Privacy policy
Controller
Lodline AB, Stockholm, Sweden. VAT SE556000000001. Contact: info@lodlinefirm.com.
Where we act on a client's instruction in a matter, we are a processor and the client is the controller. Where we decide ourselves what to collect — enquiries, analytics, our own compliance obligations — we are the controller. Both roles occur, and they are kept separate in our records.
What we collect and on what basis
| Data | Purpose | Legal basis |
|---|---|---|
| Name, company, email, text of the enquiry | Answering you within two working hours | Art. 6(1)(b) — steps prior to a contract |
| Matter data during an engagement | Performing the engagement | Art. 6(1)(b) |
| Identity and beneficial ownership data | Customer due diligence | Art. 6(1)(c) — obligation under lagen (2017:630) |
| Data on counterparties and objects, from public registers, for factual reports | Producing the ordered report | Art. 6(1)(f) — legitimate interest. See the assessment below |
| Truncated IP, page views | Understanding what is read | Art. 6(1)(a) — consent |
| Contact data for the weekly digest | Sending it | Art. 6(1)(a) — consent |
Legitimate interest in factual reports
Our reports are compiled from public registers and open sources. That involves personal data about people who are not our clients — typically directors and beneficial owners of companies being checked.
The interest is our client's: to know who they are contracting with, lending to or suing. That interest is recognised in law, and much of it duplicates obligations the client has anyway under anti-money-laundering rules.
The limits we accept. We collect only what relates to a person's commercial role — not private life. We do not compile profiles beyond a specific commissioned object. We do not assess creditworthiness or ability to pay; that is regulated activity in Sweden under kreditupplysningslagen (1973:1173) and we do not carry it on. We state in each report what could not be established rather than filling the gap by inference.
The full assessment is kept in writing and available to a supervisory authority on request.
Who receives data
The subprocessor list is published separately. Delivery partners in other jurisdictions are named to the client at proposal stage, before any engagement is signed.
Transfers outside the EEA
None as standard. Where a matter requires one, it is agreed with the client and documented in the engagement letter.
Retention
Enquiries that do not become engagements — 12 months. Matter files — as required by law and professional practice, then deleted. Customer due diligence records — as required by lagen (2017:630). Analytics — 14 months. Digest subscriptions — until withdrawal.
Your rights
Access, rectification, erasure, restriction, objection, portability, withdrawal of consent. Write to info@lodlinefirm.com; we answer within one month.
Where we act as processor for a client, we forward your request to the controller and tell you that we have done so.
Complaints: Integritetsskyddsmyndigheten (IMY).
A note on the register of beneficial owners
Access to the Swedish register of beneficial owners is restricted and requires a certificate of legitimate interest. We do not treat purchase of a report as automatic grounds for access, and where we cannot lawfully obtain a layer of data we say so in the report rather than substituting a guess.