PlingPass
Privacy notice
This notice explains how personal data is used when you use PlingPass as a worker, company representative or other account holder.
Last updated:
Who is responsible
Jven Tech AB, company registration number 559311-4134, is currently the controller for PlingPass and is responsible for the service. A separate PlingPass company is planned but has not taken over responsibility. We will inform users before the controller or contact details change.
Personal data we use
We use account and security data such as email address, password hash, sessions, phone number, SMS events and security logs. Profile data may include a self-declared date of birth, work areas, categories and a CV. Service activity may include company memberships, shifts, responses, shared CV versions, chat messages, notifications, preferences and device tokens. A self-declared date of birth is not identity verification, and PlingPass does not promise BankID verification.
Why we use personal data
We use account and service data to create and maintain accounts, provide shifts, responses, communication and other requested service features, based on the agreement with the account holder. We use data needed for secure operation, abuse prevention and support on the basis of our legitimate interests in protecting and operating the service. We process company-representative data on the basis of legitimate interests in providing the business service. If billing is enabled, some records may be processed to comply with accounting and other legal obligations. Consent is used only where it is the appropriate basis; we do not treat all processing as consent-based.
Who can see information
Authorized members of a company can see responses to that company’s shifts, CV versions shared with that response and related chat. Companies are responsible for their own recruitment decisions and handling of information they receive. Internal company favorites, preferences and notes are not public worker ratings. We disclose data to service providers only as needed to operate enabled features, and when required by law or necessary to establish, exercise or defend legal claims.
CV sharing and control
When you send a response, you explicitly share your CV with that company. The submitted version is retained with the response. Uploading a new CV to your profile does not automatically share it with previous contacts. You can explicitly share an updated version in an ongoing conversation; the company can then see both the original and the latest shared update. Deleting your CV revokes access through PlingPass, but copies already downloaded by the company cannot be recalled.
Service providers
In the current closed beta, Inleed provides application hosting, Backblaze stores encrypted backups in the EU region confirmed for our account, Resend delivers transactional email, 46elks delivers verification SMS, and Geoapify provides area, address and map functions through an EU-based API. Resend states that message content, delivery logs and related service data are stored in the United States and publishes safeguards including the EU standard contractual clauses and Data Privacy Framework participation. 46elks describes itself as an independent telecommunications controller rather than our processor. Apple or Google push notifications and Stripe payments may receive the data needed for those functions only if they are enabled; they are not enabled in the current closed beta.
How long data is kept
Account data is kept while needed to maintain the account, and a worker can remove a CV. The company’s shift posting and its information are kept separately. A limited item may be kept longer only for an individually justified accounting, dispute, security or other legal need; this is not a blanket exception. Backup copies expire separately under the backup lifecycle and are not used as active account records. Our approved policy target is to remove a completed response and the related chat, contact arrangements and shared CVs 12 calendar months after the later of the shift end and the latest message. Automatic retention processing is not enabled, so support reviews and carries out removals manually. Automatic account deletion is not enabled. Support handles deletion requests manually after reviewing the requester’s identity and account ownership. Our operational target is to handle a request within 30 days; this target is not a statement of a statutory deadline.
Your rights
Depending on the circumstances, you may have the right to access, correct or delete personal data, restrict processing, object to processing, and receive portable data. Contact info@plingpass.se to make a request or ask a privacy question. You may also complain to the Swedish Authority for Privacy Protection, IMY.
Security, storage and device data
We use access controls, password hashing, secure sessions and operational logging to protect the service. The website uses data necessary for login and security. The app stores secure credentials and preferences needed for its operation. The application is hosted through Inleed. Encrypted backups use the Backblaze EU region confirmed for our account, but Backblaze is a US provider and EU object storage does not exclude every form of US access or transfer. Geoapify requests use its EU-based API. Resend stores its email service data in the United States as described above.
Changes to this notice
We may update this notice when the service, providers or legal requirements change. The current version and its update date will be shown here. We will give additional notice when a change materially affects how personal data is used.