GENERAL INFORMATION
ToFindOut AB, organization number 556720-7500, (ToFindOut) is committed to protecting your personal privacy and integrity. The purpose of this policy is to clearly and transparently account for how ToFindOut processes your personal data in accordance with the EU General Data Protection Regulation 2016/679 (GDPR). Below you will find information about, among other things, what personal data ToFindOut processes, for which purposes, the lawful basis for the processing, how long your data is stored, and your rights as a data subject.
WHO IS THE CONTROLLER?
ToFindOut is the controller of the processing of your personal data and is therefore responsible for ensuring that the processing is carried out in accordance with applicable legislation. If you have any questions regarding our processing of your personal data, please contact us at dataprotection@tofindout.se. For further contact details, please see the heading “How to contact us”.
WHAT INFORMATION DO WE COLLECT?
Regarding candidates undergoing a background screening, we collect, among other things, the following information.
Contact details: Name, address, phone number, and e-mail address.
Personal details: Information on income, driving licence, and matters at authorities and courts.
Please note that all personal data and the sources we use are specified in the consent document that the candidate receives before a background screening is initiated. Please also note that ToFindOut never processes what the GDPR considers sensitive data, i.e. data which, for example, reveals ethnic origin or a person’s sexual orientation. We would also like to point out that we never collect personal data about persons under the age of 18.
Regarding customers, we collect the following information.
Contact details: Name, position, phone number, e-mail address, physical address, and in some cases personal identity number (not mandatory).
HOW DO WE COLLECT INFORMATION?
Regarding candidates undergoing a background screening, we collect information in the following ways.
From you: We collect information about you that you provide in consent documents or powers of attorney, in connection with e-mails, over the phone, on social media, in surveys, when signing up for newsletters, when you update your details on My Pages at www.tofindout.se, or when you visit our websites (including but not limited to traffic data, location data, web logs and other communications data, as well as e.g. the IP address, type of device, operating system and browser type used for the visit). For more information about how we handle newsletter mailings, please see the heading “Newsletter”.
From customers: We collect information about you from our customers, e.g. personal data that you have chosen to include in your CV and/or other documents. Please note that we discourage you from including sensitive personal data in such documents.
From third parties: We collect information about you from publicly available sources at Swedish or foreign authorities, as well as from companies and/or educational institutions stated in your CV.
Any powers of attorney required for the performance of the assignment will be provided to you by ToFindOut.
Regarding the collection of information about customers and prospective customers, we collect information mainly directly from the company.
WHY DO WE COLLECT PERSONAL DATA?
Regarding candidates undergoing a background screening, personal data is processed mainly for the purposes stated below.
For administration and delivery of background screenings: ToFindOut processes your personal data in order to produce and deliver our services, i.e. background screenings.
Mailings and communication: ToFindOut processes your personal data so that we can communicate relevant information to you while a background screening is ongoing, and to be able to send you a survey after the screening is completed.
Regarding customers, personal data is processed mainly for the purposes stated below.
For marketing: ToFindOut uses your personal data to provide information/marketing via e-mail, text message or other means of communication when you have an active customer relationship with us, and to enable targeted offers and services.
For the delivery of our service: ToFindOut processes our customers’ personal data primarily in order to deliver our service and fulfil our agreement with you, i.e. to provide background screenings.
For business development: ToFindOut uses information about our customers in order to produce statistical data about the use of the service. However, this statistical data never identifies individuals, but takes place at an aggregated level. This analysis is performed in order to develop, deliver and improve our products and services.
LAWFUL BASIS FOR PROCESSING PERSONAL DATA
ToFindOut’s processing of personal data in a background screening rests on a balancing of interests (legitimate interest) as the lawful basis. The consent document or the information provided to the candidate always clarifies which personal data is to be collected and where it is obtained from. Please note that you can always interrupt the process by contacting us. Read more about this under the heading “Your rights”.
Regarding existing and prospective customers, ToFindOut refers to the performance of a contract as the lawful basis.
With regard to the processing of personal data for marketing purposes, ToFindOut refers to consent as the lawful basis.
TRANSFER OF INFORMATION
Personal data relating to candidates undergoing a background screening is never disclosed to anyone other than the party that the candidate has been informed may receive it. Transfer of personal data to a country outside the EU/EEA only takes place in the individual case when a background screening is carried out in the country in question.
If personal data is transferred to a country outside the EU Commission’s list of countries with an adequate level of protection, ToFindOut will ensure that all appropriate safeguards have been taken or obtain your explicit consent for the transfer after having ensured that you have been informed of any possible risks.
STORAGE
ToFindOut ensures that our processing of personal data is carried out in accordance with applicable legislation, which means that your personal data is not stored longer than necessary with regard to the purposes of the processing. Regarding our candidates, all personal data is therefore always erased 14 days after completed delivery. If the process is interrupted, all personal data is erased promptly.
Regarding our customers, your personal data is stored for as long as you remain our customer. The data is erased when it is no longer relevant or necessary for the purposes for which it was collected, e.g. direct marketing or analysis. However, some information may be retained longer if required with regard to other legal requirements, such as the Swedish Bookkeeping Act (1999:1078). In all processing of personal data, the highest level of security and confidentiality is always observed.
YOUR RIGHTS
As a data subject, you have several rights regarding your personal data, and you have the opportunity to influence your information and what is stored.
Completion and rectification of data: ToFindOut will, at your request or on its own initiative, rectify or complete data that is found to be inaccurate, incomplete or misleading. You have the right to have your personal data erased without undue delay if you withdraw your approval.
Copy of data: If you have undergone a background screening, you have access to a copy of all collected personal data we hold about you for 14 days. Since all your personal data is erased after this period, registry extracts cannot be retrieved afterwards. During this period, however, you have unlimited access to the information by logging in to your user account at www.tofindout.se.
Objections: You can at any time decline to receive marketing communications from us by choosing to unsubscribe in any mailings. If you need further assistance regarding our communication, please contact us. See the heading “How to contact us” for contact details. You always have the right to object to our processing of personal data if you consider that we do not have legitimate grounds for the processing.
Right to interrupt the process: You have the right to interrupt the process. At your request, ToFindOut will immediately cease processing your personal data and promptly erase your data. If the client chooses to interrupt the process, ToFindOut will promptly erase your data. However, an interrupted process does not affect the lawfulness of the processing of your personal data before the process was interrupted.
Right to data portability: You have the right to data portability, i.e. the right to receive your data in a structured and machine-readable format, and the right to transfer this data to another controller. Your personal data is always available to you during the 14 days it is held by us and is clearly summarized in a digital report.
Complaints: If you consider that your rights are not respected by ToFindOut, you are welcome to contact us. You also always have the right to lodge a complaint with the supervisory authority, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten), if you consider that ToFindOut processes your personal data in violation of applicable legislation. Such complaints can be submitted via e-mail, imy@imy.se, or by letter to Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm. Read more at www.imy.se.
NEWSLETTER
If you consent to receive newsletters or fill in a contact form via our website, we store your name, your e-mail and the organization you work for. ToFindOut uses the service Upsales to manage subscriptions to our newsletters; the personal data you provide is therefore also processed by Upsales as a data processor. Upsales is not entitled to use the personal data for purposes other than performing the tasks it has undertaken for ToFindOut under the agreement between ToFindOut and Upsales. ToFindOut never sells your personal data to third parties.
The lawful basis for ToFindOut’s processing of personal data in connection with newsletter handling is based on the consent given when you accept mailings of our newsletter. Giving consent is voluntary and you always have the right to withdraw your consent. Withdrawal of consent is done by contacting ToFindOut via the address, e-mail or phone number stated below, or via the link in each newsletter. A withdrawal does not affect the lawfulness of the processing carried out before the consent was withdrawn.
COOKIES AND LINKS TO OTHER WEBSITES
Personal data may be collected when you use our website, in which case information about your usage and which pages are visited is stored. This may be technical information about your device and internet connection such as operating system, browser version, IP address, cookies and unique identifiers. When you visit our websites where our services are provided, various techniques may be used to recognize you in order to learn more about our users. This may take place directly or through the use of third-party technology.
To be able to use our website fully, you must accept cookies, which you do through your browser settings or down in the footer on your computer or mobile phone. If you do not want to accept cookies, you can turn off cookies via your browser’s security settings. However, this means that the website will not function as intended.
In the event that our website contains links to third-party websites, pages, or material published by third parties, these links are for information purposes only. Since ToFindOut lacks control over the content of these websites or their material, we are not responsible for their content. Nor is ToFindOut liable for any damage or loss that could arise from the use of these links.
HOW TO CONTACT US
For further information, you are welcome to contact us at:
ToFindOut AB
Kungsgatan 44
111 35 Stockholm
E-mail address: dataprotection@tofindout.se
Phone number: 08-611 10 20
CHANGES TO THIS DATA PROTECTION POLICY
This Data Protection Policy was last revised on 18 June 2026 (version 2026:1).