Sveaskog’s privacy notice

1. General information

1.1 This information text ("Privacy Notice") describes how we, Sveaskog Förvaltnings AB, org. no. 556016–9020 ("we", "our", and "us"), process personal data about you who:

(i) visit or interact with us via our website,

(ii) visit Sveaskog’s office premises and other properties where Sveaskog conducts business,

(iii) come into contact with Sveaskog in your work or assignment with one of our customers, suppliers, or partners, or

(iv) apply for a position with us ("you" and "your").

1.2 We are the controller for the personal data we process about you. Being the controller means that we determine the purposes and means of processing your personal data in accordance with applicable data protection legislation.

2. How we process personal data

The table below describes how we process your personal data, the purposes we have for the processing, the legal bases we rely on, and how long we retain the personal data.

Purpose

Personal Data

Legal Basis

Retention Period

To recruit new staff and, where applicable, meet future recruitment needs.

Name, email address, phone number, uploaded documents (such as CV, cover letter, and certificates), messages and other information you provide in relation to a specific job application, test responses, test results, notes from interviews and reference/background checks, gender, link to LinkedIn profile, and an evaluation of the application.

Consent, where applicable, and otherwise, Sveaskog’s legitimate interest in receiving job applications and recruiting the best candidates for vacant positions.

Information in job applications is deleted 24 months after the recruitment process is completed, provided that you as a job seeker have not withdrawn your consent or if there is a dispute related to the recruitment or a legal obligation requiring us to retain the personal data for longer than 24 months.

To receive and handle unsolicited applications.

Name, email address, uploaded documents (such as CV, cover letter, and certificates) and link to LinkedIn profile.

Consent.

Personal data is retained as long as we have your consent.

To receive and handle applications for writing a thesis at Sveaskog.

Name, email address, phone number, details about the thesis, education, and other information you provide in connection with the application.

Consent.

Information in applications is deleted after 12 months.

To receive and handle applications for a trainee position at Sveaskog.

Name, email address, phone number, uploaded documents (such as CV, cover letter, and certificates), and link to LinkedIn profile.

Consent.

Information in applications for trainee positions is deleted 24 months after the process is completed, provided that you as a trainee applicant have not withdrawn your consent.

To receive and handle applications for internships at Sveaskog.

Name, email address, phone number, link to LinkedIn profile, details about education and school, interests and wishes, and other information you provide in connection with the application.

Consent.

Information in applications for internships is deleted 24 months after the process is completed, provided that you as an intern applicant have not withdrawn your consent.

To administer our candidate portal where you, as a previous applicant or someone who has expressed interest in working with us, can view your information, previous applications, and request deletion of your data.

Email address.

Sveaskog’s legitimate interest in administering and enabling access to the candidate portal and its features.

Your email address is stored in the candidate portal as long as information about previously applied positions or unsolicited applications is retained.

To assess reports made through Sveaskog’s whistleblower function and investigate whether individuals within Sveaskog have been involved in serious irregularities or misconduct related to, for example, accounting, internal accounting control, auditing, combating bribery, criminality in banking and finance, or other serious irregularities affecting the organization’s vital interests or individuals’ lives and health.

Name and contact details you provide/contact through, and the sequence of events. Only personal data necessary for investigation and assessment in a current whistleblower case is stored and processed.

Legal obligation.

After the whistleblower case is concluded, all personal data that Sveaskog does not have a legal obligation to retain longer is deleted.

To send ordered information to you when you have subscribed to press releases or other information from us.

Email address and, where applicable, selected subscription, first and last name, mobile number, whether you own forest property, and in which municipality.

Consent.

Personal data is retained as long as we have your consent (i.e., until you choose to unsubscribe).

If you choose to unsubscribe from press releases and comments, your personal data is deleted after 25 days.

To manage an expression of interest regarding the purchase of a house, plot of land, or agricultural land from you, send you information about when new sales objects or available leases are published, and use your personal data in a potential future acquisition.

First and last name, address, postal code, city, phone number, email address, and information about your expression of interest.

Consent.

Performance of real estate contract, where applicable.

Your personal data is processed as long as we obtain your consent and, where applicable, until you choose to unsubscribe.

In the case of an expression of interest regarding a purchase, personal data is deleted 12 months after the case is concluded.

If the expression of interest leads to a real estate transaction, your personal data will be retained for the execution and verification of the transaction.

To handle your comments or questions that you have sent to us via email through our website.

Name, phone number, email address, and information related to your case.

Consent.

Personal data is retained as long as we have an ongoing case with you, provided that you have not withdrawn your consent.

Your personal data is deleted when your case is fully processed, no later than after 6 months.

To manage and deliver purchases of hunting or fishing licenses that you have made via our website.

Name, date of birth, age, phone number, email address, address, customer and payment information.

Performance of the contract or, where applicable, legal obligation.

Personal data is processed as long as necessary to fulfill our contract with you.

Accounting information is retained for at least 7 years in accordance with applicable legislation.

To fulfill a contract for the transfer or lease of real estate or a service agreement.

Data according to the contract such as name, personal identification number, phone number, email address, address, company/organization where applicable, and payment information (e.g., credit card number).

Performance of the contract, to meet formal requirements under applicable legislation for the transfer or lease of real estate, and Sveaskog’s legitimate interest in maintaining customer records.

Personal data is processed as long as necessary to fulfill our contract with you.

In the case of a contract for the transfer or lease of real estate, personal data is retained during the contract period and then for two years after the contract has ended.

The contract is retained for twenty years after the end of the contract period.

To inform and offer contractors and suppliers an opportunity to submit bids for assignments with us, manage incoming expressions of interest, and, upon transitioning to a business collaboration, execute and verify the transaction.

Name, company, email address, and other information provided by you.

Consent and, where applicable, Sveaskog’s legitimate interest in executing and verifying the transaction.

Personal data is retained for a maximum of 150 days or until the procurement is completed.

For handling catch reporting (Mörrum) and for appointing prize winners at various levels.

Name, image, city, country, and email address, as well as catch information (such as fish species and catch date).

Consent for publishing name and image on the website and legitimate interest for catch registration.

Personal data is processed for up to 12 months, after which it is deleted.

For handling booked delivery of seedlings.

Name, phone number, email address, and delivery details.

Performance of the contract.

Personal data is processed for up to 24 months, after which it is deleted.

For contact regarding timber purchases.

Name, phone number, email address, municipality where the forest is located, and other information you provide to us.

Consent.

Personal data is processed as long as you have a business relationship with us. Otherwise, your personal data is deleted after 12 months.

To receive and handle applications for sponsorship for schools.

Information about the school/educational institution, association/student union, address, postal code, city, contact person, phone, email address, and information about purpose, amount, and counter-performance.

Consent.

Personal data is processed as long as the sponsorship application is being processed, after which it is deleted.

To receive and handle applications for sponsorship collaboration.

Information about the association, name of the contact person, phone number, email address, information about purpose, amount, and counter-performance.

Consent.

Personal data is processed as long as the sponsorship application is being processed, after which it is deleted. 

To receive and handle applications for financial support (Domänfonden).

First and last name, personal identification number, residential and postal address, email address, phone number, marital status, children or surviving relatives where applicable, type of grant, information about income and income tax return, account for the application for support or personal letter, medical certificate in case of illness, bank details, and signature.

Consent.

Personal data is processed as long as we have your consent and as long as the application is being processed, for a maximum of one year.

To administer your participation in conferences, seminars, or other events and to market these events.

Name, phone number, email address, address, audio and video recordings from our conferences, seminars, and other events.

Consent.

Sveaskog’s legitimate interest in administering your participation.

As long as we have your consent to process the personal data.

The personal data we process to administer your participation is deleted after the relevant conference, seminar, or event.

To conduct and administer your participation in the annual general meeting/company meeting, prevent and address any crimes in connection therewith, and fulfill legal obligations in accordance with applicable laws and regulations.

Name, company/organization, phone, email address, and, where applicable, parliamentary assignments, video and audio recordings, and IP address to the extent that the company meeting is made available over the internet or otherwise through electronic connection.

Legitimate interest for participants from the public, and legal obligation for shareholders and members of parliament.

Personal data is retained as long as necessary with regard to the purpose or as long as required by applicable laws and regulations.

To manage, collect information, and ensure consideration and cooperation in relation to stakeholders regarding geographical locations (such as areas with social values or reindeer husbandry).

Name, phone number, email address, type of geographical location, and, where applicable, organization or equivalent, as well as information about agreements regarding management and any joint planning/consultation.

Sveaskog’s legitimate interest in fulfilling the specified purposes for the processing.

Personal data is retained as long as we have an ongoing case with you, after which it is deleted.

For technical solutions, including necessary, functional, statistical, marketing, and unclassified cookies, via our website.

Cookie information such as user session, search parameters, user behavior and activity on the website, number of visits, and identifiers (GUID).

Consent.

Personal data collected via cookies (not strictly necessary) is retained as long as we have your consent. Cookies are retained during a session or for up to a maximum of one year.

To handle legal requests (such as search warrants, court orders, summons, or similar) and to establish, exercise, or defend legal claims.

The personal data processed depends on the nature of the legal request or legal claim.

We have a legal obligation to handle requests from authorities.

Sveaskog has a legitimate interest in being able to establish, exercise, and defend legal claims.

Personal data is processed as long as necessary to respond to legal requests and to establish, exercise, and defend legal claims.

To prevent, deter, and investigate crimes, vandalism, and accidents against Sveaskog and Sveaskog’s premises, monitor wildlife, and ensure your and others' safety.

Audio and video recording (through surveillance).

More specific information about the surveillance is available at the location where the surveillance occurs.

Sveaskog’s legitimate interest in preventing, deterring, and investigating crimes, vandalism, and accidents against Sveaskog and Sveaskog’s premises, monitoring wildlife, and ensuring your and others’ safety.

If there is suspicion of a crime, the surveillance material is retained as long as necessary to handle the case.

In cases where there is no suspicion of a crime, the surveillance material is retained for a maximum of 60 days. Personal data processed through Sveaskog's wildlife monitoring is deleted immediately upon detection, but no later than within five working days.

More specific information about retention periods for recorded surveillance material is also available on the respective information sign where the surveillance occurs.

 

Personal data is only shared with those individuals within the organization who need access to fulfill the purposes for which the data was collected. Note that your personal data is always shared within the organization on a "need-to-know" basis, not a "good-to-know" basis.

3. From which sources do we obtain your personal data?

In addition to the personal data you provide to us, we also collect personal data from the following sources:

  • surveillance cameras (at locations where surveillance occurs),
  • public registers,
  • authorities, in the case of legal requests,
  • suppliers and partners, and
  • customers, suppliers, or partners with whom you are employed or contracted.

4. Legal bases

4.1 Performance of a contract
When performance of a contract is the legal basis, the processing of your personal data is necessary for Sveaskog to fulfill a contract to which you are or intend to become a party, for example, when you enter into a purchase agreement with us (for example, regarding hunting or fishing licenses).

We will, for example, email your hunting or fishing license to you according to the purchase agreement. To do this, we need to process the personal data specified in the table above regarding the purchase of hunting or fishing licenses via our website.

4.2 Compliance with a legal obligation
When compliance with a legal obligation is the legal basis, the processing of your personal data is necessary for Sveaskog to fulfill a legal obligation arising from law or other regulations, or from decisions made under law or other regulations.

We will, for example, process your personal data to fulfill our obligations under law and/or other regulations, such as data protection legislation, whistleblower legislation, discrimination legislation, and accounting legislation.

4.3 Legitimate interest
When legitimate interest is the legal basis, the processing of your personal data is necessary for purposes related to the legitimate interest of Sveaskog or a third party, and the legitimate interest outweighs the opposing interest of protection against infringement of personal integrity.

In the table above, you can find our legitimate interest in processing your personal data when this is done based on this legal basis. We cannot exercise our legitimate interests without processing the personal data mentioned above, but we believe that we can exercise our legitimate interests in a way that does not disproportionately infringe on your interests, rights, and freedoms.

Our assessment is that processing activities based on our legitimate interests is normal and what can be expected from a company of our type of business and is difficult to avoid without incurring significant financial loss and reduced efficiency for the company.

4.4 Consent
To the extent that we process your personal data based on your consent, this is indicated in the table above. Consent is collected, for example, when you choose to subscribe to information from us, submit an application, comment, or question, or register for a conference, seminar, or other event with us. You have the right to withdraw your consent at any time.

5. Recipients of personal data

To conduct Sveaskog’s business, we may need to disclose your personal data with the following recipients:

  • service providers that provide our IT systems, assist us with sending newsletters, and other administrative tasks,
  • other companies within the Sveaskog group as well as companies with which we have business relationships and their potential subcontractors, and
  • competent authorities as needed, for example, police, judiciary, or relevant supervisory authorities.

We always strive to store and process your personal data within the EU/EEA. In exceptional cases, however, your personal data may be transferred to and processed in a country outside the EU/EEA by our suppliers or processors.

In these cases, we have ensured that there are adequate safeguards to protect individuals' rights through one of the following measures:

a) The country is on the EU Commission’s list of countries with an adequate level of protection; or

b) The transfer is made through other assurances of adequate protection, such as standard contractual clauses or other applicable transfer tools.

6. Your rights

As a data subject, you have certain rights when Sveaskog processes your personal data. You have the right to request access to and information about how we process your personal data. You also have the right to request that we correct, rectify, supplement, delete, or restrict the processing of your personal data. You have the right to request a copy of the personal data we process about you.

You have the right to object to our processing of personal data based on our legitimate interests. In cases where processing is based on your consent, you always have the right to withdraw your consent, and the processing will then cease.

You also have the right to restrict the processing of your personal data (i) if you have contested the accuracy of the personal data; (ii) if the processing is unlawful and you have requested that it be restricted; (iii) if we no longer need your personal data for the original purposes, but you need it to establish, exercise, or defend legal claims; or (iv) pending verification that our legitimate reasons outweigh the interests of the data subject, in a request for deletion. You also have the right to data portability, which means that in certain cases you can receive the personal data you have shared with us in a structured, commonly used, and machine-readable format, and have the right to transmit this data to other controllers.

Your rights as a data subject will be fulfilled by us to the extent we are obligated under applicable laws.

7. Contact information

To exercise the rights above or if you have questions about our processing or your personal data, please contact us at the following address: dataskydd@sveaskog.se.

If you have comments or complaints regarding our processing of your personal data, you are primarily welcome to contact us at dataskydd@sveaskog.se. We are happy to assist you.

You also have the right to turn to and file complaints with the Swedish Authority for Privacy Protection (IMY), which is the supervisory authority for the processing of personal data. The Swedish Authority for Privacy Protection can be reached at:

Integritetsskyddsmyndigheten
Box 8114, 104 20 Stockholm
Email: imy@imy.se
Phone: 08-657 61 00
Website: imy.se

8. Notice of changes to the privacy notice

We may make changes to this Privacy Notice. At the bottom of the last page, it is indicated when changes to the Privacy Notice were last made.

If we make changes to this Privacy Notice, we will notify you via announcement at www.sveaskog.se. If the changes are substantial, we will provide additional notice as appropriate under the circumstances, and request your consent if required in accordance with applicable law.

This Privacy Notice was last updated on 2025-10-14