Integritet
Privacy policy – How THS Consulting processes your personal data
Information about enquiries, student applications and data on our website.
Data controller
Tekniska Högskolans Studentkonsulter Stockholm AB (THS Consulting), organisation number 556866-8924, is the data controller. Postal address: Drottning Kristinas Väg 15–19, 114 28 Stockholm, Sweden. Contact: info@thsc.se.
Data protection officer and contact
THSC has appointed Patrik Nicolausson as data protection officer. Contact info@thsc.se and indicate that your question is for the data protection officer. This is a general inbox, not a separate confidential contact channel. Avoid sending sensitive information. Registration of the officer with IMY remains outstanding.
Personal data we process
For a business enquiry, we collect your email address and description of your needs, plus your name, company, phone number, timeline and selected service area if provided. For student registrations, we collect your name, email, interests and CV, plus optional programme, year of study and availability details. We also record your selected application purpose, any named assignment, submission time and the information shown when submitting. Your CV or text may contain further education, experience and skills information. Do not include personal identity numbers or sensitive personal data that are not needed.
Purposes of processing
We use business information to respond to and follow up enquiries, discuss projects, prepare proposals and manage business communication. This does not automatically include newsletters or unrelated advertising. Student information is used either for recruitment to the named assignment or, if you make that separate choice, for matching future assignments in the consultant pool. Profiles or CVs are shared with a client only after the student grants permission for the named recipient and purpose. We also process names, roles, images and project presentations to describe our work. THSC establishes permission or other necessary rights before publication.
Legal basis
For voluntary consultant-pool registration, we request consent through a separate choice and a clearly described registration action. Pool registration is not required to apply for a specific assignment. Consent may be withdrawn without affecting earlier lawful processing. For business enquiries and individual applications, the basis must be assessed according to the relationship and purpose, for example legitimate interests (Article 6(1)(f)) or steps prior to a contract with you (Article 6(1)(b)), where applicable. The intended interest is handling requested communication and recruitment; submitting an enquiry is not general consent. THSC still needs to finalise its documented assessment, including any balancing assessment and the basis for publication. Statutory retention may rely on a legal obligation (Article 6(1)(c)).
Retention and deletion
THSC intends a maximum retention period of 12 months for the consultant pool from registration or valid renewal. Individual applications should be deleted when no longer needed for recruitment unless further retention has a separate justification. An unsuccessful application is therefore not automatically kept for 12 months. The target for business enquiries is 12 months from the last substantive enquiry-related communication, not unrelated or automated messages. Records for established client relationships, accounting obligations or legal claims are assessed separately. These are THSC’s targets, requiring legal assessment and documented procedures, not automatic deletion by the website. THSC carries out periodic reviews and deletion on request, subject to applicable exceptions. Reviews need to cover Drive, spreadsheets, inboxes, sent mail, archives and attachments. Backups may remain for a separately documented period.
Who may access the data
THSC’s management team and board may access student and business information for their organisational duties. Clients receive only necessary candidate information after the student grants permission for that recipient. Access needs must be reviewed regularly; management or board membership does not itself mean every record is needed.
External providers and processors
Forms are sent through the website server and Lovable’s email service to info@thsc.se or studentkonsulter@thsc.se. Details are also sent to Google Sheets; CVs are stored in Google Drive and linked in the student notification and spreadsheet. Google connections pass through Lovable. THSC currently uses privately managed Google accounts, not centrally administered Workspace accounts. Verified inbound email routing for thsc.se points to one.com. Provider contractual roles, processing agreements, subprocessors and storage terms still need verification. Information may also remain in email communication, archives and backups. The reviewed website code has no separate application database.
Transfers outside the EU/EEA
External IT providers may process data outside the EU/EEA. We have not yet verified all processing locations or international transfers for Google, Lovable, email and their subprocessors. THSC needs to assess such transfers and applicable safeguards, such as adequacy decisions or standard contractual clauses with additional measures where required. We do not claim that all data remains in the EU/EEA.
Your GDPR rights
You may request access, rectification, erasure and restriction of processing. You may object to processing based on legitimate interests and request data portability where the conditions apply. If processing relies on consent, you may withdraw it at any time, for example by ending pool registration or withdrawing publication permission. These rights are subject to GDPR conditions and exceptions. The website forms do not make automated decisions with legal or similarly significant effects. If such processing is introduced, you must be informed and your relevant rights respected.
Contact and complaints
Email info@thsc.se with questions or to exercise your rights. We may need to verify your identity proportionately. You may complain to the Swedish Authority for Privacy Protection (IMY), www.imy.se, without first contacting us.
Cookies and technical information
The reviewed website code has no active Google Analytics, Meta Pixel or LinkedIn Insight Tag integrations and no social media embeds. Social links open the relevant service only when you follow them; that service’s terms then apply. Images load from the website’s image provider and fonts are served locally. Hosting operations may process IP addresses and technical connection information for delivery, security and diagnostics. The published service uses Cloudflare and may set the __cf_bm security cookie for bot protection, with an approximately 30-minute lifetime. Navigation may use session storage to restore scroll position. The published site also loads platform scripts whose statistics, error reporting and consent requirements still need separate verification. We do not store form answers in browser local storage or intentionally send them to analytics. No consent banner has been added because no optional tracking has been verified in the reviewed page. This is not a guarantee that every platform feature has been mapped.
Changes to this policy
We update this information when processing or procedures change. Significant changes to processing based on consent require new information and, where necessary, an opportunity to make a new choice. Last updated: 3 November 2026.
info@thsc.se · Swedish Authority for Privacy Protection (IMY)