Privacy Policy

Last updated: 2024-05-23

1. Introduction to Data Privacy

Chimplie AB conducts the collection and processing of personal data in accordance with the data protection principles set out in the data protection laws and regulations of Sweden and the EU, specifically the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, referred to as the General Data Protection Regulation or "GDPR". Unless otherwise specified, all terms used in this Privacy Policy shall have the same meanings as defined in the GDPR.

Chimplie AB is committed to the GDPR principles of data privacy, ensuring our data processing activities are transparent, lawful (such as based on your explicit opt-in consent), and respectful of your rights and freedoms. This Privacy Policy of Chimplie AB (referred to as the "Privacy Policy") applies to all aspects of Chimplie AB operations, and governs the data privacy of individuals using the chimplie.com website ("the website") and those interacting with Chimplie AB in any capacity where this Privacy Policy is referenced or provided. This Privacy Policy explains how and why Chimplie AB and its subsidiaries ("we" or "Chimplie") may collect, process, store, and use your personal information, details [[Privacy Policy#8. Privacy Safeguards and Data Protection||the data protection measures]] we take, and the mechanism by which you may [[Privacy Policy#10. Data Subject Rights||exercise your lawful rights as a data subject]]. Aside from this Privacy Policy, Chimplie maintains a separate, exhaustive log of data processing activities to demonstrate compliance, if requested.

Chimplie does not knowingly seek, collect, or process any categories of sensitive and special data that may pose risks to individual rights and freedoms, or any data pertaining to minors (individuals under the age of 16).

2. Data Controller and Contact Details

  • info@chimplie.com
  • Chimplie AB, Registration No. 559079-5604
  • Saltmätargatan 8A, 113 59, Stockholm, Sweden

Chimplie is the data controller responsible for the collection and processing of personal information of our data subjects. You can contact info@chimplie.com in case of any questions, comments, complaints, or requests regarding this Privacy Policy or any other privacy and data protection matters.

Please note that interactions with any (non-Chimplie) third-party websites, content, services, or platforms, arising from your interaction with Chimplie (e.g. following a link on our website), are outside of Chimplie's control and responsibility and should be done at your own discretion. You are advised to review the privacy policies of any third-party resources before sharing personal data with them.

3. Purposes of Data Processing

Chimplie processes personal data for clearly defined purposes and only to the extent necessary to serve the specific purpose, ensuring each processing activity aligns with our legitimate business interests and respects the rights and freedoms of individuals (data subjects). The main purposes of our data processing activities include:

  1. Service Delivery and Client Relationship Management: Provision and management of services to Clients
  2. Business Operations: Recruitment of Candidates to enable the provision of services, other core business operations
  3. Marketing and Promotion: Marketing updates to interested Subscribers and Prospects
  4. Employee and Financial Management: Administration of team Members (employees, suppliers, and business partners) and payroll management

Additionally, we may process personal data for auxiliary purposes such as, inter alia, Compliance, Legal obligations, Security, and fraud prevention. Chimplie may also use personal data to create anonymous aggregated statistics (such as those about the use of our website, content, or services).

4. Lawful Bases for Data Processing

Chimplie processes personal data based on clearly defined lawful bases, one or more of which may apply depending on the specific data processing activity:

  1. Consent – your explicit, informed, freely given and unambiguous (opt-in) consent (provided for a specific purpose e.g. by applying to our vacancy or subscribing to our newsletter). By ticking an empty checkbox in the consent field of a web form, when providing personal data to us, you may confirm the fact you have read and understood these terms and agree to the processing of your data for specified purposes (this step is usually required before you can submit your personal information to us, and acts as the proof of consent). You may withdraw your consent at any time, as per your [[Privacy Policy#10. Data Subject Rights||data subject rights]].

  2. Legitimate interest – a legitimate business interest pursued by Chimplie, that is balanced against the the rights and interests of the data subject, such as Service Delivery, Improvement, and Marketing, Client Relationship Management, Business Operations and Development. Before processing any personal data on the basis of a legitimate interest, and to ensure that our legitimate interests are not overridden by the freedoms, rights, and interest of our data subjects, we conduct a comprehensive balancing test that evaluates the purpose, necessity, and impact of processing activities carried out on this basis (maintaining record of such tests). You may object to the processing of your personal data that is based on legitimate interests, as per your [[Privacy Policy#10. Data Subject Rights||data subject rights]].

  3. Contractual obligation – a lawful basis for data processing, in the event the processing is necessary for the performance of a contract (to which the data subject is party), or in order to take the steps necessary to enter such a contract (at the request of the data subject). This basis may apply when prospective clients or suppliers reach out with a clear interest or intent to take steps towards a contract with Chimplie (e.g. by requesting detailed information about our services).

5. Data Subjects

Chimplie does not collect or process any data pertaining to minors (individuals under the age of sixteen). Chimplie processes personal data of the following categories of data subjects, each for specific processing purposes and with correspondence to specific business interests:

  1. "Clients" (Services): prospective and current customers (including their representatives). We process their data to market, provide, and improve our relevant services and content, within the scope of Service Delivery and Client Relationship Management purposes.
  2. "Candidates" (Recruitment): prospective suppliers and business partners (including their representatives). We process their data to fulfil recruitment needs and enable the provision of services, and other core operations, within the scope of the Business Operations purpose.
  3. "Subscribers" (Marketing Updates): individuals subscribed to or interested in the Chimplie Updates newsletter. We process their data to share marketing and promotional materials relating to Chimplie, our services, or content, within the scope of the Marketing and Promotion purposes.
  4. "Members" (Employment): current suppliers and business partners of Chimplie (including their representatives). We process their data to enable effective administrative and financial management, within the scope of the Employee and Financial Management purposes.

6. Categories of Data

Chimplie does not collect, store, or process any sensitive or special categories of data (those which may pose risks to the rights or freedoms of individuals) or any data related to minors. We may receive your personal data from you directly, or from relevant third parties and Chimplie partners, such as agencies or online platforms, when you interact with them or their services (subject to the privacy policy of the third party in question). We strive to minimise data collection to strictly the data necessary for a specific processing activity.

Chimplie's use of Cookies is limited strictly to those essential for accessing chimplie.com (only functional purposes) and does not entail any collection, storage, or processing of data (such as your IP address or country of origin) on this basis by us.

We may collect various types of personal data (depending on the data subject), which includes:

  • Personal information such as names, gender, portrait photo
  • Contact details, such as email address, phone number, physical address
  • Demographic attributes, such as education level, occupation, career interests
  • Financial information, such as tax number, bank account number
  • Unique identification information, such as social profiles or ID number
  • Synthesised or aggregated information about you that is tailor made specifically for a relevant processing purpose (such as Candidate profiles for Recruitment purposes)

Chimplie uses this data strictly for the purposes it is provided or intended for, in a transparent manner, on a lawful basis, and to an extent expectable by the data subjects. If we intend to use your personal data for purposes other than those stated or implied at the time of collection, we will inform you to obtain your consent, or evaluate the applicability of another lawful basis, before proceeding.

7. Details of Data Transfers and Recipients

Chimplie does not sell, rent, or share your personal data with third parties. We may transfer personal data to our subsidiaries, affiliates, or trusted businesses partners and service providers (who shall process the data on our instructions and in compliance with all applicable laws and regulations) only when absolutely necessary for the relevant purposes of the data processing (e.g. transaction processing, email delivery, analytics). To the extent reasonably feasible, we strive to contain our data processing activities within the EU, ensuring adequate protection measures, such as standard contractual clauses, in case of any transfer outside of the EU.

8. Privacy Safeguards and Data Protection

Chimplie is committed to protecting personal data, (especially in case of any data transfers to third countries or parties) ensuring an adequate implementation of technical and organisational privacy protection measures, appropriate to the level of risk associated with our data processing activities. These safeguards include:

  • Access controls, such as restricted, role-based access to data and multi-factor authentication for data access
  • Data minimisation (processing only the necessary information for specified purposes)
  • Encryption of data during its collection, storage, and processing
  • Regular reviews and audits of data protection policies and practices
  • Data pseudonimisation or anonymisation where applicable

9. Data Retention Period

We retain personal data for as long as necessary to fulfil the purposes outlined in this Privacy Policy, typically no longer than five years, unless otherwise required by law (for record retention or legal compliance purposes) or contractual obligations. We regularly review retention periods of our data records and erase data that is no longer necessary for the specified purposes it was provided for.

10. Data Subject Rights

As a data subject, whose personal data is being processed by Chimplie as the data controller, you are entitled to certain rights as per the GDPR. You may contact us at info@chimplie.com to inquire about your data subject status or to exercise the following rights:

  • Access: the right to access your data (and request data copies)
  • Rectification: the right to request rectification (correcting or updating information you consider inaccurate or incomplete)
  • Withdrawal of Consent: the right to withdraw consent to data processing (if consent has been provided)
  • Erasure: the right to request the erasure of your data (in the event of consent withdrawal)
  • Restriction of Processing: the right to restriction of processing, in the event data processing is considered unlawful (if the data subject did not provide data processing consent, for instance)
  • Objection: the right to object to processing, in the event data processing is based on a legitimate interest overridden by the rights and interest of data subjects (direct marketing or scientific purposes, for instance)
  • Data Portability: the right to data portability (transfer of the personal data, provided by you, to another data controller)
  • No Automated Processing: the right to not be subjected to automated processing (such as profiling) and obtain human intervention – Chimplie does not rely solely on profiling or automated decision-making in any data processing activities
  • Complaint: the right to lodge a complaint – if you believe your rights under the GDPR have been violated, you have the right to file a complaint to a relevant competent data protection authority in the EU Member State of your residence or the Swedish Data Protection Authority

11. Changes to Privacy Policy

Chimplie reserves the right to update, modify, or change the terms of this Privacy Policy to reflect changes in our practices, legal requirements, or any other applicable factors. Any changes to the terms will be effective immediately upon posting on our website. Significant changes may be communicated through a prominent notice on the website or via email notification. The effective date of any changes will be clearly indicated.