Privacy Policy

How we process personal data (GDPR)

Last updated: 15 November 2026

This Privacy Policy explains how we process personal data when you visit elc-ab.se, contact us, become our client, or are otherwise involved in a matter we handle. We process personal data in accordance with the EU General Data Protection Regulation (EU) 2016/679 (GDPR), the Swedish Data Protection Act (2018:218) and other applicable Swedish law.

1. Controller and contact details

E LAW, corporate ID no. [ORG.NR], Ågatan 10, SE-702 10 Örebro, Sweden
E-mail: info@elc-ab.se · Phone: +46 70 776 15 10

E LAW is the controller for the processing described below. We have not appointed a Data Protection Officer, as this is not required for our business. All questions about personal data are handled through the contact details above.

2. What we process, why, and on which legal basis

2.1 Enquiries (contact form, e-mail, phone, WhatsApp)

Data: name, e-mail address, phone number, company, the content of your message and any documents you send.
Purpose: to answer your enquiry, make an initial assessment and check for conflicts of interest.
Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); where you contact us on behalf of a company, our legitimate interest in handling the enquiry (Art. 6(1)(f)).

Please do not send sensitive personal data (for example health data) or confidential documents through the contact form before we have agreed to assist you.

2.2 Clients and client representatives

Data: identity and contact details, position and authority to represent a company, information about the matter, correspondence, invoicing and payment details.
Purpose: to perform the assignment, communicate with you, invoice and administer the client relationship.
Legal basis: performance of a contract (Art. 6(1)(b)); for representatives of a corporate client, our and the client’s legitimate interest (Art. 6(1)(f)); compliance with legal obligations, such as bookkeeping rules (Art. 6(1)(c)).

2.3 Counterparties and other persons involved in a matter

Data: information about counterparties, their representatives, witnesses, experts, arbitrators and other persons that is needed to handle a matter. The data is usually received from our client, from the persons themselves, or from public sources such as company and court registers.
Purpose: to advise our client and to establish, exercise or defend legal claims in negotiations, court proceedings and arbitration.
Legal basis: our and our client’s legitimate interest (Art. 6(1)(f)). Where a matter requires special categories of personal data, we rely on Art. 9(2)(f) GDPR (legal claims). Personal data relating to criminal offences is processed only where permitted under Art. 10 GDPR and supplementary Swedish legislation.

2.4 Conflict checks

Before accepting an assignment we check that there is no conflict of interest. For this we keep a register of clients, counterparties and matters. Legal basis: legitimate interest in ensuring that we can act independently and loyally towards our clients (Art. 6(1)(f)).

2.5 Customer due diligence (anti-money laundering)

For certain assignments, for example company formations and transactions, we are subject to the Swedish Act on Measures against Money Laundering and Terrorist Financing (2017:630). We must then verify the identity of the client and its beneficial owners, check whether anyone is a politically exposed person, and keep records. Legal basis: legal obligation (Art. 6(1)(c)). Providing this data is a legal requirement; without it we cannot accept the assignment.

2.6 Bookkeeping

Invoices and other accounting records containing personal data are kept to comply with the Swedish Bookkeeping Act (1999:1078). Legal basis: legal obligation (Art. 6(1)(c)).

2.7 Website, security logs and cookies

When you visit the website, technical data such as IP address, browser type and time of visit is processed in server and security logs to keep the website secure and working. Legal basis: legitimate interest in IT security (Art. 6(1)(f)).

Strictly necessary cookies are used to make the website work and to remember your cookie choice. Statistics and marketing cookies (Google Analytics and Google Ads, loaded through Google Tag Manager) are used only if you consent in our cookie banner, in accordance with Chapter 9, Section 28 of the Swedish Electronic Communications Act (2022:482). Legal basis: consent (Art. 6(1)(a)). You can change or withdraw your consent at any time via “Cookie settings” on the website. Read more in our Cookie Policy.

The website’s fonts are hosted on our own server; no data is sent to Google Fonts.

2.8 WhatsApp

If you choose to contact us through WhatsApp, we receive your phone number, name and messages. WhatsApp is provided by WhatsApp Ireland Ltd (Meta), which processes data as an independent controller under its own terms. For confidential information we recommend e-mail.

3. Who we share personal data with

We never sell personal data. Data is shared only when necessary:

  • Our processors, who process data on our behalf under data processing agreements: web hosting, e-mail and IT services, backup, and accounting services.
  • Independent controllers, when required for a matter: courts, arbitral institutions (such as the SCC Arbitration Institute and the ICC), arbitrators, counterparties and their counsel, experts and translators.
  • Public authorities, when we are obliged by law, for example the Swedish Police Authority (Financial Intelligence Unit) under anti-money laundering rules, or the Swedish Tax Agency.
  • Google (Google Ireland Ltd and Google LLC) for statistics and advertising, only if you have consented to such cookies.
  • Meta / WhatsApp, if you choose to contact us through WhatsApp.

4. Transfers outside the EU/EEA

We aim to process personal data within the EU/EEA. Some service providers (for example Google LLC and Meta Platforms, Inc.) may process data in the United States. Such transfers rely on the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) where the recipient is certified, or otherwise on the EU Standard Contractual Clauses (Decision (EU) 2021/914) with supplementary measures where needed. When a matter itself requires transfer to a country outside the EU/EEA (for example foreign proceedings), the transfer may be based on Art. 49(1)(e) GDPR (legal claims). You can ask us for information about the safeguards used.

5. How long we keep personal data

  • Enquiries that do not lead to an assignment: up to 12 months after our last contact.
  • Client files and matter data: 10 years after the assignment has ended, in view of the general limitation period for claims (Swedish Limitation Act 1981:130).
  • Conflict-check register: as long as the related client file is kept.
  • Customer due diligence (anti-money laundering): 5 years after the business relationship ended or the transaction was carried out, or the longer period required by law.
  • Accounting records: 7 years after the end of the calendar year in which the financial year ended (Bookkeeping Act).
  • Server and security logs: normally no longer than 90 days.
  • Cookies: as stated in the Cookie Policy. Your cookie choice is stored for 12 months.

Data may be kept longer if needed to establish, exercise or defend a legal claim, or if required by law.

6. Security and confidentiality

We protect personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS), access controls, multi-factor authentication for administration, security monitoring and backups. Information about our clients’ matters is treated as confidential. If a personal data breach occurs, we will notify the Swedish Authority for Privacy Protection (IMY) within 72 hours and inform you without undue delay where required by the GDPR.

7. Your rights

Under the GDPR you have the right to:

  • access your personal data and receive a copy (Art. 15);
  • have inaccurate data corrected (Art. 16);
  • have data erased (Art. 17);
  • restrict processing (Art. 18);
  • data portability (Art. 20);
  • object to processing based on legitimate interest (Art. 21);
  • withdraw your consent at any time, without affecting processing before the withdrawal (Art. 7(3)).

Some rights may be limited by law, for example by our duty of confidentiality towards clients, by bookkeeping and anti-money laundering rules (including the prohibition on disclosing that information has been reported to the authorities), or where data is needed for legal claims. If we cannot fully meet a request, we will explain why.

Send your request to info@elc-ab.se. We may need to verify your identity. We respond within one month; for complex requests the period may be extended by up to two further months, in which case we will tell you. Requests are free of charge unless they are manifestly unfounded or excessive.

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you (Art. 22).

8. Complaints

If you are dissatisfied with how we process your personal data, please contact us first. You also have the right to lodge a complaint with the supervisory authority: Integritetsskyddsmyndigheten (IMY), Box 8114, SE-104 20 Stockholm, Sweden, imy@imy.se, www.imy.se.

9. Children

Our website and services are directed at companies and adults. We do not knowingly collect personal data from children through the website.

10. Changes to this policy

We may update this policy, for example if the law or our services change. The current version is always published here with the date of the last update. Significant changes will be clearly indicated on the website.