Purpose
This notice explains how Arc Theory AB processes your personal data when we decide why and how it is processed, that is, when we are the controller. It tells you what we collect, why, on what legal basis, who we share it with, how long we keep it, and what rights you have.
Who we are
Arc Theory AB is a Swedish AI consultancy. We design, build and operate governed AI platforms for established companies, mostly inside our clients’ own environments.
| Company | Arc Theory AB, corporate identity number 559594-2748 |
| Address | Tegnérgatan 34, 113 59 Stockholm, Sweden |
| Privacy contact | privacy@arctheory.se |
| Website | arctheory.se |
Who this notice is for
This notice covers personal data about:
- people at our clients, prospective clients and partners we are in contact with;
- candidates who apply for a job or an assignment with us, or whom we approach;
- people at our suppliers and subcontractors we deal with;
- visitors to our website arctheory.se;
- our employees and consultants.
When we are not the controller
When we work for a client, we often get access to personal data in the client’s systems, for example about the client’s employees or customers. Then the client is the controller and we are its processor: we process the data only on the client’s instructions and under a data processing agreement. The client’s own privacy notice explains that processing, and you should contact the client to exercise your rights. If you contact us, we pass your request on to the client.
What personal data we collect
| You are | What we collect | Where it comes from |
|---|---|---|
| A contact at a client, prospect or partner | Name, title, employer, email address, phone number, and what we have discussed or agreed with you | You, your employer, or public sources such as your employer’s website or professional networking sites |
| A candidate | Name, contact details, CV, education, experience, your answers to screening questions, the recruitment platform’s assessment of your qualifications, interview notes and transcripts, and the terms of any offer we make | You, the recruitment platform where you apply, recruiters who introduce you to us, people you name as references, and public professional profiles |
| A contact at a supplier | Name, title, employer, email address, phone number, and invoice and payment details | You or your employer |
| A website visitor | Technical data your browser sends, such as your IP address, browser type and the pages you request, and, if you accept analytics cookies, how you use the website | Your browser |
| An employee or consultant | Identity and contact details, personal identity number, bank account, employment terms, salary, pension, tax, absence, training, the use of our IT systems (sign-ins and security logs), and your acknowledgements of our policies | You, the Swedish Tax Agency, and our systems |
We do not ask for sensitive data, such as data about health, beliefs or ethnic origin, unless the law requires it, for example sick-leave records for employees. Please do not include such data in a job application.
Why we process it, and our legal basis
| Purpose | Who it concerns | Legal basis |
|---|---|---|
| Delivering our services and managing our client relationships | Contacts at clients | Our legitimate interest in running the engagement with your employer (Article 6(1)(f)) |
| Telling prospective clients about our services and keeping in touch | Contacts at prospects and partners | Our legitimate interest in developing our business (Article 6(1)(f)). You can object at any time. |
| Recruiting, including assessing candidates with the help of AI and preparing offers | Candidates | Steps at your request before entering into a contract (Article 6(1)(b)), and our legitimate interest in finding the right people in a consistent and fair way (Article 6(1)(f)) |
| Contacting you about future roles | Candidates who agree when we ask | Your consent (Article 6(1)(a)), which you can withdraw at any time |
| Buying and paying for goods and services | Contacts at suppliers | Our legitimate interest in managing the supplier relationship (Article 6(1)(f)) |
| Bookkeeping, invoicing and tax | Clients, suppliers, employees | Legal obligation under the Bookkeeping Act and tax law (Article 6(1)(c)) |
| Employment, payroll and benefits | Employees | The employment contract (Article 6(1)(b)) and legal obligations (Article 6(1)(c)) |
| Protecting our systems and your data: sign-in, access and security logs | Employees, consultants, and anyone who uses our systems | Our legitimate interest in information security (Article 6(1)(f)) |
| Recording that personnel have read and acknowledged our policies | Employees and consultants | Our legitimate interest in showing that we comply with security and privacy requirements (Article 6(1)(f)) |
| Serving and protecting our website | Website visitors | Our legitimate interest in running a secure website (Article 6(1)(f)) |
| Measuring how our website is used, to improve it | Website visitors who accept analytics cookies | Your consent (Article 6(1)(a)), which you can withdraw at any time in the cookie settings |
| Establishing, exercising or defending legal claims | Anyone concerned | Our legitimate interest (Article 6(1)(f)), or a legal obligation |
Where we rely on our legitimate interest, we have weighed it against your interests and rights. You can ask us for more information about that assessment.
We do not sell personal data, and we do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.
AI in recruitment
When you apply for a role with us, we use an AI assistant, built on a cloud AI service, to help us assess applications, prepare interviews, write interview notes and keep the process consistent. It scores your application from the profile summary on the recruitment platform where you applied, the platform’s assessment of the qualifications in the job ad and your answers to the screening questions, without your name. A person checks everything the AI produces, and every decision about you is made by people. An interview is transcribed only if you agree at the start.
If you do not want AI to be used on your application, tell us and we will handle it entirely by hand, with no disadvantage to you.
Who we share it with
We share personal data only when we need to, and only with:
- service providers that process it on our behalf, under a data processing agreement:
- IT and cloud providers, for email, documents, hosting and development tools;
- accounting and payroll providers;
- AI service providers, including for the AI assistant we use in recruitment;
- recruitment platforms, such as job sites where you apply, which also process your application under their own privacy policy;
- public authorities, such as the Swedish Tax Agency, when the law requires it;
- our auditors, lawyers and advisers, who are bound by confidentiality;
- our clients, when we propose a consultant for an assignment, and only with the consultant’s knowledge;
- a buyer or investor, if the business or part of it is sold or reorganised, under confidentiality.
Where it is processed
We store personal data within the EU/EEA, and process it there, with the exceptions described below. Our own systems run in our cloud provider’s data centres in Sweden and Germany, and our email and documents stay within the provider’s EU data boundary.
Our website’s content is public and is delivered through a global network of servers, and its hosting configuration is held in the United States. We do not store data about visitors ourselves. If you accept analytics cookies, our web analytics provider processes data about your visit in the United States, protected by the EU–U.S. Data Privacy Framework.
In limited cases, for example when our cloud provider gives support or runs security operations, data may be accessed from outside the EU. Such transfers are protected by the EU–U.S. Data Privacy Framework or the European Commission’s standard contractual clauses. If another provider transfers data outside the EU/EEA, we make sure a similar safeguard is in place. You can ask us for a copy of the safeguards.
When you apply for a role with us, your data is stored in Sweden, but the AI assistant we use in recruitment may have it processed by the AI model in one of our cloud provider’s data centres outside the EU/EEA. That transfer is protected by the provider’s data protection terms, which include the European Commission’s standard contractual clauses, and by the EU–U.S. Data Privacy Framework for the United States.
How long we keep it
We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires. Our Data Retention Policy sets the periods. The main ones are:
| Data | How long |
|---|---|
| Accounting records, including invoices | 7 years after the end of the calendar year in which the financial year ended, as the Bookkeeping Act requires |
| Candidates who are not hired | 2 years after the recruitment is decided, so that we can respond if a claim is brought under the Discrimination Act |
| Contacts at clients, prospects and suppliers | While we are in contact, and 2 years after the last contact |
| Employment records | During employment and 2 years after it ends, and longer where the law requires |
| Security logs | 30 to 90 days, depending on the system |
Your rights
You have the right to:
- access: get a copy of the personal data we hold about you, and information about how we use it;
- rectification: have incorrect data corrected and incomplete data completed;
- erasure: have your data deleted, for example when we no longer need it or you withdraw your consent, unless the law requires us to keep it;
- restriction: have us stop using your data, except for storing it, while a question about it is resolved;
- data portability: receive data you have given us, which we process by contract or consent, in a machine-readable format, or have it sent to another company;
- object: object to processing based on our legitimate interest. We then stop unless we have compelling reasons that override your interests. You can always object to direct marketing, and we will stop;
- withdraw consent: where we rely on your consent, withdraw it at any time, without affecting what we did before.
To use your rights, email privacy@arctheory.se. We may ask you to confirm your identity, for example by replying from the email address we already have, so that we do not give your data to someone else. We answer within one month. If your request is complex we may need up to two more months, and we will tell you within the first month if so. Using your rights is free of charge.
Complaints
If you think we process your personal data wrongly, please tell us first, so that we can put it right. You also have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, www.imy.se, or to the supervisory authority where you live or work.
Cookies
Our website uses cookies for web analytics only if you accept them in the cookie banner. They tell us how the website is used, for example which pages are visited and how visitors found us, so that we can improve it. If you do not accept them, no analytics cookies are set. You can change your choice at any time in the cookie settings on the website. The analytics provider processes the data in the United States, as described under “Where it is processed”. Apart from this, only data that is technically necessary to deliver the pages you request is processed.
Security
We protect personal data with technical and organisational measures appropriate to the risk, including multi-factor authentication for everyone, encryption in transit and at rest, access limited to those who need it, and logging of access to our systems. These measures are described in our Information Security Policy, and are part of our work towards SOC 2.
Changes to this notice
We update this notice when we change how we process personal data, or when the law changes. The current version is always at arctheory.se/privacy, with the date it was last updated. If we make significant changes that affect you, we will tell you directly where we can.
Revision history
| Version | Date | Approved by | Change | Description |
|---|---|---|---|---|
| 1.0.0 | 2026-10-13 | Björn Eriksen | Initial version | Initial version |