Privacy & Data Policy

GDPR compliant badge

Version: 1.0 — Latest update: 30 July 2025

Legal entity: Permly AB

Org.nr: 559538-6391

Address: Norrtullsgatan 2, 113 29 Stockholm, Sweden

Contact: admin@permly.ai

1. Introduction

This Privacy Policy explains how Permly AB ("Permly," "we," "us"), registered in Sweden, collects, uses, stores, and protects personal data when you interact with our Platform or communicate with us. Our Platform provides digital services for work permit applications, relocation support, and related compliance workflows. We are committed to processing personal data in accordance with the EU General Data Protection Regulation ( GDPR, Regulation (EU) 2016/679) and applicable Swedish legislation, including the Data Protection Act (Lag 2018:218). This Policy applies to all personal data we process, whether structured or unstructured, and reflects our responsibility to handle your information with care, confidentiality, and transparency.

2. Definitions

Unless otherwise stated, the terms below have the meanings assigned to them in Regulation (EU) 2016/679 ("GDPR") and applicable Swedish legislation.

  • "Platform": The digital services operated by Permly AB, including but not limited to the public website, web-based dashboards, mobile applications, APIs, electronic forms, document portals and chat interfaces through which the Services are provided.
  • "Services": The functionality, workflows, content and support made available via the Platform, including without limitation work-permit and relocation management, compliance monitoring, document generation and storage, communication with authorities, advisory support and related administrative tools.
  • "Client": Any natural or legal person that enters into an agreement with Permly AB to access or use the Services (e.g. employers, individual applicants or authorised representatives such as lawyers or consultants).
  • "User": Any individual who accesses or interacts with the Platform, whether on behalf of a Client or in their own capacity, including employees of Clients, applicants, representatives, administrators and visitors.
  • "Data Subject": An identified or identifiable natural person whose Personal Data are processed, within the meaning of Article 4(1) GDPR.
  • "Personal Data": Any information relating to a Data Subject as defined in Article 4(1) GDPR, such as names, contact details, passport numbers, visa and permit data, salary information, employment history, family relations and any supporting documents or metadata submitted via the Platform.
  • "Company Data": Non-public operational information relating to a Client's business shared with Permly AB for the purpose of receiving the Services (e.g. organisational structures, internal salary bands and HR policies). Although not Personal Data under the GDPR, Company Data is protected by strict contractual confidentiality obligations.
  • "Processing": Any operation or set of operations performed on Personal Data as listed in Article 4(2) GDPR, such as collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure or erasure.
  • "Data Controller": The natural or legal person who, alone or jointly with others, determines the purposes and means of Processing Personal Data (typically the Client), as defined in Article 4(7) GDPR.
  • "Data Processor": Permly AB when it Processes Personal Data on behalf of a Data Controller under a written data-processing agreement in accordance with Articles 4(8) and 28 GDPR.
  • "Sub-Processor": Any third-party service provider engaged by Permly AB to assist in delivering the Services (e.g. cloud-hosting, analytics or communication providers) that Processes Personal Data on behalf of the Data Controller under a written contract compliant with Article 28 GDPR.
  • "Supervisory Authority": The competent independent public authority tasked with monitoring the application of the GDPR; in Sweden, this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).
  • "Swedish Migration Agency (Migrationsverket)": The government agency that examines residence- and work-permit applications. Permly AB may assist with submissions but has no influence over the Agency's decisions.
  • "Applicable Law": All legislation governing the Processing of Personal Data and the provision of the Services, including without limitation the GDPR, the Swedish Data Protection Act (Lag 2018:218), the Archives Act ( Arkivlagen 1990:782), the Public Access to Information and Secrecy Act ( Offentlighets- och sekretesslagen  2009:400) and other relevant EU/EEA regulations.

3. What data do we collect?

We collect and use data to deliver rich, interactive experiences, track software issues and facilitate immigration workflows. One purpose of our Platform is to help you gather information and documents for immigration processes. We also gather information on behalf of Clients and, where applicable, provide that information to the Swedish Migration Agency ( Migrationsverket) to help companies and individuals obtain or maintain permits to stay, work or live in Sweden. This includes:

  • Preparing and submitting complete applications to Migrationsverket and other authorities on behalf of Clients, ensuring compliance with Swedish migration law.
  • Providing customer care and support, such as answering questions, correcting errors, and assisting with document preparation.
  • Improving and developing our Platform and workflows based on aggregated insights and user feedback.
  • Carrying out analytics and business follow-up, such as market analysis, service usage statistics, and method development for process optimisation.
  • Providing and securing our Platform, including updates, troubleshooting, fraud prevention, and maintaining reliable service availability.
  • Personalising the Platform and making tailored recommendations (e.g., relevant permit pathways or guidance based on user input).

For how and on what legal bases we process these data, see Our GDPR Roles, and for the controller/processor split, see Key Processing Activities. Retention periods are described in Section 6 (Data Storage & Retention).

4. How do we collect data?

We collect personal data directly from you when you use our Platform, visit the website, contact customer service or otherwise communicate with us. We may also collect data from public registers (e.g. Swedish Tax Agency for address updates) and via cookies that log how you use our website. Permly AB does not knowingly collect personal data from individuals under 16 without verified parental consent. We use strictly necessary cookies and, with your consent, analytics and performance cookies/SDKs. For details and choices, see Cookies.

For the corresponding lawful bases, see Our GDPR Roles. For retention, see Section 6 (Data Storage & Retention). To exercise your rights, see Your GDPR Rights.

5. AI & Automation Practices

We deploy large-language models (LLMs) and other narrow AI components solely for low-risk, assistive tasks. These systems do not make decisions with legal or similarly significant effects. We classify our use of AI as limited-risk under the EU AI Act and assess the residual risk as low in line with GDPR Recital 75 because:

  • Final determinations (e.g., immigration outcomes) are made exclusively by Migrationsverket or the relevant authority, never by AI.
  • Inputs are processed in a secure EU/EEA runtime with automatic redaction of direct identifiers where technically feasible before AI processing.
  • All models undergo systematic bias, fairness and performance testing prior to deployment and at least quarterly thereafter.

What we do

  • Draft summaries, form answers and guidance to accelerate case preparation.
  • Classify and tag uploaded documents to recommended categories, following the Controller's instructions.
  • Perform automatic redaction of direct identifiers where technically feasible before AI processing.
  • Host all AI processing exclusively on vetted EU/EEA cloud providers. Maintain model cards, versioning and change-control documentation for every model release.
  • Generate irreversibly anonymised aggregated benchmarking statistics (Recital 26 GDPR), ensuring that individuals are no longer identifiable. These anonymised outputs fall outside the scope of the GDPR.
  • Offer per-customer opt-out from participation in aggregated anonymised benchmarking datasets, where applicable.

What we don't do

  • Fine-tune or train foundation models on identifiable client data.
  • Share personal data with non-EEA AI providers or data brokers.
  • Make final binding immigration, employment or legal decisions using AI.
  • Create or file final documents without human approval.
  • Use AI for employee surveillance or productivity scoring. Nor do we grant AI systems write access to production databases.
  • Sell anonymised or aggregated statistics for marketing or advertising purposes.

AI outputs are assistive tools, not authoritative records. Users must review, edit and approve all content before submission to any authority.

6. Data Storage & Retention

We store and protect personal data in accordance with the EU General Data Protection Regulation (Reg. (EU) 2016/679, "GDPR") and the Swedish Data Protection Act (Lag 2018:218). GDPR's storage-limitation principle (Art. 5(1)(e)) means we keep personal data no longer than necessary for the purposes for which it was collected, unless EU/Swedish law requires a longer period or we must retain a minimal subset to establish, exercise or defend legal claims (Art. 17(3)(b), (e)).

6.2 Security of storage (Art. 32 GDPR)

We implement role-based access control (least privilege) with encryption, continuous logging/monitoring, and EU/EEA-hosted infrastructure in ISO 27001-certified data centres. Where we rely on sub-processors, they operate under written data-processing agreements that meet Art. 28 GDPR (including, where relevant, the EU Standard Contractual Clauses). We conduct DPIAs and vendor risk reviews where required.

6.3 Default retention

Unless a longer period is required by law, contract, or a documented legitimate interest, we delete or irreversibly anonymise immigration case-file data within 12 months of case closure/decision. This implements the storage-limitation principle in Art. 5(1)(e) GDPR and still allows you (or your employer/controller) to retrieve recently closed matters.

6.4 When we keep data longer (and why)

  • Book-keeping / tax law (7 financial years): We must retain "räkenskapsinformation" (e.g., invoices, ledgers, voucher backups) for 7 financial years (until the end of the seventh year after the calendar year in which the fiscal year ended), per 7 kap. 2 § Bokföringslagen (1999:1078). This does not require us to keep the full immigration case file.
  • Potential or ongoing claims (up to 10 years): The general civil limitation period is 10 years under 2 § Preskriptionslagen (1981:130). If we reasonably need data to establish, exercise or defend legal claims (GDPR Art. 17(3)(e)), we keep only a minimal, relevant subset (a "legal-hold defence packet") for up to 10 years and restrict access strictly.
  • Controller instructions: When we act as processor, the controller's written retention schedule in the DPA governs (Art. 28 GDPR). If, for example, an employer requires longer retention for compliance/audit, we follow that written instruction.
  • Specific legal obligations: If Union or Member State law (Art. 6(1)(c) GDPR) or a court/authority order mandates retention, we keep only what is necessary for that obligation (Art. 17(3)(b) GDPR).

6.5 Migrationsverket-related material

When we act as your ombud (via fullmakt / Power of Attorney) before Migrationsverket, the authority becomes controller for its own copy of the submitted material. We normally retain our copy for 12 months after decision to evidence transmission and outcome, unless (i) the controller's audit/retention policy requires a longer period, (ii) a legal obligation applies, or (iii) we must retain a minimal subset to defend legal claims.

6.6 The "defence packet" (what we actually keep up to 10 years)

A narrowly scoped bundle that is usually sufficient to defend claims, e.g.:

  • Engagement letter / DPA and key email correspondence
  • Timestamped submission proof and audit logs (what was sent, when, by whom)
  • The final decision/outcome
  • Redacted versions of sensitive attachments (only if strictly necessary)

6.7 Access & disclosure

We disclose personal data only where a lawful basis applies (e.g. legal obligation, contract performance, legitimate interest not overridden by your rights, or explicit consent). All personnel with access to personal data are bound by confidentiality undertakings and receive annual privacy and security training.

6.8 Deletion, anonymisation & legal holds

When the retention period expires, we delete or irreversibly anonymise the data. If you exercise your right to erasure (Art. 17 GDPR) and no exception applies, we delete without undue delay and within 30 days. If an exception does apply (e.g. legal obligation or legal claims), we place the data under a restricted legal hold, limit access on a strict need-to-know basis, and notify you of the legal basis and expected duration.

We review our retention schedules and security controls at least annually to ensure continued compliance with data-minimisation and storage-limitation (Art. 5(1)(c) and (e) GDPR).

7. Our GDPR Roles

Depending on context, Permly acts as either a data controller or data processor:

SituationPermly's RoleLegal basis / GDPR scope
Account creation & platform use (employers, applicants/employees, and authorised representatives / third‑party advisors)ControllerArt. 6(1)(b) contract, Art. 6(1)(f) legitimate interest (security/fraud prevention), Art. 6(1)(c) legal obligation (book‑keeping)
Work‑permit case handling for an employer and the applicant/employee (we follow Migrationsverket's statutory requirements; the employer decides purposes/retention)ProcessorArt. 28 GDPR (DPA). Employer (Controller) selects the Art. 6 basis (typically 6(1)(b)/(c)/(f)); special‑category data only where a GDPR Art. 9 ground applies
Authority submissions (e.g., Migrationsverket), secure transmission & short proof retentionProcessorArt. 6(1)(c) (controller's legal obligation) + Art. 28 GDPR; limited 12‑month retention under Art. 6(1)(f) for proof of transmission (if instructed/allowed)
Proof of transmission & minimal legal‑defence packet (strictly minimised, time‑limited)ControllerArt. 6(1)(f) legitimate interest + Art. 17(3)(e) (establish, exercise or defend legal claims)
Aggregated benchmarking & statistics across many employers after IRREVERSIBLE ANONYMISATIONOut of GDPR scopeRecital 26 GDPR — anonymised data is not personal data. DPA authorises anonymisation; no Art. 6 basis required for the anonymised output.
Marketing emails, cookies, voluntary surveysControllerArt. 6(1)(a) consent, Art. 6(1)(f) legitimate interest for essential security/diagnostic analytics (Recital 49)

We generate cross-customer benchmarks and statistics only after we have irreversibly anonymised the underlying controller data. Properly anonymised information is no longer personal data and therefore falls outside the scope of the GDPR (Recital 26).

'The principles of data protection should not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable.' — GDPR, Recital 26

6.3 How we anonymise (short SOP)

  • Generalise / bucket quasi-identifiers (e.g. salary, SSYK → 2-digit, employer size → <50 / 50-249 / 250+, dates → month/quarter).
  • k-Anonymity: we only publish cohorts with k ≥ 10 and suppress small cells.
  • Map free text to a controlled taxonomy to avoid re-identification.
  • Delete linkage keys.

Until anonymisation is complete, any raw/pseudonymised data remains fully subject to the GDPR and is processed strictly under the Controller's instructions (Art. 28 GDPR). For details on our processing purposes, lawful bases and roles, see Our GDPR Roles and Key Processing Activities.

7. Our GDPR Roles

The GDPR distinguishes between Data Controllers (who determine the purposes and means of processing) and Data Processors (who process personal data on behalf of a Controller). Permly AB may act in either capacity depending on the specific activity:

When we are a Controller

  • Account creation and platform access
  • Customer support and communication
  • Marketing and product updates (with consent)
  • Security monitoring and fraud prevention
  • Aggregated benchmarking (after irreversible anonymisation)
  • Legal compliance and record-keeping

When we are a Processor

  • Work permit case handling for employers
  • Document preparation and submission to authorities
  • Data entered by employers into our platform
  • Applicant/employee data processed on behalf of employers
  • Communication with immigration authorities

Important for data subjects:

When we act as a Processor, your employer (the Controller) determines how your data is used. For data subject rights in these cases, you should contact your employer first, though we will assist in fulfilling your requests. When we act as a Controller, you can exercise your rights directly with us at admin@permly.ai.

8. Sub-processors & Data Transfers

We engage a limited number of trusted sub-processors to deliver our Services. All personal data is processed and stored exclusively within the European Economic Area (EEA). We will provide at least 30 days' prior notice before adding or replacing a sub-processor (GDPR Art. 28(2)).

Supabase

Role: Processor

Purpose: PostgreSQL database hosting & object storage

Data location: Sweden (EU/EEA only)

Categories:
  • Account data (names, emails, hashed passwords/MFA secrets)
  • Case-file metadata & documents (encrypted at rest)

Notes: Primary datastore. Configured to store all customer content in EU regions only under our DPA.

Google Cloud (EMEA)

Role: Processor

Purpose: Secure hosting, compute & background processing

Data location: Finland & Germany (EU/EEA only)

Categories:
  • Application workloads
  • Anonymised AI analytics

Notes: Workloads are pinned to EU regions. No customer content is transferred outside the EEA.

Scrive

Role: Qualified Trust Service Provider

Purpose: Qualified/advanced electronic signatures (QES/AES), PoA flows

Data location: (EU/EEA only)

Categories:
  • Signature envelopes (PDF/A-3)
  • Audit trails & RFC 3161 timestamps
  • Signer identifiers (e.g., BankID attributes)

Notes: Used for legally valid e-signing of POAs and application forms. Acts as a processor under our DPA.

Vercel

Role: Processor

Purpose: Frontend hosting, CI/CD, static asset delivery

Data location: EU

Categories:
  • Static frontend build assets

Notes: Personal and case data are not stored in Vercel systems; dynamic and database traffic is processed on EU infrastructure.

9. Security Measures

We use industry-standard encryption (in transit & at rest), strict access controls, staff NDAs, and continuous monitoring. If a data breach affects you, we will notify you and/or the relevant controller without undue delay (within 72 hours where feasible).

10. Your GDPR rights

GDPR rightWhen Permly is ControllerWhen Permly is Processor
Information & accessRequest directly from us (admin@permly.ai).Contact your employer, or reach out to us (we assist them or you as required by our DPA).
Rectification, erasure, restriction, portabilitySubmit a request to us.Submit your request to your employer or reach out to us; we support the fulfilment of your request.
Objection & withdrawal of consentYou may object to our processing (e.g., marketing) or withdraw consent at any time.Direct your objection or consent withdrawal to your employer or reach out to us.

We generally respond to rights requests in less than one month (Art. 12(3) GDPR). For full details on our roles, see Our GDPR Roles.

11. Cookies

We use strictly necessary cookies for the proper functioning of our Platform and analytics cookies (only with your consent) to help us understand usage and improve our services. We do not use advertising or tracking cookies for marketing purposes. You can manage or withdraw your consent at any time via our cookie banner or in your browser settings.

11.1 What are cookies?

Cookies are small text files placed on your device that enable core website functions or help collect information about how our Platform is used. This may include basic technical data (e.g., device type, browser version) or aggregated usage information. Cookies do not give us direct access to your personal files or identify you without additional information.

11.2 How we use cookies

  • To maintain secure logins and session integrity.
  • To remember language and regional preferences.
  • To understand how users navigate our Platform and identify areas for improvement.
  • To generate anonymised, aggregated usage statistics.

11.3 Types of cookies we use

  • Strictly necessary cookies: Required for basic Platform functionality such as authentication, security, and user preferences. These cannot be disabled.
  • Analytics cookies (consent-based): Used to collect anonymised information on how visitors interact with our Platform, helping us improve usability and performance. These are only enabled if you consent via our cookie banner.

11.4 Managing cookies

You can refuse or remove cookies at any time via your browser settings or our cookie banner. Please note that disabling strictly necessary cookies may affect the functionality of the Platform. For detailed instructions, refer to your browser's help section.

Strictly Necessary

Always Active

Required for core functionality such as secure log‑ins and user preferences.

Analytics

Consent‑Based

Privacy‑enhanced analytics to understand usage and improve performance.

Marketing

Not Used

We do not use marketing or third‑party tracking cookies.

12. Marketing

Permly AB may send you information about our products and services that we believe may be relevant to you, as well as updates on our Platform. We only send such communications with your prior consent or where permitted by law (e.g., for existing customers). You may opt out at any time by following the unsubscribe instructions in our emails or by contacting us directly.

We do not sell your personal data to third parties for marketing purposes, and we do not use tracking or advertising cookies.

14. Privacy policies of other websites

Our Platform may contain links to external websites or third-party services. This Privacy Policy applies only to Permly AB's website and Platform. If you click on a third-party link, you should review their privacy policy to understand how they process your data.

15. Changes to this Privacy Policy

We keep our Privacy Policy under regular review and will post updates on this page. For material changes, we will provide at least 30 days' advance notice via email or in-Platform notifications.

16. Contact

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data rights, please contact us at admin@permly.ai.

17. Key Processing Activities

Permly AB may act as either a Data Controller or a Data Processor depending on the context of the processing activity. These roles determine our responsibilities under the General Data Protection Regulation (GDPR). The table below outlines our key processing activities, the roles we assume, and the types of personal data involved.

Account creation and login

Role: Controller

Data Subjects: Users of the platform (employers, HR staff, candidates, authorised representatives)

Data Categories:
  • Basic identifiers such as name, email, phone and company information
  • Authentication data like hashed passwords, multi-factor authentication (MFA) secrets and refresh tokens
  • Security-related data including session IDs, truncated IP addresses, browser user-agent strings and login timestamps
  • User preferences and profile settings
Legal Basis:
  • Art. 6(1)(b) — Contract: Required to create and manage user accounts ('necessary for the performance of a contract').
  • Art. 6(1)(f) — Legitimate interest: Collecting technical and security data strictly to protect the service from misuse and ensure network and information security (Rec. 49).
  • Art. 32 — Security of processing: Obligation to implement state-of-the-art technical and organisational measures to safeguard accounts.
Actions:
  • We provide a short, clear and easily accessible privacy notice at sign-up (Art.13) so users know exactly what data is collected and why.
  • We apply data minimisation (Art. 5(1)(c)): only the information essential for creating and maintaining an account is required.
  • Passwords are hashed and never stored in plain text.
  • To limit risk, inactive accounts are automatically deleted after 12 months. Before deletion, users are given a 30-day window to reactivate if needed.

Identity and background verification (Permly Verification)

Role: Processor (the employer or applicant is the Data Controller)

Data Subjects: Applicants, Family members (if included in the application)

Data Categories:
  • Mandatory identification documents required by Migrationsverket, such as passport scans (including the machine-readable zone, MRZ) and, where applicable, national ID cards or travel documents.
  • Mandatory biometric data, such as a facial image (passport-style photo) for identity verification, and other biometric information.
  • Mandatory qualifications, including education certificates, diplomas, CV/resumé, and any other supporting evidence of professional experience needed for the permit type.
  • Mandatory contact details.
  • Mandatory personal and family information, such as marital status, family composition, and other civil status details.
  • Optional supporting documents voluntarily provided by the applicant (e.g., additional references, proof of experience, or other records for their own case-handling or documentation purposes).
Legal Basis:
  • Art. 6(1)(b) — Contract: Processing is necessary to perform pre-contractual and contractual steps for employment or relocation.
  • Art. 6(1)(c) — Legal obligation: Required for compliance with the Swedish Aliens Ordinance (Utlänningsförordningen, Ch. 4) and related migration regulations.
  • Art. 9(2)(b) or (f) — Special-category data: Processing sensitive data (e.g., biometric data) strictly where required by law or necessary for establishing, exercising or defending legal claims.
  • Art. 28 — Processor obligations: Processing is performed strictly under a Data Processing Agreement with the Controller, in accordance with GDPR Art. 28.
Actions:
  • Processing limited to the minimum data explicitly required by Swedish migration law; any additional data stored is voluntary and user-controlled.
  • A signed Data Processing Agreement (DPA) with all required Art. 28(3) clauses, defining scope, purpose and security obligations.
  • Encryption in line with industry best practice.
  • Transparent sub-processor management: maintaining and publishing an updated list of all sub-processors with at least 30-day advance notice before changes (Art. 28(2)).

Power-of-Attorney and document e-signing

Role: Processor

Data Subjects: Applicants, Employers

Data Categories:
  • Signed Power of Attorney (POA) in PDF/A-3 with embedded Qualified Electronic Signature (QES)
  • Application forms and supporting documents in PDF/A format
Legal Basis:
  • Art. 6(1)(c) — Legal obligation: Required for compliant submission under Förvaltningslagen §14.
  • Art. 28 — Sub-processor engagement: Use of an EU/EES-based Qualified Trust Service Provider (QTSP) for advanced/qualified electronic signatures, with prior notice to the Controller.
Actions:
  • Execution of Qualified Electronic Signatures (QES) via an EU-listed QTSP with BankID or equivalent strong identity proofing.
  • Immutable, hash-chained audit trail with RFC 3161-compliant time-stamps for full traceability.
  • Dual confirmation: both employer and applicant must review and approve documents before submission.

Employer compliance & job offer assembly (Migrationsverket Form 232011)

Role: Processor

Data Subjects: Employers, Applicants

Data Categories:
  • Job details: including but not limited to title, core duties (aligned with SCB/SSYK taxonomy), SSYK 4-digit code, employment type (permanent/fixed-term), scope of work (full-time/part-time), and contract duration.
  • Employment terms: full employment agreement text including annexes, probation clauses, collective bargaining references (if applicable), union contact details, and termination conditions.
  • Compensation: base salary, variable remuneration (bonuses/commissions), benefits (e.g., meal, housing, travel allowances), annual salary review process, and working time details as required under MIGRFS 2023:1.
  • Insurance coverage: proof of mandatory insurances including occupational injury (TFA), health, life, and occupational pension (tjänstepensionsförsäkring), including policy numbers and providers, consistent with Migrationsverket's requirements for work permit eligibility.
  • Workplace information: employer organisation details (Bolagsverket registration number), physical work location, organisational unit, and designated company contact person.
  • Leave entitlements, if applicable: annual leave days (per Semesterlagen), parental or family leave entitlements, and any additional paid/unpaid leave policies.
Legal Basis:
  • Art. 6(1)(b) GDPR — Contract: Processing is necessary for the preparation of an enforceable employment agreement between employer and applicant, a prerequisite for work permit eligibility under Swedish law.
  • Art. 6(1)(c) GDPR — Legal obligation: Required for compliance with Chapter 4 of the Swedish Aliens Ordinance (Utlänningsförordningen) and the Swedish Migration Agency's regulation MIGRFS 2023:1 on salary, insurance, and employment conditions.
  • Art. 5(1)(c) GDPR — Data minimisation: Only the information explicitly required by Migrationsverket's Form 232011 and associated legal frameworks is collected; optional information is clearly marked as voluntary.
  • Art. 28 GDPR — Processor obligations: Processing performed strictly under a Data Processing Agreement (DPA) with the employer (Controller), with all mandatory Article 28(3) provisions (purpose, instructions, confidentiality, sub-processing, and technical measures).
  • Art. 5(2) GDPR — Accountability: Change-tracking and review workflows allow the Controller to demonstrate compliance in case of audits or Migration Agency inquiries.
Actions:
  • Structured, schema-driven digital interface that replicates Migrationsverket's official Form 232011 layout, enforcing mandatory fields and data formats to prevent omissions or errors.
  • Automated SSYK classification engine. Employers can override suggestions to preserve Controller discretion (aligning with GDPR Art. 24).
  • Real-time compliance validation: salary, benefits, and insurance coverage cross-checked against MIGRFS 2023:1 thresholds and Statistics Sweden (SCB) benchmark data, with API-based timestamped lookups to evidence the regulatory alignment at the time of assembly.
  • Visual traffic-light system (green/yellow/red) flags incomplete or non-compliant data, reducing the likelihood of rejection by Migrationsverket.
  • Immutable audit log: cryptographically linked records capture every modification (who/what/when), satisfying GDPR Art. 5(2) and providing evidentiary value in disputes or inspections.
  • Dual-review process: the employer must explicitly confirm the job offer's accuracy, and the applicant is presented with a read-only version for review and consent prior to submission.
  • Exported job offers stored as PDF/A-3 with embedded SHA-256 hash and RFC 3161-compliant trusted timestamps, ensuring document integrity and non-repudiation.
  • Role-based access controls (RBAC) and least-privilege principles ensure that only authorised employer representatives and designated Permly processors can access or edit the job offer, in line with GDPR Art. 32.
  • Retention governed by Bokföringslagen (1999:1078) and migration law: job offer data retained only for as long as legally necessary for case handling or regulatory compliance, then securely deleted or anonymised.

Secure communication with authorities

Role: Processor (for transmission) / Independent Controller (for limited legal-defense retention)

Data Subjects: Applicants, Employers, Family members

Data Categories:
  • Case identifiers (diarienummer, case IDs)
  • Application forms and supporting documents (PDF/A)
  • Audit metadata (submission timestamps, sender identity, authority receipt confirmations)
Legal Basis:
  • Art. 6(1)(c) GDPR — Legal obligation: Required for compliant submission of applications to Migrationsverket and other competent authorities.
  • Art. 6(1)(f) GDPR — Legitimate interest: Retention of minimal proof of transmission (hash, timestamp, receipt) for up to 12 months to defend against service disputes or authority inquiries.
  • Art. 13(3) GDPR — Transparency: Informing data subjects when the competent authority assumes Controller responsibility upon receipt of the transmitted data.
  • Art. 28 GDPR — Processor obligations: Processing performed under Controller instructions pursuant to a Data Processing Agreement (DPA).
Actions:
  • Data is transmitted using PEPPOL/SFTI channels or direct authority APIs with mutual TLS and RFC 5280-compliant certificate validation.
  • Two-tier retention model: (a) operational copies retained in encrypted form for up to 12 months solely to handle appeals, authority queries, or dispute resolution, then securely deleted or anonymised (GDPR Art. 5(1)(e)); (b) where instructed by the employer (Controller), archival copies of employment-related documents qualifying as accounting records (e.g., job offers) retained in a restricted-access encrypted archive for up to 7 years in compliance with Bokföringslagen (1999:1078, Ch. 7 § 2).
  • All transmissions logged in a hash-linked, immutable audit trail with RFC 3161-compliant timestamps, enabling full traceability for Controllers and authorities (GDPR Art. 5(2)).
  • Users notified when their data is handed over to an authority, with clear information on the authority's role as new Controller (GDPR Art. 13(3)).
  • Role-based access (RBAC) and least-privilege principles applied to all transmitted data; archives stored with AES-256-GCM encryption in EU/EES data centres.

Platform analytics, cookies, marketing communications, and voluntary feedback

Role: Controller

Data Subjects: Platform users, Website visitors, Prospects, Subscribers, Respondents

Data Categories:
  • Truncated IP addresses, device IDs, clickstream, and pseudonymised analytics data
  • Error logs for diagnostics and security
  • Email addresses and names for marketing and survey participants
  • Engagement data (e.g., opens, clicks) for newsletters
  • Voluntary survey responses and optional contact details
  • Consent status, version history, and opt-in/opt-out signals (DNT, GPC)
Legal Basis:
  • Art. 6(1)(f) GDPR — Legitimate interest for essential analytics and diagnostics (Recital 49)
  • Art. 6(1)(a) GDPR — Consent for marketing communications, cookies, and voluntary surveys
  • ePrivacy Directive 2002/58 & Swedish Marketing Act 2008:486 — Consent for tracking and marketing
Actions:
  • Documented Legitimate Interest Assessment (LIA) for analytics (Rec. 49).
  • Use of a Consent Management Platform (CMP) with granular, IAB TCF v2.2-compliant preferences; consent text, timestamps, and proof retained for 5 years.
  • Truncation and pseudonymisation of analytics data; differential privacy applied for aggregated insights.
  • One-click unsubscribe for all marketing communications; suppression lists maintained to honour opt-outs.
  • Respect for browser signals (Do Not Track, Global Privacy Control).
  • Retention: analytics logs deleted after 12 months; survey data anonymised or deleted after 24 months; consent records retained for 5 years.

Aggregated benchmarking, statistics, and AI-assisted analytics

Role: Out of GDPR scope after anonymisation

Data Subjects: Controller-provided employer and applicant case data (processed under DPA until anonymisation), Aggregated, irreversibly anonymised datasets across multiple employers (no personal data)

Data Categories:
  • Case metadata (e.g., intake and decision dates, SSYK codes at 2-digit level, employer size buckets, and processing durations), stripped of all direct identifiers.
  • Aggregated statistical measures (e.g., average processing times, workload bottlenecks, approval rates) across multiple customers, k-anonymised and suppression-adjusted.
  • No linkage keys, free-text data, or uniquely identifying combinations are retained in anonymised outputs.
Legal Basis:
  • Art. 28 GDPR — Processor obligations: All raw and pseudonymised controller data is processed strictly under the employer's instructions in accordance with our Data Processing Agreement (DPA).
  • Recital 26 GDPR — Anonymous data: Once datasets are irreversibly anonymised using generalisation, suppression, and k-anonymity, they are no longer considered personal data: 'The principles of data protection should not apply to anonymous information, namely … data rendered anonymous in such a manner that the data subject is not or no longer identifiable.'
  • Art. 6(1)(f) GDPR — Legitimate interest: processing minimal, non-sensitive, pseudonymised metadata for the sole purpose of service improvement (e.g., identifying process inefficiencies), supported by a documented balancing test (Recitals 47 & 49).
  • Art. 35 GDPR — Data Protection Impact Assessment (DPIA): DPIAs are conducted for analytics workflows involving AI, covering re-identification risk, proportionality, and bias mitigation.
  • EU AI Act — Limited-risk classification: Internal AI-assisted analytics is categorised as 'limited-risk' under Title III, Chapter 1, as no automated decisions with legal or significant effects are made (Recital 60).
Actions:
  • Anonymisation process: Apply a documented anonymisation SOP including quasi-identifier generalisation (e.g., SSYK reduced to 2-digit groups, employer size bucketed as <50 / 50-249 / 250+), date shifting to month/quarter granularity, k-anonymity (k ≥ 10), and suppression of small cohorts. Free-text fields are mapped to controlled taxonomies or excluded entirely. Linkage keys are deleted post-processing. (See WP29 Opinion 05/2014.)
  • Strict segregation: Until anonymisation is complete, all working datasets segregated with role-based access control (RBAC), encryption at rest, and encrypted linkage keys accessible only to authorised personnel.
  • Bias & fairness testing: All internal machine-learning components used for process analytics undergo bias and performance testing at deployment and quarterly thereafter, following EU AI Act Art. 10 and ISO/IEC 24027:2021 guidelines.
  • Model documentation: Maintain model cards, version control, and change logs for all AI components, aligning with transparency principles in the EU AI Act and ENISA best practices.
  • User rights: Pre-anonymisation, data subjects retain their GDPR rights (Art. 15-21), including the right to object (Art. 21) to inclusion in benchmarking datasets. Post-anonymisation, outputs are fully anonymous and fall outside GDPR's scope.

Rights handling & breach notification

Role: Controller

Data Subjects: Any data subject, Potentially affected individuals in case of a breach

Data Categories:
  • Personal data necessary to verify and respond to rights requests (access, rectification, erasure, portability)
  • Incident data: categories of affected data, risk assessment, and summary for notification purposes
Legal Basis:
  • Art. 6(1)(c) — Legal obligation (GDPR Articles 12-23, 32-34)
Actions:
  • Rights requests handled via secure portal with ID verification
  • Responses issued within 30 days (extendable +60 days)
  • Machine-readable export (JSON/CSV) for portability
  • Incident detection, risk assessment, and root-cause analysis
  • Notify IMY within 72 hours for reportable breaches (Art. 33) and inform individuals when risk is high (Art. 34)
  • Audit logs maintained for all rights requests and incidents
Privacy Policy - Permly