‍Why and for whom?

At North House AB, 559362-3365 ("North House", "we", "us") we care about data privacy. This means that we respect and protect your privacy and the right to control and transparency when processing your Personal Data.

This Privacy Policy (the "Policy") applies to data processing for which North House is the Personal Data Controller. The policy describes the purposes for which we need your Personal Data, the legal basis we rely on and the measures we take to protect personal data. It also describes how you can exercise the rights you have regarding our processing of your Personal Data.

This Policy describes our handling of Personal Data in cases where you communicate with us, use the Service or visit our website.

This policy is aimed at:

• Job seekers with us
• Investors in North House
• Employees of North House
• Visitors on our website

‍

Definitions

"Processing" of Personal Data is everything that can be done with Personal Data, e.g. storage, modification, reading, transmission, etc.

"Applicable data protection legislation" means from time to time applicable legislation, ordinances and regulations, including regulations issued by relevant supervisory authorities, regarding the protection of natural persons' fundamental rights and freedoms and in particular the right to protection of their Personal Data when processing Personal Data that is applicable in the current case, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free flow of such data and on the repeal of Directive 95/46 /EC (General Data Protection Regulation) ("GDPR") as well as legislation, regulations and regulations supplementing the GDPR.

"Personal Data" is any kind of information that can be linked to an identifiable, living person.

"Personal Data Controller" is the company/organization that decides for which purposes and in what way the Personal Data is to be processed and is thus also responsible for Personal Data being processed in accordance with Applicable Law.

"Personal Data Processor" is the company/organization that processes Personal Data on behalf of the Personal Data Controller and may therefore only process the Personal Data in accordance with the Personal Data Controller's instructions and Applicable Law.

"Data subject" means the living, natural person whose Personal Data is processed.

"the Service" The North House platform that enables creation and ongoing management of governance frameworks.

”The Company” is the customer using the services North House provide.

“Registrant” means the person or entity that registers or signs up for our service.

‍

North House Personal Data responsibility

The information in this Policy covers the Processing of Personal Data for which North House is the Personal Data Controller, i.e. the Processing for which we specify the purpose of data collection, processing and retention. The policy does not describe how we process personal data in the role of Personal Data Processor - i.e. when we process personal data on behalf of our customers.

‍

Website

We collect and process Personal Data from you who visit our webpage in order to improve the user experience and for certain marketing purposes. 

‍

Recruitment

We collect and process Personal Data concerning individuals who apply for employment with us. We collect information that you provide to us in connection with the recruitment process, for example in CVs and cover letters. If we have hired a recruitment agency, we collect the Personal Data that the recruitment agency provides to us. We do not normally collect reviews from reference persons during the recruitment process, but should this happen, we will collect the Personal Data that the reference person provides about you. In some cases, we collect information that is publicly available, for example on social media, as a basis for assessing an application. In connection with an employment agreement, we verify the information you have provided against public records to ensure that we have correct information for you.

‍

Shareholders

We collect and process Personal Data concerning you as a shareholder. This is, for example, information that according to the Swedish Companies Act (Aktiebolagslagen 2005:551) must be reflected in the share register, information you provide to us in connection with registration for and voting at the general meeting, account information in case transactions are to be carried out and contact information so that we can contact you in matters that apply the company.

‍

Employees

We collect and process Personal Data concerning you as an employee in order to be able to manage the employment relationship and in various ways facilitate your tasks and your existence at the workplace. It could, for example, be about getting your salary paid to a designated bank account, registering for participation in a team building activity or if you have any dietary preferences.

‍

North House Processing of Personal Data

We have a responsibility to describe how we live up to the requirements placed on us when we process your Personal Data. This section aims to give you an understanding of the types of personal data we process about you and for what purposes.

‍

How long do we save your Personal Data?

We save your Personal Data for as long as is necessary regarding the purpose for which it was collected. Depending on the legal basis on which we perform the processing, this may:

a) follow from an agreement

b) depend on a valid consent

c) result from legislation

d) following an internal assessment based on a balancing of interests.

We never retain your Personal Data for longer than necessary. North House also takes reasonable measures to keep the Personal Data that is processed up-to-date and to delete outdated and otherwise incorrect or redundant Personal Data.

‍

Processing

The main purpose of the Personal Data processing that we carry out is to provide, perform and improve our services. There are several different reasons why we may need to collect, process and save your data.

We mainly process the following personal data:

• Contact and identification details to confirm your identity and be able to communicate with you
• Information about your use of the service or product in order to improve the customer experience.
• ‍

How do we get access to your personal data?

We collect your personal data in a number of different ways. We mainly get access to your personal data:

• By the fact that you yourself have provided us with your personal data
• Because your employer has provided us with your personal data
• Through generated information retrieved internally
• Through our logs
• Through information created from analysis of data
• From public sources such as authorities, SPAR etc.

‍

Legal grounds

In order for us to process your personal data, it is required that we have so-called legal basis for the respective treatment. In our business, we process your personal data primarily on the following grounds:

Consent - North House processes your Personal Data after we have received your consent to Processing. Information about the Processing is always provided in connection with asking for consent.

Agreement - The Processing is necessary for us to be able to fulfill obligations in an agreement between us or to prepare for entering into an agreement with the Registrant.

Legal obligation - According to applicable laws and regulations, we are obliged to process Personal Data as a result of our operations.

If you want additional information about the legal basis for which we process your Personal Data, you have the right to request a so-called register extract. Read more under "Your rights" below.

‍

Your rights

You are in control of your Personal Data. We strive to ensure that you can exercise your rights as efficiently and smoothly as possible.

Access - You have the right to receive information about the Personal Data Processing that concerns you in a so-called register extract. The register extract contains, among other things, details about which types of Personal Data we have stored and for which purposes and on which legal basis.

We only release information if we have been able to verify the identity of the requestor.

Correction - If you discover that the Personal Data we process about you is incorrect, contact us and we will work with you to rectify it.

Deletion - Do you want us to forget you completely? You have the right to request the 

deletion of your Personal Data when they are no longer necessary for the purpose for which they were collected. If we are required to retain your data by law or an agreement we have entered into with you, we will ensure that it is only processed for the specific purpose stated in the law or agreement until it can be deleted.

Objection - Do you disagree with us that our interest in Processing your Personal Data outweighs your interest in protecting personal integrity? No problem - in that case we will review our balance of interests and check that it still holds. We will take your objection into account when we make a new assessment to evaluate whether we can still justify our Processing of your Personal Data. If you object to direct marketing, we will delete your Personal Data at once without reviewing our assessment.

Limitation - You can also ask us to limit our Processing of your data:

• During the time we are dealing with a request from you about any of your other rights.
• If, instead of requesting deletion, you want us to mark that the data should not be processed for a certain purpose. If you e.g. do not want us to send you advertising in the future, we still need to save your name or contact details to know that we should not contact you.
• In cases where we no longer need the data for the purpose for which it was collected, provided you do not have an interest in us retaining the data to assert a legal claim.
  

Data portability - We can provide you with the information you have provided to us yourself or that we have received from you in connection with entering into an agreement with you. The data is provided in a commonly used and machine-readable format.

Withdraw consent - If you have consented to one or more specific Processing(s) of your Personal Data, you have the right to withdraw your consent at any time and thus ask us to cease the Processing immediately. Please note that you can only withdraw your consent for future Processing(s) of Personal Data and not for any Processing that has already taken place.

‍

How to use your rights

Contact info@northhouse.se

‍

Transfer of Personal Data

Appropriate safeguards for transfers of Personal Data to third countries

• If the Company transfers or discloses your Personal Data to a recipient in a country outside the EU/EEA area (third country), the Company will ensure that appropriate protective measures have been taken (such as the European Commission's standard contractual clauses and other necessary measures) to protect the Personal Data.
• According to Applicable Data Protection Legislation, you have the right, upon request, to receive a copy of the documentation that demonstrates that the necessary protective measures have been taken to protect your Personal Data when transferred to a third country.
• If you want to know more about the processing of your Personal Data and if your Personal Data is transferred to a third country, please contact us at the contact details shown at the bottom of this information text.

‍

Our Personal Data Processors

North House does not sell or share your Personal Data. In some cases, however, we may share your Personal Data with selected third parties. If that happens, we make sure that the transfer takes place in a secure way that preserves your privacy. Below are categories of recipients with whom we may share your information.

• Suppliers of various HR systems or HR services, e.g. through the CLM system or for the payment of salaries.
• IT suppliers for, for example, business systems and case management. To carry out our assignments and services, we store your data in our business systems (a system that administers our customers and contacts).

‍

Security

We will ensure that access to your Personal Data is adequately protected by applying appropriate security measures, according to industry best practices. We have implemented appropriate technical, physical and organizational measures to protect your Personal Data against unauthorized or accidental destruction, alteration or disclosure, misuse, damage, theft or loss through accident or unauthorized access.

‍

Complaint to supervisory authority

If you feel that we are processing your Personal Data incorrectly, even after you have alerted us to this, you always have the right to submit your complaint to the Swedish Privacy Protection Authority.

More information about our obligations and your rights can be found on the Swedish Data Protection Authority's website (https://www.imy.se/en). You can also contact the authority at imy@imy.se.

‍

Contact

Contact us if you have questions about your rights or if you have any other questions about how we process your personal data: info@northhouse.se

‍

‍