Privacy Policy
(Valid from May 25, 2018, last updated on september 14, 2026)
This Privacy Policy applies in situations where the Seventh Swedish National Pension Fund (“AP7”), corporate identity number 802406-2302, processes personal data in its capacity as data controller.
This Privacy Policy applies to the specific webpages on www.ap7.se, hereinafter referred to as the “Website”, as well as to the processing of personal data relating to contact persons of contractual counterparties and other business partners, and in connection with recruitment. AP7 only collects personal data that is necessary, relevant and not excessive in relation to the purposes for which it is processed.
As a general rule, we process your personal data when you carry out any of the activities described below on our Website. If you are a contact person for one of our contractual counterparties, suppliers or other business partners, we process your personal data when communicating with you.
Below, we describe how we collect personal data, the categories of personal data concerned, the purposes and legal bases for processing, any transfer of personal data to third parties, and how long the data is retained.
Collection and Processing of Personal Data
Digital Meetings, Recording and Transcription
In connection with digital meetings conducted via Microsoft Teams or a similar service, AP7 may, where necessary to document and ensure the quality of communications with external parties, record or transcribe the meeting. This may include audio, video, screen sharing, chat functions and speech-to-text transcription.
The processing takes place within the EU and is necessary for AP7 to perform its duties under the Swedish National Pension Funds Act (2000:192). Recordings and transcripts constitute official documents and may be requested under the Swedish principle of public access to official documents. However, any disclosure is always subject to a confidentiality assessment under the Swedish Public Access to Information and Secrecy Act.
Participants are informed at the start of the meeting and may turn off their camera and microphone. If recording is not necessary for AP7 to perform its duties, participants may choose not to take part in the recording, in which case AP7 will provide alternative means of documentation.
Applying for Vacancies or Expressing an Interest in Employment with Us
Any vacancies are advertised via the Website. When you follow the link for further information and instructions on how to apply, you are redirected to our recruitment partners. This means that AP7 does not directly collect personal data in this context, and the processing of personal data is therefore governed by the privacy policies of our recruitment partners.
Where our recruitment partners present candidates to us, AP7 processes their personal data for the duration of the recruitment process. AP7 processes the personal data for the purpose of managing current or future recruitment needs. The personal data is primarily processed in order to receive and assess applications, contact applicants and retain application documents.
The legal basis for this processing is legitimate interests. Typical categories of personal data processed in this context may include name, address, email address, photograph, telephone number and CV.
AP7 may process personal data relating to a final candidate for the purpose of carrying out reasonable background checks before filling the position concerned. Background checks are only carried out where justified by the relevant job description.
The processing is considered necessary for AP7 to fulfil its public responsibilities. The legal basis for the processing is the performance of a task carried out in the public interest. The final candidate will be informed that a background check will be carried out and will be required to provide their approval.
AP7 engages an external provider to carry out background checks and, for this purpose, provides the provider with the final candidate’s name and Swedish personal identity number.
Personal data relating to the successful candidate is subject to AP7’s internal rules governing the processing of employee personal data and is retained in accordance with applicable rules.
Application documents relating to candidates who have been presented but have not progressed further in the recruitment process are retained for two years after the employment decision has become final and are deleted thereafter.
Unsolicited applications, i.e. applications that do not relate to a specific advertised vacancy, are deleted immediately after review or, alternatively, after contact has been made with the person who submitted the application. The legal basis for this processing is legitimate interests.
In certain cases, AP7 may recruit directly for certain positions via our Website. In such cases, the personal data is processed by the Human Resources department and by certain managers involved in the recruitment process. The personal data processed in connection with an application primarily includes name, email address, telephone number and Swedish personal identity number.
The legal basis for the processing is the performance of a task carried out in the public interest, i.e. the processing is necessary for AP7, as a Swedish public authority, to perform its duties and ensure that its operations are conducted appropriately.
If you are employed, your application documents will be archived. If you are not employed, your personal data will be deleted within two years of your most recent application. In the event of an appeal relating to the recruitment decision, your personal data will not be deleted until the appeal process has been concluded.
As a Swedish public authority, AP7 is subject to the principle of public access to official documents. This means that if someone requests copies of your application documents, we may be required to disclose them. However, this does not apply to information protected by confidentiality.
Submitting Tenders in Our Procurement Procedures
The Website contains information about current procurement procedures and how to submit tenders. When a tenderer follows the procurement link, they are redirected to the registered procurement database and/or procurement system used by AP7.
Where tenders are submitted to AP7 via a procurement consultant’s procurement system, AP7 begins processing personal data only when the tenders are made available to AP7.
Submitted tenders may contain personal data such as names, addresses, email addresses and telephone numbers. AP7 processes this personal data for the purpose of managing and evaluating tenders submitted to AP7 in public procurement procedures.
The personal data is primarily processed in order to receive and assess tenders, contact tenderers and retain tender documentation.
The legal basis for the processing of personal data is the performance of a task carried out in the public interest, i.e. the processing is necessary for AP7 to perform its duties as a Swedish public authority under Swedish public procurement legislation.
All tenders are officially registered and, as a general rule, constitute official documents and are therefore public. The successful tender is officially registered and retained in accordance with applicable rules. Tenders that do not proceed further in the procurement process are officially registered and retained for four years, after which they are deleted in accordance with applicable retention rules.
Communicating via the Contact Form on Our Website
The Website contains a contact form through which you can send us a message. The personal data entered in the form consists of your name and email address.
We recommend that you minimise the amount of personal data you provide to AP7 and that you do not provide sensitive personal data when communicating with us. Please provide only the information necessary for us to deal with your enquiry.
AP7 processes your personal data solely in order to respond to your enquiry and to fulfil its communications responsibilities as a Swedish public authority.
The legal basis for the processing is the performance of a task carried out in the public interest, specifically AP7’s statutory duty to provide public service as a Swedish public authority.
Incoming messages are deleted once they have been dealt with. Personal data is therefore not retained for longer than necessary to handle your enquiry.
Social Media
On X, AP7 is responsible only for any personal data published by AP7 itself and not for personal data posted by others.
On Facebook and YouTube, AP7 and the relevant service provider are jointly responsible for certain personal data that is published. This responsibility covers both personal data published by AP7 and personal data published by others.
Subscription to Blog Posts
In order for you to subscribe to AP7’s blog and receive updates from us, we need to process your personal data, in this case your email address.
The purpose of the processing is to provide the subscription service and to fulfil AP7’s communications responsibilities as a Swedish public authority.
The legal basis for the processing is the performance of a task carried out in the public interest, specifically AP7’s statutory duty to provide public service as a Swedish public authority.
Your personal data is deleted when your subscription ends.
Contact Persons of Contractual Counterparties, Suppliers and Other Business Partners
In order for us to communicate with our contractual counterparties, suppliers and other business partners, we process personal data relating to their contact persons.
The purpose of the processing is to manage necessary contacts in contractual or supplier relationships, evaluate services and manage other external contacts necessary for AP7’s operations as a Swedish public authority.
The legal basis for the processing is the performance of a task carried out in the public interest, i.e. the processing is necessary for AP7 to perform its duties as a Swedish public authority.
Typical personal data processed includes names, addresses, email addresses and telephone numbers.
As a Swedish public authority, AP7 is required to comply with the Swedish Archives Act. This means, among other things, that personal data contained in matters that must be archived is retained in our operational systems.
Under applicable archival rules, certain documents may be deleted after a specified period. Personal data contained in such documents is therefore deleted once that period has expired. The deletion of personal data that is no longer required is referred to as storage limitation.
In exceptional circumstances, AP7 may access an employee’s email during their employment. This will only occur where there is suspicion of misconduct or similar circumstances.
Transfer of Personal Data to Recipients
We transfer personal data to recipients, such as hosting providers and system providers, only where this is necessary for the conduct of our operations or in order to comply with a legal obligation.
As a general rule, AP7 does not transfer personal data to recipients in countries outside the EU/EEA. If such a transfer is nevertheless necessary in order for AP7 to fulfil its obligations, AP7 will ensure that your personal data continues to be protected and that the transfer is carried out lawfully.
Official Documents
The General Data Protection Regulation (GDPR) and the Swedish Data Protection Act do not apply to the extent that their application would conflict with the freedom of the press and freedom of expression protected under Sweden’s constitutional laws.
AP7 may therefore disclose official documents in accordance with the Swedish principle of public access to official documents (Chapter 2 of the Freedom of the Press Act).
As the obligation to disclose official documents does not extend to disclosure in electronic form, the provisions of the GDPR and the Swedish Data Protection Act nevertheless apply to such disclosure, for example by email or via the internet.
Personal data contained in official documents may be disclosed to third parties, provided that the personal data is not subject to confidentiality.
Your Rights as a Data Subject
You have certain rights in relation to the processing of your personal data. These rights include the right to:
- Request rectification of your personal data if it is inadequate, incomplete or inaccurate.
- Object to certain processing of your personal data.
- Request the erasure of your personal data.
- Request restriction of the processing of your personal data.
- Obtain information as to whether AP7 processes your personal data and, if so, obtain a copy of that personal data.
- Receive personal data that you have provided in a machine-readable format and have it transferred to another service provider (data portability). This applies only to personal data processed by automated means on the basis of consent or for the performance of a contract.
- Withdraw your consent to AP7’s processing of your personal data, to the extent that the processing is based on your consent.
- Lodge a complaint concerning the processing of your personal data with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) if you believe that the processing of your personal data infringes your rights and interests under applicable law.
Data Protection Officer
AP7 has appointed Apriori Advokatbyrå AB as its Data Protection Officer.
Contact Details
Data Controller: Sjunde AP-fonden (AP7)
Visiting address:
Vasagatan 16, 9th floor
111 20 Stockholm
Sweden
Postal address:
Box 100
101 21 Stockholm
Sweden
Telephone: +46 (0)8 412 26 60
Email for data protection matters: dataskydd@ap7.se
Data Protection Officer:
Caroline Mitteregger
Apriori Advokatbyrå AB
Email: caroline@apriorilaw.se
Telephone: +46 (0)8 403 777 10
If You Wish to Make a Complaint
If you wish to complain that our processing of personal data is in breach of the GDPR or other applicable legislation, you should in the first instance contact AP7.
You may also contact the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) directly. Further information is available on the Swedish Authority for Privacy Protection’s website.
Cookies
This Website uses cookies. A cookie is a small text file that the website you visit stores on your computer.
Cookies are used by many websites to provide visitors with access to various functions. Information contained in cookies can also be used to track a user’s browsing activity.
You can read more about how we use cookies on our Website.
About Cookies
This website uses so-called cookies. According to the Electronic Communications Act, which came into force on July 25, 2003, all visitors to a website with cookies should receive information about:
- The website containing cookies
- What these cookies are used for and their purposes
- What data is stored in cookies
- Which cookies we use and how long they are stored
- If the information comes from or is disclosed to third parties
- How cookies can be avoided
What Is a Cookie and What Is It Used For?
A cookie is a small text file that the website you visit saves on your computer. Cookies are used on many websites to provide visitors with various features. The information in the cookie can be used to track a user’s browsing.
There are three types of cookies. Permanent cookies are saved as small text files on your computer and are deleted on a predetermined date. They are used, for example, to store settings that the user makes between different visits to the website. Session cookies are stored in the browser’s memory (e.g., Internet Explorer) and are deleted when the browser is closed. They can be used, for example, to maintain a login when the user moves from one page to another. There are also cookies that collect statistics to measure the number of visitors. The statistics collected by this type of cookie are not related to personal data.
Which Cookies Do We Use?
Our website uses the web analytics service Google Analytics 4. Google Analytics 4 (GA4) differs from previous versions of Google Analytics (such as Google Universal Analytics).
When collecting data, Google Analytics 4 does not log or store IP addresses.
- Analytics removes all IP addresses it collects from EU users before logging data through EU domains and servers.
Additionally, Analytics provides controls to:
- Disable the collection of Google Signals data by region.
- Disable the collection of detailed location and device data by region.
For more information, please refer to Google’s help pages.