Lundberg & Associates


About us




Lundberg & Associates AB (“LA”) cares about privacy and protecting the personal data processed by the firm. All personal data is processed in accordance with applicable data protection legislation.Visits to our website can be made without the visitor having to provide any personal data or accept cookies. However, those who choose to submit a job application or elsewise contact us and will provide us with personal data.When persons are in contact with us or occur in connection with our engagements, this entails personal data being provided to us or obtained by us. Our support organisation also collects and processes personal data about contact persons of suppliers and other external parties. Below we describe how we collect, process and share personal data in such cases. Further down we also provide information about the rights of data subjects in relation to us as controller as well as our contact details.

What personal data do we process?

Much of our communication takes place by telephone and email, which essentially always entails the processing of personal data. Emailing or phoning us generally means that personal data that can be linked to individuals are provided.We collect the personal data provided to us in connection with our engagements or that are otherwise processed during the preparation or administration of an engagement. We primarily collect personal data directly from the individuals concerned. However during engagements we sometimes receive information about individuals involved without the information being provided directly from them. We may also supplement the personal data provided by obtaining information from private and public records and sources. Normally, there is no obligation to provide us with personal data. However, if we do not receive certain personal data, we will not beable to accept an engagement, since we will not be able to comply with our obligations, inter alia, to perform conflict of interest and money laundering checks. Our support organisation also collects and processes personal data when in contact with e.g. suppliers and other external parties.The personal data we process may consist of contact details (e.g. name, title, work address, telephone number and email address), identification details (e.g. passport details and date of birth /ID number), as well as invoicing information (e.g. account number and tax details). In specific engagements the personal data may also comprise other information, e.g. course of events or other circumstances, or other information relevant to the engagement.

What are the purposes of our processing of personal data?

We process personal data provided or obtained in connection with engagements so we can fulfil our obligations and safeguard our customers' interests, and also for administration in connection with engagements, as well as obligations which follow from law. Our support organisation also processes personal data so that we can manage and administrate our relationships with suppliers and other external parties.We may also use personal data as a basis for our market and client analyses, business and methodology development, as well as for statistical purposes, risk management, and marketing purposes.

What is the legal basis for our processing?

In relation to information about private individuals, the legal basis for processing personal data is performance of the contract which governs the engagement. In relation to representatives, business partners and consultants, foreign representatives, representatives and counsel of counterparties, etc., our processing of personal data is normally based on a balancing of interests. This entails that we consider it necessary to process the personal data for the purposes that concern our client's or, where applicable, our legitimate interests and that these outweigh any opposing interests or fundamental rights and freedoms.The processing of personal data in connection with the archiving of documents after an engagement has been concluded are based on our duty to comply with our legal obligations (e.g. under accounting and anti-money laundering legislation).We may have additional grounds for the processing in connection with the various engagements we have accepted.Processing of personal data relating to suppliers or their representatives and other external parties is based on our legitimate interest in administrating the relationship and performing our contractual obligations.When we process personal data in order to analyse and develop our business, and for marketing communication, processing is based on our legitimate interest in improving and marketing our business.

Who has access to the personal data that we process?

We employ appropriate technical and organisational security measures to help protect the personal data we process from loss and to guard against, inter alia, access from unauthorised persons.Transfers of data outside the EU/EEA are made in line with applicable data protection laws and for the purposes specified above. When personal data is transferred to the firm's international offices, the data may be transferred to countries outside the EU/EEA. Transfers of this type are normally based on the EU Commission's standard contractual clauses. Transfers to countries outside the EU/EEA may also occur within the scope of a given engagement insofar as is necessary to establish, exercise or defend our client's legal claims.LA will not disclose personal data to anyone outside LA, except where

  1. it has been agreed between us and the person whose personal data we process,
  2. it is necessary within the scope of a given engagement to safeguard our customers'rights and interests,
  3. it is necessary so we can fulfil a statutory obligation, comply with a decision of a public authority or a court of law,
  4. we engage an external service provider or business partner who performs serviceson our behalf. Such service providers and business partners may only process personal data in accordance with our instructions, and may not use personal data for their own purposes, or
  5. it is otherwise permitted by law.

How long will we keep personal data?

We do not save the personal data longer than necessary given the purpose of the processing, unless otherwise required or permitted by law.The personal data that may be processed before and during the performance of an engagement are subsequently saved for at least ten years from and including the date the engagement was concluded, or for a longer period as required by the nature of theengagement.

What are the rights of the data subject?

Lundberg & Associates AB, Reg No 559131-8802, with address Bäckmans väg 19, 444 55 Stenungsund, Sweden, is the controller of the personal data processing as described above. This means that we are responsible for ensuring that the personal data are processed correctly and in accordance with applicable data protection laws.Data subjects have the right to know what personal data we process about them. A data subject also has the right to request that we rectify or erase inaccurate or incomplete personal data about them (e.g. if the personal data are no longer needed for the purpose or if the consent is withdrawn). Data subjects are also entitled to object to specific processing of personal data and request that processing of personal data be restricted. Finally, data subjects have the right to receive, in machine-readable format, personal data they have provided, and have the data transferred to another party responsible for data processing.Restriction or erasure of personal data may mean that we are unable to meet our commitments. Anyone who is dissatisfied with how we process their personal data is entitled to report this to the Swedish Data Inspection Board (Sw. Datainspektionen), which is the supervisory authority for our processing of personal data.If you have any questions or complaints about how we process your personal data or wish to exercise any of your rights set out above, you are welcome to contact us by email at kontakt@lundbergandassociates.com or by post to the address above.