Data protection
Privacy policy
Version 1 · 6 November 2026
Kashif & Tausif AB, org.nr 556973-7892 (“we”) uses this service for our personal assistance: schedules, time, Försäkringskassan (the Swedish Social Insurance Agency), municipalities, payroll, finances, the care journal, quality, messages, documents and the client portal, on the web and in the app.
This policy describes which personal data is processed, where it comes from, why, who receives it, how long it is kept and what rights you have.
In short
- We are the controller for the data about you who work for us, receive assistance through us or are a representative or relative.
- The service is delivered by our processor Tizfai Technologies AB, which processes the data only on our instructions.
- Personal identity numbers, the journal, deviations, messages, bank accounts and files are stored encrypted, on servers in the EU.
- No advertising or analytics tracking, and personal data is never sold.
1. Who is responsible for the data?
Kashif & Tausif AB is the controller for the data about staff, clients who receive assistance, representatives and relatives. Contact us through Messages or Help in the app.
Tizfai Technologies AB, company registration number 559284-7379, Kumminvägen 1, 611 46 Nyköping, delivers the service and is our processor under a data processing agreement. Tizfai Technologies AB is itself the controller only for what it needs to keep the service secure and working, such as logins and security logs, and for its customer relationship with us.
2. Which data is processed?
- Staff: name, personal identity number, contact details, employment, schedule, hours worked, absence, pay, tax, bank account, competences, the data Försäkringskassan requires about assistants and BankID signatures. For criminal record extracts we note that one was shown; a copy is kept only where the law requires it.
- Clients who receive assistance: name, personal identity number, decisions from Försäkringskassan and the municipality, schedule, time, journal, care plan, deviations and Lex Sarah cases, contact details and documents.
- Representatives and relatives: name, contact details and what you do in the client portal yourselves, such as signatures, feedback and requests.
- Everyone who logs in: logins, trusted browsers and phones, and who changed what (the history).
3. Where does the data come from?
From us as employer and provider, from you, from BankID when you log in or sign, and from authorities we exchange data with, such as Försäkringskassan and Skatteverket (the Swedish Tax Agency).
4. Why, and on what legal basis?
- The assistance: planning, providing and documenting it under LSS and the Social Insurance Code, and reporting to Försäkringskassan and the municipality (contract with the client and legal obligation).
- The employer's obligations: employment, pay, tax, employer declarations, pension and the Working Hours Act (the employment contract and legal obligation).
- Quality and security: deviations, Lex Sarah, internal control and secure logins (legal obligation and legitimate interest).
- Communication: messages, notifications and the client portal (contract and legitimate interest).
5. The journal, health and other sensitive data
The journal, the care plan, deviations and sick leave are health data. We process them to provide assistance under LSS and for our obligations as an employer (Article 9(2)(h) and 9(2)(b) of the GDPR). They are stored encrypted, only those with permission can read them, every reading of the journal is logged, and Tizfai Technologies AB's support never reads journals, deviations, Lex Sarah cases or messages.
Personal identity numbers are processed where secure identification requires them, for example in reports to Försäkringskassan and Skatteverket.
6. Who receives the data?
- People working for us who need the data for their work. A client and the client's representatives see only what we open in the client portal, never pay.
- Authorities and recipients we send to: Försäkringskassan, Skatteverket, municipalities, the bank (the payroll file), Fora or Pensionsvalet, and Fortnox or Kivra if we use them.
- Our processor Tizfai Technologies AB and its sub-processors: Hetzner Online GmbH (servers in the EU), Finansiell ID-Teknik BID AB (BankID), Apple and Google (notifications to the app, without journals, pay or personal identity numbers) and OpenAI when we import a schedule from another system — names and personal identity numbers are then replaced by codes before the text leaves the servers.
- Authorities when the law requires it.
The data is stored and processed in the EU/EEA. Notifications are delivered by Apple and Google, and OpenAI may process the coded schedule text outside the EU/EEA; this happens with the safeguards the GDPR requires. We never sell personal data or share it for marketing.
7. The iPhone and Android app
The app shows the same service as the web and processes the same data. In addition:
- The login on the phone lasts 30 days from when it was last used. When you log out the phone is forgotten.
- Locking with Face ID, a fingerprint or the phone's passcode happens entirely on the phone. Nothing about your face or fingerprint leaves it.
- Notifications need your permission; the phone's notification token is then stored. You choose what you get under Settings → Notifications. A notification about a message names the sender, never the content.
- The app uses no location, no ads and no analytics tracking.
8. How long is the data kept?
- Pay, payments, employer declarations, invoices and receipts: until the end of the seventh year after the calendar year in which the financial year ended (the Swedish Bookkeeping Act).
- The journal: deleted two years after the last entry, unless we must keep it longer.
- Lex Sarah cases: at least five years after they were closed.
- Reports to Försäkringskassan and the municipality: as long as the records can be requested, and at least as long as the bookkeeping.
- Files in the trash: deleted after 30 days.
- Everything else: as long as needed for its purpose, for example during the employment or the assignment.
9. How is the data protected?
All traffic is encrypted (HTTPS). Sensitive data and files are stored encrypted, passwords only as hashes. A new browser or phone is confirmed with a code. Everyone sees only what their permissions allow, and changes are logged. When Tizfai Technologies AB's support helps us in the service, that is logged.
11. Your rights
You have the right to know which data we process about you and get a copy, have errors corrected, have data deleted, restrict or object to the processing, and receive data you provided yourself in a machine-readable format. The right to deletion does not cover what we must keep by law. How to have your account deleted is on the page Delete your account.
Contact us through Messages or Help in the app. If you are unhappy with how your data is processed, you can complain to the Swedish Authority for Privacy Protection (imy.se).
12. Changes and contact
We publish changes here with a new date and version number. Controller: Kashif & Tausif AB, org.nr 556973-7892. Contact: through Messages or Help in the app.