GDPR and privacy

1. Collection of personal data

We have to collect personal data in order to be able to employ an independent contractor. In order for EasyFreelance to be able to process personal data, we must have a legal basis. The processing of personal data is lawful if the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (such as the one we need to be able to enter into with the independent contractor).

Processing is also lawful if the processing is necessary for compliance with a legal obligation to which EasyFreelance is subject.

The processing may also be carried out on the basis of a balancing of interests, in which EasyFreelance's interest in processing information is weighed against the data subject's interest in protection of their integrity, and the outcome is that a legitimate interest exists.

Processing is furthermore lawful if the data subject has given consent to the processing. Consent shall be provided separately and can always be withdrawn.

2. Legal basis for collection and processing

Performance of a contract – This requires that we can process personal data in order to be able to enter into or perform agreements. The purpose is to administer terms, which may involve the payment of salary or contacting the independent contractor. In order for us to be able to fulfil our part of the agreement as an employer, it may in certain cases be required that EasyFreeance shares personal data about the employee with our client (who has ordered an assignment from the independent contractor). If employment exists, we are required to inform you on an ongoing basis about matters that affect your position (such as questions relating to the working environment).

Legal obligation – EasyFreelance processes and shares personal data because of the obligations that arise through legislation or other laws, regulations of public authorities, decisions, requests or guidelines. Personal data and the documents required under regnskapsloven (the Norwegian Accounting Act) are kept for as long as this is necessary. Documentation for bookkeeping and accounting may consist of agreements, written correspondence and invoices. The processing of personal data is required since we must, for example, submit personal data to the Swedish tax authority and to other authorities and national organisations.

Performance of a contract/legitimate interests – EasyFreeance processes personal data by analysing and processing statistics. For this processing we may use both encrypted and pseudonymised data. The aim of this processing is to improve our business and to continue to offer our employees and customers good service, functionality and services.

EasyFreelance uses cookies on our websites in order to be able to offer a better user experience for our visitors. We may carry out certain tests on our website which give us statistics on whether a particular function on our site is user-friendly or not. A cookie is a text file that is stored on your device so that our website can recognise your device. If you wish to know when your device receives a cookie, you can set your browser to notify you of this. (In that way you have the opportunity to accept or reject a cookie.) If you only visit the open website, cookies do not give us information containing personal data; they then provide only statistics and anonymous information, such as the route by which you reached our website. EasyFreelance may use systems such as Google Adwords, Google Analytics, Facebook, Bing etc. in order to create target groups in advertising platforms.

EasyFreelance considers that there is a legitimate interest in maintaining a user-friendly site and good services, but that this is also a requirement for us to be able to fulfil our part of the agreement.

EasyFreelance processes your personal data by handling case history in order to be able to offer you customer support and to continuously train our employees and improve our working methods so as to be able to offer the best possible support. When you contact us, the communication may be subject to analysis. We consider that, in order to be able to fulfil our part of the agreement, we must be able to offer good customer support (which is one of the services we are paid for). Our customer support is one of our most important means of communication with our employees. For non-employees we consider that it is in our and the data subject's legitimate interest that we can offer good customer support, but also so that we can enter into an agreement.

If and when we need to obtain credit information in order to be able to provide our EasyPay service, it is both in order to perform the agreement and in our legitimate interest that we process your personal data for this purpose. If you do not want us to carry out a credit check, you should not choose the EasyPay service.

Vital interests of the data subject – EasyFreelance may process personal data such as that of the next of kin of an Independent Contractor when we consider that this may be necessary in order to protect interests that are of vital importance to you as an employee. It is, however, your choice whether or not you wish to give us this information.

Legitimate interests – EasyFreelance may approach the independent contractor with direct marketing, which we regard as a legitimate interest when we are to provide information about existing or new services. We market both our existing and new services, which may have as their purpose to provide more work opportunities for the independent contractor or to facilitate day-to-day activities while the independent contractor is employed by us. For this purpose EasyFreelance may use personal data that we have stored and certain user data. The legitimate interest for this processing is to optimise our services and processes in order to provide the best services for the independent contractor in the long term and to provide information about news. There is always an opportunity to object to receiving marketing information, and the data subject can, in each email, choose not to receive further marketing from us.

3. Consent

In order to make it possible for data subjects to receive information that is of interest only to them, we wish to use personal data for profiling. For this we need consent. Profiling means that we process personal data by collecting, storing, processing and analysing data in order to produce offers that match the data subjects and their personal needs. From the personal profile they will then receive information about services and products that may be of interest to them, or that in one way or another facilitate their working role and their relationship with us. In order to be able to give consent to this you must be at least 18 years of age. You do not need to give consent in order to become an independent contractor. A consent can always be withdrawn under account settings.

4. Which categories of personal data are processed

The categories of personal data that EasyFreelance needs to process and store in order to be able to enter into an agreement with the independent contractor are the following:

• Name
• National identity number
• Email
• Telephone number
• Address
• Professional title
• Occupation
• Working environment
• Account number
• Identification documents

For those who are or have been employed, the following are also processed:

• Employee number
• Date of employment
• End date
• Form of employment
• Working periods
• Salary
• Tax deduction card and information
• Employment contract

It is voluntary to submit contact information for the next of kin who is relevant to you.

We collect personal data in various ways; most often this happens when the data subject creates an account and gives us the information, or we may receive it from a client. Personal data may, however, also be collected because the data subject has contacted us, for example through our customer support.

5. Time period

EasyFreelance stores and processes personal data as required for those who performed assignments as independent contractors in accordance with the law, and this is deleted within ten years from the last salary paid out by us. The categories stored are those needed for legitimate aims.

For data subjects who never performed assignments as independent contractors and whose accounts have been inactive for three years, EasyFreelance will automatically delete their accounts. The account will then be deleted three years from registration if the data subject does not actively choose to retain their account. An account is considered to be inactive if the registered account holder has never been employed by us and has not logged in to their account for three years.

Personal data received by customer support is deleted after one to three years, if the information is not necessary for a longer period because of identified objective or legal reasons.

6. Recipients and suppliers

EasyFreelance shares personal data with various recipients. These may be various suppliers of IT systems or case management systems, or personal data may be shared with the bank, where the bank processes this for the payment of salary.

EasyFreelance also provides personal data to other recipients such as public authorities, if we are obliged to provide this by law or by another decision of the authority.

In most cases our customers (the party who purchases the assignment performed by the independent contractor) need access to and process the independent contractor's personal data. Most often the customers themselves collect the necessary personal data directly from the independent contractor, but sometimes it is however collected through EasyFreelance.

The legal basis on which we may share personal data with our client is to perform or enter into an employment agreement to which the independent contractor is, or intends to be, a party. Where the law requires it, EasyFreelance has a data processing agreement with the recipient of the personal data.

7. Transfer to a third country

Recipients and suppliers may be established both within the EU/EEA and in a third country. In a third country the GDPR legislation does not apply. If EasyFreelance transfers personal data to a third country, we verify either that there is an adequate level of protection in that country or that there are special safeguards ensuring that the information and your rights are protected. Adequate safeguards may be that the transfer is governed by standard contractual clauses that protect the rights of data subjects, or by binding corporate rules. The standard contractual clauses referred to have a content that aims to ensure that the contractor lives up to the standard required by the GDPR and to ensure that the data subject's integrity is safeguarded.

The countries that the European Commission has determined to have an adequate level of protection can be found here: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

The standard contractual clauses approved by the European Commission and used by us can be found at: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj

8. Increased protection of personal data

EasyFreelance takes what are known as appropriate technical and organisational measures in order to increase the protection of your personal data.

Examples may be:

• Encryption
• Agreements and routines
• Internal register of personal data
• Impact assessment
• Information minimisation
• Restriction of access to personal data within the company

We value the access to personal data and do not allow unauthorised persons to gain access to it. (EasyFreelance has confidentiality agreements with consultants who work for the company.)

9. Your rights and how you use them

Under the law, data subjects have certain rights that they may assert against the data controller. In most cases you can exercise these rights free of charge. We will respond to a request without undue delay, most often within one month.

Your rights mean that you can,

• obtain confirmation as to whether we process your personal data (and, if so, that your personal data is processed in accordance with what is stated here)
• obtain a copy of the personal data that we process
• object to processing or request what is known as data portability, restrict the processing of your personal data, have your personal data rectified
• have your personal data erased, or
• request the withdrawal of consent (this does not affect the lawfulness of processing based on consent before it was withdrawn)

In order to withdraw consent regarding profiling, you can untick the box you ticked when you submitted the consent. You will find the box on your profile in our application (this requires you to log in). If you wish to exercise any of your other rights, you can send an email to [email protected].

It is possible to lodge a complaint with the supervisory authority in Sweden/Norway if you consider that our processing of your personal data is incorrect.

10. Rectification of personal data

If you change your name, address or contact information, or if you discover incorrect information, it is your responsibility to change your information in the account so that it is up to date and correct. EasyFreelance always wishes to have correct information about you and we will do what we can to ensure that your information is updated. If your personal data is subject to rectification or erasure, EasyFreelance will notify the recipients of your personal data, provided that EasyFreelance finds this possible and not unreasonably burdensome.

Under age

For minor independent contractors we have a specialised privacy policy which is adapted accordingly and which describes the processing we carry out in respect of personal data for data subjects under 18 years of age.

Contact a data protection officer

If you need to contact our data protection officer, you can always call customer support or send an email to [email protected].

Archiving of consent

Since EasyFreelance has the burden of proof that any consent has been obtained and stored.