Privacy Policy for Candidates

Version 1.0 | Last updated: 6 August 2026 | Effective from: 6 August 2026

1. About This Policy

LaborFlow Consulting AB, hereinafter referred to as "LaborFlow", is committed to protecting your privacy. This Privacy Policy describes how we process personal data about you when you apply for a job with us, express an interest in future opportunities, participate in a recruitment process, or otherwise come into contact with us as a candidate. The Policy applies regardless of whether you apply directly, are contacted by us, or are introduced by a recruitment partner.

2. Data Controller

LaborFlow Consulting AB, company registration number 559577-4794, is the data controller responsible for the processing of your personal data in connection with recruitment and candidate contacts.

Registered address: Lillgårdens Gränd 3/1001, 436 57 Hovås, Sweden.
Email for data protection enquiries: office@laborflow.se
Contact person for data protection enquiries: Katarzyna Sikora, CEO, katarzyna.sikora@laborflow.se

3. Personal Data We Process

Depending on the position and recruitment process, we may process the following categories of personal data:

-identity and contact information, such as name, telephone number, email address, place of residence, and profile picture;

-application and qualification information, such as CV, cover letter, education, skills, work experience, certifications, languages, and work samples;

-information generated during the process, such as interview notes, assessments, test results, salary expectations, availability, and communications with you;

-reference and background information obtained from the persons you identify or from a background check, where such a check is relevant, proportionate, and legally permitted;

-technical information, such as IP address, timestamps, and log data when you use our careers page or recruitment system;

-information about work permits or the right to work, where this needs to be verified prior to employment;

-other information that you voluntarily provide to us.

Please do not provide sensitive personal data or information concerning criminal offences unless we have expressly requested such information and informed you why it is required. If such information is necessary, we will process it only where there is a specific legal basis for doing so under applicable law.

4. Sources of Personal Data

We primarily collect personal data directly from you. We may also receive information from:

-recruitment agencies, staffing agencies, or other partners that introduce you to us;

-references you have provided;

-publicly available professional sources, such as a professional profile relevant to the position;

-providers of tests or background checks, where these form part of the process and are legally permitted;

-a current employee who recommends you, provided that it is reasonable to assume that you wish to be contacted.

Where personal data has not been collected directly from you, we will provide the information required under applicable data protection rules within the applicable time limit.

5. Why We Process Personal Data and Our Legal Basis

Managing Applications and Conducting Recruitment

To receive and administer applications, communicate with you, assess your qualifications, conduct interviews and tests, make recruitment decisions, and document the process. The processing is normally based on our legitimate interest in recruiting suitable candidates. When you apply for a position on your own initiative, certain processing activities may also be necessary in order to take steps at your request prior to entering into an employment contract.

Verifying Information and Obtaining References

To verify relevant qualifications and contact references. The processing is normally based on our legitimate interest in conducting a reliable and secure recruitment process. We will inform you before contacting references. Background checks are carried out only where justified by the nature of the position and following a specific assessment of lawfulness and proportionality.

Complying With Legal Obligations and Managing Legal Claims

To comply with requirements arising from, among other things, employment law, anti-discrimination law, accounting requirements, or decisions by public authorities, as well as to establish, exercise, or defend legal claims. The legal basis is compliance with a legal obligation or our legitimate interest in protecting our rights.

Offering Future Career Opportunities

If you expressly consent to being included in our candidate pool, we process your personal data so that we can contact you about relevant future opportunities. The processing is based on your consent, which you may withdraw at any time by contacting us. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Improving the Recruitment Process

We may compile statistics and analyse the effectiveness of the recruitment process. Where possible, we use aggregated or anonymised data. Where personal data is processed, the processing is based on our legitimate interest in improving our operations.

6. Legitimate Interest Assessment

Where we rely on legitimate interests as the legal basis for processing, we have assessed that the processing is necessary for the stated purpose and that our interests do not override your interests, fundamental rights, and freedoms. You may contact us for more information about this assessment and have the right to object to such processing.

7. Recipients of Personal Data

Only persons who need the information for their work are granted access to it. We may share personal data with:

-hiring managers, HR personnel, and other relevant decision-makers within LaborFlow Consulting AB;

-providers of recruitment systems, IT operations, communications services, tests, reference-checking services, or background-checking services;

-recruitment and staffing partners involved in the process;

-public authorities, courts, legal advisers, or other recipients where required by law or necessary in connection with legal claims;

-a buyer or advisers in connection with a reorganisation, merger, or transfer, subject to appropriate confidentiality arrangements.

Service providers that process personal data on our behalf are subject to data processing agreements and may process the data only in accordance with our documented instructions.

8. Transfers Outside the EU/EEA

We strive to process personal data within the EU/EEA. If a service provider or recipient processes personal data outside the EU/EEA, we ensure that the transfer is based on an adequacy decision or is subject to appropriate safeguards, such as the European Commission's Standard Contractual Clauses, together with supplementary measures where necessary. Please contact us if you would like more information about current transfers or the applicable safeguards.

9. How Long We Retain Personal Data

We retain personal data only for as long as necessary for the relevant purposes or for as long as required by law. The following retention periods apply:

Ongoing recruitment: during the recruitment process and thereafter for no longer than 24 months for follow-up purposes and the management of potential legal claims, unless longer retention is required or permitted in the individual case.

Candidate pool: for 24 months from your consent or your most recent meaningful contact, after which the data will be deleted or renewed consent will be obtained.

Tests and interview notes: during the recruitment process and for no longer than 24 months after the process has ended.

Background-check results: deleted as soon as the check has been completed and the information is no longer required, unless the data must be retained for longer by law or for the management of legal claims.

Information that must be retained by law or in connection with an ongoing legal claim: for as long as the obligation or matter continues.

When the applicable retention period expires, the data is securely deleted or anonymised. Backups are cleared in accordance with our established retention cycles.

10. Automated Decision-Making and AI

LaborFlow does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. If we use such processing in the future, we will inform you in advance in accordance with the GDPR, including relevant information about the logic involved, its significance, the anticipated consequences, and the applicable rights. Tools used to assist in sorting or summarising applications must not replace meaningful human assessment without a specific legal analysis.

11. Security

We use appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, alteration, and disclosure. Depending on the level of risk, these measures include access controls, logging, encryption, backups, supplier controls, and training for relevant personnel.

12. Your Rights

Depending on the circumstances, you have the right to:

-receive information about and access to the personal data we process about you;

-request correction of inaccurate or incomplete data;

-request deletion of your personal data or restriction of processing;

-object to processing based on legitimate interests;

-receive certain data in a structured, commonly used, and machine-readable format where the right to data portability applies;

-withdraw consent where the processing is based on consent;

-not be subject to an unlawful decision based solely on automated processing.

These rights are not absolute and may be restricted by law. To protect your data, we may need to verify your identity. Please contact us at office@laborflow.se. We will respond to your request within the time limit prescribed by applicable data protection rules.

13. Complaints to the Supervisory Authority

If you believe that we process your personal data in breach of data protection rules, we encourage you to contact us first. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or with the supervisory authority in the EU/EEA country where you live or work, or where the alleged infringement took place.

Swedish Authority for Privacy Protection (IMY)
Website: www.imy.se

14. Changes to This Policy

We may update this Policy when our processing activities or legal requirements change. The latest version is published at www.laborflow.se. In the event of material changes, we will provide appropriate notice.

15. Contact

Questions regarding this Policy or our processing of your personal data should be sent to:
LaborFlow Consulting AB
Email: office@laborflow.se
Postal address: Lillgårdens Gränd 3/1001, 436 57 Hovås, Sweden
Contact person for data protection enquiries: Katarzyna Sikora, katarzyna.sikora@laborflow.se