The intention of this Privacy Policy is to ensure that Rodolfo´s processing of personal data is done on lawful grounds and in accordance with the principles of the GDPR and that we handle our customers, employees and suppliers personal data in a safe and transparent way.
In the same way as for society as a whole, Rodolfo AB (“Rodolfo”), our customers, employees and suppliers are affected by digitization and globalization which has led to a significant increase in the use and spreading of personal data. Digitization means increased opportunities, but also a greater need for protection of the data subjects' personal data and integrity. This policy describes the overall principles that apply to personal data processing within Rodolfo.
The purpose of this policy is to define Rodolfo´s responsibility, and appoint roles and responsibilities, in order to comply with the General Data Protection Regulation (GDPR).
The objective is that Rodolfo´s processing of personal data is done on lawful grounds and in accordance with the principles of the GDPR to ensure that we handle our customers, employees and suppliers personal data in a safe and transparent way.
In this policy the following definitions are used:
Data Controller: ‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Data Subject: The natural living person to whom personal data relates to. A Data Subject is in this policy defined as any natural person that Rodolfo have any kind of relation with, e.g. private customer, employee, consultant and other.
Data Processor: A natural or legal person, public authority, institution or other body handling personal data on behalf of the personal data controller.
Personal Data: Any type of information that directly or indirectly can be referred to a natural physical and living person is according to the Data Protection Act considered personal data. This means that also photos and sound recordings of individuals that are processed in a computer can be considered personal data, even though no names are used. Encrypted data and different types of electronical identities, such as IP addresses, are also considered personal data if they can be linked to a physical person.
Processing: An action or combination of personal data or sets of personal data, whether performed automated or not, such as collection, registration, organization, structuring, storage, processing or modification, production, reading, use, transfer by transmission, dissemination or provision otherwise, adjustment or assembly, restriction, erasure or destruction.
The scope of this policy is limited to Personal Data processing as required by the General Data Protection Regulation (GDPR). This covers Rodolfo, external consultants performing tasks on behalf of Rodolfo and Data processors performing data processing on behalf of Rodolfo. In addition to the general guidelines set out in this policy, detailed requirements in local data protection laws must, as applicable, be followed by employees when processing personal data. In the case where Rodolfo is Data Processor for an external organization the data processing should be done in accordance with this policy, unless otherwise stated in a Data Processing Agreement between Rodolfo and a Data controller.
The Data Protection Policy applies to all staff, who performs tasks on behalf of Rodolfo regarding processing of personal data. It is also intended to be the basis for information to data subjects regarding personal data processing. It also applies to data processors who perform personal data processing on behalf of Rodolfo.
The CEO shall ensure that Rodolfo is appropriately organized with delegated responsibilities and sufficient resources for the processing of personal data within the company. The CEO can be contacted at adam@rodolfo.se
The Chief Information Officer (CIO) has the responsibility to identify information security risks, propose appropriate information security controls and follow up compliance towards, and efficiency of, the information security controls. The CIO can be contacted at info@rodolfo.se
The Controller is always responsible for the processing of personal data. The Controller is always the legal person who controls and decides the handling of personal data
External suppliers of IT operations, cloud services and similar where personal data is processed on behalf of Rodolfo are called Data Processors. A Data Processor shall perform the data processing as specified in a data processing agreement.
All employees are personally responsible for the legal and correct processing of personal data in their daily work. By following Rodolfo´s governing documents relating to personal data processing, the employees contribute to compliant personal data processing.
Personal data may only be processed if certain conditions are met, for example (a) if the individual to whom the personal data pertains has given his or her consent to the processing; (b) the processing is necessary for the performance of a contract to which the individual is a party; (c) the processing is necessary for compliance with a legal obligation of Rodolfo; or (d) Rodolfo’s legitimate interest to process personal data outweighs the individual’s interest of not having his or her personal data processed.
Lawful processing, accuracy and transparency: When processing Personal Data within Rodolfo we shall make sure that the processing is lawful and that we are transparent towards the Data Subjects.
Data minimization: Within Rodolfo we shall never collect and handle more Personal Data than is required to perform the purpose for which the data was collected. That means that we must ask ourselves at each collection of Personal Data, if it is required. If the purpose for the data processing has expired, we must delete the Personal Data that is no longer needed.
Purpose limitation: When collecting Personal Data, we must have a clear and legitimate purpose with the collection and further processing. If the purpose ends, we must delete the Personal Data processed under that purpose. If we want to process Personal Data for a new purpose, it must not be incompatible with the original purpose, for instance outside of what the Data Subject concerned would reasonably expect. We must also make sure to inform the Data Subject about this, and under which legal ground we are processing the Personal Data.
Accuracy: Personal data must be accurate and up to date. Personal data that is inaccurate or incomplete should be erased or corrected.
Storage limitation: Personal data should only be stored for as long as is necessary for the purposes for which it is processed, or as required by applicable law. When the retention period has expired, it should be erased in a permanent and secure way. If we want to keep Personal Data for a longer period than required for the purpose which is was collected, we must see to it that the data no longer can be connected to a Data Subject, directly or indirectly (anonymization). For Personal Data received from a Data Subject that we have a customer like relation with, we keep the Personal Data for a time period constituting best practice determined by the national Data protection authorities in each country.
Integrity and confidentiality: Personal data shall be protected, against unauthorized or illegal treatment and against loss, destruction or accidental injury. Rodolfo, will follow appropriate technical and organizational procedures to protect personal data.
Accountability: Rodolfo is responsible for ensuring that the principles of personal data processing are followed when processing personal data and able to show how they are complied.
Rodolfo shall respond to Data Subject’s requests in the manner required by applicable law or otherwise deemed reasonably practical and appropriate in consultation with the CIO.
Transparency and information: Individuals whose personal data is being processed should be provided with notice there of. Such notice should be concise, easily accessible, be written in clear and plain language, and must contain certain specific information.
Access rights: An individual may request to receive information regarding Rodolfo’s processing of personal data.
Rights to rectification and erasure: An individual may request to have personal data corrected or erased.
Right to object: An individual may request the (automatic) processing of personal data to be restricted.
Right to object: Applies when personal data is processed to perform a task of public interest, as part of the exercise of an administrative authority or after a weighing of interests. An individual has the right to complain against Rodolfo’s processing of his/her personal data. An individual has the right to compensation for damage.
Where processing is to be carried by a processor on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that processing will meet the requirements of Data Protection Laws and ensure the protection of the rights of the data subject. There shall be a legal binding agreement between the Data controller and the Data Processor, which fulfils the requirements in the Data Protection Laws, and in which the distribution of responsibilities between the parties is specified regarding the personal data processing:
Data protection by design and by default: Each new service or business process introduced by Rodolfo that involves the processing of personal data should be designed to take the protection of such data into consideration, for example by ensuring that necessary security measures are built into its design (“privacy by design”). Each such new service or business process should also be designed to ensure that, by default, only personal data which is necessary for the specific purpose of the processing is processed (“privacy by default”).
Data protection impact assessment: Where a type of processing, in particular one using new technologies such as new IT systems or cloud services, is likely to result in a high risk to the privacy of an individual, Rodolfo should, prior to the processing, carry out an assessment of the impacts the contemplated processing activities may have on the protection of personal data. Rodolfo will follow The Swedish Data Protection Authority´s guidelines on impact assessment.
Data breach notification: Employees who suspect that this policy or relevant data protection laws have been violated should contact Rodolfo´s CIO immediately in order for Rodolfo to be able to comply with statutory notification requirements.
Provision of all Data Subjects rights: As stated in chapter 3.1 of this policy.
Security measure: An employee who has access to personal data must only process the data in accordance with the purpose of the processing, and may not share, distribute, or otherwise disclose the personal data to a third party unless instructed to do so by Rodolfo. Appropriate technical and organizational measures should be implemented to protect personal data against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and any other unlawful forms of processing. Such measures should be appropriate to the risks represented by the processing. Transfers of personal data to entities outside the EU and EEA, is only allowed when the importing entity has provided sufficient assurances that the personal data will be adequately protected. This may be accomplished by using one of the EU Commission’s standard data transfer agreements. Consult the CIO for further information.
Training and awareness: Rodolfo provides adequate training for all employees based on the employees role and responsibilities.
In order to fulfill the agreement with our customers, we register contact details, such as invoice and delivery address. This data is registered in our business system and are managed for billing and accounting purposes.
Because we purchase some services that we may need, we will also process personal data of our suppliers and subcontractors. This might be in order to be able to make payments or contact you so that you can effectively succeed with your assignments and so that you can continue to offer your products and services to us. This applies to the following categories:
Employees at a supplier company
Freelancers
Consultants
Temporary employees
We also process data when we receive job applications.
When processing your personal data, we do so with your consent and / or on a need basis, in order to operate our business, comply with our contractual and legal obligations, protect our systems or meet other legitimate interests, primarily related to sales and marketing activities.
In order for Rodolfo to fulfill their obligations as an employer and to ensure safe and efficient administration, Rodolfo is required to collect, process and store personal data from freelancers, consultants and other subcontractors. Only personal data related to the assignment are processed.
We process data to provide support and support services to you so that you can you use our Services.
We do not use data for purposes other than those described in this policy. The data we process may include:
Name and contact information: We collect first and last name, e-mail address, mailing address, phone number, delivery details and other similar contact information. This data is processed in order for us to fulfill agreements with our customers, in order to be able to administer and maintain registers on freelancers, so that we can contact you for recruitment purposes.
Personal identity number and payment information: In order to meet our agreements with suppliers, subcontractors, customers and temporary employees we need to collect payment information. Please note that personal identity numbers are only registered for temporary employees, so that we can register and pay the agreed fees.
Device and usage data: It may also include operating system information, including IP address, device ID, national settings, and language settings.
Film and photo: This only applies to projects for our customers where we provide services that include film and photo.
Support and feedback information: We also collect information that you provide us and the content of messages you send to us, such as feedback or questions and information you provide for customer support.
Sensitive personal data: We usually do not deal with sensitive information, except for a few interview situations where the content itself may be of a sensitive nature. In these situations, you as a participant have to give your consent and approve that the content will be publically published. However, it is our customer that acts as Data Controller in these situations. It is therefore the customer that is responsible for collecting and storing of the consent.
In cases where we share information about you with others, we have made sure that these companies comply with our data protection requirements and are not allowed to use personal data they receive for any purpose other than agreed.
It may sometimes be necessary for us to share your information with other companies to facilitate our business, deliver our services, and fulfill our obligations. For example, it may be about system and cloud services providers we use to enhance our work. However, these companies cannot view the data we process without our explicit permission.
Rodolfo has a special internal policy for processing personal data in email and other types of unstructured data. Firstly, we need a lawful ground for managing email. Rodolfo, like other companies and private organizations, usually process personal information in incoming emails according to the lawful ground of a weighing of interests. The policy also states that Rodolfo will not use email to systematically handle personal data, and will take responsibility for thinning out emails and personal data.
Finally, we may need to disclose or save your information when we consider it necessary to be able to:
Comply with the law, a legal process or provide information to the police or other administrative authorities.
Protect our customers, for example, to prevent spam or fraud, or to facilitate the prevention of death or a serious injury.
Manage and maintain the security of our services, including preventing or stopping an attack on our systems or networks.
Protecting rights or property belonging to Rodolfo, including enforcing the terms governing the use of the services, but if we receive information that someone uses our services to trade stolen intellectual or physical property belonging to Rodolfo, we will not investigate a customer's private content, but we can choose to hand the matter over to the police.
If you have a question as to what applies to your personal data, want to receive a compilation of the personal data we have stored about you, or if you have a complaint or a question to our CIO, please contact us at info@rodolfo.se. We will answer your questions within 30 days.
Rodolfo will conduct objective, comprehensive audits of this Policy, including data protection, on a periodic basis. The CEO of Rodolfo is responsible for the overall oversight and implementation of this Policy. The CIO is responsible for Rodolfo’s day-to-day compliance with this policy and Data Protection Laws.
We use tools such as cookies to improve the user experience and collect valuable feedback. For more information, please read our privacy policy.