Privacy should beclear by design.

DF IT AB, operating under the TopTeam brand, is the data controller for the processing described in this notice, unless otherwise stated. We determine the purposes and means of processing personal data in connection with our website, enquiries and business relationships.

This notice applies to visitors to our website, people who contact us with general enquiries, representatives of customers, suppliers and other business partners, and individuals who communicate with us in connection with our business activities.

If you apply for an opportunity, provide a CV or enter into a candidate or consultant relationship with us, our Candidate & Consultant Privacy Notice provides more specific information about that processing.

Information about AI-supported professional profile processing is available in our AI, Data & Origo Transparency statement.

The information we process depends on how you interact with us and what is necessary for the relevant purpose.

We do not ask you to provide sensitive personal information through general contact forms unless it is necessary for a specific lawful purpose. Please avoid including such information in a general enquiry.

We process personal data for defined purposes and only where an applicable legal basis exists. The basis depends on the nature of the processing and the circumstances.

Where we rely on legitimate interests, we assess whether the processing is necessary and whether our interests are overridden by your rights and freedoms. Where processing is based on consent, you may withdraw that consent at any time.

Our website is hosted by Loopia and uses WordPress, Elementor and related website functionality. The operation of the website may involve technical information such as IP addresses, access logs, security events and information submitted through forms.

Cookies and similar technologies may be used to provide necessary website functionality and, where enabled, for other purposes such as analytics or marketing. Non-essential technologies requiring consent should not be activated before the required consent has been obtained.

Our Cookie Notice provides information about the technologies used, their purposes and how you can manage your choices. The actual cookie inventory and consent controls are maintained separately from this general notice.

Personal data may be accessible to authorised DF IT AB personnel and to service providers that support our operations. Depending on the circumstances, information may also be shared with customers, suppliers, professional advisers or public authorities where necessary and lawful.

Our identified service providers include Microsoft for cloud storage and communications and Loopia for website hosting. Other providers may be involved in specific website, security or technical functions.

Microsoft provides data residency commitments through its EU Data Boundary for eligible services, subject to the conditions and exceptions in its applicable terms. We do not treat those commitments as a guarantee that all processing or access takes place exclusively within the EU/EEA.

Where personal data is transferred outside the EU/EEA, we assess the applicable transfer mechanism and any required safeguards. Information about relevant safeguards can be requested through our privacy contact.

We retain personal data only for as long as necessary for the relevant purpose, subject to applicable legal obligations and other lawful retention requirements.

Deleted information in applicable ordinary systems is reviewed and cleared by an administrator under our internal procedure, with an operational target of no more than five days. This does not mean that every technical recovery copy is permanently erased within that period.

Microsoft 365 and other service providers may retain information through recovery, backup or legal-retention mechanisms for periods that differ from our ordinary deletion routine.

For information about the retention of a particular category of data, or to request deletion, contact privacy@topteam.se.

We use technical and organisational measures intended to protect personal data against unauthorised access, loss, alteration and disclosure. These include restricted access to relevant systems, protected Microsoft 365 cloud storage and confidentiality obligations for personnel handling personal information.

We review our safeguards in relation to the risks of the processing and the technologies we use. No system can be guaranteed to be completely free of risk.

Depending on the circumstances and applicable law, you may have the right to access your personal data, request rectification or erasure, restrict processing, object to processing based on legitimate interests and request data portability where applicable.

To exercise your rights, contact privacy@topteam.se. We may need to verify your identity before responding. We respond without undue delay and within the time limits required by applicable data protection law.

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or another competent supervisory authority.

More information is available at imy.se ↗.

We review this notice when our processing activities, systems, suppliers or applicable legal requirements change. The current version and effective date are published on this page. Where required, we provide additional information about material changes.