Privacy notice – the staff intranet
This notice describes what personal data the intranet processes, why, for how long it is kept, and your rights. A plain-language summary – the full policy is available from HR.
Who processes your data
Ur & Penn is the data controller. Operation and technical support of the intranet are provided by IT on behalf of Ur & Penn. Direct data-protection questions to your line manager or HR.
What data is processed
Name and role (from the staff/ERP system), your work account and permissions, posts, comments, images and reactions you publish yourself, profile and wallpaper images, logins and page visits, and which news items you have read.
Purpose and legal basis
The intranet is used for internal communication and collaboration within Ur & Penn. Processing is necessary to fulfil your employment contract and the employer's legitimate interest in internal information – never for marketing or automated decision-making. Data is never shared with third parties for marketing.
Photos of you (photo mode)
Your profile picture is shown to colleagues only, and only with your consent. You switch photo mode on/off under Profile → Photo mode. Without consent a neutral initial-avatar is shown instead. You can change or withdraw consent at any time – the image is then no longer shown.
How long data is kept
Content you publish is kept until you or an administrator removes it. Profile pictures are kept while photo mode is on; when consent is withdrawn the image is no longer shown. Login and visit logs are kept for security and troubleshooting and are deleted when an erasure request is executed, or per the retention periods described in the full policy available from HR. When employment ends, content from departed staff is no longer shown in the feed.
Your rights
You have the right to access your data, to have errors corrected, to restriction of processing, to object to processing based on our legitimate interest, to data portability, and to be erased (the right to be forgotten). Erasure removes your posts, images, reactions and logs – some rows are deleted immediately while published content is marked as removed so it can never be restored. Submit requests to HR via your manager; an administrator executes them.
Contact and complaints
Questions about personal data: contact your manager or HR. You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY).