Privacy Policy
Last updated:
Saibon Group AB — Org. No. 559475-9218
This Privacy Policy explains how Saibon Group AB (“Saibon”, “we”, “us”) collects, uses, and protects your personal data when you visit our website, use our platform, or interact with us. We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) and applicable Swedish law.
This policy applies to: website visitors, customer account holders (B2B), consultants whose profiles are managed on the platform, and marketplace visitors.
1. Who We Are (Data Controller)
Saibon Group AB is the data controller for the personal data processing described in this policy. This means we determine why and how your personal data is processed.
| Detail | Information |
|---|---|
| Company name | Saibon Group AB |
| Organisation number | 559475-9218 |
| Address | Magnus Ladulåsgatan 3, 118 65 Stockholm, Sweden |
| Privacy contact | Rasmus Wiik — support@saibongroup.com |
| Website | saibongroup.com |
Saibon does not currently meet the threshold for mandatory Data Protection Officer (DPO) appointment under GDPR Article 37. Rasmus Wiik serves as our data protection contact for all privacy matters.
2. What Personal Data We Collect
We collect different types of personal data depending on how you interact with us. Here is an overview:
2.1 Data you provide directly
| Category | Examples | Who it applies to |
|---|---|---|
| Account information | Name, email, phone, company name, role | Customer users |
| Consultant profiles | Name, CV, skills, experience, availability, location, photo (optional) | Consultants managed by customers |
| Rate data | Compensation expectations as rate ranges or bands (e.g. ‘5000–5500 EUR/month’) | Consultants |
| Billing information | Company name, billing contact, invoice address | Customer billing contacts |
| Communications | Emails, support requests, feedback | Anyone who contacts us |
2.2 Data collected automatically
| Category | Examples | Purpose |
|---|---|---|
| Usage data | Login times, features used, pages visited | Service improvement |
| Technical data | IP address, browser type, device info, operating system | Security and troubleshooting |
| Cookies | Session cookies, analytics cookies | See Section 9 below |
2.3 Data we do NOT collect
- We do not collect special category data (health, ethnicity, religion, political opinions, sexual orientation, trade union membership) unless a customer explicitly uploads such data against our guidelines.
- We do not collect data about children (see Section 11).
- We do not purchase personal data from third-party data brokers.
3. Why We Process Your Data and Our Legal Basis
The table below sets out how and why we process your data, and the legal basis under GDPR for each activity. (called a “legal basis”) for every type of processing. Here is what we do and why:
| Purpose | Legal basis | GDPR Article | Retention |
|---|---|---|---|
| Provide and operate the platform | Performance of contract | Art. 6.1(b) | Duration of agreement + 60 days |
| AI-powered consultant matching | Performance of contract (customer instruction) | Art. 6.1(b) | Duration of agreement |
| Pseudonymised marketplace visibility | Legitimate interest / consent | Art. 6.1(f) or 6.1(a) | Until customer unpublishes |
| Platform security and audit logs | Legitimate interest (security) | Art. 6.1(f) | 90 days |
| Billing and invoicing | Legal obligation (Swedish Bookkeeping Act) | Art. 6.1(c) | 7 years |
| Customer support | Performance of contract | Art. 6.1(b) | 3 years from last contact |
| Service improvement (anonymised data) | Legitimate interest | Art. 6.1(f) | Indefinite (anonymised) |
| Marketing to existing customers | Legitimate interest | Art. 6.1(f) | Until opt-out |
| User account and login management | Performance of contract | Art. 6.1(b) | Duration of account |
| Cookie analytics (non-essential) | Consent | Art. 6.1(a) | See Section 9 |
4. AI-Powered Processing — How Our Matching Engine Works
Transparency about our AI system is important to us. Here’s what you need to know:
4.1 What the AI does
Saibon’s AI Matching Engine analyses consultant profiles (skills, experience, availability and location) and compares them to assignment requirements. It produces a ranked list of the top matching consultants with a match-score and a plain-language explanation of why each consultant was suggested.
4.2 AI risk classification
Our AI system is classified as a high-risk AI system under Annex III, Category 4(a) of the EU AI Act (Regulation 2024/1689) — “AI systems used in employment and workers management.”
4.3 The AI does not make decisions for you
Our AI is a decision-support tool only. It suggests consultants — it never automatically assigns, contacts, or engages a consultant. A human user always makes the final decision. This means GDPR Article 22 (which restricts fully automated decision-making with legal effects) does not apply, because no binding decision is made without human involvement.
4.4 Bias and fairness
The matching logic is designed to be objective, based on professional competencies, experience, availability, and location. We regularly test the AI system for unintended bias in accordance with Article 10 of the EU AI Act. We do not use gender, age, ethnicity, or other protected characteristics as matching criteria.
4.5 Your right to an explanation
Every matching recommendation includes a visible match score and a plain-language explanation. If you want more information about how the matching engine works, you can request high-level functional information by contacting us at support@saibongroup.com. This does not extend to proprietary source code or algorithmic weights.
4.6 Opting out of AI processing
If you are a consultant whose profile is managed on the platform and you do not wish your data to be processed by the AI matching engine, please ask the company that manages your profile (your employer or contracting company) to update your settings or remove your profile. They are the data controller for your data.
5. Who We Share Your Data With
We share personal data only when necessary to provide our service or when required by law. We never sell your personal data.
5.1 Sub-processors (service providers)
We use the following sub-processors who process data on our behalf under strict contractual obligations:
| Sub-processor | Country | Service | Transfer mechanism |
|---|---|---|---|
| Google Cloud EMEA Limited | Ireland (EU) | Cloud infrastructure and data hosting | EU–US DPF + SCCs |
| Oderland Webbhotell AB | Sweden (EU) | Web hosting | N/A (EU) |
| Software by Animarum AB | Sweden (EU) | Technical development | N/A (EU) |
| OpenAI OpCo, LLC | United States | AI model inference (API) | EU–US DPF + SCCs |
| ActiveCampaign (Postmark) | United States | Transactional email delivery | EU–US DPF + SCCs |
| Stripe, Inc. | United States | Payment processing (planned) | EU–US DPF + SCCs |
An up-to-date list is always available at www.saibongroup.com/legal/dpa.
5.2 Other recipients
- Marketplace buyers: Can see pseudonymised consultant profiles (no identifying information) until the customer initiates contact.
- Authorities: We may disclose data if required by law, court order, or regulatory request (e.g., from IMY or tax authorities).
- Corporate transactions: In the event of a merger or acquisition, your data may be transferred to the new entity, subject to GDPR protections.
6. International Data Transfers
We process personal data primarily within the EU/EEA. Our primary infrastructure is hosted by Google Cloud in Ireland.
Where data may be accessed from or transferred to countries outside the EU/EEA (for example, due to Google Cloud’s US parent company), we rely on:
- The EU–US Data Privacy Framework (DPF) for US transfers where the recipient is DPF-certified
- Standard Contractual Clauses (SCCs) approved by the European Commission
You can request a copy of the applicable transfer safeguards by contacting support@saibongroup.com.
7. How Long We Keep Your Data
We retain personal data only as long as necessary for the purpose it was collected. Here are our standard retention periods:
| Data type | Retention period | Reason |
|---|---|---|
| Consultant profiles | Duration of agreement + 60 days | Service provision + data export window |
| Account data | Duration of account | Service provision |
| Platform audit logs | 90 days | Security monitoring |
| Billing records | 7 years | Swedish Bookkeeping Act |
| Marketing communications | Until opt-out | Legitimate interest |
| Support correspondence | 3 years from last contact | Service quality |
| Cookie data | See Section 9 | Varies by cookie type |
After the retention period expires, data is automatically deleted or irreversibly anonymised.
8. Your Rights
Under the GDPR, you have the following rights regarding your personal data. These rights are free of charge and we will respond within 30 days:
| Right | What it means |
|---|---|
| Right of access (Art. 15) | You can request a copy of the personal data we hold about you. |
| Right to rectification (Art. 16) | You can ask us to correct inaccurate data. |
| Right to erasure (Art. 17) | You can ask us to delete your data (“right to be forgotten”), subject to legal retention obligations. |
| Right to restriction (Art. 18) | You can ask us to limit how we process your data while a dispute is resolved. |
| Right to data portability (Art. 20) | You can request your data in a structured, machine-readable format (CSV or JSON). |
| Right to object (Art. 21) | You can object to processing based on legitimate interest or for direct marketing. |
| Right to withdraw consent | Where we process based on consent, you can withdraw it at any time. |
| Right re: automated decisions (Art. 22) | You have the right not to be subject to purely automated decisions with legal effects. Our AI is decision-support only (see Section 4). |
To exercise any of these rights, contact us at support@saibongroup.com. If you are a consultant whose profile is managed by a company on our platform, please contact that company first — they are the data controller for your profile data and can handle most requests directly through the platform.
If you believe we have not handled your request properly, you have the right to lodge a complaint with the Swedish Data Protection Authority (IMY):
- Website: www.imy.se
- Email: imy@imy.se
- Post: Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm
10. Security
We take the security of your personal data seriously. Our technical and organisational measures include:
- Encryption at rest (AES-256) and in transit (TLS 1.2+)
- Role-based access controls with least-privilege principles
- Logically isolated cloud infrastructure (Virtual Private Cloud)
- Regular penetration testing (at least annually)
- Encrypted daily backups stored in a geographically separate EU region
- Automatic vulnerability scanning (code-level) and cloud-provider intrusion detection
- Confidentiality agreements with all staff and sub-processors
Full details of our security measures are set out in Schedule 3 of our Data Processing Agreement (DPA), available at www.saibongroup.com/legal/dpa.
11. Children’s Data
Our platform is a B2B service designed for business use. We do not knowingly collect personal data from children under 16 years of age. If we become aware that we have collected data from a child, we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the “Last updated” date at the top of this page
- Notify registered users by email at least 30 days before changes take effect
- Post a prominent notice on our website
We encourage you to review this policy periodically. The current version is always available at www.saibongroup.com/legal/dpa.
14. Contact Us
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:
| Detail | Information |
|---|---|
| Privacy contact | Rasmus Wiik |
| Support@saibongroup.com | |
| General inquiries | info@saibongroup.com |
| Address | Magnus Ladulåsgatan 3, 118 65 Stockholm, Sweden |