Privacy Policy

1. Data Controller

The Swedish Accreditation Center ("SAC", "we", "us"), based in Stockholm, Sweden, is the data controller for personal data collected through this website and platform. You can reach us at info@sac-sweden.com.

2. Data We Collect

We collect the following categories of personal data:

• Account data: Name, email address, password (stored hashed), role
• Institutional data: Institution name, type, licence details, address, contact information
• Application data: Self-evaluation responses, quality documentation, accreditation scope
• Uploaded documents: Policies, quality reports, evidence files
• Enquiry data: Name, institution, email and message sent through the contact form
• Usage data: IP address, browser type, access timestamps (for security and audit)

We aim to collect only the minimum personal data needed. Please do not upload named salary information or individual health or disability data except where specifically requested, and then preferably anonymised or aggregated.

3. Legal Basis

We process personal data under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and, where you are located outside the EU/EEA, applicable local data-protection law. Our legal bases are:

• Consent: given at registration, which you may withdraw at any time
• Contract / pre-contractual steps: processing necessary to handle your accreditation application and provide the service you requested
• Legitimate interests: securing the platform and keeping an audit trail that protects the integrity of accreditation decisions
• Legal obligation: retention and disclosure required by law

4. Where Your Data Is Stored

Platform data is hosted in the European Union / EEA. Where data is accessed from outside the EU/EEA (for example by assessors or representatives in other countries), we will ensure appropriate safeguards as required by applicable law, such as the EU Standard Contractual Clauses.

5. Service Providers

We use hosting, database, file-storage and email-delivery providers that process personal data on our behalf under written agreements. We will list them here once our production setup is final.

6. Data Retention

Account and application data is kept for the duration of your accreditation relationship with SAC and afterwards only for as long as necessary for legal, accreditation-integrity and dispute-resolution purposes. Audit logs are retained as required to preserve the integrity of accreditation decisions and to meet legal obligations. Contact-form enquiries are kept only as long as needed to handle them.

7. Your Rights

Subject to applicable law, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Restriction: Request limitation of processing in certain circumstances
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw consent: At any time, without affecting earlier processing

To exercise any of these rights, contact us at info@sac-sweden.com. You also have the right to lodge a complaint with a data-protection supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (IMY).

8. Cookies

The platform uses only essential cookies needed to sign you in and keep your session secure. We do not use advertising or analytics cookies.

9. Security

We implement appropriate technical and organisational security measures, including encryption in transit and at rest, hashed passwords, role-based access controls and immutable audit logging.

10. Contact

For any privacy-related enquiries, contact us at info@sac-sweden.com. Swedish Accreditation Center, Stockholm, Sweden.