Privacy policy for Croisette

Croisette is committed to protecting your individual rights and your personal data. This data protection policy describes how we collect, use, store and share personal data.

Croisette is divided into different companies and this policy applies to all companies operating under the Croisette brand. So depending on which organisation you are dealing with, that organisation is the data controller. However, we at the central level will of course help you with all your questions.

We process personal data for several reasons. When we write ”you” we mean you as a customer, potential customer, bidder, speculator, authorised representative, buyer and seller.

The processing of personal data, such as the name, address, e-mail address or telephone number of a data subject must always comply with the General Data Protection Regulation and in accordance with Swedish legislation. With this privacy policy, we therefore want to explain how we process your personal data and what rights you have as a data subject.

It is important that you read and understand how we process personal data. It is necessary for us to process your personal data when you contact us or when purchasing products and services. If you have any questions about how we process your personal data, you are welcome to contact us.

What is personal data?

Personal data is any information that can be directly or indirectly attributed to a living individual. Personal data that can be directly attributed to an individual may include name, email address and telephone number. Personal data that cannot be directly referred to an individual, but through the use of supplementary information can also be personal data, such as an IP number.

What is processing of personal data?

All personal data collected must be processed in some way. This can be done both by automated means, such as in our IT systems, or in physical records, such as physical binders.

What personal data we collect and for what purpose:

Purpose Legal basis Personal data processed Storage time
Personal data processed in the context of direct marketing by telephone, post, email, SMS.
Legitimate interest
Name, address, email, phone number, housing preferences.
2 years
To advertise that an item has been sold.
Consent
Name, address, picture.
2 years
Data collected in the context of recruitment for vacant posts.
Legitimate interest
Name, address, telephone number, e-mail.
2 years
Fulfilling legal obligations such as bookkeeping.
Legal obligation
Name, address, social security number, account number, telephone number, e-mail.
7 years
Personal data collected in order to send invoices and verify payment.
Contracts
Name, address, telephone number, e-mail.
7 years
Personal data processed at events and other gatherings.
Legitimate interest
Name, email, phone number, any allergies.
3 months, possible allergies at the end of the event.

As customers, buyers, speculators, sellers and potential sellers:

Purpose Legal basis Personal data processed Storage time
Data processed in the administration and contracting of housing services, such as succession, new construction and tenancy.
Contracts
Name, social security number, address, telephone number, e-mail, loan commitment, choice of bank, purchase contract and attachments with information about the property, apartment number, bank details, property designation.
10 years
Booking of other services for sale and occupation (home styling, photography, cleaning, energy declaration, legal advice, inspection and measurement).
Contracts
Name, address, telephone number, e-mail.
3 months
Archive the file to fulfil obligations under the FMI.
Legal obligation
All information necessary for FMI's supervision. In addition to personal and contact information, also all information and communication in the transaction, such as name, address, email, telephone number, social security number, loan information, apartment number, property designation.
10 years
Data that we are required by law to process to prevent money laundering and terrorist financing.
Legitimate interest
Name, address, e-mail, telephone number.
2 years
Administration of the written valuation of a property.
Contracts
Name, address, e-mail, telephone number, property code, apartment code, personal number, port code.
10 years

Where the processing of your personal data takes place

We always endeavour to process all your personal data within the EU/EEA. Where this is not possible, we always ensure that your personal data is protected in accordance with the General Data Protection Regulation.

In a few processing operations, your data may be shared with organisations in the US, such as social media and marketing tools, and in these cases your personal data is protected by Standard Contractual Clauses as a safeguard.

Profiling and automated decision-making

When you show interest in a property with us or share your future wishes, you may be matched with similar properties that come on the market. You consent to this matching and can withdraw your consent at any time.

Who we share your personal data with:

We may share your personal data with other organisations, such as Knight Frank, with whom we have partnerships. These are:

Data Processors: these process the data on our behalf and according to our instructions. We have data processors in the following categories:

We may also share your personal data with other data controllers. These are the organisations that are solely responsible for the processing and we cannot impose any requirements on them. These are:

Where we get your personal data from:

When:

We may also collect personal data from our partners and clients who use our services, for example when renting out homes or selling new builds.

We only collect the personal data necessary for the purpose in question.

Your rights:

We are responsible for ensuring that your personal data is processed correctly and under applicable law. In this section we explain your rights in relation to our processing of your personal data. In order for us to be able to fulfil your request for your rights, we need to ensure that it is the right person asking the question, which is why we need to be able to identify you. All for your security.

Right of access

We are transparent about how we process your personal data. You have the right to request an extract from the register about how we process your personal data and what personal data we have about you. You can therefore request access to your personal data.

Right of rectification

We are committed to ensuring that we have accurate personal data about you. If you believe that your personal data is inaccurate, your right is to have it corrected. It may also be that it is incomplete and needs to be completed.

Right to erasure

Your personal data belongs to you and we only borrow it. You have the right to have your personal data deleted if, for example, you believe it is being processed unlawfully or is no longer needed. However, on some occasions we need to continue processing personal data where there are other laws that require it, such as the Accounting Act. When there are other laws that force us to continue processing your personal data, we are not able to delete your data.

Right to restriction

You have the right to request the restriction of the processing of your personal data in certain cases. This means that your personal data can only be processed for certain purposes. This may be the case if the data subject objects to the accuracy of the data or if it is processed unlawfully. The processing of your personal data will therefore be restricted for the duration of the investigation.

Right to object to certain types of processing

In cases where we use a balancing of interests, you have the right to object to the processing of personal data. In cases where we consider that our processing outweighs the interest of the data subject, we will continue the processing of personal data. In cases where you object to direct marketing, we will stop that processing.

Right to data portability

On the occasions when our processing of your personal data is carried out by automated means and on the legal basis of consent or contract, you have the right to receive a copy of your personal data in a structured and machine-readable format and have the possibility to have it transmitted directly to another controller.

Right to lodge a complaint with the Data Protection Authority

If you believe that we are processing your personal data incorrectly, you are welcome to contact us. It is also your right to contact the Swedish Data Protection Authority for any complaints about how we process your personal data. The Swedish Data Protection Authority is the responsible supervisory authority for the processing of personal data in Sweden.

Withdrawal of consent:

In cases where we process your personal data with consent as a legal basis, you have the right to withdraw your consent at any time to end the processing.

How we protect your personal data

You should always feel safe to disclose your personal data to us at Croisette. We work actively with both technical and organisational security measures to protect personal data, and only staff and partners with the right authorisation have access to your personal data.

Cookies:

We use Google Analytics and Hubspot to track the number of visitors to our website. This is only used to monitor the number of hits on our pages and site therefore we cannot track or trace individual users or their physical addresses.

Contact details

If you have questions or comments regarding our data protection policy, you are welcome to contact Croisette.

You can email us at dataskydd@croisette.se or write a letter to Croisette AB Malmö head office, Hyllie Boulevard 8c, 215 32 Malmö, Sweden.