Privacy policy

Last updated: 21 October 2026.

This policy describes how Arbetsrättsjuridik processes personal data when you contact us, book advice, engage us or visit the website.

Who is responsible for your data?

Carmen Elfgren, who operates Arbetsrättsjuridik based in Jönköping, is the controller for the practice's processing. Contact info@arbetsrattsjuridik.se with questions or to exercise your rights.

What data do we process?

For an enquiry, we process your name, contact details and information you provide. Bookings also involve meeting times and booking details. During an assignment, we may need employment information, contracts, correspondence and other documents relevant to the issue. Payment and bookkeeping involve billing details, payment status and transaction references. Each payment provider describes its processing of card and account information.

Data mainly comes from you. During an assignment, we may also receive relevant information about you or other people from employers, employees, representatives, opposing parties, authorities and public documents.

Do not send personal identity numbers, health information, trade union membership or other sensitive data through website forms. If such information is needed for an assignment, we agree on how to provide it. Personal identity numbers are processed only where clearly justified, for example for reliable identification.

Why is data processed?

Enquiries and quotes

We use data to answer questions and assess whether we can accept an assignment. The basis is our legitimate interest in handling enquiries and communicating with people contacting the practice (Article 6(1)(f) GDPR). Where an individual requests an offer for their own contract, the basis may instead be steps taken at their request before entering a contract (Article 6(1)(b)).

Bookings and legal assignments

For individuals who are parties to a contract, necessary booking, advice and assignment administration are based on the contract (Article 6(1)(b)). Data about company representatives, contact persons and other people concerned is processed on the basis of the legitimate interest in performing the assignment and safeguarding the client's legal interests (Article 6(1)(f)).

If special categories of personal data must be processed to establish, exercise or defend legal claims, the exception in Article 9(2)(f) may apply in addition to a legal basis under Article 6. Such data must be limited to what the matter requires.

Payments, bookkeeping and legal claims

Payment administration is based on contract or legitimate interests as described above. Bookkeeping and other statutory duties are based on a legal obligation (Article 6(1)(c)). Records needed for a dispute are processed on the basis of the legitimate interest in establishing, exercising or defending legal claims.

Reading this policy is not general consent to all processing. Enquiries and assignments are handled on the legal bases described here. Where consent is used for a specific purpose, it must be voluntary and capable of being withdrawn.

Who may receive the data?

Data is shared only where necessary for a stated purpose and there is a basis for processing. Relevant recipients include providers of website, communications, booking, meeting, payment and bookkeeping services. A legal assignment may also require sharing relevant information with opposing parties, representatives, courts and authorities.

• Webnode provides the website and website forms.
• Cal.com is used for online bookings. Google Calendar and Google Meet are used for calendar management and online meetings.
• Stripe handles payments in the booking process. If you choose Klarna through Stripe, Klarna also processes data for that payment option.
• Fortnox is used for invoicing and bookkeeping. Fortnox Finans and Swish are involved when you use those payment methods.
• Email and other necessary IT providers may handle contact details and messages.

Providers may act as processors on our behalf or as independent controllers for certain purposes of their own, such as payment checks and statutory duties. Each service's privacy information explains its own processing.

How long is data retained?

Enquiries that do not lead to an assignment are retained for as long as needed for a response and relevant follow-up. They should then be deleted unless retention is needed for a legal claim.

Documents from a completed assignment are normally retained for up to ten years where needed to document the assignment or handle legal claims. An ongoing dispute may require relevant data to be kept longer. Data no longer needed should be deleted earlier.

Accounting records must be retained for seven years after the end of the calendar year in which the financial year ended. Booking and payment information forming part of those records is covered by that obligation. Other booking data is retained only for as long as needed for the meeting, assignment or a possible dispute.

Storage and transfers outside the EU/EEA

Digital services may involve processing outside the EU/EEA, for example through a provider's subcontractors or support services. It is therefore not possible to state generally that all storage takes place within the EU/EEA. Transfers may only take place on a basis permitted by the GDPR, such as an applicable adequacy decision or the European Commission's standard contractual clauses with necessary supplementary safeguards. Contact us for information about safeguards for a particular transfer and how to obtain a copy.

Cookies and external services

The website uses Webnode features and has Google Analytics configured for visitor statistics. Cookies and similar technologies may process IP addresses, device information and visit data. Statistics and other non-essential storage or access on your device require valid consent. Manage your choices through Cookies in the footer. Where personal data is processed, necessary functions and security may be based on legitimate interests.

Booking and payment links lead to external services with their own privacy information. The website also displays a Reco logo retrieved from Reco; technical data such as an IP address may be shared with Reco when it loads. If you follow a Reco link, Reco's privacy information also applies. Do not include sensitive case information in public reviews.

Your rights

You can request access to your personal data and correction of inaccurate data. Under the conditions in the GDPR, you may also request erasure, restriction of processing and data portability. You can object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing.

These rights are not absolute. For example, bookkeeping requirements or the need to handle legal claims may require certain data to be retained. We must also protect other people's rights when providing information.

Contact info@arbetsrattsjuridik.se to exercise your rights. We may need to verify your identity in a proportionate way. Requests are handled without undue delay and normally within one month. Where necessary, this may be extended by up to two further months; you will be informed of the extension and reasons within the first month.

You have the right to complain to the Swedish Authority for Privacy Protection (IMY). Read more about your rights on IMY's website.

What information do you need to provide?

Contacting us is voluntary. Marked fields are required to send an enquiry through the form. You may also contact us by email. Without sufficient contact and case information, we cannot answer the question, complete a booking or perform the assignment. Your payment provider may need additional information for the chosen payment method.

Data security and incidents

Personal data must be handled with safeguards appropriate to its sensitivity and the risks of processing. Access and sharing must be limited to what the purpose requires. Avoid sending sensitive documents in an initial website form or ordinary message; contact us first about an appropriate transfer method.

A personal data breach must be assessed and documented. Where the GDPR requires notification to IMY, this must be done without undue delay and, where feasible, within 72 hours of becoming aware of it. Affected individuals must be informed where required by the rules.

Questions and updates

Send questions about personal data to info@arbetsrattsjuridik.se. The policy is updated when the practice's processing changes. The date at the top shows when the text was last updated.