Your informationdeserves clarity.

DF IT AB, operating under the TopTeam brand, is the data controller for the processing described in this notice unless otherwise stated. We determine the purposes and means of processing personal data in connection with our candidate and consultant relationships.

You can contact us with questions about this notice, information we hold about you or how to exercise your data protection rights.

This notice applies to people who apply for opportunities, submit a CV, are contacted about potential opportunities, enter into a candidate relationship with TopTeam or work with us as consultants or potential consultants.

Employees and contracted consultants may also receive additional information relating to employment, contractual administration, payroll, accounting and other processing specific to their relationship with DF IT AB.

The information we process depends on your relationship with us and the purpose of the processing. We aim to limit it to information that is relevant and necessary for that purpose.

Sensitive personal information

We do not ask you to include sensitive personal information in your CV unless it is necessary for a specific lawful purpose. If such information is received, we assess whether it is necessary and whether an applicable legal basis and condition for processing exist. Information that is not needed should be removed or otherwise handled appropriately.

Information you provide

We receive information when you apply for an opportunity, send us your CV, contact us or communicate with us during a candidate or consultant relationship. Website applications are delivered to the responsible recruiter's email inbox and are then handled in our protected Microsoft 365 environment.

Professional sourcing

We may identify potential candidates through Arbetsförmedlingen's CV search service using our employer account. We may record a contact status in that service to help manage our sourcing activity. Origo does not automatically import candidate profiles from Arbetsförmedlingen or scrape profiles from social media.

Where we obtain personal data from another source, we provide the information required by applicable data protection law, including relevant information about the source, purposes and your rights.

Professional verification

We may check the existence of employers or educational institutions stated in a CV using public information. These checks are intended to support the accuracy of professional information, not to collect unrelated personal information about you.

We process personal data for defined purposes and only where an applicable legal basis exists. The basis depends on the activity and the circumstances of the relationship.

Where we rely on legitimate interests, our interests are to identify and connect relevant professional capability with opportunities, administer our relationships and protect our operations. We assess whether the processing is necessary and whether those interests are overridden by your rights and freedoms.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing carried out lawfully before it was withdrawn. Where processing is based on legitimate interests, you may object in accordance with applicable data protection law.

Before information about you is shared with a potential customer, we ask you to review the information intended for sharing, confirm that it is correct and approve the proposed disclosure.

This allows you to understand what is being presented and correct inaccuracies before the profile is shared. Approval of a specific disclosure is not treated as permission for unrelated processing.

Customers receiving a profile may act as independent data controllers for their own recruitment or assignment decisions. Their processing may be subject to their own privacy information.

Origo is TopTeam's internal decision-support system. It supports structured profile preparation and the assessment of professional relevance to incoming assignment requirements.

What Origo does

Origo uses automated analysis to compare professional profiles with assignment requirements. This includes initial filtering based on professional and practical criteria, AI-assisted relevance assessment, scoring, graded recommendations and written rationales.

These results can influence which consultants are actively highlighted for a particular assignment. A profile may receive a low relevance assessment or may not be analysed further for a particular assignment. This does not remove the person from the consultant pool.

Human review

Consultant managers can access the wider consultant pool and review relevant information independently of an AI recommendation. They may disregard or override a result, consult the original CV and discuss the opportunity directly with the consultant. Customer presentation is a separate human-led process and requires the consultant's approval.

We assess the role and impact of automated processing in our recruitment and assignment processes and provide applicable information and safeguards in accordance with data protection law.

Pseudonymised profile information

Directly identifying information is handled in our protected Microsoft 365 environment before profiles are used in Origo. The matching process uses pseudonymised professional information associated with an internal reference code. Professional details such as roles, employers, employment periods, education, qualifications, skills and relevant location information may remain.

Because a profile can be connected back to an identifiable person, the information remains personal data under data protection law. It is not anonymous information. The reference mapping is not included in production AI matching requests.

AI service provider

Origo's production matching uses Anthropic's commercial API. Text-based professional profile and assignment information is sent for analysis. Original CV documents are not uploaded as files in the production matching flow.

We use approved AI tools and account arrangements for processing professional profile information. Our procedures distinguish production matching from development and other AI-assisted activities, and require appropriate safeguards for each.

Further information about our AI-supported processing is available in our AI, Data & Origo information.

We retain personal data only for as long as necessary for the relevant purpose, subject to applicable legal obligations and other lawful retention requirements.

Potential candidate relationships

When a potential candidate relationship ends at your request or following a mutual decision not to continue, our process is to end active matching and delete the active candidate profile and related recruitment information, subject to any information that must lawfully be retained.

Administrative deletion routine

Deleted information in our ordinary systems is reviewed and cleared by an administrator under our internal procedure. Our operational target is to clear applicable deleted-item locations within five days. This does not mean that every technical recovery copy is permanently erased within that period.

Employment and contractual records

Where a person has been employed or entered into a contractual relationship with DF IT AB, certain records may need to be retained for longer to comply with legal obligations or to establish, exercise or defend legal claims. Such records are handled separately from an active candidate profile.

Recovery copies and other retention

Microsoft 365 and other service providers may retain information through recovery, backup or legal-retention mechanisms for periods that differ from our ordinary deletion routine. These periods depend on the applicable service, configuration and legal requirements.

Origo's backup procedure is designed to exclude personal data. Information used in active processing and any remaining technical copies are handled according to the applicable retention and deletion procedures.

You may contact us to request deletion or information about how long particular data is retained. We will assess the request according to the applicable legal requirements.

Personal data may be accessible to authorised DF IT AB personnel, customers receiving an approved professional profile and service providers that support our operations.

Our identified providers include Microsoft for cloud storage and communications, Loopia for website hosting and Anthropic for relevant AI services. Other providers may be involved in specific technical or website functions.

We use the applicable contractual arrangements and data protection terms for the services we use. Where personal data is transferred outside the EU/EEA, we assess the applicable transfer mechanism and any required safeguards. Information about relevant safeguards can be requested through our privacy contact.

Microsoft provides data residency commitments through its EU Data Boundary for eligible services, subject to the conditions and exceptions in its applicable terms. We do not treat those commitments as a guarantee that all processing or access takes place exclusively within the EU/EEA.

We use technical and organisational measures intended to protect personal data against unauthorised access, loss, alteration and disclosure. These include restricted access to relevant systems, protected Microsoft 365 cloud storage and confidentiality obligations for personnel handling candidate and consultant information.

Candidates may be given access to relevant information held about them. Employees have dedicated areas for their information within Microsoft 365, with access limited according to the applicable permissions.

Our procedures include separate handling of directly identifying information, controlled access to professional profiles and measures to protect information used in AI-supported processing. We review safeguards in relation to the risks of the processing.

Depending on the circumstances and applicable law, you may have the right to access your personal data, request rectification or erasure, restrict processing, object to processing based on legitimate interests and request data portability where applicable.

You can contact privacy@topteam.se to exercise your rights. We may need to verify your identity before responding. We will respond without undue delay and within the time limits required by applicable data protection law.

If you believe an AI-supported assessment about you is inaccurate or has affected an opportunity unfairly, you may contact us to request review or correction. We will consider the request and provide the information and safeguards required by applicable law.

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or another competent supervisory authority.

More information is available at imy.se ↗.

We review this notice when our processing activities, systems, suppliers or applicable legal requirements change. The current version and effective date are published on this page. Where required, we provide additional information about material changes.