Privacy Policy

Last Updated

This Privacy Policy explains how Xpektor Tech AB ("we", "us", or "the company") collects, uses, protects, and manages your personal data in accordance with applicable laws, including the EU General Data Protection Regulation (GDPR) and the Swedish Credit Information Act (1973:1173).

The Xpektor Service

Xpektor provides a platform for risk analysis and risk monitoring. Our customers, mainly lenders, use it to assess the creditworthiness and economic reliability of their customers, suppliers and other counterparties.

Xpektor is the controller of the personal data processed in the service, including data from public registers and data that you share with us. Our customers are independent controllers for their own use of the information we provide.

When one of our customers invites you to share information from your bank accounts, accounting system or tax account, you approve the sharing with BankID. The data is used only in the credit information we provide to that customer, whose name appears at the top of the service. You can withdraw your approval at any time. Data shared this way is kept until you withdraw your approval or the customer's legitimate need ends, and no later than three years after it was retrieved.

You can read more about this processing under Credit Information below.

When you purchase the service directly from Xpektor, you can read in sections 1–8 how we process your personal data.

Credit Information

Xpektor has applied to the Swedish Authority for Privacy Protection (IMY) for a licence to conduct credit information activities. The rules of the Credit Information Act described in this section, such as credit report copies, apply once the licence has been granted.

Whose data we process

Private individuals, sole traders, company representatives (board members, CEOs, signatories and auditors) and beneficial owners, when one of our customers requests credit information about them or about a company they represent. This includes individuals who, at a customer's request, share data from their bank accounts, accounting system or tax account.

Data and sources

Most of this data we obtain from public registers and data providers:

  • Swedish population register (SPAR): name, personal identity number and address

  • Bolagsverket and Creditsafe: current and historical roles in companies, beneficial ownership and trading prohibitions

  • Kronofogden: payment orders, payment remarks, debt balances, enforcement cases, debt restructuring, company reconstruction and bankruptcy

  • Skatteverket: assessed income, tax arrears, and registrations for F-tax, VAT and employer status

  • Lantmäteriet: real property and mortgages

  • Transportstyrelsen: vehicle ownership

  • Swedish courts: civil judgments

  • Sanctions and PEP lists (via OpenSanctions): whether a person appears on a sanctions list or is a politically exposed person

  • News media: negative media coverage, analysed with the support of OpenAI

Some data you share with us yourself, after approving the sharing with BankID:

  • Bank accounts: balances, transactions, loans and credits, retrieved via Enable Banking, an authorised account information service provider

  • Accounting systems: income statements, balance sheets, and customer and supplier ledgers, for example from Fortnox or Spiris

  • Tax account: transactions and balance on your tax account at Skatteverket, retrieved with your authorisation

For private individuals who are not traders, we only disclose payment defaults established by a court or authority, or that have led to debt restructuring or bankruptcy (section 7 of the Credit Information Act).

We do not process special categories of personal data, data from social media, or criminal offence data about private individuals. For sole traders and company representatives, we may process final judgments concerning economic crime, and trading prohibitions, only to the extent permitted by IMY.

Purpose and legal basis

The data is used so that our customers can assess creditworthiness, ability to pay and economic reliability, for example before granting a loan, credit, a rental agreement or an instalment purchase, when assessing customers, suppliers and other counterparties, and to prevent over-indebtedness and fraud. The legal basis is legitimate interest (GDPR Article 6(1)(f)), within the framework of the Credit Information Act. This also applies to data you share with us; your approval with BankID allows the data to be retrieved, but is not the legal basis. We have documented a legitimate interest assessment. Credit information is never used for marketing.

Recipients

Credit information is disclosed only to customers that have an agreement with us and a legitimate need, such as banks, credit market companies, consumer credit providers, other businesses and public bodies. Every request is logged. Data you share with us is only used in credit information to the customer you approved, and is never disclosed to other customers.

Credit report copy

Whenever we disclose credit information about you, you receive a copy at the same time and free of charge, via your digital mailbox or by post. The copy shows what was disclosed, including any risk assessment and the factors behind it, to whom, and your rights. Copies are also sent for credit information about trading partnerships and limited partnerships. If you receive a copy you do not recognise, contact us immediately.

Risk assessment

Credit information may include risk assessments from A to E in three areas – financial, regulatory and overall – produced by a rule-based, documented model that is never based on special categories of data or protected characteristics. Xpektor does not make decisions about you. Under our agreements, customers may not let the risk assessment alone decide matters that significantly affect you, such as whether you are granted credit; a person must review the decision. You have the right to know which factors affected your assessment.

Retention

  • Payment defaults and other data about private individuals: no later than three years after the event.

  • Debt restructuring: according to the time limits in the Credit Information Act.

  • Assessed income: the three most recent tax years.

  • Company roles: five years.

  • Judgments concerning economic crime and trading prohibitions: five years, or until the prohibition ends.

  • Data you share with us: until you withdraw your approval or the customer's legitimate need ends, and no later than three years after it was retrieved.

  • Logs of disclosures: three years.

1. Data We Collect

We collect different types of personal data to provide and improve our services. The types of data we may collect include:

  • Contact information such as name, address, email address, and phone number

  • Identification information such as personal identity numbers or company registration numbers

  • Financial information such as payment details

  • Technical information such as IP address, browser type, and device information

  • User information such as login details and user preferences

2. Legal Basis for Processing

We process your personal data on the following legal grounds:

  • To perform a contract or take steps at your request before entering into a contract

  • To comply with legal obligations

  • With your consent, where required by law

  • To pursue our legitimate interests, such as improving and marketing our services


  1. How We Use Your Information

We use the collected data for the following purposes:

  • To provide and maintain our services

  • To communicate with you regarding inquiries, purchases, or support requests

  • To customize and improve our services and develop new features

  • To send relevant information, offers, or marketing, based on your consent or our legitimate interests

We keep customer and account data for the contract term, plus 7 years for accounting records and 12 months for other data. Marketing data is kept for 24 months after the last contact. Backups are overwritten after 30 days.

4. Sharing of Data

We only share your personal data with third parties when necessary to provide our services or when required by law.

We ensure that such third parties implement appropriate security measures to protect your data.

We use processors for hosting, analysis of media coverage and mailing, including Microsoft Azure (Sweden), OpenAI and Kivra, all bound by data processing agreements. Enable Banking retrieves bank data as an independent controller under its own licence as an account information service provider. Personal data is processed within the EU/EEA.

5. Data Protection

We take appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or loss. These include encryption, multi-factor authentication, role-based access control, logging and masking of personal identity numbers.

6. Your Rights

You have the right to request:

  • Access to your personal data, including who has received credit information about you in the past twelve months

  • Correction of inaccurate data. Disputed credit information is blocked while we investigate, and recipients from the past twelve months are notified of any correction.

  • Deletion of your personal data

You also have the right to:

  • Object to certain processing activities. Under the Credit Information Act, the right to object does not apply to processing in credit information activities.

  • Request restriction of processing

  • Lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se

To exercise your rights, please contact us using the contact information below. We verify your identity before disclosing any data and respond within one month.

7. Changes to this Privacy Policy

We may update this Privacy Policy and will notify you of any significant changes. The latest update date is indicated at the top of this policy.

8. Contact

If you have questions about this Privacy Policy or how we handle your personal data, please contact us:

Xpektor Tech AB
Västra Hamngatan 24
SE-411 17 Gothenburg, Sweden
Email: [email protected]

Data Protection Officer: Sarah Hirschfeldt, [email protected]