Privacy Notice

Introduction – information on the processing of personal data

Grant Thornton cares about privacy and strives to process personal data in a responsible, secure and transparent manner. If you come into contact with Grant Thornton, for example as a representative of a customer or supplier, job applicant or as a visitor to our websites or at one of our physical events, we may process personal data about you. We process such data in accordance with applicable information security and data protection rules, in particular the General Data Protection Regulation (GDPR) and supplementary industry-specific rules.

This privacy notice contains information about how Grant Thornton Sweden AB, reg. no. 556356-9382, and its subsidiaries (hereinafter Grant Thornton) process and protect personal data in their daily operations. The purpose of the information is to provide an overall picture of how Grant Thornton processes personal data and to give you as an individual (data subject) the opportunity to exercise your rights. See below for contact information.

Information for Grant Thornton's employees and consultants is provided at the start of the employment or assignment and is available on the company's intranet.

Our websites (grantthornton.se including grantthornton.se/event, karriar.grantthornton.se and Grant Thornton's customer portal) may contain links and references to external websites provided by another member company of the global network Grant Thornton International Ltd or third parties.

Grant Thornton is not responsible for data protection issues relating to websites provided by other parties or how these parties process personal data in general.

Processing of personal data

Personal data is information that can be directly or indirectly linked to a natural person, such as name, contact details, user data or financial data. Processing refers to all actions taken with personal data, such as collecting, registering, processing, organising, analyzing, storing, sharing/transferring and deleting the data.

In order for Grant Thornton to process personal data, there must always be a legal basis for the processing. The processing may, for example, be necessary for the performance of a contract, compliance with a legal obligation, satisfy a legitimate interest or be based on your consent. Grant Thornton processes personal data in accordance with the fundamental principles of data protection legislation and also takes into account relevant industry regulations.

Grant Thornton processes personal data primarily in the role of data controller, which means that we determine the purposes of the processing and how it is to be carried out, which is common for audit and advisory assignments. In certain situations, we also process personal data in the role of data processor on behalf of a customer, for example when we perform services within payroll, accounting or other assignments where the customer gives us a specific assignment.

When may Grant Thornton process personal data about you as a data subject?

As an external data subject, you can get in touch with Grant Thornton in various ways. For example:

• You represent a company that is a customer of Grant Thornton
• You are a customer of Grant Thornton as a private individual or sole trader
• You are the owner of a company or organization that is a customer of Grant Thornton
• You are an employee of a customer (or its contractual partners) who has commissioned Grant Thornton to process your personal data
• You are a potential customer (or its representative) who contacted us
• You have visited our website
• You have visited one of our meeting places and/or participated in one of our events
• You are a student or interested in working at Grant Thornton
• You are a representative or contact person for a contracting party/supplier
• You are a representative of an authority or act as an agent for an opposing party
• You work at another member company within the global network Grant Thornton International Ltd
• You have previously worked at Grant Thornton (alumni network)
• You have contacted Grant Thornton in a general question or GDPR-related matters

Why we process personal data

Grant Thornton processes personal data in different ways in different parts of the business. Which data is processed and for what purposes depends on the context in which you come into contact with Grant Thornton.

Marketing and communication

We process personal data to market Grant Thornton and our services. This may concern, for example, the management of marketing and customer registers and to carry out various marketing activities in the form of sending newsletters, invitations to seminars, webinars and other events. Such processing is usually based on a legitimate interest but may in some cases require your consent.

We also process personal data when you visit our websites or interact with us via social media. This includes processing that takes place through cookies and similar technologies. For information on how we handle cookies, see here.

Customer relations and contract activities

Within the framework of our auditing, accounting, payroll, tax and advisory activities, we process personal data in order to be able to establish, implement and administer our customer relationships and assignments.

Personal data is processed in order to:

• Prepare quotations and conclude engagement contracts (including their signing);
• carry out customer review and sanctions controls in order to counter money laundering, terrorist financing and fraud;
• providing the international customer portal and monitoring our IT environment,
• communicate with customers, contact persons, agents and other interested persons;
• administer assignments and preserve assignment documentation (including back-ups);
• follow-up, analyse and develop our business and carry out customer surveys,
• manage and investigate legal claims, insurance and claims cases, if necessary, and
• personal data may form the basis for internal quality controls or be disclosed to authorities in connection with supervision and review of our operations.

Processing of personal data within the framework of our assignment activities takes place on the basis of an agreement and/or a legitimate interest and in order to comply with our legal obligations.

For further information about our processing of personal data in connection with client acceptance, customer administration and assignments, please refer to our special information about personal data processing for customers and assignments.

Recruitment and alumni network

We process personal data in connection with recruitment in order to be able to process applications, carry out selection processes and communicate with candidates. We do not ask for any sensitive personal data, such as health data or information about ethnic origin, but may be processed in cases where an applicant or candidate chooses to provide such data.

Personal data may also be processed within the framework of our alumni network for former employees.

The processing of personal data of candidates and former employees is supported by a legitimate interest as well as a legal obligation.

Supplier contacts

We process personal data about you as a contact person at a supplier or other contractual partner or partner to Grant Thornton in order to manage agreements and invoices.

The processing of personal data within the framework of our supplier management is based on a legitimate interest.

Contact requests and data protection matters

When you contact us, we process the personal data provided for the purpose of handling and responding to your inquiry.

We also process necessary personal data when dealing with data protection-related issues, for example if you exercise your rights under the data protection legislation.

The legal basis for processing personal data in the context of contact requests and general questions is a legitimate interest. In the case of data protection-related matters, the processing is supported by a legal obligation.

How long we process personal data

Grant Thornton processes personal data for as long as it is necessary to fulfil the purposes for which the data was collected or to comply with legal obligations. The storage period varies depending on the type of processing, for example the following:

• Personal data that is processed for various marketing purposes and to offer/offer our services, but which does not lead to a customer relationship, is stored for up to two years. Personal data that is processed in order to receive our newsletters and other mailings is processed until the recipient notifies that he or she no longer wishes to receive our e-mails.
• Personal data processed within the framework of customer relationships and assignments needs to be stored for a longer period of time in order to meet special requirements under law, industry regulations or to be able to establish, exercise or defend legal claims. As a general rule, such documentation is stored for ten years after the completion of the assignment. When the personal data is no longer needed, it is deleted or anonymised.
• Personal data processed for the recruitment of employees is stored for two years after the specific position has been filled.
• Personal data processed in connection with data protection-related matters is stored for five years in order to demonstrate compliance with applicable data protection legislation.

Transfer and sharing of personal data

Grant Thornton may forward your personal data to the global network of which Grant Thornton is a member (Grant Thornton International Ltd) or to another member company. Grant Thornton processes personal data in systems provided by Grant Thornton International Ltd. Grant Thornton also processes personal data in joint assignments with other member companies. Personal data may be disclosed to a public authority or insurance company and/or legal advisers in connection with legal proceedings in accordance with law, regulation or authority decision.

Personal data is also passed on to contracted suppliers (data processors and, where applicable, their sub-processors) when using IT-related services and systems. Grant Thornton transfers and shares personal data when it is necessary to provide our services, administer assignments or for other legitimate business purposes. The information and personal data processed in this way are mainly stored on servers within the EU/EEA.

Some recipients may be based outside the EU/EEA. In the event of a transfer of personal data for processing in a third country outside the EU/EEA, which is not deemed to have an adequate level of protection, Grant Thornton is responsible for ensuring that the personal data is subject to other appropriate safeguards in accordance with applicable data protection legislation.

Security and appropriate safeguards

In a digital environment, no one can guarantee the security of information and personal data. Grant Thornton strives to maintain a high level of protection by implementing appropriate technical and organisational protection measures to prevent unauthorised access, alteration or loss of business information and/or personal data. Information security and data protection requirements are regulated in writing in agreements with our suppliers, data processors and consultants. All employees undergo mandatory training on information security and data protection, among other things.

In addition, the information and personal data that an auditor accesses within the framework of an audit engagement is covered by a statutory duty of confidentiality, which applies without limitation in time. For accounting consultants, tax consultants and other advisers, the duty of confidentiality follows from the professional ethics regulations (without limitation in time) and from what has been agreed. For all employees, a special confidentiality obligation also applies according to the employment contract. Employees' commitment to confidentiality and confidentiality also applies without limitation, i.e. even after the termination of the employment.

Data Subjects Rights and contact details

Grant Thornton Sweden AB has chosen to appoint a Data Protection Officer, who is tasked with monitoring compliance with applicable data protection rules. You can always contact the Data Protection Officer if you have questions about how Grant Thornton processes personal data or if you want to assert your rights as a data subject. Please note that if you have protected personal data, you should primarily contact us by phone or letter and not by e-mail or our digital contact forms.

Contact by letter:
Grant Thornton Sweden AB,
Attn: GDPR,
Box 7623,
103 94 Stockholm

Contact via form on the website:
Contact us

Contact by phone:
+46 (0)8 563 070 00

Your rights as a data subject:

If your personal data is processed by Grant Thornton, you as a data subject have several rights. If you wish to exercise your rights or have questions regarding the processing of your personal data, you can contact the Data Protection Officer using the contact details above. Grant Thornton processes and stores a request for data subjects' rights for the time needed, at most five years, in order to be able to investigate and show how these matters have been handled or to be able to establish, exercise or defend legal claims.

Right to access your data

• You can request to know whether Grant Thornton processes personal data relating to you and, if so, receive a copy of these free of charge - a so-called register extract - together with information about the processing in question. In these cases, Grant Thornton asks you for identifying information that is necessary to ensure that your request is handled efficiently and that we disclose the right information to the right person. A request for a register extract can be made via Contact Us or in writing to Grant Thornton's postal address and must then be signed by the applicant in your own hand and contain information about the applicant's name and social security number.

Right to rectification

• Grant Thornton is responsible for ensuring that the personal data processed is correct and up-to-date. If you believe that the personal data concerning you is incorrect or incomplete, you can request that the data be corrected or supplemented. Since documentation in assignments must be kept in unchanged condition, corrections can rarely be made to the assignment documentation.

Right to object

• You also have the right to object to personal data being processed by Grant Thornton on the basis of a balancing of interests. In that case, you need to specify which processing you object to. If Grant Thornton cannot demonstrate that there are legitimate grounds to continue processing the data, the processing must cease.

Right to restriction

• In certain situations, for example if you have objected to the processing or requested rectification, you have the opportunity to demand that the processing of your personal data be restricted. By requesting restriction, you have, at least for a certain period of time, the opportunity to stop Grant Thornton from using the data other than to, for example, defend legal claims. A restriction means that the data is marked so that it may only be processed for certain purposes.

Right to erasure of your personal data ("right to be forgotten")

• Under certain conditions, you have the right to have your personal data deleted. If the processing is based on your consent and you withdraw it, or if the processing is for direct marketing purposes and you object to the data being processed for this. However, as long as your personal data is needed, there is a legal obligation or there are legitimate reasons to continue processing the data, Grant Thornton has no obligation to delete the data.

Right to portability of your personal data (right to data portability)

• If Grant Thornton processes your personal data in order to fulfil an agreement with you or if you have consented to provide your personal data, you may in some cases have the opportunity to obtain personal data relating to you in order to use it elsewhere, for example transfer the data to another data controller if it is technically possible.

More information about your rights can be found on the Swedish Authority for Privacy Protection's website: Your rights under GDPR | IMY

Right to file a complaint with the Swedish Authority for Privacy Protection

As a data subject, you also have the right to file a complaint with the Swedish Authority for Privacy Protection if you believe that Grant Thornton is not processing your personal data in accordance with the General Data Protection Regulation. Read more about how to file such a complaint: Complain about an incorrect processing of your personal data according to GDPR | IMY

This information is published 3 September 2026 and is updated continuously and when needed.