We are Telia Sverige AB (organization number 556430-0142), referred to as Telia. This Privacy Policy describes how we, as data controllers, process personal data. This Privacy Policy applies when Telia provides products and services to business customers (the customer) for data that Telia is responsible for as data controller. The Privacy Policy also applies when visiting our websites directed at customers in Sweden (e.g., MyBusiness and telia.se), but not to any other company's website or services, even if they can be accessed via Telia's network or services.
This policy describes our processing of personal data about the data subject, meaning an employee or contractor of the customer (a "user"). When processing personal data, we comply with the General Data Protection Regulation, the Swedish Act (2018:218) with supplementary provisions to the EU Data Protection Regulation, and the Swedish Electronic Communications Act (2022:482), along with applicable regulations and provisions.
Telia's processing of personal data on behalf of the customer (i.e., when Telia acts as a data processor) is not covered by or described in this Privacy Policy.
1. What's in this Privacy Policy?
This Privacy Policy applies to business customers. It describes our processing of personal data. Telia also has service-specific privacy policies where we describe how we process personal data in relation to a specific service, available in connection with the service.
In this Privacy Policy, we describe:
How we collect personal data
What personal data we process
How we protect personal data
Who we share personal data with
This Privacy Policy does not apply when other companies' services are used or when visiting other companies' websites, even if accessed through our communications network.
2. How do we collect personal data?
Telia provides a wide range of services, which requires collecting certain personal data from customers and users. For example, we collect personal data that the customer provides when entering into an agreement with Telia and communicating with us – such as when contacting us for information. We also collect personal data generated when users use certain services – for example, making calls or sending text messages and/or emails.
Telia accesses personal data through the following channels:
Directly from customers – When a customer orders our services, logs into our websites or applications, visits our websites, subscribes to our newsletters, responds to customer surveys, or contacts us by phone, email, or chat, the user shares personal data that we process.
Generated data – Telia processes data about users that arises when they use our communications networks or other services, such as when making calls, sending text messages, using the internet, using our TV services, or visiting our websites.
Derived data – Derived data is created when we draw conclusions about a user's interests or consumption habits.
Other sources – We access personal data through other service providers, authorities, publicly available registers such as SPAR, from banks or credit institutions. We also access personal data via our group companies in accordance with what is stated in this Privacy Policy.
3. What personal data do we process?
Personal data is information that can be directly or indirectly linked to a natural person.
We group personal data into the following categories:
Anonymous data – We process anonymous or aggregated data that is not linked to a natural person. Such data is not personal data under the General Data Protection Regulation.
Basic personal data – Basic personal data is all information relating to an identified or identifiable natural person that does not fall under any other category. This includes name, personal ID code, date of birth, address, email, order information, payment information, consents and objections, communication with Telia, marketing data, images and videos captured by CCTV (surveillance cameras).
Children's personal data – Telia processes children's personal data to the extent permitted by law, when appropriate. Telia takes reasonable efforts to ensure and verify that the guardian of a child under 13 has consented to the processing of the child's personal data, taking into account available technology and privacy risks associated with the processing.
Communication content – This category refers to information exchanged between two parties communicating using an electronic communications service, such as the content of phone calls, emails, text messages, and multimedia messages.
Tracking data – Tracking data consists of information collected using cookies and similar tracking technologies in connection with web or mobile browsing. For more information, see our cookie policy at https://www.telia.se/cookie-policy and our cookie table found on the website.
Location data – Location data refers to the geographical location (e.g., GPS coordinates, base station location) of a person and/or terminal equipment, such as a mobile phone. Note, however, that when location data is used to transmit communication in an electronic communications network or for billing purposes, the data is categorized as traffic data.
Special categories of personal data – Special categories of personal data include racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data used as a unique identifier for a natural person, health data, or data concerning sex life and sexual orientation. Telia does not collect or process special categories of personal data unless such information has been voluntarily provided to us or the data subject has given us explicit consent to process such categories of personal data.
Traffic data – Traffic data is data generated when using our communications services. It is necessary to process traffic data to transmit communication through the electronic communications network and to bill for communications services. Traffic data reflects activities when communications services and networks are used at a specific time and place, such as when a user's number (A number) has called another number (B number) at a specific time, in a specific location, and the call has had a certain duration. Traffic data that cannot be linked to a person is also processed to provide services and compile billing. This refers to traffic data obtained from the use of communications services in our network by roaming users, clients of other operators or internet providers – individuals who have not been authenticated by Telia.
4. Purpose, legal basis, and retention period
We collect and process personal data to the extent necessary for specified purposes if it is necessary to fulfill the purpose of the processing. We process personal data for as long as necessary, taking into account the longest permitted storage period established by us or as required by law or other regulations.
Telia ensures and takes all necessary measures to ensure that outdated or unnecessary information is not stored and that personal data and other information is accurate.
Telia's processing of personal data is based on four legal bases (legitimate interest, consent, contractual relationship, and legal obligation). Different rights and opportunities to influence the processing are linked to the different legal bases.
More information about the legal bases, retention periods, and your rights as a data subject is described in our general Privacy Policy at telia.se/integritet.
5. How do we protect personal data?
5.1. How we protect personal data
Protecting personal data is of utmost importance to us, which is why we have implemented necessary organizational and technical security measures to ensure data protection. We work to inform and train our employees, ensure secure information handling, and protect our buildings and technical equipment.
The purpose of our information security activities is to implement an appropriate level of protection for information assets, risk mitigation, and preventive risk measures. We ensure the security of our networks and keep our customers' communications confidential, in accordance with the terms applicable to our services and in accordance with the legislation that applies to us.
Our employees are subject to confidentiality obligations and must follow our internal data protection rules. They receive training in data protection and are responsible for fulfilling their obligations. Our partners are also required to ensure that their employees follow the same regulations as we do and that their employees meet the requirements for processing personal data.
More information about how we work with information security in general is available on our website.
5.2. Protection of children and their personal data
To keep children safe and to prevent the spread of documented child sexual abuse material, we work with the police to block access to websites that, according to them, contain such material.
6. Who do we share personal data with?
We may share personal data with the following parties:
Group companies – We share personal data within group companies to get an overview of our customers' engagement with all group companies. At an aggregated level, meaning when personal data is combined with other customers' data, that information is used for analysis, including tracking the distribution of customers between different companies within our group.
Our partners – In various areas, we engage suppliers and in some cases other group companies to deliver services. They need information for us to deliver our services. However, they do not have the right to use personal data for any purpose other than providing the service or under the conditions we specify. They process personal data based on our instructions as our data processors. The data processors we use include, for example, IT service providers and service partners.
Other telecommunications companies or service providers – We share personal data with other telecommunications companies or service providers that provide or have undertaken to provide services, for example for billing purposes or in the event of faults or disruptions. When a user calls a phone number belonging to other Swedish or foreign telecom operators, the user leaves our communications network and uses the roaming services provided by other telecom operators (e.g., when traveling abroad). These operators collect and process personal data and receive personal data from Telia. When Telia shares personal data with other telecommunications companies or service providers, the processing and collection of personal data occurs in accordance with each company's or provider's terms and Privacy Policy. This Privacy Policy does not apply to these parties' processing of personal data. Telecommunications companies or other providers may in turn transfer personal data to parties outside the European Union (EU) or the European Economic Area (EEA). If necessary, we recommend that you contact them for more information.
Public authorities – To prevent, investigate, and detect criminal activity or to provide emergency services with necessary information, we share personal and traffic data to the extent required by law. As a provider of electronic communications networks and services, we are obligated to provide the Swedish National Defence Radio Establishment (FRA) with information (intelligence) regarding electronic signals crossing our borders. You can read more at www.fra.se.
Other parties – We share personal data with other parties with consent, for example for publication in public directory services (electronic directory services or phone directories). In connection with legal proceedings, at the request of an authority, following a court decision, in connection with a trial or administrative process, personal data may be shared. For example, we may share personal data with a copyright holder or their representative.
7. Transfer of personal data to third countries
Our partners who process personal data on our behalf are sometimes located outside the European Union (EU) or the European Economic Area (EEA). When transferring personal data outside the EU or EEA, we ensure through agreements (e.g., by using the EU Commission's standard contractual clauses) or otherwise (an adequacy decision by the European Commission) that the transfers are carried out in accordance with the Data Protection Regulation. We ensure that personal data remains protected even when transferred outside the EU/EEA.
Telia assesses risks related to third country transfers through a risk analysis (TIA). Telia uses a TIA to verify whether the legislation in third countries ensures an adequate level of protection for personal data in the event of a transfer. We also conduct a TIA if personal data is processed by a company within the EU/EEA that is owned by a parent company outside the EU/EEA. Through the analysis, we can identify whether countries can ensure an essentially equivalent level of protection as within EU/EEA countries. We work with our data processors to collect sufficient information to perform and complete our analysis. Based on the third country analysis, we can assess whether and what supplementary technical and organizational safeguards need to be implemented.
European Commission's list of countries outside the EU that offer an adequate level of protection
European Commission's standard contractual clauses
Swedish Authority for Privacy Protection's website on third country transfers
8. How to contact us
You can exercise your rights, as described in the general Privacy Policy, by contacting Telia and verifying your identity in an appropriate manner. Once you have been identified, we will immediately register and process your request. We will provide information about actions taken no later than one month from receipt of your request.
You can contact us at:
Telia Sverige AB
Mina Rättigheter – Företag
Svarspost 108317743
978 00 Luleå
Form for requesting register extract (PDF)
If we cannot find a resolution, you have the right to contact and file a complaint with the Swedish Authority for Privacy Protection (IMY) (www.imy.se), which is responsible for supervision and control of data protection legislation.
Contact information for IMY:
Phone: +46 (0)8 657 61 00
Email: imy@imy.se
Postal address: Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm, Sweden
Telia is committed to conducting responsible and sustainable business. If you suspect that Telia has acted in violation of law or our Privacy Policy, this can also be reported confidentially through Telia Company's Speak Up Line (our whistleblowing system).
Our Data Protection Officer can be reached via email at dpo-se@teliacompany.com
9. Changes to this Privacy Policy
Just as modern communications services, products, and offerings evolve rapidly, so do activities related to personal data management. We will do our best to keep this Privacy Policy updated and available on Telia's website.
We encourage you to regularly visit our website, where the latest version of this policy is published. We may also announce the most important changes on our website, via email, or in another reasonable manner.