![LöFAB Logo Black (F)[76].png](https://static.wixstatic.com/media/620603_b322ed4abd9d403face491a9be776890~mv2.png/v1/fill/w_250,h_64,al_c,q_85,usm_0.66_1.00_0.01,enc_avif,quality_auto/L%C3%B6FAB%20Logo%20Black%20(F)%5B76%5D.png)
1. Purpose
This General Data Protection Regulation (GDPR) privacy notice explains how Lövstjärnan Fabriks AB (“LöFAB”) collects, uses, and protects personal data, in accordance with the EU GDPR (Regulation (EU) 2016/679) and the Swedish Data Protection Act (Dataskyddslagen, SFS 2018:218). It fulfils LöFAB’s transparency obligations under GDPR Articles 13–14 and its accountability obligations under Article 5(2).
2. Scope
This notice applies to all personal data processed by LöFAB as data controller - in any medium - relating to:
-
Current and former employees
-
Job applicants
-
Business contacts (representatives of customers, suppliers, and partners)
-
Facility visitors
-
Website and digital visitors
-
Whistleblowing reporters and report subjects
It does not apply to personal data processed by third parties acting as independent controllers, including third-party websites linked from LöFAB's website.
3. Data We Collect, Legal Basis, and Retention Period
The information below is LöFAB's consolidated record of the personal data it collects, the legal basis for processing it, and how long it is retained.
Current Employees: HR & Employment; Payroll & Finance
Personal Data Collected
Home address; personal/work email/phone; date of birth; national ID number; employment contract details; time and attendance; performance and appraisal records; training and qualifications; sickness and absence records; emergency contacts; benefits and pension information; security vetting information (where applicable). Special categories: health data (sickness/occupational health); other categories where required by equality legislation. Bank details, salary, payroll history.
Legal Basis for Processing (Art. 6/9)
Art. 6(1)(b). contract performance; Art. 6(1)(c) legal obligation (employment law, health & safety; tax law); Art. 6(1)(f) legitimate interests (performance management); Art. 6(1)(a) consent (optional schemes/surveys); Art. 9(2)(b)/(h) special categories (health/occupational);
Retention Period
Retained during employment period.
Retention Basis
Swedish Employment Protection Act (LAS); general limitation periods; Swedish Accounting Act; Tax Procedures Act
Former Employees: Financial Records
Personal Data Collected
Accounting records
Legal Basis for Processing (Art. 6/9)
Accounting records
Retention Period
7 years from end of financial year
Retention Basis
Swedish Accounting Act; Tax Procedures Act
Former Employees: HR Records
Personal Data Collected
Payroll history, duration of employment.
Home address; personal/work email/phone; date of birth; national ID number; employment contract details; time and attendance; performance and appraisal records; training and qualifications; sickness and absence records; emergency contacts; benefits and pension information; security vetting information (where applicable). Special categories: health data.
Legal Basis for Processing (Art. 6/9)
Art. 6(1)(c) legal obligation; Art. 6(1)(b) contract performance (residual obligations)
Retention Period
10 years from end of employment
Retention Basis
Swedish Employment Protection Act; general limitation periods
Former Employees: HR Records
Personal Data Collected
Name; home address; email; telephone; position applied for; current employment; education and qualifications; work experience; special skills; references; CV/cover letter content; correspondence; test/assessment results; photographs (if in CV). Source: directly from applicant, or (outreach recruitment) public sources such as LinkedIn or Swedish-registered databases (Utgivningsbevis). Security assessment data may be requested for certain roles.
Legal Basis for Processing (Art. 6/9)
Art. 6(1)(f) legitimate interests (managing recruitment, improving processes)
Retention Period
3 years from end of recruitment process
Retention Basis
GDPR Art. 6(1)(f); Swedish limitation periods
Business Contacts
Personal Data Collected
Contact person; telephone; email; fax; job title; work address. Additional data may be processed where the contact's organisation is subject to LöFAB's business partner due diligence process (notified separately). Source: directly from contact, their organisation, or public sources/registers.
Legal Basis for Processing (Art. 6/9)
Art. 6(1)(f) legitimate interests (maintaining and developing business relationships)
Retention Period
3 years from last meaningful contact (7 years if captured in finance records)
Retention Basis
GDPR Art. 6(1)(f); Swedish Accounting Act
Facility Visitors: Security Legislation
*Safety-only records (no security legislation trigger)
Personal Data Collected
Name; national ID number; passport number and citizenship (where no Swedish ID); organisation represented; duration of visit; entry log; email; telephone; job title; vehicle registration (if using visitor parking). Source: directly from visitor or their organisation.
Legal Basis for Processing (Art. 6/9)
Art. 6(1)(c) legal obligation (Swedish national security legislation); Art. 6(1)(b) contract performance; Art. 6(1)(f) legitimate interests (facility safety and security)
Retention Period
10 years from date of visit
* 3 years from date of visit
Retention Basis
Swedish national security legislation; GDPR Art. 6(1)(f)
Facility Visitors: CCTV Footage
Personal Data Collected
Surveillance recordings
Legal Basis for Processing (Art. 6/9)
Art. 6(1)(f) legitimate interests (facility safety and security)
Retention Period
30 days (auto-overwrite unless incident retention required)
Retention Basis
GDPR data minimisation (Art. 5(1)(e))
Website Visitors
Personal Data Collected
Cookies and browsing data (with consent); name, email, telephone, and organisation (via website forms/registrations). Cookies do not identify individuals — see Section 14 (Cookie Policy).
Legal Basis for Processing (Art. 6/9)
Art. 6(1)(a) consent (non-essential cookies; digital subscriptions); Art. 6(1)(f) legitimate interests (providing digital services)
Retention Period
2 years from last interaction
Retention Basis
GDPR Art. 6(1)(f)
Whistleblowing: No Investigation
Personal Data Collected
Reporter identity (if not anonymous): name, contact details, role. Subject identity: name, role, department. Report and assessment records. Anonymous reports are accepted; LöFAB will not seek to identify anonymous reporters unless required by law.
Legal Basis for Processing (Art. 6/9)
Art. 6(1)(c) legal obligation (EU Whistleblower Protection Directive 2019/1937)
Retention Period
Deleted promptly on closure
Retention Basis
EU Whistleblower Protection Directive 2019/1937
Whistleblowing: Investigation Conducted
Personal Data Collected
As above, plus details of alleged wrongdoing (conduct, dates, locations); witness/third-party identities mentioned in report; supporting documentation; investigation records and outcome.
Legal Basis for Processing (Art. 6/9)
Art. 6(1)(c) legal obligation; Art. 6(1)(f) legitimate interests (detecting and remedying wrongdoing); Art. 9(2)(f)/(g) special categories in reports
Retention Period
Duration of investigation and proceedings; max. 5 years
Retention Basis
EU Whistleblower Protection Directive; GDPR Art. 9(2)(f)/(g)
Data Subject Requests
Personal Data Collected
DSAR records, identity verification, responses
Legal Basis for Processing (Art. 6/9)
Art. 6(1)(c) legal obligation (responding to requests)
Retention Period
3 years from fulfilment of request
Retention Basis
GDPR Arts. 12, 5(2) (accountability)
Cookies (non-essential): Consent Records
Personal Data Collected
Consent logs
Legal Basis for Processing (Art. 6/9)
Art. 6(1)(a) consent
Retention Period
Duration of consent + 3 years
Retention Basis
GDPR Art. 7(1)
Note: LöFAB maintains a separate internal Record of Processing Activities (RoPA) in accordance with GDPR Article 30. The RoPA is maintained by the Privacy Officer and is available to IMY on request. In exceptional circumstances (e.g. ongoing legal proceedings), data may be retained beyond the periods above. This schedule is reviewed annually.
4. Automated Decision-Making
LöFAB does not use automated decision-making, including profiling, that produces legal or similarly significant effects concerning data subjects within the meaning of Article 22 of the GDPR. Should we introduce any such processing in the future, we will update this Notice accordingly and, where required by applicable law, seek your consent or provide you with the opportunity to request human review of any automated decision.
5. Sharing of Your Personal Data
We may share your personal data with third parties only where necessary and only to the extent required for the purposes described in this Notice. The categories of recipients with whom your personal data may be shared include:
-
IT and infrastructure service providers, including cloud hosting, data storage, and enterprise software providers that support our internal systems and operations.
-
Human resources and payroll processors, including providers of payroll administration, benefits management, and workforce management platforms.
-
Professional advisers, including legal counsel, auditors, accountants, and insurance providers, where necessary in connection with the conduct of our business.
-
Export control and regulatory compliance platforms, including software and service providers used to screen transactions, counterparties, and personnel against applicable control lists and licensing requirements.
-
Group companies, including LeafStar Services, Inc. (LSS), where necessary for group governance, compliance oversight, or shared business functions.
-
Government and regulatory authorities, including IMY, tax authorities, and export licensing authorities, where disclosure is required or permitted by law.
LöFAB does not sell personal data. Any processor acting on LöFAB's behalf is engaged only under a written Data Processing Agreement meeting GDPR Article 28 requirements (see Section 10).
6. International Transfers of Personal Data
Some of the recipients listed in Section 5 are located, or process personal data, outside the European Economic Area ("EEA") — including LSS in the United States. Where LöFAB transfers personal data to recipients in countries that have not been the subject of an adequacy decision by the European Commission, appropriate safeguards are put in place in accordance with Chapter V of the GDPR. The transfer mechanisms relied upon include:
-
Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46(2)(c) of the GDPR, incorporated into agreements with the relevant recipients. Where required, SCCs are supplemented with a transfer impact assessment evaluating the legal framework of the destination country and any necessary supplementary measures.
-
Adequacy decisions of the European Commission, where the destination country or territory has been recognised as providing an adequate level of protection. Transfers to recipients in such countries may be made without additional safeguards.
Transfers to recipients outside of the EU, such as the United States, are made either on the basis of the EU–US Data Privacy Framework (where the recipient is a certified participant) or, where that framework does not apply, on the basis of Standard Contractual Clauses supplemented as necessary.
For transfers related to export control, defence procurement, or regulatory compliance obligations, certain disclosures to public authorities in third countries may be required or permitted under applicable law. Such transfers are made on the basis of Article 49(1)(d) of the GDPR (important reasons of public interest) or another applicable legal basis, and only to the extent required.
You may request further information about the safeguards applicable to any specific international transfer by contacting the Privacy Officer at contact@lofab.com.
7. Rights
Under the GDPR, you have the following rights in relation to your personal data. To exercise any right, contact the Privacy Officer at contact@lofab.com. LöFAB will respond within one calendar month (extendable by two months in complex cases, with prior notice).
Access
Request a copy of the personal data LöFAB holds about you and information on how it is processed.
Rectification
Request correction of inaccurate or incomplete personal data.
Erasure
Request deletion of your personal data where it is no longer necessary, where consent is withdrawn, or where processing is unlawful. Not available where retention is required by law.
Restriction
Request that processing be restricted in certain circumstances (e.g. where accuracy is disputed or an objection is pending).
Objection
Object to processing based on legitimate interests. LöFAB will cease processing unless it can demonstrate compelling legitimate grounds or a legal claim requirement.
Data Portability
Where processing is based on consent or contract, request your data in a structured, machine-readable format and its transfer to another controller (where technically feasible).
Withdraw Consent
Withdraw consent at any time where processing is consent-based. Withdrawal does not affect the lawfulness of prior processing.
Lodge a Complaint
Complain to IMY (www.imy.se) if you are dissatisfied with how LöFAB processes your personal data. LöFAB encourages you to contact the Privacy Officer first.
8. Cookie Policy
When you visit www.lofab.com, LöFAB may store cookies or similar files on your device. Cookies are small text files that help us understand how the website is used. They do not identify you as an individual.
Cookie categories
-
Necessary — essential for the website to function. They cannot be disabled.
-
Analytics/performance — help us understand visitor interaction with our site.
-
Functional — enable enhanced functionality and personalization.
Your Choices
On your first visit, you will be asked to consent to non-essential cookies. You may change or withdraw consent at any time through the cookie preference settings on the site, or by configuring your browser to refuse cookies. Previously stored cookies can be deleted through browser settings.
For queries, email contact@lofab.com.
9. Legal Notice
Copyright
Copyright © Lövstjärnan Fabriks AB 2026. All rights reserved. Content on this site may not be reproduced, copied, or exploited for commercial purposes without LöFAB's prior written approval. Personal, non-commercial use is permitted provided all copyright notices are retained. Press releases and public documents may be reproduced in public communications with clear attribution of source.
Disclaimer
All site content is provided "as is" without warranty of any kind. LöFAB is not liable for any loss or damage arising from use of or inability to use this site or any linked website. LöFAB may modify or withdraw content at any time without notice.
Third-party links
Links to third-party websites are provided for convenience only. LöFAB has no control over, and accepts no responsibility for, the content or privacy practices of linked sites. A link does not imply endorsement.
Applicable Law
This site is operated in accordance with the laws of Sweden. Disputes relating to this site are subject to the exclusive jurisdiction of the Swedish courts.
10. Policy Approval
This policy has been reviewed, approved, and officially authorized for implementation across all units of Lövstjärnan Fabriks AB - 15 JULY 2026.