Privacy Notice
Published: 2025-09-16
Andra AP-fonden (hereafter “AP2” or “we/our”) respect and safeguard individual privacy. This privacy notice contains information about how AP2 processes personal data in our relationship with external parties. We describe the purposes for which personal data is processed and for how long, the legal basis we apply, and the measures we take to protect your personal data. We also explain how you, as a data subject, can exercise the rights you have in relation to our processing of your personal data.
About our personal data processing
Controller and Data Protection Officer
Andra AP-fonden (company id number 857209-0606) is Data Controller for the processing of your personal data and is therefore responsible for ensuring that the processing is in line with the General Data Protection Regulation (‘GDPR’) and other data protection legislation that we are obliged to comply with.
AP2 has appointed a Data Protection Officer whose tasks include monitoring that our use of personal data complies with applicable legislation. The role of Data Protection Officer is held by AP2’s Compliance Officer.
You can find our contact details, as well as those of our Data Protection Officer, at the bottom of this privacy notice.
Lawful basis
In order to process personal data, we, as the Data Controller, must ensure that there is a lawful basis in accordance with the GDPR. AP2 is a government agency, and our mission is regulated by the Swedish Public Pension Funds (AP Funds) Act (2000:192). Personal data processing that is necessary for us to carry out our operations within the framework of our public duties is based on Performance of a task carried out in the public interest or in the exercise of official authority. In other cases, we have ensured other relevant lawful bases. The lawful basis for each processing activity is outlined in the section ‘Description of Our Personal Data Processing’ below.
Collection of Personal Data
The personal data AP2 processes about you is information which you or your employer have provided to us, or which we have otherwise obtained during our relationship. We may also collect or receive information about you from other sources, such as public registers, websites, or social media. In the case of recruitment, we may obtain your personal data from the recruitment agency we engage, and we may also gather information from the references you provide in your application.
Storage of Personal Data
The retention period for personal data is determined based on what is necessary to achieve the purposes for which the data was collected in accordance with this privacy notice. When we no longer need your personal data for the specific purpose, we will delete the data from our systems and databases.
However, since AP2 is a government agency, we are legally obligated to record and archive certain documents containing information about our operations. The information which is required to be archived may also include personal data. Documents for archival purposes are only stored for as long as required to meet legal obligations regarding archiving. Whether your personal data may be included in such documents that we are required to archive after our purpose for processing has ceased, is outlined under each processing activity in the section ‘Description of Our Personal Data Processing’ below.
Where your personal data is processed
AP2 strives to process your personal data only within the EU/EEA. In some cases, we may transfer your personal data to a country outside the EU/EEA. If personal data is transferred to such a country, we will take protective measures to ensure that the security level is adequate and in compliance with the requirements of the GDPR. To ensure transparency in the processing of personal data, you, as a data subject, can contact us if you would like information on how we ensure an adequate level of security when processing personal data outside the EU/EEA.
Parties with whom we share your personal data
We may share your personal data with third parties to perform certain services within the scope of our operations, such as for various IT services. In such cases, a data processing agreement is always established with the service provider to ensure that your personal data is processed in accordance with the GDPR and only in line with our instructions.
In some cases, we may also be required to disclose data at the request of other authorities or to other parties within the context of legal proceedings or similar situations.
As a government agency, AP2 is obligated to make certain documents available under the principle of public access to information, which means that the public can request documents related to AP2’s operations, including those that may contain personal data. AP2 always conducts confidentiality assessments in accordance with applicable public access and secrecy legislation to ensure that sensitive personal data or data that could harm your interests is not disclosed
Profiling and automated decision-making
Profiling refers to automated processing of personal data to evaluate specific personal characteristics and behaviours, such as by analysing or predicting personal preferences.
Automated decision-making means that certain decisions, which have a significant impact on you, are made entirely automatically without any human involvement.
AP2 does not perform any personal data processing that involves profiling or automated decision-making.
Description of our personal data processing
In the section below, we describe how we process your personal data depending on which category of data subject you belong to. We explain:
- why we process your personal data (‘Purpose’),
- which personal data we process (‘Categories of personal data’),
- the legal basis for the processing (‘Lawful basis’),
- how long we process your personal data based on the purpose of the processing (‘Retention period’) and, if applicable, the grounds for the retention period set, and
- whether the processing, or any part of it, is included in documents that we are required to archive after the purpose for which the personal data was collected has ended (‘Archiving requirements’).
Journalists and the general public
If you are a journalist or have contact with AP2 for any other reason, AP2 processes your personal data for the following purposes.
Administration of press releases and newsletters
| Description of purpose: | To be able to administer distribution of press releases and newsletters. |
| Categories of personal data: | Name, E-mail address. |
| Lawful basis: | Performance of a task carried out in the public interest or in the exercise of official authority. |
| Retention period: | Until you unregister from distribution of press releases and newsletters. |
| Archiving requirements: | No |
External communication
| Description of purpose: | To manage external communication via letters and emails, including handling requests under the principle of public access to documents. |
| Categories of personal data: | Name, Address, E-mail address, Telephone number, Information you communicate to us. |
| Lawful basis: | Performance of a task carried out in the public interest or in the exercise of official authority. |
| Retention period: | Until the matter has been handled or, if follow-up is required, no later than after three years. |
| Archiving requirements: | The processing may, depending on the content, be subject to archiving requirements and may therefore be stored after the purpose for which the personal data was collected has ended. |
Ensure security in our systems and for our operations
| Description of purpose: | To ensure security in our systems and for our operations when you visit our premises. |
| Categories of personal data: | When you visit our premises: Name If you are a visitor connecting to our internal network: Device details, IP-address. |
| Lawful basis: | Performance of a task carried out in the public interest or in the exercise of official authority. |
| Retention period: | If you visit our premises: Until the visit is completed. If you are a visitor connecting to our internal network: The Wi-Fi log is erased 90 days after your visit. |
| Archiving requirements: | No |
Suppliers, external managers, counterparties & partners
If you represent a company that is a supplier or external manager to us, participates in public procurement, or is otherwise involved in a supplier agreement with us, or if you represent a company that is a counterparty or partner to us, AP2 processes your personal data for the following purposes.
Fulfilment of contracts
| Description of purpose: | In order for us to fulfil contracts and, if necessary, protect ourselves from legal claims and exercise our legal rights. |
| Categories of personal data: | Name, Position, E-mail address, Telephone number, signature. |
| Lawful basis: | Performance of a task carried out in the public interest or in the exercise of official authority. |
| Retention period: | 10 years after the contract ceases (in accordance with the applicable statute of limitations). |
| Archiving requirements: | Part of the processing is subject to archiving requirements and may therefore be stored after the purpose for which the personal data was collected has ended. |
Carry out events and other external activities
| Description of purpose: | To carry out events and other activities for external parties. |
| Categories of personal data: | Name, Position, E-mail address, Dietary preferences (if relevant). |
| Lawful basis: | Performance of a task carried out in the public interest or in the exercise of official authority. |
| Retention period: | Three years after the event has taken place (for follow-up purposes). However, information about dietary preferences will be deleted immediately once the event has been completed. |
| Archiving requirements: | No |
Conducting public procurement
| Description of purpose: | To administer received bids and communicate with bidders during public procurement. |
| Categories of personal data: | Name, Position, E-mail address, Telephone number, Signature. |
| Lawful basis: | Performance of a task carried out in the public interest or in the exercise of official authority. |
| Retention period: | Until the contract is awarded. |
| Archiving requirements: | Yes, rejected bids are stored for four years after the contract is awarded. Awarded contracts is retained according to set retention period for the purpose Fulfilment of contracts. |
Execution and follow-up of asset management operations
| Description of purpose: | For the execution and follow-up of asset management activities, such as documentation, analysis, evaluation, and assessment of investments, mandates, and external relationships. |
| Categories of personal data: | Name, Position, E-mail address, Telephone number. Within the framework of AP2’s analysis of investments in unlisted companies (‘Due diligence’), also information regarding occurrence on an international sanction list and financial crime may be processed. |
| Lawful basis: | Performance of a task carried out in the public interest or in the exercise of official authority. |
| Retention period: | Five years after the investment, mandate, or relationship has ended (for follow-up purposes). Potential information regarding occurrence on an international sanction list and financial crime within the framework of AP2’s Due Diligence process is erased or anonymised directly after decision about the investment is made. |
| Archiving requirements: | No |
External communication
| Description of purpose: | To manage external communication via letters and emails, including handling requests under the principle of public access to documents. |
| Categories of personal data: | Name, Address, E-mail address, Telephone number, Information you communicate to us. |
| Lawful basis: | Performance of a task carried out in the public interest or in the exercise of official authority. |
| Retention period: | Until the matter has been handled or, if follow-up is required, no later than after three years. |
| Archiving requirements: | The processing may, depending on the content, be subject to archiving requirements and may therefore be stored after the purpose for which the personal data was collected has ended. |
Ongoing administration of asset management operations
| Description of purpose: | For the ongoing administration of asset management activities, such as the management of external relationships and investment mandates. |
| Categories of personal data: | Name, E-mail address, Telephone number, Position, Signature. |
| Lawful basis: | Performance of a task carried out in the public interest or in the exercise of official authority. |
| Retention period: | No later than one year after the agreement or mandate has ended (for follow-up purposes). However, personal data included in accounting records will be processed for 7 years after the end of the calendar year in which the payment was made, in accordance with applicable accounting legislation. |
| Archiving requirements: | No |
Ensure security in our systems and for our operations
| Description of purpose: | To ensure security in our systems and for our operations when you visit our premises. |
| Categories of personal data: | When you visit our premises: Name If you are a visitor connecting to our internal network: Device details, IP-address. |
| Lawful basis: | Performance of a task carried out in the public interest or in the exercise of official authority. |
| Retention period: | If you visit our premises: Until the visit is completed. If you are a visitor connecting to our internal network: The Wi-Fi log is erased 90 days after your visit. |
| Archiving requirements: | No |
Ensure regulatory compliance when conduction securities trading
| Description of purpose: | Monitoring of communication between trading parties and AP2 for the purpose of ensuring compliance with regulations regarding market abuse when conducting securities trading. |
| Categories of personal data: | Name, E-mail address, Telephone number, Voice recordings, Communication information. |
| Lawful basis: | Performance of a task carried out in the public interest or in the exercise of official authority and Legal Obligation (Market Abuse Regulation (EU) 696/2014). |
| Retention period: | Five years after registration (legal obligation). |
| Archiving requirements: | No |
Candidates/job seekers
For candidates/job seekers, personal data is processed for the following purposes.
Recruitment and filling of vacancies
| Description of purpose: | To administer applications during recruitment. |
| Categories of personal data: | Name, Address, E-mail address, Telephone number, Qualifications, Evaluation data, Other information you share with us. |
| Lawful basis: | Performance of a task carried out in the public interest or in the exercise of official authority. |
| Retention period: | Two years after the position is filled or immediately if you withdraw your application. If you send us an unsolicited application, that is, without a vacancy being advertised, the retention period ends once you have received feedback from us that no position is available. |
| Archiving requirements: | Yes, the processing is subject to archiving requirements and may therefore be stored after the purpose for which the personal data was collected has ended. |
Potential Board Members
As part of AP2’s nomination committee work for AP2’s portfolio companies, personal data is processed for the following purposes.
Identify potential Board Members
| Description of purpose: | To identify potential board members for the fund’s portfolio companies. |
| Categories of personal data: | Name, Address, E-mail address, Telephone number, Date of Birth, Qualifications, Picture. |
| Lawful basis: | For Identifying Potential Board Members for Specific Assignments: Performance of a task carried out in the public interest or in the exercise of official authority For Storing Data for Potential Future Board Positions: Consent. You can withdraw your consent for the processing at any time by contacting us through any of the contact methods provided below. |
| Retention period: | When the board position is no longer relevant, or when consent is withdrawn. |
| Archiving requirements: | No |
Participants in the essay competition
For students participating in our annual essay competition, personal data is processed for the following purposes.
Execution of the essay competition
| Description of purpose: | For conducting the essay competition and publishing the winners on our external website. |
| Categories of personal data: | Name, E-mail address, Picture, Evaluation of your essay. |
| Lawful basis: | Consent. You can withdraw your consent for the processing at any time by contacting us through any of the contact methods provided below. |
| Retention period: | Until you withdraw your consent. |
| Archiving requirements: | No |
Payment of Scholarship
| Description of purpose: | For the payment of the scholarship to the winning submission. |
| Categories of personal data: | Name, Bank account. |
| Lawful basis: | Legal obligation (Accounting Act (1999:1078)). |
| Retention period: | Seven years after the end of the calendar year in which the payment was made, in accordance with applicable accounting legislation. |
| Archiving requirements: | No |
Your rights
Under the GDPR, as a data subject, you have several rights that you should be aware of, and you can contact us at any time if you wish to exercise any of these rights.
- Right of access to your personal data – You have the right to know whether we are processing your personal data and, if so, to access the data and information.
- Right to rectify your personal data – If you believe that the data we hold about you is incorrect, you have the right to have it corrected.
- Right to erasure of your personal data – You have the right to request that we delete your personal data, and we are required to grant such a request unless the data is needed for a specific purpose or is part of a public document.
- Right to restrict processing – If you believe the data is incorrect, that our processing violates the law, or that we no longer need the data for a specific purpose, you can request that we limit the processing of your data. You can also request that we do not delete your data, for example, if you need the data to claim compensation.
- Right to object to processing – When we process personal data in the context of our official authority or to perform other tasks in the public interest, you have the right to object to the processing. If we cannot demonstrate compelling legitimate reasons to continue processing the data, we must stop processing.
- Right to data portability – You have the right to request that your personal data, which is processed automatically, be transferred from us to another data controller (data portability) if the processing is based on consent or a contract.
- Right to lodge a complaint with a supervisory authority – You have the right to file a complaint with the Swedish Data Protection Authority (Integritetsskyddsmyndigheten) if you are not satisfied with how we process your personal data. Their contact details are Phone: +46 8 657 61 00, Email: imy@imy.se, Postal Address: Integritetsskyddsmyndigheten, P.O. Box 8114, SE-104 20 Stockholm.
Contact details
If you have any questions regarding the processing of your personal data or wish to exercise your rights, please feel free to contact us through any of the following contact methods.
Phone: +46 31 704 29 00
Mail: info@ap2.se
Address:
Andra AP-fonden
P.O. Box 11155
SE-404 24 Göteborg
Data Protection Officer: Compliance Officer
Mail: dataskyddsombud@ap2.se