PRIVACY POLICY

Small text files stored in the browser to enable functionality, statistics, and marketing. Managed in accordance with Herbox’s separate Cookie Policy.

All information that directly or indirectly can identify a natural person, such as name, email address, IP address, or customer number.

Any operation performed on personal data, such as collection, storage, analysis, sharing, or deletion, whether manual or automated.

The party that determines the purposes and means of the processing. 

An external party that processes data on behalf of Herbox under a Data Processing Agreement (DPA).

A legal condition under Article 6 of the GDPR (consent, contract, legal obligation, or legitimate interest).

When Herbox has a legitimate business interest, such as customer communication or IT security, that outweighs the privacy interest. For processing based on legitimate interest, Herbox conducts a Legitimate Interest Assessment (LIA), which is documented and updated as necessary.

Special categories of data (health, ethnicity, political opinions, etc.) are processed only in exceptional cases. Herbox’s services are also not directed at children, and we do not knowingly collect personal data from minors without the consent of a legal guardian.

The individual whose data is being processed (customer, user, employee, supplier, etc.).

The EU’s Standard Contractual Clauses and the EU-US Data Privacy Framework, both mechanisms for ensuring protection in the context of third-country data transfers.

info@herbox.se

We acknowledge receipt within 2 business days and normally respond within 30 days.

info@herbox.se

We may require identification (BankID or a copy of an ID).

info@herbox.se

Feedback within 24 hours

Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm

Further information is available at www.imy.se

IP address, technical logs

Legitimate interest (necessary operation)

2 months

IP (truncated), events, cookie ID

Consent (ePrivacy)

90 days

Hashed email, device/cookie ID

Consent / Legitimate interest (customers)

Up to 24 months

Name, email, agreement, communication

Contract / Legitimate interest

Up to 10 years (accounting 7 years)

Contact details, interaction data

Legitimate interest (opt-out)

Until opt-out or 36 months of inactivity

Contact details, job title, interactions

Consent (email) / Legitimate interest

36 months

Minimized fields depending on Zapier

Legitimate interest

Short-term storage in Zapier

Limited email excerpts

Legitimate interest

Processing only, no persistent local storage

CV, contact details, notes

Legitimate interest (recruitment) + consent for extended retention

24 months (longer with consent)

Contact details of references, notes from reference conversations, verification of education or employment

Consent (from the candidate before contact) + legitimate interest in ensuring accurate recruitment

24 months after the completion of the recruitment process (or longer with explicit consent from the candidate)

Contact details, salary, absence, competence data, and information about next of kin

Processing is carried out to fulfill the employment contract, legal obligations (e.g., tax and labor law), and Herbox’s legitimate interest in administering HR processes.

During employment and thereafter for 2–10 years depending on the type of data (e.g., payroll and accounting data 7 years, agreements up to 10 years, contact details 2 years)

Customer and supplier invoices, payment data, vouchers

Accounting Act (1999:1078)

7 years after the end of the financial year

Contract documents, correspondence, payment history

Limitation Act (1981:130)

Up to 10 years

Payroll statements, invoices, payments

Tax Procedure Act (2011:1244)

7 years

Correspondence, investigation materials

GDPR Article 17.3(e) (defence of legal claims)

Until the matter is concluded

Employment agreements, payroll and pension records

Swedish Labour law

2–10 years depending on the type of document

CRM and marketing

Name, email, communication history, preferences

Data Processor

Encryption, access restriction, DPA

Email and Productivity

Name, email, documents, files, metadata

Data Processor

DPF certification, MFA, data minimization

Automation

Limited data fields for system integration

Data Processor

Encryption during transfer, SCC

AI Analysis and Automated Support

Short text excerpts (minimized)

Data Processor

DPF certification, restriction against model training

Advertising and analytics

Hashed email, cookie ID, IP address, device data

Independent controllers

Consent management via GTM, DPF/SCC

Rekrytering

Namn, kontaktuppgifter, CV, intervjunoteringar

Data Processor

DPA, dataminimering, automatisk gallring

Finance and delivery

Name, address, payment details, invoice records

Processors / independent controllers

Non-disclosure agreements, encrypted communication, statutory retention periods

System data, access logs, backups

Encryption in transit and at rest, role-based access control, multi-factor authentication (MFA), logging, and regular access reviews

Logs 12 months, backups according to IT policy (max 12 months)

All personal data

Non-disclosure agreements, ongoing training, incident response process, annual review of procedures

Continuously during employment / assignment

Data included in incident reports

DPO-supervised process, internal logging, notification to IMY within 72 hours if individuals’ rights are at risk, and information to affected data subjects in accordance with Articles 33–34 GDPR

Documentation retained for 5 years after the case is closed

Correspondence, investigation materials

GDPR Article 17.3(e) (defence of legal claims)

Until the matter is concluded

Employment agreements, payroll and pension records

Labour law

2–10 years depending on the type of document

Name, email, documents, metadata

USA (DPF certified)

EU-US Data Privacy Framework (DPF)

IP address (truncated), cookie ID, analytics data

USA (DPF certified)

EU-US Data Privacy Framework (DPF)

Short text excerpts (minimized)

USA (DPF certified)

EU-US Data Privacy Framework (DPF)

Limited data fields for system integration

USA (not DPF certified)

Standard Contractual Clauses (SCC) + supplementary measures

Name, email address, interaction data

USA (DPF certified)

EU-US Data Privacy Framework (DPF)

Art. 15

Obtain a copy of your personal data and information about the processing.

Request via info@herbox.se.

Art. 16

Correct inaccurate or incomplete data.

Contact us by email or phone.

Art. 17

Deletion of data when it is no longer needed or when consent is withdrawn.

Email info@herbox.se.

Art. 18

Temporarily stop processing in case of a dispute regarding accuracy or lawfulness.

Mark the email “Restriction.”

Art. 20

Receive your data in a structured format or transfer it to another party.

Request export (CSV/JSON).

Art. 21

Object to processing based on legitimate interest or direct marketing.

Use opt-out links or contact us.

Art. 7.3

Withdraw consent without affecting processing carried out prior to the withdrawal.

Via cookie banner or email.

Art. 22

Request a manual review of decisions with legal effects.

Email info@herbox.se.