Privacy Policy

Last updated: [2026-10-02]

1. Who we are

This policy explains how Addilon Professionals AB (reg. no. 559265-3603, “Addilon”, “we”) processes personal data when you visit our website, apply for a job with us or through our clients, register in our candidate database, act as a reference, are a contact person at a client, or follow us on social media.

We are the data controller unless stated otherwise. When we handle candidates on behalf of a client that decides the purposes and means of processing, the client is the controller and we act as data processor. This will be stated in your application.

Privacy contact: [email protected] · Kivra: 559265-3603, 106 31 Stockholm

2. What personal data we process and why

Situation	Data	Purpose	Legal basis
You apply for a job	Name, email, phone, location, CV, cover letter, attachments, answers to screening questions, LinkedIn link, position applied for and source	Handle your application, assess suitability, contact you	Contract (steps at your request before a contract) and legitimate interest
You register your interest or join the candidate database	As above, plus profile, skills, preferences	Contact you about future assignments	Consent
We assess you during the process	Interview notes, ratings and assessments, results from personality and ability tests (e.g. Assessio), references, process status	Make recruitment decisions	Legitimate interest; for tests and references usually your consent
Interview scheduling	Times, calendar details, meeting link, participants	Schedule and conduct interviews	Contract / legitimate interest
Communication	Emails and messages we send and receive, delivery status (delivered, opened)	Keep you informed about your application, including notice that you did not proceed	Contract / legitimate interest
Reference checks	Referee’s name, contact details and feedback	Verify the candidate’s experience	Legitimate interest / candidate’s consent
Client contacts	Name, title, email, phone, communication	Perform contracts, share candidate shortlists, invoice	Contract / legitimate interest
Website visits	IP address, device, browser, pages visited, cookie identifiers	Operate, secure and improve the website; measure and optimise ads; see which companies visit the website	Legitimate interest (necessary cookies, logs, spam protection); consent for analytics and marketing cookies (see section 10)
Contact form and comments on the website	Name, company, country, email, phone, needs, message; for comments also IP address and user agent	Contact you about your enquiry; detect spam	Legitimate interest
Social media	Account information from the networks where we publish (for employees who connect their account)	Publish job ads and posts	Legitimate interest
Legal requirements	Data required by law	Accounting, handling of legal claims	Legal obligation / legitimate interest

We normally do not process special categories of data (e.g. health, religion, ethnicity). Please do not include such information in your CV or cover letter. If you do, we only process it where necessary or with your consent.

3. Where the data comes from

Directly from you, from referees you name, from employers or consulting firms you are connected to, from publicly available professional profiles (e.g. LinkedIn), and from results of tests you take at our request.

4. Who receives the data

Recruiters and authorised staff at Addilon.

Our clients – if you are being considered for an assignment with them, we share your CV and relevant assessment. We do not share your data with a client unless you are being considered for that client.

Service providers (processors) acting on our instructions, including:

• hosting, database and file storage
• email delivery
• AI analysis
• test provider
• calendar and video meeting services (Google, Microsoft)
• social networks for publishing (LinkedIn, Meta – Facebook and Instagram)
• website tools (see section 10): Meta (Facebook pixel), LinkedIn (Insight Tag), Google (Analytics, Tag Manager), Upsales, WPML and its translation services, and Automattic (Akismet and Gravatar).

Authorities, where we are legally required to disclose.

We never sell personal data. We have data processing agreements with our providers.

5. Transfers outside the EU/EEA

Some providers may process data outside the EU/EEA, including in the US. In that case we ensure adequate protection through the European Commission’s Standard Contractual Clauses (SCCs) and/or the provider’s certification under the EU–US Data Privacy Framework, together with supplementary technical safeguards (encryption, access controls). This applies, among others, to Google Analytics (data is stored on servers in the US), Meta, LinkedIn and Automattic.

6. How long we keep data

Closed recruitment: We keep your application for 24 months from your last activity or consent, to be able to respond to discrimination claims and to contact you about similar assignments.

Candidate database: As long as your consent is valid, at most 24 months. Before it expires we may ask you to extend for another 12 months. If you do not respond, the data is deleted or anonymised.

Tests and assessments: Same period as the application, or shorter if the test provider requires it.

References: Same as the application.

Client contacts: During the contract plus a reasonable period afterwards.

Accounting records: 7 years under Swedish accounting law.

Logs: Normally no more than 12 months.

You can request deletion at any time (see section 9).

7. Security

We protect data with, among other things, encryption in transit and at rest, role-based access (only authorised users see candidates for assignments they work on), separation between organisations, logging of access and changes, and regular security checks. If a personal data breach poses a risk to you, we will notify you and the Swedish Authority for Privacy Protection as required by law.

8. Your rights

You have the right to:

• access the data we hold about you,
• have inaccurate data rectified,
• have data erased,
• restrict processing,
• object to processing based on legitimate interest,
• receive your data in a machine-readable format (data portability),
• withdraw consent at any time (without affecting earlier processing),
• request human review if you are affected by an automated assessment.

Contact us at [email protected]. We reply within one month. You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se, [email protected].

9. Cookies and website tools

A cookie is a small text file stored in your browser. We use them for three reasons: to make the website work, to measure how it is used, and to measure and improve our marketing.

You decide. On your first visit we ask whether you accept analytics and marketing cookies. No such cookies or tracking tools are loaded until you have said yes. You can change your choice at any time via [link/button for cookie settings] or by clearing cookies in your browser. Declining does not affect your ability to use the website or apply for jobs.

9.1 Necessary cookies (no consent required)

Tool	What it does	Lifetime
Login	Keeps you logged in and protects the account. Only for users with an account.	2 days (2 weeks if you choose “Remember me”); removed on logout
Cookie support test	Checks that your browser accepts cookies. Contains no personal data.	Until you close the browser
Layout choices	Stores your screen layout choices for logged-in users	1 year
Editing	Contains only the ID of the page or article being edited. No personal data.	1 day
Comments (optional)	Stores name, email and website if you tick the box to remember them for your next comment	1 year

9.2 Analytics and marketing (require your consent)

Tool	Provider	Why we use it	What is collected
Google Analytics	Google	Understand how visitors use the website so we can improve it. Information is collected in anonymised form.	Pages visited, device, browser, approximate location, cookie identifiers. Stored on servers in the US. [State whether IP anonymisation is enabled]
Google Tag Manager	Google	Manages and loads our tags in one interface. Only loads tags you have accepted.	Technical details of the visit
Facebook pixel	Meta	Measure, optimise and build audiences for our ad campaigns based on our visitors.	Pages visited, actions (e.g. forms), device and cookie identifiers. May be linked to your Facebook account if you are logged in.
LinkedIn Insight Tag	LinkedIn	Get statistics on our LinkedIn ads.	Pages visited, device and cookie identifiers. May be linked to your LinkedIn profile if you are logged in.
Upsales	Upsales	Match IP addresses to companies	IP address, pages visited and, in mailings

Where these providers use the data for their own purposes, each is responsible for its own processing. See their privacy policies: Google, Meta, LinkedIn and Upsales.

9.3 Tools that handle website content

• Comments. When you leave a comment we collect what you enter plus your IP address and user agent string, to detect spam.
• Akismet (Automattic). Spam protection that sends the comment content, your IP address, user agent, referrer and site URL, and name, username and email if provided, for checking.
• Gravatar (Automattic). An anonymised string (hash) created from your email address may be sent to Gravatar to see whether you have a profile picture there. Once your comment is approved, the picture is shown publicly with the comment. See https://automattic.com/privacy/.
• Contact form. You enter name, company, country, email, phone, needs and message. The data is only used to contact you about your enquiry.
• Images. Images uploaded to the website may contain location data (EXIF/GPS) that others can download. Do not upload images with location data.
• You can set your browser to block cookies, but some features may then stop working.

10. Social media

Our posts on LinkedIn, Facebook and Instagram are published through our company accounts. For staff who connect their account to our system, we only request the permissions needed to publish, and access can be revoked at any time in the social network’s settings. Each network’s own privacy policy applies to its processing.

11. Changes

We may update this policy. The latest version is always on this page, and we will inform affected individuals of material changes.