Privacy policy

This page tells you what we store about you, why, who sees it and when it is deleted. The first part applies to everyone in contact with us: customers, visitors and anyone who gets in touch. The second part applies to our portal for UF companies at arcgruppen.se/my. The portal is our own. It is not Ung Företagsamhet's UF portal.

The company responsible for the data (the data controller) is ARC Gruppen AB, company reg. no. 559268-4723.

Part 1: customers, visitors and everyone who contacts us

What we store

What you give us yourself when you email, call, fill in the contact form or order something:

• Name and contact details, company and title.
• Billing and payment details.
• Emails, calls and notes that belong to an assignment.
• Technical information when you visit the website: IP address, browser and which pages you have looked at.

We never ask for sensitive data, for example about health, religion or political views.

Why, and on what legal basis

• Contract. We need the data to carry out the assignment and stay in touch with you while we do (Article 6.1 b GDPR).
• Law. The Swedish Bookkeeping Act requires us to keep invoices and payments (Article 6.1 c).
• Legitimate interest. We keep correspondence so that we can help you better next time, and we look at visitor statistics to understand how the website is used (Article 6.1 f).
• Consent. Newsletters, course interest sign-ups and statistics cookies only if you have said yes (Article 6.1 a). You can withdraw your yes whenever you like.

For how long

• Data that belongs to an assignment: during the assignment and 24 months after.
• Invoices and payments: seven years, under the Bookkeeping Act.
• Newsletters: until you unsubscribe.
• Course interest sign-ups: until the course is announced, and for 24 months at most.
• Questions to Flash advice: 90 days after the question has been answered and closed, unless it has led to an assignment or to advice.

Then we delete the data. How long something deleted can remain in a backup is described under "Backups" further down. That applies to all our systems.

Who gets to see the data

We never sell your data and never share it with anyone for marketing.

A few suppliers handle data for us, and only on our instructions (data processors):

• Google provides our email, calendar and video meetings (Google Meet).
• An external storage service keeps our backups, encrypted.
• Our accounting firm sees invoices and payments.

Authorities receive data when law, a court or an authority's decision requires it.

Where the data is

The website, the portal and the database run on our own server in Sweden. Google may process data outside the EU. The EU-U.S. Data Privacy Framework or the EU standard contractual clauses then apply.

Flash advice

At arcgruppen.se/flash-radgivning anyone can ask an advisor one question without an account.

What we keep: the question, your email address and whatever you choose to fill in: your name, the company's name and your school. If you come from one of our wizards, we also keep the result you sent along, as it was when you sent it. The answer and any emails that follow are kept with the question.

Why: so that we can answer you. The legal basis is legitimate interest (Article 6(1)(f)): you have asked for an answer. We do not use the information for marketing, and asking a question does not put you on any newsletter.

Who sees it: our advisors. The answer is sent from info@arcgruppen.se through Google's email service. Everything else is on our own server in Sweden.

How long: 90 days after the question has been answered and closed, we delete the question, the answer, the emails and any attached files. At the same time we delete your contact record, unless you are a customer or in touch with us for some other reason.

When we keep it longer: if the question leads further, for example to an assignment or to advice for your UF company, the rules for that apply instead. For an assignment they are under "For how long" above, for UF companies in Part 2. We only move the question there when you have chosen to go further.

The wizards and course interest

The wizards: when you answer the questions in one of our wizards, for example "What can you do digitally?", the answers stay in your own browser. They are sent to the server only to work out the result and are not stored there. We count how many people use a wizard, how many reach the result, which steps, answers and suggestions are shown and what is clicked in the result. It is one number per day, with nothing about who you are.

Tell me when there is a course: if you tick that we may email you when a course exists, we store your email address, the topics you ticked and the wording you agreed to. Nothing else. The legal basis is consent (Article 6.1 a). Every email from us has a link to unsubscribe, and you can ask us to remove you at any time. When the course is announced we remove you from the list, and after 24 months at the latest we delete the details. The address is kept on our server in Sweden; the email is sent through Google's email service.

Cookies

• Necessary cookies keep you logged in and remember your language (session_id, frontend_lang). Without them the site does not work.
• Statistics with Google Analytics load only after you have said yes in the cookie banner. If you say no, they do not load at all.

The fonts are on our own server. Nothing is fetched from Google when a page loads, unless you have said yes to statistics.

More about cookies in the cookie policy.

Part 2: the portal for UF companies

In the portal at arcgruppen.se/my a UF company works together and reaches its advisor with us. The people there are pupils, most of them under 18. Their teachers are there too, along with external contacts the advisor has connected to the company, and the advisor.

The most important things first:

• About a pupil we store name, school email and role in the company, the account, and what the pupil writes in the portal. A phone number, an address or other contact details cannot be stored: the system stops every attempt.
• 30 days after your UF year has ended we delete the pupils' data. We do not archive it and we do not hide it. We delete it.
• The feedback to the advisor is anonymous, to the advisor as well.
• We sell no data and show no advertising.

What we store about pupils

About you: first name, last name, school email and role in the company.

Your account: the login (your email), the password (not stored in plain text), how you want to be notified and the phones you have connected for push notifications.

Your logins: when you log in, and from which browser, IP address and approximate town. In the portal the advisor only sees when you were last in, so that nobody in the company is left out without anyone noticing.

What you write and upload: threads and replies, tasks and comments in Projects, files, submissions with every version, links, calendar events, the weekly check-in, decisions, booked meetings with your note and your own to-do list.

Surveys. There are two kinds:

• Feedback to the advisor is anonymous. Who answered and what was answered are stored in two tables that cannot be linked. The answer is stored without name, email and time. The advisor sees the answers only when the survey is closed and at least three have answered, and then in mixed order. If your company is too small, your answers are counted together with other companies'.
• The self-assessment is done at the start and end of the year. It is not anonymous: the advisor sees your answers, so that you can see what you have learned.

The company profile (logo, slogan, what you do, website and social media) belongs to the company, not to any pupil. It becomes public only when the advisor has read and published it.

What we store about teachers and external contacts

Teachers: name, email, account and logins. It is the pupils who invite their teacher.

External contacts: name, company, role, phone, mobile, email and a short text the advisor writes about you. The advisor asks you before your card is added, and chooses whether the pupils see phone, mobile and email. With the level "Contact card only" you get no account; with "Contact card and login" you get one.

Why we may store it

• The portal and the advice: legitimate interest (Article 6.1 f). The company has asked for advice, and the portal is how we give it. Since most pupils are under 18, we store as little as possible and delete it when the year is over.
• Push notifications: consent. You switch them on yourself and off whenever you like.
• External contacts: consent. You have said yes to the pupils seeing your card.
• The company on our reference list: the company's consent, see "What remains" below.

What you write is used only for the advice.

Who sees what

Projects, calendar, files, submissions and the weekly check-in are seen by the company's pupils, the advisor, the teachers and external contacts with a login.

Nobody else on the website sees any of this. Whoever runs the technology for us can in theory reach the database, but opens it only to fix faults. Anonymous survey answers stay locked even then, until the survey is released.

Where it is

Everything is on our server in Sweden, with two exceptions:

• Meetings. When you book a meeting it goes into the advisor's Google Calendar, with the name and email of whoever booked and those taking part, and Google creates the Google Meet link.
• Email. Mail from the portal is sent from info@arcgruppen.se through Google's email service.

Push notifications go through the phone's own notification service (Apple, Google or Mozilla, depending on phone and browser).

For how long, and how we delete

Every UF company has an end date for its UF year in the portal. Once a day the portal checks which companies are more than 30 days past their end date, and then deletes automatically:

• The pupils' contacts and accounts, with passwords, notification choices, connected phones, login logs and badges.
• Everything the pupils have written, anywhere in the portal, with attached files. Also the invitations and emails sent only to a pupil's address.
• The threads, whole, with title, question and answers. Also what you sent with the button "Write to the advisor".
• Files, submissions with every version, links and tags.
• The tasks in Projects, the company's own calendar events, the weekly check-in, the personal to-do lists and the self-assessments.
• The bookings with your notes, and the booking emails. The meetings remain in the advisor's calendar, without your note and without pupils as attendees, in Google Calendar too.

Deleted means deleted. The records are removed from the database. They are not archived, and nobody can bring them back in the portal. Files are removed from the server when the system cleans its file store, normally the same day.

What remains

The company, as a reference. The company's name, logo, description, website, social media and UF year are kept and marked as finished. That is data about the company, not about any person. Address, phone and email are removed, since they are often a pupil's own.

The company is shown on our list of UF companies (/uf-foretag/foretagen) only if you have said yes. The contact person does that under Company in the portal, or you tell the advisor. A yes can be withdrawn at any time, also after the year has ended: get in touch and we remove the company from the list.

Other things that remain, without any pupil data:

• Anonymous feedback answers, which cannot be linked to anyone.
• A line saying how many things were deleted, without names.

If an account cannot be deleted for technical reasons, its name is changed to "Removed pupil", the email is removed, the account is closed and everything it wrote is deleted.

Teachers and external contacts

A teacher or external contact can follow several companies. As long as one of them is active, we touch nothing.

Teachers. When the last company you follow is finished, you get an email: "Do you want to keep your account?". If you answer yes, the account stays for the next UF company, so you do not have to register again. If you do not answer within 30 days, we delete your account and your data.

External contacts. You remain a contact with us, like any business contact. The link to the UF companies, the portal login and what you wrote in their threads are removed. If you want us to delete you entirely, get in touch.

Want something deleted sooner? Get in touch and we will do it. Files someone in the company deletes disappear at once and cannot be recovered. The contact person can remove a teacher under Team.

Backups

We back up the database and the files so that we can restore everything after a breakdown. The backups are kept in two places: on our own server for 30 days, and encrypted with an external storage service for up to 13 months (one a day for a week, one a week for a month and one a month for a year).

What you have deleted can therefore remain in an encrypted backup for that long. The backups are opened only to restore after a breakdown. Should we need to do that, the year-end cleanup runs again automatically, and we delete again what we deleted on request.

Before an update of the system we also take an extra copy, which is deleted within seven days.

Your rights

You have the right to:

• Know what data we hold about you, and get a copy.
• Correct what is wrong. You change your role and email yourself under Your profile in the portal.
• Have data deleted, unless the law requires us to keep it.
• Restrict or object to what we do on the basis of legitimate interest.
• Take your data with you in a machine-readable format.
• Withdraw a consent whenever you like.

If you are under 18 you can do all of this yourself. Your parent or guardian can also get in touch.

Email info@arcgruppen.se or call +46 13-328 9485. We reply within one month.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY) at imy.se.

Changes

When we change something significant in this policy, we write it here and change the date at the top.

Contact

Questions about your data? Contact us.

ARC Gruppen AB, company reg. no. 559268-4723 Söderleden 22, 587 31 Linköping, Sweden +46 13-328 9485, info@arcgruppen.se