Your privacy, by design

About this policy

This privacy policy explains how Information Technology Consulting i Mark AB (“ITCM”, “we”, “us”) processes personal data and how we comply with the EU General Data Protection Regulation (GDPR) and Swedish data protection law. It applies when you visit itcm.se, contact us, apply for a job, or use an app or service that links here.

Many of the apps and systems we build are operated on behalf of our clients. For those services your data is controlled by the client and ITCM acts only as a data processor (see “When we process data for our clients” below). If you reached this page from such an app, please also read that service’s own privacy notice.

Who we are

For the processing we carry out for our own purposes, ITCM is the data controller:

The personal data we process

Depending on how you interact with us, we may process:

• Contact details — name, email address, phone number, company and role, when you contact us or work with us.
• Communication — the content of emails, messages and support requests you send us.
• Website usage — IP address, device and browser information, and pages visited, collected through cookies and analytics where you have consented.
• Recruitment — the CV, application and any information you provide when applying for a role.
• Business records — information needed to manage our client and supplier relationships, invoicing and bookkeeping.

We do not intentionally collect special categories of data (such as health or political opinions), and we never sell personal data to anyone.

Why we process it and our legal basis

• To deliver our services and contracts — legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• To respond to enquiries and maintain relationships — legal basis: our legitimate interest in running and growing our business (Art. 6(1)(f)).
• Analytics and marketing cookies — legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.
• Recruitment — legal basis: steps taken at your request before entering a contract, and our legitimate interest in assessing candidates.
• Accounting and legal obligations — legal basis: compliance with a legal obligation (Art. 6(1)(c)), such as Swedish bookkeeping law.

When we process data for our clients

When we build, host or operate an application or system for a client, that client decides why and how personal data is processed — they are the controller and ITCM is a data processor acting on their documented instructions.

In those cases we process personal data only under a written data processing agreement (DPA) that requires appropriate security measures, confidentiality, control over sub-processors, and support for the controller in meeting its GDPR obligations. If you use such a service and want to exercise your rights, contact the organisation that provides it; we will support them in responding.

Sharing and sub-processors

We share personal data only where necessary, with:

• Trusted service providers who process data on our behalf — such as hosting, infrastructure, email and analytics providers — each bound by a data processing agreement.
• Authorities or professional advisors where we are required to do so by law.

We choose sub-processors that provide adequate guarantees under the GDPR, and we host data within the EU/EEA wherever possible.

International transfers

Where a provider processes data outside the EU/EEA, we make sure the transfer is protected by an adequacy decision or by appropriate safeguards such as the European Commission’s Standard Contractual Clauses, together with additional technical measures where needed.

How long we keep your data

We keep personal data only for as long as it is needed for the purpose it was collected, or as required by law. Enquiries and correspondence are kept while the relationship is active and for a reasonable period afterwards; accounting records are kept for seven years under Swedish law; job applications are kept for the duration of the recruitment process unless you agree to us keeping them longer.

How we protect your data

Security is central to how we build systems. We apply encryption in transit, access controls and the principle of least privilege, network segmentation, logging and monitoring, regular updates and security reviews. We design new systems with data protection by design and by default, and we limit the personal data we collect to what is necessary.

Your rights under the GDPR

Where ITCM is the controller, you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected (rectification).
• Have your data erased (the “right to be forgotten”) where applicable.
• Restrict or object to certain processing.
• Receive your data in a portable format (data portability).
• Withdraw consent at any time, without affecting processing already carried out.

To exercise any of these rights, email us at info@itcm.se. We will respond within one month.

Cookies

We use necessary cookies to make the site work, and analytics and marketing cookies only with your consent. You can review and change your choices at any time through the cookie settings on this website.

Questions and complaints

If you have any questions about how we handle your personal data, contact us at info@itcm.se — we are happy to help.

You also have the right to lodge a complaint with the Swedish supervisory authority, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), at imy.se.

Changes to this policy

We may update this policy from time to time. When we make significant changes we will update the date at the top of the page and, where appropriate, notify you.