Research Automators Sweden AB
1. Purpose and scope
Research Automators Sweden AB (“Research Automators”) is committed to protecting personal data and respecting the privacy of individuals whose personal data we process.
This policy describes the principles and responsibilities that apply to the processing of personal data by Research Automators. It applies both when Research Automators acts as a data controller for its own processing and when acting as a data processor on behalf of customers.
Research Automators processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable data protection legislation.
2. Data protection principles
Research Automators shall ensure that personal data is:
3. Processing of customer data
When Research Automators processes personal data on behalf of a customer, Research Automators acts as a data processor and processes the data only in accordance with the customer’s documented instructions, the applicable Data Processing Agreement (DPA) and applicable law.
Customers remain responsible for determining the purpose and legal basis for the processing and for ensuring that personal data provided to Research Automators may lawfully be processed.
4. Access and confidentiality
Access to personal data is restricted to personnel who require access to perform their duties.
Personnel with access to personal data are subject to confidentiality obligations and shall receive appropriate instructions regarding the handling and protection of personal data.
5. Information security
Research Automators applies appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.
Security measures are selected based on the nature of the processing and associated risks. Research Automators maintains separate policies and procedures governing information security.
6. Data protection by design and by default
Data protection shall be considered when developing and operating systems and services involving personal data.
Research Automators aims to minimise the personal data processed and to provide functionality that enables customers to manage, protect and delete personal data when required.
7. Sub-processors
Where Research Automators engages sub-processors to process customer personal data, appropriate contractual data protection obligations shall be in place.
Research Automators maintains information about the sub-processors used in the provision of its services and manages changes to sub-processors in accordance with applicable Data Processing Agreements.
8. International data transfers
When acting as a data processor, Research Automators processes customer personal data within the EU/EEA or in countries for which the European Commission has determined that an adequate level of data protection exists, in accordance with the applicable Data Processing Agreement.
Any other transfer of personal data outside the EU/EEA shall only take place where permitted by applicable data protection legislation and appropriate safeguards are in place.
9. Personal data breaches
Suspected or confirmed personal data breaches shall be investigated and handled without undue delay.
Where Research Automators acts as a data processor, affected customers shall be informed in accordance with the applicable Data Processing Agreement and GDPR.
Research Automators shall cooperate with customers as reasonably required in investigating personal data breaches and meeting applicable regulatory obligations.
10. Retention and deletion
Personal data shall not be retained for longer than necessary for the purpose for which it is processed.
When acting as a data processor, Research Automators shall delete or return customer personal data following termination of the relevant service in accordance with the customer’s instructions, the applicable Data Processing Agreement and applicable legal requirements.
11. Data subject rights
Research Automators respects the rights of individuals under applicable data protection legislation.
Where Research Automators acts as a data controller, requests from individuals regarding their personal data shall be handled in accordance with GDPR.
Where Research Automators acts as a data processor, Research Automators shall reasonably assist the relevant customer in fulfilling its obligations regarding data subject rights.
12. Compliance and review
All personnel processing personal data on behalf of Research Automators are expected to comply with this policy and applicable internal procedures.
This policy shall be reviewed regularly and updated when necessary due to changes in legislation, Research Automators’ services, processing activities or identified risks.
Policy owner: Research Automators Sweden AB
Approved by: CEO
Version: 2025-02-13