Integrity policy

1. Background

Trygghetsfonden BAO-Finansförbundet ("Trygghetsfonden", "we" or "us") collects and stores information about you in accordance with the General Data Protection Regulation (GDPR) and other data protection legislation, as well as in accordance with what follows from this information. This information text specifies, among other things, which categories of personal data we process and for which purposes they are processed.

Throughout this text, the term "processing" is used, which encompasses all measures involving personal data, including and without limitation: collection, handling, storage, sharing, access, use, transfer and deletion of personal data.

"Personal data" refers to any information that can be directly or indirectly linked to an identified or identifiable natural person.

Trygghetsfonden collects personal data from those who are in career transition through Trygghetsfonden, as well as representatives of banks/companies affiliated with Trygghetsfonden, trade union representatives/ombudsmen and other collaboration partners. The text below is divided into two sections relating to the different categories.

---

2. Processing of personal data for those in career transition

Purpose of the processing of your personal data

2.1 — Management and decisions regarding transition support

We process your data in order to manage and make decisions regarding your cases, e.g. to decide whether you are entitled to benefits from Trygghetsfonden. The data we process within the scope of this purpose includes:

• Name
• Telephone number
• Email address
• Address
• Personal identity number
• Severance pay
• Salary
• Payments from a-kassa and Försäkringskassan
• Date of termination of employment
• Period of employment
• Payments from us
• Account number
• Information regarding the termination of the position
• Trade union contact person
• IP address and other device information are processed to provide you with access to our digital support
• Information about previous positions, roles and competencies
• Information about education, licences and qualifications
• Information about participation in activities and courses
• Notes about you and meetings with you

The processing is carried out to satisfy Trygghetsfonden's legitimate interest in providing support in accordance with the agreement between Finansarbetsgivarna and Finansförbundet, and to fulfil obligations under collective agreements. Your personal data will be processed for seven ( 7 ) years from the closure of your case, in order to fulfil obligations under, among other things, the Swedish Bookkeeping Act.

Trygghetsfonden receives personal data through the employer's notification to Trygghetsfonden, your registration and any application, as well as through subsequent supplements. Trygghetsfonden also receives personal data about you through the collection or supplementation of information from other parties such as the Swedish Public Employment Service (Arbetsförmedlingen), the Swedish Social Insurance Agency (Försäkringskassan) or the relevant unemployment insurance fund.

In order for other parties to be able to provide supplementary information or carry out their assignments on behalf of Trygghetsfonden, they sometimes need to access and process your personal data.

Your personal data is processed within the EU and the EEA. Trygghetsfonden only uses data processors that maintain reliable IT and information security practices.

2.2 — Communication regarding the management of your case

We process your data in order to communicate with you within the scope of your case. The data we process for these purposes includes:

The processing is carried out in order to satisfy Trygghetsfonden's legitimate interest in being able to communicate with you regarding your case. Your personal data will be processed for five ( 5 ) years from the date the case was initiated. If disbursement of benefits is ongoing when the 5-year period has elapsed, personal data will be retained until Trygghetsfonden has fulfilled its obligations.

2.3 — Fulfilment of legal obligations

We process your data in order to fulfil legal obligations, e.g. bookkeeping and accounting requirements and obligations under data protection legislation. The data we process for these purposes includes:

• All data that is collected and that is necessary to fulfil the respective legal obligation.

The processing is carried out so that we can fulfil our legal obligations. Your personal data will be processed for the period of time necessary to fulfil the respective legal obligation.

2.4 — Management and response to legal claims

We process your personal data, if necessary, to manage and respond to legal claims, e.g. in the event of a dispute or legal proceedings.

• All data that is necessary for us to establish, exercise or defend legal claims, e.g. communication with you and contact details.

Your personal data will be retained for this purpose for ten ( 10 ) years from the date the legal claim arose.

---

3. Processing of personal data for representatives of affiliated banks/companies, trade union representatives and other collaboration partners

Purpose of the processing of your personal data

The information in this section concerns how Trygghetsfonden processes personal data for representatives of employers, trade union representatives and other collaboration partners.

When Trygghetsfonden collects, registers and processes personal data from representatives of affiliated banks/companies and other collaboration partners, this is done on the basis of contract, legitimate interest, consent or legal obligation as the lawful basis.

Trygghetsfonden determines the purposes and means of this processing and is therefore the data controller for the processing of this data. Within our operations, we process personal data relating to representatives of companies or organisations that are affected by or contribute to Trygghetsfonden's activities.

3.1 — Purpose of processing

Our processing of your personal data is limited to fulfilling purposes that form the basis of our operations. If you are a contact person for a bank/company affiliated with Trygghetsfonden, we process your contact details in order to communicate with you, for example regarding carried out or planned redundancies.

Personal data relating to a representative of a collaboration organisation or supplier is processed for purposes linked to the specific relationship between Trygghetsfonden and your employer/organisation. This may, for example, involve communication regarding the sharing of information, delivery of goods or services.

Certain information about you is processed to comply with legal obligations. This may, for example, involve data on invoices in accordance with obligations under the Swedish Bookkeeping Act.

3.2 — Personal data processed by Trygghetsfonden

All personal data processed by Trygghetsfonden is linked to your role as an employer or representative of an organisation connected to Trygghetsfonden. In various parts of our operations, the following data about you may be processed:

• Name
• Contact details such as address (workplace), telephone number, email address
• Role or position
• Trade union affiliation
• City or location
• Employer

3.3 — How personal data is collected

Your details as a contact person are received by Trygghetsfonden through the registration of individuals on the platform, via contacts by email or telephone. Furthermore, personal data may be collected from invoices or similar contacts that exist with collaboration partners.

3.4 — Recipients of personal data

Trygghetsfonden enters into data processing agreements when we engage sub-consultants, suppliers of IT systems or equivalent who process personal data on our behalf. Through these agreements, we ensure that our data processors, and other organisations that process personal data on our behalf, only use personal data to fulfil the assignments we have given them.
Your personal data is processed within the EU or the EEA. Trygghetsfonden only uses data processors that maintain reliable IT and information security practices.

3.5 — Retention of personal data

Your personal data is retained only for as long as Trygghetsfonden needs it, taking into account the rules of the GDPR. If you are a representative of a supplier or collaboration organisation, your contact details will be retained for the duration of the collaboration.

---

4. Transfer of personal data

We may share your personal data with recipients of personal data. In many of these cases, each organisation is to be regarded as the data controller for its own processing of personal data. In cases where a data processor relationship has arisen, relevant and necessary agreements are in place to regulate the processing of personal data. The data processors used by Trygghetsfonden are listed below.

Data Processors

• Storegate AB, which provides storage linked to the Lime CRM system
• Ciko, which provides a case management system for the handling of transition support
• Microsoft Corporation for administrative software

---

5. Your rights

One of the purposes of the GDPR is to protect individuals' fundamental rights and freedoms and to give you clear rights in relation to those who process your personal data. The purpose is that your personal data should be processed transparently and give you control over your personal data.

If you are in career transition, you can always log in to the portal to view and review your personal data. If you are a representative of an employer, a trade union representative or one of Trygghetsfonden's collaboration partners, please contact us if you would like information about your personal data.

5.1 — Right to rectification

Trygghetsfonden will take measures in accordance with applicable legislation to keep your personal data accurate, complete and up to date. You have the right to rectification of incomplete or inaccurate personal data.

5.2 — Right to object to processing

If the processing of your personal data is based on a balancing of interests and you consider that your privacy interest outweighs Trygghetsfonden's legitimate interest in processing your personal data, you have the right, on grounds relating to your specific situation, to object to the processing by contacting us using the contact details provided in section 6 below. If you object to the processing, we must demonstrate a compelling legitimate reason in order to continue processing the personal data.

You also always have the right to decline the processing of your personal data for direct marketing purposes.

5.3 — Right to erasure

Under certain conditions, such as when you have withdrawn a previously given consent and there is no other lawful basis for continued processing of your personal data, you have the right to request the erasure of your personal data.

5.4 — Right to restriction of processing

Under certain conditions, you have the right to restrict the processing of your personal data to only encompass the storage of the personal data, e.g. while we investigate whether you have the right to erasure.

5.5 — Right of access

You have the right to receive confirmation from Trygghetsfonden that your personal data is being processed by us and, if so, to access the personal data and the following information:

• the purposes of the processing;
• the categories of personal data being processed;
• recipients of personal data (particularly if such recipients are located outside the EU/EEA);
• the period during which the personal data is processed;
• information about the rights set out herein;
• information about the source from which the personal data was collected; and
• whether automated decision-making, including profiling, takes place.

In addition, you also have the right, upon request, to receive a copy of your personal data in a commonly used electronic format.

5.6 — Right to data portability

Where the processing of your personal data is based on your consent or because the processing is necessary to fulfil or enter into a contract with you, and provided that the personal data has been collected directly from you, you have the right to receive a copy of your personal data in a commonly used machine-readable format.

5.7 — Complaints to the supervisory authority

You are welcome to contact us with questions or complaints regarding the processing of your personal data. However, you also always have the right to lodge complaints regarding the processing of your personal data with the Swedish Authority for Privacy Protection (Dataskyddsmyndigheten).