Hoppa till huvudinnehållet

Privacy Statement

Last updated: 2025-11-06

About us and this privacy notice

Deloitte AB (“Deloitte”, or “we”, “our”, “us”) is a member firm in Deloitte Touche Tohmatsu Limited's global network. We are strongly committed to protect your personal data used in our work and to be in compliant with the applicable legislation. This privacy statement covers our processing activities regarding personal data of individuals outside of Deloitte’s organisations. We hope that this privacy statement will help you understand what kind of information we process and how.

For information about which personal data we collect and process about you when you interact with our websites, visit our offices or we provide certain marketing related services to you, please see Privacy Notice for visitors of Deloitte’s offices, websites and use of our marketing related services.

We may collect and process the below types of personal data for the purposes of:

  • providing services to our clients (which could be you, your employer or someone else that you have a relationship with);
  • client relationship management;
  • compliance with legal or regulatory requirements; 
  • internal policies;
  • ensuring the integrity of our systems and network; 
  • protecting our legal interests in case of a dispute; and
  • handling inspections and queries by supervisory authorities, external auditors and legal advisors.

Basic data: name, address, telephone number, e-mail address, employment, title, education, age, birthday, gender, family circumstances, country of residence, passport information, social security number (Sw. personnummer)

Financial data: salary or other income, loans/debt, tax-related information, investments and assets

Online data: IP-address, social media account and/or company website data, cookie ID and other online ID

Sensitive data: data relating to health and membership of trade union

Sensitive data will only be collected when there is a legal requirement such as statutory audit or payroll services, or when you give us your explicit consent.

Please note that we may collect other types of personal data if it is necessary to provide a specific service to a client.

We usually collect your personal data in the following ways:

  • Data collected directly from you
  • Data collected from a third person (such as your employer or a service provider)
  • Data collected from publicly available source (such as the Swedish Companies Registration Office, Swedish Tax Authorities and the website of the company you work for etc.)
  • Other Deloitte entities

We collect and process your personal data based on the following legal basis:

  • Consent
  • Performance of a contract
  • A legal obligation to which we are subject to
  • The legitimate interest of Deloitte or our client

The legitimate interest of Deloitte includes the following purposes

  • Provide our clients with services;
  • Ensure the integrity of our networks and systems;
  • Compliance with internal policies;
  • Client relationship management and
  • Manage and improve our website.

To be able to tailor our website to provide you with a more personalized experience and to ensure that the communication we send to you are as relevant as possible we do basic profiling where we match your activity on our homepage to your marketing preferences if you accept cookies and sign up to receive communication from us. Please note that you have the right to object to the profiling but this would result in us not being able to personalize our communication to you. To object to the profiling you have to manage your cookie preferences and unsubscribe from our email communication, as it is not possible for us to send these emails without tracking enabled. 

In connection with one or more purposes outlined in section 1, your personal data may be disclosed to and shared with the following recipients: Our client; public authorities; our professional advisors (e.g. auditor and legal advisors); service providers; IT-providers including cloud services; insurance and pension companies (if part of our services to our client) and other Deloitte entities.

We may also need to disclose your personal data to authorities and/or to other third parties if required to do so by law, a regulator or during legal proceedings.

Please note that some of the recipients of your personal data referenced above may be based in countries outside of the European Union whose laws may not provide the same level of data protection and thus not subject to an adequacy decision by the European Commission. In such cases, we will ensure that there are adequate safeguards in place through EU’s standard contractual clauses to protect your personal data that comply with our legal obligations.

We will hold your personal data on our systems for the longest of the following periods:

  • as long as is necessary for the relevant activity or services;
  • any retention period that is required by law (for example in audit, we have a legal obligation to retain data for 10 years after the end of the calendar year in which the audit was concluded); and
  • the end of the period in which litigation or investigations might arise in respect of the services.

We use a range of physical, electronic and managerial measures to ensure that we keep your personal data secure, accurate and up to date. These measures include:

  • education and training to relevant staff to ensure they are aware of our privacy obligations when handling personal data;
  • administrative and technical controls to restrict access to personal data on a ‘need to know’ basis;
  • technological security measures, including fire walls, encryption and anti-virus software; and
  • physical security measures, such as staff security passes to access our premises.

Although we use appropriate security measures once we have received your personal data, the transmission of data over the internet (including by e-mail) is never completely secure. We endeavor to protect personal data, but we cannot guarantee the security of data transmitted to us or by us.

In case of a data breach, we have special measures set to limit the risk of information dissemination. We will follow the guidelines and requirements specified by the regulatory authority for incident reporting.

In relation to the processing of your personal data, you have specific rights cf. Art. 15 to 21 of the GDPR

  • Access: you can ask for confirmation as to whether or not a certain processing of data concerning you is in place. You have the right to receive a copy of the personal data and information about how it is used as well as further clarifications about the information referred to in this Privacy Statement;
  • Rectification: you can ask to rectify or supplement the data you have provided to us, if inaccurate;
  • Erasure: you can request that your data be deleted, if they are no longer necessary for our purposes, in case of withdrawal of consent or your opposition to the processing, in case of unlawful processing, or there is a legal obligation to erase them;
  • Restriction: you can request that your data be processed only for the purpose of storage, with the exclusion of other processing activities, for the period necessary for the correction of your data, in case of unlawful processing for which you oppose the cancellation, if you have to exercise your rights in court and the data stored by us may be useful to you and, finally, in the event of opposition to the processing and a review is in progress on the prevalence of our legitimate reasons over yours;
  • Object: you can object at any time to the processing of your data, unless there are our legitimate reasons to proceed with the processing that prevail over yours, for example for the exercise or our defence in court;
  • Withdrawal: you may revoke your consent at any time, in all cases where consent is the legal basis for processing. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal. It might also imply that we cannot provide you the services you have requested. You may withdraw you consent by contacting Deloitte, see below.
  • Portability: you can ask to receive your data, or to have them transmitted to another Data Controller indicated by you, in a structured format, commonly used and readable by automatic device. 

To exercise your rights, or if you have any questions or want to file a request you can always contact our Nordic privacy team by sending an email to: nordicprivacy@deloitte.com or by using this contact form.

You also have a right to file a complaint with the Swedish data protection authority (Sw. Integritetsskyddsmyndigheten).

Integritetsskyddsmyndigheten
Box 8114
104 20 Stockholm

Telephone: 08-657 61 00 
E-post: imy@imy.se 

If you have any questions regarding our processing of your personal data you are welcome to send an email to nordicprivacy@deloitte.com or by using this contact form.

We keep our privacy notice under regular review and thus the notice may be subject to changes. The date of the last revision of the privacy notice can be found on the top of the page.