PERSONAL DATA POLICY (UPDATED JANUARY 2021)

Data Controller

Straetus AB is the data controller for the processing of personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR).

Data Protection Officer

Straetus AB has appointed a Data Protection Officer (DPO) whose task is to monitor compliance with personal data protection rules within the organisation. The DPO performs this role independently in relation to Straetus AB. You may contact the Data Protection Officer by emailing info@straetus.se.

Collection of Personal Data

Straetus AB processes personal data as part of its debt collection activities.

The categories of personal data processed include name, personal identity number, contact details (address, email, and telephone number), and financial information (such as income details, etc.).

Straetus AB may also record telephone calls, register relevant written communication, or otherwise document customer interaction and communication with Straetus AB. Name and address information is continuously updated via the Swedish population register (SPAR).

Purpose and Legal Basis for Processing Personal Data

Straetus AB processes personal data for the following purposes:

The primary purpose of Straetus AB’s processing of personal data is to fulfil its duties as a debt collection service provider. This includes collecting, verifying, and registering the personal data required to manage debt collection cases correctly, as well as documenting, administering, and fulfilling entered agreements. The debtor has voluntarily and contractually provided personal data to our client, which is a prerequisite for Straetus AB to handle the individual debt collection case.

Legal Obligation as the Legal Basis for Processing

The legal grounds for a debt collection agency’s processing of personal data are primarily that the data is necessary for the agency to carry out its debt collection activities. Additional legal bases include that the processing is necessary to comply with legal obligations (e.g. providing correct personal data in matters before authorities and courts) and to perform a contract (fulfilling payment obligations).

Processing of Personal Data by Parties Other Than Straetus AB

Personal data may, within the framework of applicable confidentiality rules, be processed by companies within the group and from time to time by companies that the group cooperates with in order to perform its services. Necessary agreements have been entered into with these parties, among other things, to protect customers’ privacy when personal data is processed.

Retention Periods

Personal data will be stored for as long as the debt collection case is ongoing and thereafter for up to ten (10) years in accordance with legal requirements (see “Legal Obligation as the Legal Basis for Processing”). Personal data is deleted thereafter.

Rights of the Debtor

The debtor has the right to receive information about and access to the personal data processed by Straetus AB.

The debtor also has the right to contact Straetus AB to request rectification of incorrect or incomplete data, request erasure or restriction of the processing of personal data, and to object to the processing under certain conditions.

The customer’s written request and/or objection as described above is assessed by Straetus AB on a case-by-case basis. In some cases, Straetus AB may not be able to erase or restrict the processing of personal data, either because the data must be retained due to a contractual relationship or due to applicable legislation.

Supervisory Authority (Swedish Authority for Privacy Protection)

The debtor may also contact the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten) directly regarding questions or complaints concerning Straetus AB’s processing of personal data via www.imy.se.