Resarö Utveckling Advokat AB undergoing change of name to Area Advokater Stockholm AB
Last updated on September 23, 2026
Resarö Utveckling Advokat AB undergoing change of name to Area Advokater Stockholm AB protects personal privacy. This privacy policy describes how we process personal data in our law practice, why the data is processed, how long it is stored, who can access it and what rights you have.
The policy applies to, among other things, clients and potential clients, representatives and contact persons of clients, counterparties and their representatives, witnesses, experts, consultants, suppliers, job seekers and other persons whose information appears in our assignments or contacts.
1 Data Controller
Resarö Utveckling Advokat AB undergoing change of name to Area Advokater Stockholm AB, corporate registration number 559596-5897, is the data controller for the processing described in this policy.
Contact details
Email: kontakt@area.se
Website: www.area.se
2 Where the personal data comes from
We receive personal data directly from you or from the organization you represent. We may also receive data from clients, counterparties, agents, courts, authorities, experts, witnesses, insurance companies, banks, other advisors and suppliers.
We may supplement the data with information from public and private registers and other reliable sources, such as the Swedish Companies Registration Office, beneficial owner registers, sanction and PEP registers, court documents, property registers, credit reference agencies and publicly available websites.
You are not normally required to provide us with personal information. However, certain information is necessary for us to assess whether we can undertake an assignment, meet client due diligence requirements, enter into or perform agreements and carry out the assignment. If such information is not provided, we may have to decline or withdraw from the assignment.
3 What personal data we process and why
The data we process depends on your relationship with us and the nature of the assignment. Below we describe our main processing operations.
3.1 Case intake and interest control
| Purpose | Processing of personal data | Categories of personal data |
| Assess whether we can undertake an assignment and control that there are no conflicts of interest or other conflicts of interest. | Registration and verification of clients, potential clients, counterparties, affected group companies and other relevant persons. | Name, contact information, employer, position, qualifications and information about connections to companies or matters. |
Legal basis: Legitimate interest in carrying on legal practice and complying with the Code of Professional Conduct for lawyers. Pre-contractual measures when the data subject is a potential client.
Storage time: For the time needed for the control. Data needed for control of future interest will be saved as long as this is justified by the legal practice and applicable regulations.
3.2 Customer due diligence and compliance
| Purpose | Processing of personal data | Categories of personal data |
| Meet customer due diligence requirements and other obligations under applicable regulations. | Verification of identity, authority, ownership, beneficial owner, PEP status, sanctions, purpose and nature of the assignment and, if necessary, the origin of the funds. | Name, personal identification number or date of birth, contact information, copy of identity document, signature, position, ownership, beneficial ownership, PEP and sanction information and financial information. |
Legal basis: Legal obligation under money laundering and sanctions regulations. Legitimate interest when a control is necessary to manage the risks of the business but does not follow directly from law.
Storage time: As a general rule, five years according to the money laundering regulations. In some cases, data may be retained for longer, but normally a maximum of ten years when the law permits or requires it.
3.3 Execution and administration of assignments
| Purpose | Processing of personal data | Categories of personal data |
| Perform legal duties and safeguard the client's rights and interests. | Communication, advice, preparation and review of documents, negotiation, litigation, evidence management, documentation and case administration. | Contact and identity information, information about employer, position and qualifications, as well as information in correspondence, agreements, project materials, procurement documents, process materials, meeting notes, audio or video recordings and other assignment documentation. |
Legal basis: Fulfillment of contracts when the data subject is a client. Otherwise, legitimate interest in carrying out the assignment and safeguarding the client's rights and interests. Legal obligation when processing is required by law or Code of Professional Conduct for lawyers.
Storage time: During the assignment and thereafter normally for ten years, or for a longer period if the nature of the assignment or applicable rules justify it.
3.4 Invoicing and finances
| Purpose | Processing of personal data | Categories of personal data |
| Invoicing, collecting payments and fulfilling accounting and tax obligations. | Time reporting, invoicing, payment, accounting, tax management, client funds accounting and financial follow-up. | Name, contact information, position, invoice information, payment information and information about work performed. |
Legal basis: Fulfillment of contracts, legal obligations and legitimate interest in receiving payment and administering the business.
Storage time: According to accounting and tax regulations and, when the information is included in the client file, according to the retention period that applies to the assignment.
3.5 Contacts and inquiries
| Purpose | Processing of personal data | Categories of personal data |
| Respond to messages and inquiries and manage contacts. | Receiving, storing and responding to emails, phone calls and other messages. | Name, contact information, employer, position and other information provided in the contact. |
Legal basis: Legitimate interest in communicating and providing information. Pre-contractual measures when the contact concerns a potential assignment.
Storage time: As long as the contact is current and thereafter as long as the information is needed for follow-up, interest control or legal claims.
3.6 Suppliers and business relationships
| Purpose | Processing of personal data | Categories of personal data |
| Enter into, administer and follow up on agreements and other business relationships. | Management of contact persons, permissions, invoices, security and contract follow-up. | Name, contact information, employer, position, qualifications, contract information and invoice information. |
Legal basis: Fulfillment of contracts and legitimate interest in administering and protecting the business.
Storage time: During the contractual relationship and thereafter as long as the data is required by law or for legal claims.
3.7 Marketing, events and mailings
| Purpose | Processing of personal data | Categories of personal data |
| Provide information about and develop the business and administer events and mailings. | Management of participants, subscriptions and relevant business contacts as well as sending out information. | Name, email address, phone number, employer, position, participation and communication choices. |
Legal basis: Consent when required. In other cases, legitimate interest in informing about and developing the business.
Storage time: Until consent is withdrawn, you object or the data is no longer needed. Unsubscription data may be saved to ensure that new mailings are not made.
3.8 Recruitment
| Purpose | Processing of personal data | Categories of personal data |
| Implement and administer recruitment. | Assessment of applications, interviews, reference checking and communication with applicants. | Name, contact information, application documents, resume, education, work experience, references and interview documentation. |
Legal basis: Pre-contractual measures and legitimate interest in recruiting. Consent to data shall be saved for future recruitment when consent is required.
Storage time: During recruitment and thereafter for as long as necessary for legal claims. Longer storage for future recruitment only occurs with legal support.
3.9 Legal claims and information security
| Purpose | Processing of personal data | Categories of personal data |
| Protect our rights and those of others and prevent and manage security incidents. | Establishing, establishing and defending legal claims, as well as logging, authorization control and investigation of incidents or abuse. | The personal data relevant to the claim or incident as well as technical data, such as IP address, log data and data about the use of our IT systems. |
Legal basis: Legitimate interest in protecting the business and establishing, exercising or defending legal claims and legal obligation when processing is required by law.
Storage time: As long as the data is needed for the claim, security purpose or a legal obligation.
4 Assessment of legitimate interest
When we base processing on legitimate interest, we have assessed that our interest or that of a third party outweighs the data subject's interest in the protection of their personal data. The assessment takes into account the nature of the processing, the data, the relationship to the data subject, reasonable expectations and applied safeguards. You have the right to object to the processing.
5 Who can access the personal data?
We only disclose personal data when it is consistent with attorney-client privilege, the assignment, and applicable data protection legislation. Depending on the circumstances, recipients may be:
- the client and persons designated by the client
- courts, arbitration tribunals, arbitration institutions, authorities and other public bodies
- counterparties, agents, witnesses, experts, surveyors, consultants, insurance companies, banks and other advisors
- The Swedish Bar Association, the Swedish Police Authority and other recipients when providing information is required by law or good legal practice
- providers of IT operations, document and case management, email, cloud storage, security, electronic signing, financial administration, communication and other support services
Suppliers who process personal data on our behalf may only do so in accordance with our instructions and are subject to contracts, confidentiality requirements and appropriate safeguards. If data is processed outside the EU or EEA, we ensure that there is an appropriate transfer support. You can contact us for more information. A supplier may in some cases be an independent data controller.
We do not sell personal data.
6 Information security and external IT services
We take appropriate technical and organizational measures to protect personal data. The measures are tailored to the risks and may include access control, strong authentication, encryption, logging, backups, incident management, training and supplier requirements.
Before using external IT, cloud or AI services, we assess the service's security, confidentiality, contractual terms, subcontractors, access options, storage locations and the ability to revert or delete information. Confidential client information may not be used for the provider's own purposes or model training without legal and ethical support.
7 Automated decisions
We do not make decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you.
8 Your rights
You may, depending on the circumstances, have the right to:
- receive information about how we process your personal data and access the data
- have incorrect or incomplete information corrected
- request that data be deleted
- request that processing be restricted
- object to processing based on legitimate interest and always object to direct marketing
- receive data in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller
- withdraw consent. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn
The rights are not absolute. A request may be refused in whole or in part if further processing is permitted or necessary by law, good legal practice or for legal claims, or if disclosure would violate legal professional privilege or unduly affect the rights and freedoms of others. We may need to verify your identity before processing a request.
We will normally get back to you within one month. The time may be extended by another two months if the request is complex or if many requests have been received. In such cases, we will inform you of the extension and the reasons for it.
9 Questions and complaints
If you would like to exercise a right or have questions about our processing of personal data, you can contact us at kontakt@area.se.
You also have the right to file a complaint with the Swedish Data Protection Authority. Contact details and more information can be found at www.imy.se.