Last updated: 2 September 2026
1. Introduction
EcoNordic Consulting Group AB respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how we collect, use, store and share personal data when you:
- visit our website;
- contact us by email, telephone or through a contact form;
- book a meeting with us;
- apply for an assignment, employment or membership in our consultant network;
- interact with our digital services.
We process personal data in accordance with the General Data Protection Regulation (GDPR), the Swedish Data Protection Act and other applicable data protection legislation.
2. Data Controller
EcoNordic Consulting Group AB is the data controller responsible for the processing described in this policy.
Company: EcoNordic Consulting Group AB
Swedish company registration number: 559497-1979
Address: Stridsvagnsvägen 14, 291 39 Kristianstad, Sweden
Email: info@encg.se
Telephone: +46 (0) 44 590 40 40
Website: https://www.encg.se/
Questions concerning this policy or our processing of personal data may be sent to info@encg.se.
3. Personal Data We Collect
The personal data we collect depends on how you interact with us.
Contact and business enquiries
When you contact us by email, telephone or through our contact form, we may collect:
- name;
- email address;
- telephone number;
- company and professional role;
- subject and message;
- other information that you choose to provide;
- information generated through our subsequent communication.
We use this information to respond to your enquiry, provide requested information and evaluate potential assignments, collaborations or business relationships.
The legal basis is our legitimate interest in responding to and managing business enquiries. Where your enquiry concerns a possible agreement, the processing may also be necessary to take steps before entering into a contract.
Meeting bookings
When you book a meeting through Calendly, we may process:
- name;
- email address;
- company and professional role;
- selected meeting time;
- time zone;
- information that you provide in the booking form;
- technical information required to complete the booking.
The information is used to arrange and administer the meeting and to communicate with you concerning the booking.
The legal basis is our legitimate interest in administering meetings or taking steps at your request before entering into a contract.
Calendly may process information on our behalf. More information is available in Calendly’s Privacy Notice https://calendly.com/legal/privacy-notice
Candidates, employees, consultants and partners
If you apply for employment, an assignment, a partnership or inclusion in our consultant network, we may collect:
- name and contact details;
- CV and professional profile;
- education, qualifications and certifications;
- employment and assignment history;
- skills, industry experience and areas of expertise;
- availability, geographical preferences and commercial information;
- references and recommendations;
- information provided during interviews and other communications;
- documents that are necessary for evaluating or administering the relationship.
We use this information to evaluate your profile, communicate with you, match your experience with relevant opportunities and administer possible employment, consultancy or partnership arrangements.
The legal basis is taking steps before entering into a contract and our legitimate interest in recruiting employees, consultants and business partners.
We ask you not to provide sensitive personal data unless it is specifically requested and necessary. References will normally only be contacted after you have been informed.
Candidate and consultant information may be managed through Cinode. Cinode acts as a service provider supporting our competence, recruitment and consultant-management processes. More information is available in Cinode’s Privacy Notice https://cinode.com/en/privacy/privacy-policy/
We do not share an identifiable candidate or consultant profile with a prospective client unless you have been informed or another lawful basis for the disclosure applies.
Website and technical information
When you visit our website, certain technical information may be processed automatically, including:
- IP address;
- browser and device type;
- operating system;
- date and time of access;
- pages visited and interactions with the website;
- referring website;
- technical error and security information;
- cookie identifiers and consent preferences.
Necessary technical information is processed to operate, maintain and protect the website. The legal basis is our legitimate interest in providing a secure and functional website.
4. Cookies and Consent Management
Our website uses cookies and similar technologies.
Strictly necessary cookies may be used without consent when they are required for the website to function securely and correctly. Analytics, embedded content and other non-essential technologies are only activated after you have provided the relevant consent.
We use Complianz to:
- display and manage the cookie banner;
- record and respect your consent choices;
- prevent non-essential services from loading before consent;
- allow you to change or withdraw your consent.
Complianz is primarily operated within our WordPress environment. Your current choices can be changed through the cookie settings available on the website.
Further details about individual cookies, providers, purposes and storage periods should be available in our separate Cookie Policy or cookie declaration.
5. Google Analytics
Subject to your consent, we may use Google Analytics to understand how visitors use our website and to improve its content, structure and performance.
Google Analytics may process information such as:
- pages visited;
- approximate geographical location;
- browser and device information;
- website interactions;
- referring website;
- online and cookie identifiers.
We do not intentionally send names, email addresses or other directly identifying information to Google Analytics.
The legal basis is your consent. Google Analytics must remain disabled until analytics consent has been provided. You may withdraw your consent through the website’s cookie settings.
Analytics-level user and event data is normally retained for 14 months, unless a shorter period is configured.
Further information is available in Google’s Privacy Policy https://policies.google.com/privacy and its information about how Google uses information from sites and apps https://policies.google.com/technologies/partner-sites
6. Google Maps and Embedded Content
Our contact page may contain an embedded Google Maps service to show our location.
If the map is activated, Google may receive technical information such as your IP address, browser information, device information and interactions with the map. Google Maps should not load until you have provided the relevant consent.
The legal basis for activating the map is your consent.
Other embedded content, such as videos or external application forms, may behave as if you visited the third party’s website directly. The applicable provider may process data in accordance with its own privacy policy.
7. How We Share Personal Data
We may share personal data with trusted recipients when necessary for the purposes described in this policy.
These recipients may include:
- website hosting, administration and security providers;
- email and communication providers;
- Google, for analytics and map services;
- Calendly, for meeting bookings;
- Cinode, for recruitment, competence and consultant-management processes;
- professional advisers such as accountants, auditors and legal advisers;
- customers or prospective customers in connection with a recruitment or consultant-matching process;
- public authorities when disclosure is required by law.
Service providers that process personal data on our behalf may only process the data according to our instructions and applicable data-processing agreements.
We do not sell personal data.
8. International Data Transfers
Some of our service providers may process personal data outside Sweden or the European Economic Area.
Where personal data is transferred outside the EU/EEA, we take appropriate measures to protect it. These measures may include:
- a European Commission adequacy decision;
- the EU–US Data Privacy Framework, where applicable;
- the European Commission’s Standard Contractual Clauses;
- supplementary technical and organisational safeguards.
Information about the relevant safeguards may be requested by contacting us.
9. How Long We Retain Personal Data
We retain personal data only for as long as it is necessary for the purpose for which it was collected.
As a general rule:
- contact-form submissions and general business enquiries are retained for up to 24 months after the last meaningful contact;
- Calendly booking information is retained for up to 24 months after the meeting or last meaningful contact;
- candidate and consultant information is retained for up to 24 months after the application or last meaningful activity, unless an ongoing relationship or another lawful reason justifies longer retention;
- Google Analytics user and event data is retained for up to 14 months;
- ordinary technical and security logs are normally retained for no longer than 90 days, unless they are needed to investigate a security incident;
- cookie-consent records are retained for as long as necessary to document and manage the consent;
- agreements, invoices and accounting information are retained for the period required by applicable accounting, tax and legal requirements.
Information may be retained for a longer period when necessary to establish, exercise or defend legal claims or comply with a legal obligation.
Data that is no longer required is deleted or anonymised.
10. Security
We use appropriate technical and organisational measures to protect personal data against accidental or unlawful loss, alteration, unauthorised disclosure, access or misuse.
Access to personal data is limited to employees, consultants and service providers who need the information for an authorised purpose.
Although we take reasonable measures to protect personal data, no online service can guarantee absolute security.
11. Your Rights
Subject to the conditions in applicable data protection legislation, you may have the right to:
- receive information about how your personal data is processed;
- request access to your personal data;
- request correction of inaccurate or incomplete information;
- request deletion of your personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive certain information in a structured, commonly used and machine-readable format;
- withdraw your consent at any time.
Withdrawing consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
We do not use solely automated decision-making that produces legal or similarly significant effects concerning website visitors, candidates or consultants.
Requests concerning your rights may be sent to info@encg.se. We may need to verify your identity before completing a request.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection:
Integritetsskyddsmyndigheten (IMY)
Website: https://www.imy.se/
12. External Links
Our website may contain links to websites and services operated by third parties. EcoNordic is not responsible for the privacy practices or content of external websites. We recommend that you review the applicable privacy policy before providing personal data to an external service.
13. Changes to This Policy
We may update this Privacy Policy when our services, systems or legal obligations change.
The current version will always be published on this page. Material changes will be communicated through the website or by another appropriate method.