Privacy policy

Who is responsible for the data

The staffing agency that uses TidFai is the data controller for the data about its consultants, users and clients in the service. Tizfai Technologies AB (reg. no. 559284-7379, Kumminvägen 1, 611 46 Nyköping, Sweden) processes it as a data processor under an agreement with the agency.

For sign-in and security data, for support cases and for visits to tidfai.se, Tizfai Technologies AB is the data controller.

In an own workspace, where a consultant whose agency does not use TidFai keeps their own assignments, the consultant is the controller of the data about their clients and agencies in the same way.

Which data is processed

The service processes the data needed to plan, report, sign, invoice and pay work:

• Name, personal identity number, email address, mobile number, profession and language.
• Assignments, shifts, stamps, breaks, disturbances and time reports with categories, hours and amounts.
• BankID signatures: name, personal identity number, time and BankID's signature evidence, and details of the client's attester.
• Invoice and payroll data: company details, F-tax status, bankgiro, plusgiro or IBAN, tax table and tax details, payslips and employer declarations.
• Attachments uploaded to a time report or an assignment.
• Device and sign-in data: a random device code, the device's model and operating system, the app's version, the push token for notifications and an event log of sign-ins and changes.

Why, and on which basis

• To perform the agreement with the agency and the consultant: schedules, time reports, signing, invoices and payroll.
• To meet legal obligations: the Swedish Bookkeeping Act requires signed time reports, invoices and payroll records to be kept for seven years, and tax law requires employer declarations to be filed.
• For our legitimate interest in a secure service: sign-in protection, one-time codes, locks after too many attempts and traceability of changes.

Who receives the data

Data is shared only where the service needs it to work:

• The client's attester sees the time report to be signed, through a personal link with a limited lifetime.
• BankID signing goes through Tizfai Identity, Tizfai Technologies AB's own BankID service, which in turn uses BankID.
• One-time codes and notices are sent by SMS through Tizfai Technologies AB's SMS service and by email.
• Notifications to the mobile app go through Apple's and Google's notification services. They never contain amounts, personal identity numbers or free text.
• Employer declarations are sent to Skatteverket when the agency chooses to send them, and vouchers to Fortnox when the agency has connected its Fortnox.
• Bank files are downloaded by the agency and handed to the bank by the agency itself.
• Payments for consultants' subscriptions are handled by Stripe Payments Europe Ltd (card and Swish). TidFai never stores card details.

How the data is protected and how long it is kept

The service runs on servers within the EU. Personal identity numbers, mobile numbers, account numbers, tax details, attachments and pay amounts are stored encrypted. Access is governed by roles and permissions per company, and the consultant never sees the client price.

Account data is kept for as long as the account exists. Signed time reports with their signature evidence, invoices, payslips and employer declarations are kept for seven years after the end of the financial year, as the Bookkeeping Act requires. Event logs are kept for security and traceability and removed when no longer needed.

Cookies

The website tidfai.se uses no cookies and no tracking. The app at app.tidfai.se uses only the cookies needed to keep you signed in and to recognise a device you have already confirmed with a one-time code. There is no analytics or advertising tracking.

Your rights

You have the right to know which data is processed about you, to have incorrect data corrected, to have data erased when it is no longer needed, to receive your data and to object to processing based on legitimate interest. Under My profile you see and change your own contact details and devices.

Turn first to the staffing agency you work through, or to us at info@tidfai.se. You can also complain to the Swedish Authority for Privacy Protection (IMY).

Closing the account

Accounts in TidFai are created by the staffing agency. To close your account, ask the agency to deactivate it, or write to info@tidfai.se from the email address on the account. The account is closed and data that need not be kept by law is removed. Signed time reports, invoices and payslips remain with the agency for as long as the Bookkeeping Act requires.

Changes and contact

If the policy changes, the date at the top is updated. Questions about personal data go to info@tidfai.se or to Tizfai Technologies AB, Kumminvägen 1, 611 46 Nyköping, Sweden.