest lead, or a pending rights request is automatically deleted after 24 months of inactivity. The link to a terminal interest lead is removed 36 months after closure and the last relevant update. This does not automatically delete the member account; an account-erasure request is reviewed and handled separately.

Current company-authority evidence is retained while it is needed for the company account. When an operator has removed completed evidence, its identifying and BankID-linked contents become eligible for automatic minimization after 24 months. Minimization occurs in the first safe successful daily cleanup after the cutoff, once the signing request is closed and no active or uncertain BankID operation must be preserved. Technical references needed to prevent an old runtime from creating new evidence remain without the signatory name, email, BankID reference, signature, or OCSP contents.

BankID data is not sent to analytics or marketing. A change that stores additional BankID attributes, changes recipients, or reuses the identity for a new purpose requires a new privacy review.

Interest Leads and Recipients

A direct interest lead is sent only to the firm chosen by the consultant and cannot be rerouted to another firm.

A matched interest lead is assigned to exactly one eligible firm. If no firm is eligible, it remains unassigned until Ops handles it manually.

The firm receiving an interest lead is an independent recipient for its follow-up. It may use the data only to handle that specific lead and according to its own legal obligations.

If an interest lead is withdrawn, we stop future access where possible. Data the recipient firm has already accessed may need to be handled by that firm under its own obligations.

Analytics, Marketing, and Public Transparency

When the Analytics category is allowed, we use Vercel Web Analytics for page views and first-party analytics for a limited set of public interactions. First-party analytics uses random pseudonymous session and journey identifiers that are not linked to an account, BankID, an interest lead, or consent evidence.

Private workspaces, sensitive search parameters, contact details, profile values, free text, lead ids, and BankID data are excluded from analytics events. Raw first-party events are retained for 30 days and anonymous daily aggregates for 24 months.

Company authority signing links are excluded from web analytics because the link contains an authority token.

The Marketing category exists in the interface but is not active on this site today. Google tags or other ad measurement must not be enabled before a separate consent model and updated documentation are in place.

If consultant ratings or sponsored firms are shown publicly, they must be described clearly so that ratings, rankings, and sponsorship are not conflated.

The deterministic quality and fair-order matching has been assessed and is not a decision with legal or similarly significant effects under Article 22. Higher ratings do not increase request volume, and Ops can manually handle unassigned and matched requests. A material future change requires a new review.

Cross-border Transfers

Certain subprocessors (Vercel, GitHub, Stripe, and Resend) may process personal data outside the EU/EEA. Resend processes recipient details, message content, and delivery metadata in the United States to deliver transactional email.

Such transfers are protected by the EU Standard Contractual Clauses (SCCs) included in each subprocessor's data processing agreement. Information about the applicable safeguards and how to obtain a copy can be requested from support@vardbemanningsguiden.se.

Agreement Evidence When a Company Workspace Is Claimed

When the first owner claims a company workspace, we store the company name and organisation number, accepted terms and pricing versions, the privacy-notice and authority-declaration versions shown, the user, time, source invitation, and a minimized reference to the BankID identification.

BankID identification establishes which person claimed the workspace but does not replace the separate review of registration certificates, company signing authority, and BankID signatures before activation.

Commercial Match Status and Retention

To perform customer agreements, establish billing support, handle disputes, and prevent circumvention, we document when an identifiable consultant has been made available to a particular firm through the Service.

The commercial match status has no contractual expiry. To evidence that status, we retain a minimised and access-restricted relationship reference for as long as necessary and lawful for those purposes. Its necessity, access, and minimisation form are reviewed regularly.

The relationship reference is kept separate from the interest lead's full contact details, messages and other free text, and BankID identity data. Those data follow their shorter retention periods and are deleted or minimised when no longer needed; they do not need to be retained for the match status to continue.

The relationship reference is not used for marketing or automated decisions about the consultant. Data subjects can contact support@vardbemanningsguiden.se to request access, correction, deletion, or restriction, or to object to processing under applicable data protection law.

Sources, recipients and responsibilities

Data comes from you, authorised company representatives, companies inviting you, public business sources and our identity/payment providers. Company-contact sources and objections are described separately below. We do not disclose contact details to every listed company; enquiry recipients follow the enquiry rules above.

Authorised company members receive data needed for their role. Providers process data for agreed services: Vercel for application hosting and technical logs, Neon for the database, GitHub for backups and restore verification, Resend for service messages and one.com for support correspondence. Stripe supports invoicing and payments. The BankID section explains its allocation of responsibilities. Authorities and legal advisers may receive limited data where legally required or necessary for legal claims.

Rojs controls its own service, security, matching and billing purposes. When administering a company's consultant, assignment, workplace or time-report data solely on its instructions, the company is controller and Rojs is processor under the DPA. Contact the company about its processing; we can help route your request. Our own use of necessary fee/accounting evidence is assessed separately.

You may request current recipients and processing countries and a copy of applicable transfer safeguards at support@vardbemanningsguiden.se. These may include EU standard contractual clauses and supplementary measures where necessary.

Retention of accounts, profiles and applications

Identifiable information must be kept only for a documented purpose. At termination or on an erasure request we assess each data category separately, distinguishing ongoing service, cases and obligations from data that can be deleted or anonymised. Deletion may require manual handling; hiding a profile does not itself delete its data.

Accounts, memberships and consultant profiles: data needed for access and requested functions remains during the account relationship. On closure, profile/access data must be removed or minimised except what is still needed for an open case, a specific legal obligation or a legal claim. Closing an account does not necessarily allow all financial evidence to be deleted at the same time.

Applications: data is used during assessment and follow-up of a decision or requested reconsideration. Once those processes end, data without a continuing contractual, verification or legal need must be removed or minimised. Rejected and abandoned applications must be reviewed regularly for this purpose.

Company profiles, contacts and customer/workplace directories: data remains while needed for publication, the company relationship or assignment administration. Inactive unclaimed profiles and archived customers/workplaces must be reviewed quarterly. Unnecessary contacts and free text must be removed even if the company itself remains in the directory.

Retention of enquiries, ratings and agreement evidence

Enquiries: contact details and messages follow the active lifecycle plus 24 months after closure, unless a documented dispute, legal obligation or hold justifies longer retention. Limited assignment/access evidence follows a 36-month rule after closure. Delivery identifiers and bounded failure categories are minimised after 90 days. BankID attribution and a minimised commercial relationship reference have separate rules; they do not justify keeping full messages or contact details for the same duration.

Ratings and moderation: data is needed while the rating is published and while a verification, objection or dispute about its accuracy remains open. After publication and case handling end, unnecessary identifying information must be removed or minimised. Evidence still needed for a legal claim is kept separate from public display. Our legitimate interest is reliable ratings and preventing abuse.

Agreement acceptances, authority evidence and invitations: relevant proof remains during the company relationship and subsequently only to the extent needed for specified contractual matters, disputes, applicable limitation periods or legal obligations. An old invitation still supporting agreement evidence is handled with that evidence, not as an ordinary expired invitation. Removed authority evidence follows the specific 24-month rule described in the BankID section.

Time reports, approvals and invoice evidence: data supports assignments and invoicing. Accounting records are retained as required by applicable bookkeeping law; unnecessary profile information and free text are not automatically subject to the same requirement. Open disputes can justify separate, limited preservation until resolution and expiry of the relevant claims period. Customer-controlled processing also follows the company's instructions under the DPA.

Retention of consent evidence, security and analytics

Consent evidence contains choices, version, time and limited site context, not the visited page path or signing link. It demonstrates the lawfulness of the related analytics processing. The need ends when that processing and its personal data have been retired, unless a specific complaint, regulatory investigation or legal claim requires separate evidence. Proof may therefore remain after withdrawal but cannot authorise continued analytics.

Security/audit logs and rights requests: identifying data supports investigation of documented access events, evidence of authorised decisions or handling and demonstrating a response. Once the case is closed, we assess whether a concrete objection, regulatory or claims risk still requires evidence; otherwise identifying data must be removed or minimised. Remaining evidence is limited and access-restricted. Logging alone does not justify indefinite retention of all free text.

Technical operational logs have a 30-day retention period, except separate evidence in a documented incident or investigation. Terminal background jobs and linked recovery history normally follow a 90-day rule after the latest terminal event. Scheduled encrypted logical backup files remain for no more than 14 days. Following a restore, earlier deletion instructions must be reapplied before the data is used.

Analytics retention is 30 days for pseudonymous first-party events, 24 months for anonymous daily aggregates and the active Vercel plan's 12-month reporting window for web analytics. Pseudonymous data can remain personal data. Anonymous aggregates must not identify a person. Cookie/session lifetimes are in the cookie policy. Consent is required for analytics, not used as a blanket basis for accounts, security or accounting.

Rights and Contact

You may request access, rectification, erasure and restriction and object to processing based on legitimate interests. Data portability applies to data you provided where automated processing is based on consent or contract: a structured, commonly used, machine-readable format and transmission to another controller where technically feasible. GDPR conditions and exceptions apply, including protection of other people's rights.

Send privacy questions or requests for human review of an incorrect BankID link, denied access or disputed identity to support@vardbemanningsguiden.se. The CEO is accountable for human review. The target is an initial human response within three business days, not a final decision or a replacement for statutory rights-request deadlines.

Withdraw analytics consent at any time through Cookie settings in the footer by declining analytics. Withdrawal does not affect earlier lawful processing. Contact us to withdraw other consent. Object to direct marketing using an unsubscribe link or support; that processing must then stop.

Send rights requests to support@vardbemanningsguiden.se. Consultants and company members can download their account data and close their personal account in account settings. Operators have equivalent controls under My account in Ops; the last administrator must first establish another active administrator. Company profiles, reviews, other members and company agreements remain. Necessary contractual, payment and security history follows the retention rules; a new BankID sign-in does not restore company permissions. Proportionate identity checks may be necessary to protect your information. We respond without undue delay and normally within one month of receipt. Where complexity or the number of requests requires an extension, we explain it within the first month; the extension is at most two months. If we cannot fulfil a request, we explain why and how to complain.

Enquiry access may include actual recipients and timestamps without improperly disclosing others' data. You may complain to the Swedish Authority for Privacy Protection (IMY), imy.se, and seek a judicial remedy. Where data is required for a contract or legal duty we explain this at collection; without necessary data we may be unable to provide the requested function.