Privacy policy for Högre for landlords

Who is responsible

Leija Software AB, company registration number 559317-2801, Linfrögatan 2A, 702 50 Örebro, Sweden, is the controller of your personal data under the General Data Protection Regulation (GDPR). Questions about how we handle your personal data can be sent to privacy@leija.se.

What the app processes about you

• Your email address, so that you can sign in with a code we email to you (performance of a contract).
• Device name, platform (iOS or Android) and app version, stored when you sign in so that signed-in devices can be listed and blocked, and so that we can ask you to update a version that is no longer supported (performance of a contract).
• Push token, platform and language, if you turn on notifications, so that we can send notifications to your phone. Notifications are delivered through Expo (650 Industries, USA), Apple and Google, and show the address and time, never applicants' names. You can turn them off in the app or in your phone's settings (performance of a contract).
• Operating system, app version and a random installation ID when the app checks for updates. Updates are delivered through Expo, and this data is not linked to you or your account (legitimate interest in fixing errors in the app quickly).
• The actions you take in the app, such as attendance markings, decisions on applicants and internal notes. They are stored in Högre together with who performed them, in the same way as in the web portal (performance of a contract).
• Pseudonymous usage statistics, such as which screens are viewed, sign-ins, onboarding steps and whether a notification is opened. The statistics are processed by our analytics provider PostHog in the EU and linked to a pseudonymous ID, never to your email address or name. Your IP address is not used to determine where you are (legitimate interest in improving the services).

The app does not collect your location, contacts, photos, camera, microphone or advertising ID. It does not track you across other companies' apps or websites, and no data from the app is sold or shared for advertising.

Security on your phone

Candidate details and notes are never stored on the phone. Lists of viewings, time proposals and candidates are cached on the phone so that the app works with poor coverage, and attendance markings made without coverage are kept there until they have been sent. All of this is deleted when you sign out. Your sign-in (session token) is stored in the phone's secure storage, the Keychain on iOS and the Keystore on Android. The Face ID or fingerprint lock is checked by the phone itself, and nothing from it leaves the phone. All communication between the app and Högre is encrypted over HTTPS.

Applicants' data in the app

The app shows information about applicants, such as name, contact details, income and credit level, for the lettings your organization has in Högre. We process this data on behalf of the landlord: the landlord is the controller and Leija is the processor.

Service providers

We use service providers for hosting (Vercel), analytics (PostHog, in the EU) and notifications and app updates (Expo, in the USA). They may only use your personal data for the purposes we have agreed with them. For providers outside the EU/EEA we use appropriate safeguards, such as the European Commission's standard contractual clauses.

How long we keep your data

A sign-in on a phone expires after 90 days without use, and when you sign out. Personal data linked to your use of the services is kept for no longer than 180 days after you last used them, unless a longer period is required by law or to establish, exercise or defend legal claims.

Your rights and deletion

You have the right to access your personal data and to request rectification, erasure or restriction of the processing. Where the processing is based on our legitimate interest, you have the right to object to it, and where it is based on a contract, you have the right to data portability.

Your account belongs to your organization. To have the account and your data deleted, contact your organization's administrator, who can remove you as a user in the web portal, or email support@hogre.se. When you sign out of the app, the sign-in for that phone is blocked. For other requests about your rights, email privacy@leija.se. We may ask you to verify your identity before we handle a request.

If you have a complaint about how we process your personal data, you can contact the Swedish Authority for Privacy Protection (IMY) or the data protection authority in your country.

Changes

We may update this policy. The latest version is always available on this page.