Processing of personal data

We ask that you to read this Privacy Notice carefully. If you have any questions about how the Fastighetsbyrån Group process personal data, you are most welcome to email us at integrity@fastighetsbyran.se.

Swedbank Fastighetsbyrån AB (“Fastighetsbyrån”) – a Swedish limited liability company with corporate domicile in Sweden – is the data controller jointly with its subsidiary Fastighetsbyran The Real Estate Agency S.L. (“the Subsidiary”) and the real estate agents operating under the Fastighetsbyrån brand on the Portuguese residential property market in accordance with this Privacy Notice (jointly hereinafter the “FastighetsbyrånGroup”, “we”, or “us”). Thus, Fastighetsbyrån and its Subsidiary is jointly responsible with the real estate agents for ensuring that your privacy is protected.

Please note that this privacy notice only applies to the Portuguese residential property market and not the Swedish market. The processing of personal data differs due to differences in national legal provisions and differences in between the different property markets.

Fastighetsbyrån Group has implemented a Data Protection Governance Framework to handle all data subject requests and questions. The single point of contact for all markets are integrity@fastighetsbyran.se.

If you have any questions about buying or selling a residence, please contact your estate agent.

“Personal data” is the term for all information that relates to an identified or identifiable natural person. An “identifiable natural person” is a natural person who can be identified directly or indirectly through information such as their name, civil registration number and address, as well as via encrypted information and various types of electronic identity (e.g. IP-address) that constitute personal data on condition that they can be linked to a natural person. Information that can only indirectly identify a person can be considered personal data as well, in the event that it is indirectly possible – in combination with other data – to identify a person.

The processing of personal data encompasses all aspects of use of personal data, such as collection, registration, processing and storage.

Fastighetsbyrån Group collects information from you when you interact with us in person or by digital means. You may also provide us with information about yourself directly or indirectly in a number of ways, for example when you commission a real estate agent, participate in the viewing of a property, browse the Fastighetsbyrån Group website, or register for a subscription service.

We may also collect information from a third party such as a certificate of registration of title of a property. The information relating to you that we have reason to collect depends on the reason for our contact. Examples of personal data we collect include:

• Personal and contact details such as your name, civil registration number/national identification number, email address, phone number, and address.

• Preferences such as preferred type of housing, comments from viewings, and similar information.

• Your preferred language and means of communication (email, WhatsApp, and similar).

• Account and payment data for buyers and vendors.

• Device information such as IP-address, language, and browser settings.

The principal purpose of the personal data processing performed by Fastighetsbyrån Group is to provide, and improve upon, our real estate agency service. There are additional purposes we may need to collect, process, or save personal data. Some of them are legal; for instance, we may be required to collect data in accordance with Anti-Money Laundering/Counter-Terrorism Financing requirements.

In other cases, we may need to retain your personal data in the context of performance of a contract or offer you the best, most tailored services possible. Some processing of personal data is also required to enable us to provide solid service and support, as well as to deal with complaints in an efficient, customer-friendly manner. We may also need to save your personal data if you decline to receive marketing from us, so that we can ensure that you do not receive any further marketing communications in the future.

We may require your national identification number (such as civil registration number or passport number), as real estate agents are required to identify the customer and verifying the customer's identity in accordance with Anti-Money Laundering/Counter-Terrorism Financing requirements.

Purpose of the processingCategories of personal data

To confirm your identity and verify your personal data and contact detailsNational identification number, identification data, contact details

To broker properties and supply other services to youContact details, identification data

To provide customer service and any assistance you may need regarding our servicesContact details, identification data

To process participation in competitions and events, where relevantContact details

To comply with national laws on the prevention money laundering and terrorism financingNational identification number, identification data, contact details

Storage of verifications and accounting Contact details, identification data, payment information

Customer group and market analysis in order to improving our services for youBehavioural data, demographic data

Mailing offers and marketingContact details

Ensuring that if you have declined advertising mailings, etc. they are not sent to youContact details

To conduct digital customer meetingsContact details

The period for which we retain the personal data we collect is defined in accordance with the purpose of – and our legal obligations in relation to – each processing. In practice, this means that Fastighetsbyrån Group retains personal data for the period necessary for the purposes specified in the table above. This may be for as long as is necessary for us for the performance of a contract. It may also be for as long as is necessary pursuant to applicable laws or decisions from public authorities. For this reason, the retention periods may differ depending on the specific purpose in relation to the personal data. Fastighetsbyrån Group also implements appropriate measures to ensure the personal data processed are up-to-date and to delete obsolete or otherwise incorrect personal data. Your personal data will be deleted or anonymised as soon as the purpose for which they were collected – or the statutory obligation to store them – expires.

Fastighetsbyrån Group has a legal obligation to store your data for a specified period for special reasons.

• The obliged entity is required to comply with Anti-Money Laundering/Counter-Terrorism Financing requirements. For this reason, the obliged entity is required to retain personal data relating to customer verification or individual transactions of more than EUR 15,000 for five (5) years. If we consider it necessary to store the documents for longer in order to investigate suspected money laundering, we can retain personal data for a maximum of ten (10) years depending on national legal provisions applicable.

When we apply the legal basis of “legitimate interest”, this means that the processing is necessary for either The Fastighetsbyrån Group’s, or a third party’s, legitimate interests. The legal basis may apply to our wish to follow up on your participation in a viewing or your purchase of a property. In addition, legitimate interest encompasses keeping our services as user-friendly and relevant for you as possible. In this context, we need to analyse how the services are utilised in order to be able to make improvements for you, our customer.

Our objective is to provide you with service in the form of relevant communications and a range of services, as well as relevant and customised offers. Another legitimate interest is to communicate sales prices and addresses via different channels, for example through publication on our own and other partners’ websites, through mailings and on social media, with the intention to market Fastighetsbyrån Group and our services. Whenever the legal basis of “legitimate interest” is applied, we always balance the interests of Fastighetsbyrån Group or a third party’s in processing of personal data in relation to the interests of the individual in protecting his/her personal data as well as any rights and freedoms of natural persons. If we consider the interests of the individual to take precedence, we do not perform the processing.

When the legal basis is “legitimate interest” you have the right to object to such processing. Please see more information in the section on your rights below.

The Fastighetsbyrån Group does not sell your personal data to third parties, nor do we share them with just any recipient. The recipients of your personal data may be a data controller, a real estate agent with whom Fastighetsbyrån and the Subsidiary is the joint controller, or a data processor.

When we share your data with a data processor, i.e. a party that processes personal data on our behalf. We perform due diligence of all data processors to ensure that they can provide sufficient guarantees relating to the security and confidentiality of the data. We have documented agreements with all data processors, through which they guarantee the security of the personal data processed and undertake to comply with all security requirements and instructions.

The section below presents the categories of recipient with whom we may share your personal data:

• Swedbank Group and the Swedish savings banks

Fastighetsbyrån The Real Estate Agency S.L. is a wholly owned subsidiary of Swedbank Fastighetsbyrå AB. Swedbank Fastighetsbyrå AB is in turn a wholly owned subsidiary of Swedbank AB (publ). The Swedbank Group refers to Swedbank AB (publ) and its subsidiaries.

Swedbank AB and Swedbank Fastighetsbyrå AB have a historically close collaboration with the Swedish savings banks. For statistical and analysis purposes, we share personal data with Swedbank AB and Swedish savings banks based on our legitimate interest of establishing group-level statistics.

On your assignment, we share your personal data with Swedbank AB or Swedish savings banks in order for the recipients to be able to offer you mortgages and other banking services. Such sharing of your data is based on our legitimate interest to support buyer and seller in the context of transactions.

• Banks

On your assignment, we share your personal data with banks, i.e. banks that is not a part of Swedbank or Swedish savings banks as described above, in order for the recipients to be able to offer you mortgages and other banking services. Such sharing of your data is based on our legitimate interest to support buyer and seller in the context of transactions.

• Fastighetsbyrån Group’s real estate agents

Fastighetsbyrån and the Subsidiary is the joint data controller with the real estate agents operating under the Fastighetsbyrån brand. For this reason, your personal data may be shared between the real estate agent offices if necessary to perform our assignment.

• Buyer and vendor

As a potential buyer of/bidder on a property, personal data such as your name, contact details and bid may be shared with the vendor. If the property purchase is completed, the buyer will have access to the vendor’s personal data.

• System suppliers of business systems

In order to be able to complete our commissions and services, we store your data in our business system (a system used to manage our customers and contacts) and, in the event of customer complaints, in a complaints management system.

• Suppliers of printing and advertising services

We may also share information relating to you with processors who provide printing and distribution services and process personal data solely on our behalf. This information may, for example, be a description of properties prior to sale, or advertisement of properties on websites such as Idealista.

• Statistics and sales information

Depending on the market, Fastighetsbyrån Group may be share statistics of property transactions such as price and type of property.

• Partners in association with brokerage transactions

Fastighetsbyrån Group offers a range of supplementary products and services, such as the brokerage of insurance policies and inspection services, which may involve transferring personal data to our partners. Fastighetsbyrån Group also participates in other working relationships – ratings sites, for example – which may entail the transfer of your personal data. Moreover, we work with other operators to simplify the brokerage process. Such operators include e-signature providers to facilitate the signing of electronic contracts.

• Financial Intelligence Units

Wherethe obliged entity has reasonable grounds to suspect that funds, regardless of the amount involved, are the proceeds of criminal activity or are related to terrorist financing, the obliged entity is required to report any such suspicions to the national Financial Intelligence Unit. Further, the obliged entity is required to provide all necessary information to a national Financial Intelligence Unit per such request and in accordance with procedures established per national law.

• Insurance companies and legal counsel

In some cases, Fastighetsbyrån Group may share information with the estate agent’s insurance company or legal representative. Personal data may be shared with such a recipient with the intention to establish, exercise, or defend a legal claim, or in the event of suspected or established material loss to Fastighetsbyrån Group, with the buyer or the vendor.

We apply a number of technical and organisational measures to ensure a level of security that is appropriate to protecting the personal data we process. For example, we have established internal guidelines for IT security, data protection and information security, and have signed NDAs with employees, the Board of Directors, suppliers and partners. Fastighetsbyrån Group has also prepared instructions for the classification of information that regulate which security level is to apply to different kinds of information, which security measures are to be adopted for the respective levels, circles of authority, etc.

When you fill in information in a form on Fastighetsbyrån's website, we use the service Friendly Captcha that is a recipient of your personal data and a data processor. The purpose of this processing is to ensure that it is a human and not a robot that enters information into forms, which provides protection against spam and attack attempts. The service only stores a de-identified version of your IP address, and thus no personal data is retained.

Fastighetsbyrån Group, our data processors, and partners generally process personal data within the EU/EEA. In cases where personal data is processed outside the EU/EEA, we ensure that our recipients ensure the adequate level of security and protection and have a legal basis for the transfer. This could be, for example, if the recipient country has been deemed to have an adequate level of protection by the EU Commission.

The USA considered to have an adequate level of protection, provided that the recipient is also covered by the EU-US Data Privacy Framework. This means that Fastighetsbyrån Group can transfer personal data to the USA as long as the recipient has joined and adheres to the EU-US Data Privacy Framework.

Recipients in the USA: Meta (adheres to the EU-US Data Privacy Framework)

No matter what personal data we may process, you are always to be able to exercise control of your own data. You therefore have the right to the following under GDPR:

The right to access gives you the right to get a copy of your data, but also verification if data relating to you are processed and information on how this data have been processed.

Any person has the right to request that inaccurate information be rectified. This also means that the individual has the right to add such personal data that is missing and that is relevant taking into account the purpose of the personal data processing.

If data is rectified at the individual's request, Fastighetsbyrån Group must also inform those to whom they have provided data that data has been rectified. This does not however apply if it should prove to be impossible or would involve excessive effort. The individual also has the right to request to be given information about to whom data has been provided.

You have the right to request erasure of your personal data. We will then erase your data if these data are no longer necessary for the purpose for which they were collected. If the data have been stored on the basis of a statutory obligation, however, we cannot erase them.

If our right to process your personal data is based on consent given by you or in the performance of a contract to which the data subject is party, you are entitled to request a copy of these data in a machine-readable format to allow you to reuse them at another company. This primarily applies to data you have provided to us yourself. In other words, only certain data are subject to the right to data portability.

You are entitled to withdraw your consent at any time. If you withdraw your consent, all processing based on this consent will cease. To withdraw your consent, you can email us at: integrity@fastighetsbyran.se

You are always entitled to decline direct marketing and to object to any processing of personal data that is based on a balancing of interests (legitimate interest).

• In cases where we apply legitimate interest/balancing of interests as the legal grounds for a given purpose, you are entitled to object to the processing. In order to continue to process your personal data subsequent to such an objection, we need to be able to prove a compelling, legitimate reason for the processing in question that weighs more heavily than your interests, rights or liberties.

• If you object to direct marketing, we will cease processing your personal data for this purpose.

In certain cases, individuals have the right to demand that the processing of their personal data be limited. By "limited" is meant that the data is flagged so that it in future may only be processed for certain limited purposes.

The right to limitation applies among other things when the data subject considers that the data is inaccurate and has requested rectification. The data subject can in such cases also request that the processing of their personal data be limited while the accuracy of the data is investigated.

When the limitation ceases to apply, the data subject is to be informed of this.

Remember that you have the opportunity to influence the channels we use to contact you. For example, you can choose not to be contacted by email or text message. You also have the opportunity to decline different types of communications – newsletters, for example. In such cases, you should not object to the processing of the information, but simply contact us and request limitation to one channel of communication that we use.

It does not cost you anything to exercise your rights. If, however, a request is manifestly unfounded or excessive, in particular because of their repetitive character, we will charge a fee to cover the administrative costs associated with said request or decline said request.

Fastighetsbyrån Group does not use automated decision-making.

In this context, “profiling” refers to automatic processing of personal data for the purpose of assessing certain personal characteristics of a natural person, more specifically, to analyse or predict, for instance, this person’s financial situation, personal references, interests or whereabouts. Fastighetsbyrån Group uses profiling for purposes including market- and customer analyses, and in system development. The legal grounds for profiling are either Fastighetsbyrån Groups legitimate interest, on the basis of legal obligations, performance of a contract, or your consent.

You are entitled to withdraw your consent at any time. If you withdraw your consent, all processing based on this consent will cease. To withdraw your consent, you can email us at: integrity@fastighetsbyran.se.

We use cookies and similar tracking technologies to improve your experience of our services. Some services actually require cookies to function as intended. To find out more about how we use cookies, click here.

Do you have any questions relating to our processing of your personal data, or do you want to exercise any of your rights linked to the processing of personal data? If so, you are welcome to contact us at Fastighetsbyrån via integritet@fastighetsbyran.se.

SWEDBANK FASTIGHETSBYRÅ AB (Swedish company ID. no. 556090–2115), with corporate domicile: Västra Järnvägsgatan 7, SE-111 64 Stockholm, Sweden, and postal address: Box 644, SE-101 32 Stockholm, Sweden, Phone: +46 8 54 54 55 00.

FASTIGHETSBYRAN THE REAL ESTATE AGENCY S.L., CIF, B54290218. Avda de Maisonnave 3, 5A Alicante, Spain.

Email: info@fastighetsbyran.se, Web: www.fastighetsbyran.com

For additional information about the estate agent offices with whom SWEDBANK FASTIGHETSBYRÅ AB and FASTIGHETSBYRAN THE REAL ESTATE AGENCY S.L is the joint data controller, see: Find your estate agent

The single point of contact for the joint data controllers are integrity@fastighetsbyran.se. The data subjects are free to contact any of the controllers in relation to their rights in accordance with the GDPR or this Privacy Notice. Fastighetsbyrån is the controller that administers any data subject requests. The real estate agent offices process personal data in the context of real estate property transactions and are the obliged entities subject to anti-money laundering obligations.

If you have any complaints regarding our processing of your personal data, you have the right to submit them to the supervisory authority in the country in question.

In Sweden, the Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection – IMY) is the responsible supervisory authority.

In Portugal it is the Comissão Nacional de Proteção de Dados (Portuguese Data Protection Authority – CNPD).

Sweden: Integritetsskyddsmyndigheten (IMY)
Web: https://www.imy.se/
Phone: +46 8 657 61 00
Email: imy@imy.se

Portugal: Comissão Nacional de Protecção de Dados (CNPD)
Web: https://www.cnpd.pt/
Phone: +351 213 928 400
Email: geral@cnpd.pt