Privacy Policy

Last updated 8 April 2026

1. General

1.1. Introduction

Real Advokatbyrå Aktiebolag, company registration number 556888-4778 (“REAL”), understands the importance of personal privacy and is committed to protecting the personal data that REAL processes. This privacy policy (the “Policy”) is intended to provide you, whose personal data is processed by REAL (“You”, “Your” or “Yours” and “REAL” respectively), with information about how REAL processes Your personal data. It is therefore important that You read this Policy and take note of REAL’s duty of care when processing personal data.

This Policy can be accessed from our website, but does not constitute our Cookie Notice. Our Cookie Notice is available at https://www.realadvokatbyra.se/cookies/.

1.2. Data controller and communication

REAL is the data controller. If You have any questions about REAL’s processing of personal data, please contact REAL at info@realadv.se or +46 (0)8 450 15 40. REAL will respond to You as soon as possible and always within three months. The response time depends on the complexity of the question and/or the number of questions regarding personal data that REAL is handling at the time. If we need more than one month to respond, we will notify You of this no later than one month after receiving Your request.

You can also contact the Swedish Data Protection Authority (IMY) via the website www.imy.se. The Swedish Data Protection Authority supervises this area with the aim of protecting the privacy of individuals when processing personal data at, for example, REAL. If You live or work outside Sweden, You can contact the local supervisory authority in the country in question.

2. Processing of personal data

2.1. General principles of processing

According to Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), personal data is any information that can be directly or indirectly attributed to an identified or identifiable natural person. Processing means any operation or set of operations performed on personal data, regardless of whether they are performed automatically or not, such as collection, registration, organisation or storage. This means that personal data will, in principle, be processed whenever You interact with REAL, for example by telephone, email or other electronic means.

REAL’s processing of personal data is carried out in accordance with the regulations in force at any given time regarding the processing of personal data in Sweden. Processing is carried out only where there is a lawful basis in accordance with section 2.4 and for specific, explicitly stated and legitimate purposes. Processing shall be limited to personal data that is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed. The data shall not be retained for longer than is necessary in accordance with section 4. REAL shall be transparent in its communication with You regarding the processing of Your personal data, and shall be responsible for and able to demonstrate compliance with the principles set out herein.

You are not under a statutory obligation to provide personal data to REAL. However, certain personal data is necessary for REAL to conduct mandatory conflict of interest and anti-money laundering checks prior to entering into an engagement.

2.2. Purpose of processing

This Policy concerns the processing of personal data by REAL in connection with:

• the provision of products and/or services by REAL to current or potential clients (“Client Services“),
• REAL’s use of products and/or services provided by product or service suppliers (“Supplier Services“),
• the provision of premises, internet connection and other relevant services in connection with visits to REAL’s offices (“Visitor Services“),
• recruitment processes at REAL, including personal data from third parties, such as a recruitment agency (“Recruitment“),
• business development, including the provision of social events, REAL’s alumni activities and marketing through newsletters, seminars and other communication channels (“Marketing Services“), and
• use of REAL’s website, https://www.realadvokatbyra.se/.

Client Services, Supplier Services and Visitor Services are collectively referred to as “Services” in this Policy.

2.3. Categories of personal data

The following categories of personal data may be processed by REAL:

“Identification data” refers to Your name, including all first and last names, personal identification number, or date of birth in the absence of a personal identification number, copies of identification documents such as passports and photographs.

“Contact data” refers to Your telephone number, including mobile number, billing information, postal address and email address.

“Bank data” refers to information about bank accounts and bank card information.

“Payment data” refers to information about payments to and from You, as well as other details such as information about which service You or we have purchased.

“Professional data” refers to information about Your job title and the email address, telephone number and address used in Your profession.

“Employment history” refers to information about Your previous employment and Your qualifications.

“Social media data” refers to posts and other interactions You have with any of REAL’s social media accounts.

“Technical data” refers to data that is processed continuously when interacting with our website, our local network and/or other electronic services, such as IP address, domain name, login data, browser type and version, URI address, time zone setting, location data, and information regarding plug-ins, operating systems and platforms.

“Event data” refers to information collected in connection with event activities, such as data on attendance at and surveys about social events.

“Surveillance data” refers to surveillance material from visits to REAL’s premises, obtained from surveillance cameras and electronic records, such as the use of key tags to enter REAL’s premises.

“Special categories of personal data” refer to personal data defined as revealing beliefs, association membership or health-related information. This personal data is only processed to a limited extent, such as when we are required by law to process the personal data or to take into account Your allergies in connection with a social event that You have voluntarily signed up for.

“Data relating to criminal convictions and offences” means personal data relating to criminal convictions, offences or related security measures. This personal data is only processed to a limited extent, for example when the data is needed to fulfil legal obligations, such as assessing the risk of money laundering, or when the data is provided directly by You.

“Data relating to children” refers to personal data relating to individuals under the age of 18. Such personal data is only processed to the extent necessary and when we act on behalf of the child’s representative in the matter in question, for example, in the case of a gift of real estate to a child or other matters for which the data is of particular importance.

2.4. Legal basis for processing

REAL may process personal data on the following grounds:

• When You have given Your consent (“Consent“).
• When processing is necessary to fulfil an agreement on Your behalf, to which You are a party, or to take action at Your request (“Performance of a contract“).
• When processing is necessary to comply with legal obligations incumbent on REAL (“Legal Obligation“).
• When processing is necessary in order to protect the vital interests of You or another natural person (“Vital Interests“).
• When processing is necessary for the legitimate interests of REAL and these outweigh Your need for protection (“Legitimate Interests“). REAL’s legitimate interests include:
  • offers of legal advice,
  • management and development of our business and relationship with You or Your organisation,
  • surveys on the use of our services and website,
  • identifying client needs,
  • improving our services and terms and conditions,
  • ensuring compliance with our general terms and conditions,
  • managing our supply chain,
  • ensuring that invoices are paid, and
  • ensuring that our IT systems are not exposed to risks.

REAL’s processing of Special Categories of Personal Data requires Consent, Vital Interests, that the processing is necessary for Your or REAL’s obligations and the exercise of rights under social security legislation, that the personal data has been made public by You, that the processing is necessary in connection with establishing, asserting or defending legal claims or for statistical purposes in accordance with section 2.5.

2.5. Duration of processing

Personal data will be stored by REAL for as long as the data is necessary to (i) fulfil the purpose of the personal data processing, (ii) establish, assert or defend legal claims or to protect the rights of the data subject, and (iii) comply with legislation, regulations or other binding documents, including the Swedish Bar Association’s guidelines on good legal practice, which include a requirement for at least ten years of archiving.

REAL may anonymise personal data so that it can no longer be associated with You for statistical purposes. In this case, REAL may process the information for an indefinite period of time without notifying You.

If personal data is no longer needed for the purpose of personal data processing, this data will be stored in such a way that it is not accessible in daily operations.

When personal data is no longer needed for any of the above purposes, it will be deleted in accordance with REAL’s established deletion procedures and applicable legislation.

2.6. Processing outside Sweden

We always strive to limit the processing of personal data to the EU or EEA. If Your personal data needs to be processed in a third country and/or an international organisation, REAL ensures that the processing of personal data is carried out in accordance with or with an equivalent level of protection as the applicable data protection regulations within the EU. This is done primarily by examining the Commission’s decision on the level of protection in third countries, secondly on the basis of documents adopted or accepted by the Commission or Swedish authorities, and thirdly by, for example, entering into a data transfer agreement with the recipient of the personal data and ensuring that the Commission approves this. If an adequate level of protection cannot be ensured through these steps, Your personal data may only be transferred to a third country and/or an international organisation if (i) one of the exceptions listed in Article 49 of the GDPR applies, such as consent in accordance with Section 3, or (ii) if Legitimate Interests outweigh Your need for protection, the processing is limited in scope and REAL has taken appropriate safeguards. In the latter case, REAL will inform the Data Protection Authority about the processing.

If the processing takes place in the United States, REAL ensures that the recipient is part of the Data Privacy Framework (DPF) developed between the EU and the United States. REAL only has American sub-processors who have chosen to join the framework, and REAL always signs agreements and checks that REAL’s sub-processors specify the DPF in their data protection information. Furthermore, REAL always checks that the personal data processing specified by the sub-processor in their data protection information also covers the personal data processing that we want them to perform on behalf of REAL. You can find a list of companies that are affiliated with the DPF on the US Department of Commerce website.

3. Your rights

In connection with any processing of Your personal data, You have the following rights under Chapter III of the GDPR:

• to be informed free of charge about the processing of Your personal data, and to request and/or obtain access to information about this processing at REAL’s expense,
• to receive Your personal data in a structured and machine-readable format, and to have it transferred to another data controller,
• to have Your personal data not used directly for marketing purposes or solely for automated processing,
• to have Your personal data corrected without undue delay if it is incorrect in our records, to be informed about the recipients of this personal data and that the recipient’s data controller is notified of the correction,
• to have Your personal data deleted without undue delay, provided that none of the storage criteria in section 2.5 are met, and to be informed of the recipients of this personal data and that REAL will notify the recipient’s data controller of the deletion,
• to request a more limited use of Your personal data if, for example, the personal data is no longer needed for the intended purpose,
• to withdraw consent and request that the personal data be deleted unless there is another legal basis for its processing, and
• to object to the processing of Your personal data when the legal basis for our processing is our Legitimate Interests.

Upon request for access to information about the processing of Your personal data, REAL will provide copies that show the personal data processing. If paper copies are requested, REAL may charge administrative fees, provided that multiple copies are requested. If digital copies are requested, REAL will provide these in the usual electronic form, for example as a PDF or Word file.

4. Processing in specific cases

REAL takes all appropriate measures to minimise the amount of personal data processed. The personal data that REAL processes and the legal basis for doing so vary depending on the type of contact You have/have had with REAL, as illustrated below.

4.1. Client services

Purpose	Type of personal data	Legal basis	Storage period
To assess whether You can be registered as a client after completing the necessary background checks, such as money laundering checks, terrorist financing checks and other background checks that may be required.	Identification data Contact data Bank data Payment data Technical data Professional data Special categories of personal data	Performance of a contract Legal obligation Legitimate Interests Consent	At least ten (10) years from the date of completion of the case in accordance with the Swedish Bar Association’s Code of Conduct. Until consent is withdrawn.
To offer Services.	Identification data Contact data Bank data Professional data Technical data	Performance of a contract Legal obligation Legitimate Interests Consent	At least ten (10) years from the date of completion of the case in accordance with the Swedish Bar Association’s Code of Conduct.
To process payments, fees and to collect payments that You owe us.	Identification data Contact data Bank data Payment data Professional data	Performance of a contract Legitimate Interests Consent	At least ten (10) years from the date of completion of the case in accordance with the Swedish Bar Association’s Code of Conduct.
Confirming the origin of financing or capital.	Identification data Contact data Bank data Professional data	Performance of a contract Legal obligation Legitimate Interests Consent	At least ten (10) years from the date of completion of the case in accordance with the Swedish Bar Association’s Code of Conduct.
To manage our relationship with You, including informing You of changes to REAL’s general terms and conditions.	Identification data Contact data Technical data Professional data	Performance of a contract Legal obligation Legitimate Interests Consent	At least ten (10) years from the date of completion of the case in accordance with the Swedish Bar Association’s Code of Conduct.
Interacting with authorities and other regulatory bodies.	Identification data Contact data Bank data Professional data	Performance of a contract Legal obligation Consent	At least ten (10) years from the date of completion of the case in accordance with the Swedish Bar Association’s Code of Conduct.
To protect our business, including protecting and improving IT security, troubleshooting our systems, and security measures at REAL’s premises.	Identification data Contact data Professional data Event data Technical data	Legal obligation Legitimate Interests	Data processed for the purpose of protecting our business, including IT security, troubleshooting and investigation of security incidents, is stored for a maximum of fourteen (14) months from the date of creation of the log.
To be able to invite You to social events, such as seminars.	Identification data Contact data Professional data Event data Technical data	Legitimate Interests Consent	Personal data processed for the purpose of sending invitations to social events, such as seminars, is stored for a maximum of three (3) years from our last contact with You. Until consent is withdrawn.
To identify services and/or products that may be of interest to You.	Identification data Contact data Professional data Event data Technical data	Legitimate Interests Consent	Personal data processed for the purpose of identifying services and/or products that may be of interest to You will be stored for a maximum of three (3) years from our last contact. Until consent is withdrawn.
To request Your feedback on, for example, Client Services, and to handle this feedback.	Identification data Contact data Professional data Technical data	Legitimate Interests Consent	Personal data processed for the purpose of requesting and handling Your feedback, for example regarding client services, is stored for a maximum of two (2) years from the date the feedback was received. Until consent is withdrawn.

4.2. Supplier services

Purpose	Type of personal data	Legal basis	Storage period
To assess whether we can engage You as a supplier after necessary background checks, such as money laundering checks.	Identification data Contact data Bank data Technical data Professional data	Performance of a contract Legal obligation Legitimate Interests	Personal data processed for the purpose of assessing the possibility of engaging You as a supplier, including necessary background checks such as money laundering checks, will be stored for a maximum of two (2) years if the collaboration does not materialise. If an agreement is entered into, the storage periods applicable to performance of a contract or under applicable law will apply.
To handle payments and fees, and to collect payments that You owe us.	Identification data Contact data Bank data Technical data Professional data	Performance of a contract Legal obligation Legitimate Interests	Personal data processed for the purpose of handling payments and fees and collecting payments owed to us is stored for a period of at least ten (10) years from the date of completion of the assignment in accordance with the Swedish Bar Association’s Code of Conduct, or longer if required by applicable law.

4.3. Visiting services

Purpose	Type of personal data	Legal basis	Storage period
To safeguard the interests that REAL visitors can be expected to have, while maintaining the need for physical and digital security.	Surveillance data	Legitimate Interests Consent	Surveillance data, such as camera recordings, is normally stored for up to seven (7) days from the time of recording. However, if required to investigate an incident, establish, assert or defend legal claims, the material may be stored for as long as necessary to take these measures.

4.4. Recruitment

Purpose	Type of personal data	Legal basis	Storage period
To initiate contact with potential employees and/or handle job applications directly or through recruitment agencies for business-related reasons.	Identification data Contact data Professional data Employment history Technical data	Legal obligation Legitimate Interests Consent	Personal data in recruitment processes is normally stored until the end of the recruitment process and thereafter for a maximum of two (2) years, in order to be able to handle any discrimination claims in accordance with applicable legislation. Until consent is withdrawn.

4.5. Marketing services

Purpose	Type of personal data	Legal basis	Storage period
To enable long-term relationships with employees through REAL’s alumni activities.	Identification data Contact data Professional data Employment history Event data	Legitimate Interests Consent	Personal data processed within the framework of REAL’s alumni activities, for the purpose of enabling long-term relationships with former employees, is stored for as long as the purpose is relevant and the person has not objected to continued contact. If no contact has been made for a period of three (3) years, the data is deleted. Until consent is withdrawn.
To expand REAL’s network of contacts and/or inform people interested in REAL’s activities or the property industry in general through marketing.	Identification data Contact data Professional data Technical data Social media data	Legitimate Interests Consent	Personal data processed for the purpose of marketing to expand REAL’s network of contacts and/or to inform people interested in our business or the real estate industry in general is stored for as long as the contact is active or for a maximum of three (3) years from our last contact. If You unsubscribe from further communication, the data will be deleted immediately. Until consent is withdrawn.
To increase transparency between REAL as a business and workplace and individuals interested in REAL’s activities or the real estate industry in general through social events.	Identification data Contact data Professional data Event data	Legitimate Interests	Personal data for social events is normally stored for up to one (1) year after the event.

4.6. Use of the REAL website

Purpose	Type of personal data	Legal basis	Storage period
To provide a website about REAL for marketing services, recruitment and other situations where individuals are interested in accessing information about REAL’s activities digitally.	Technical data Contact data (if contact forms are used)	Legitimate Interests Consent	Personal data processed for the purpose of providing our website and digital information about REAL’s activities, including marketing, recruitment and other dissemination of information to interested individuals, is stored for as long as necessary to fulfil the purpose and as specified in our cookie policy. Data from forms or other contact channels via the website is stored for a maximum of three (3) years from our last contact. Until consent is withdrawn.