VARP
Svenska

Privacy notice – Varp

Last updated:

What Varp is

Varp is a service that ranks likely buyers of Swedish companies, built by norrifrån. It is currently a hobby and learning project used only by us. We plan to offer it as a paid service later.

To show who decides in a company and which companies share people, Varp processes data about people in their company role. This page explains what we collect, why, and what rights you have.

The person register (annual-report signatories, insiders and project leads) has been built since 20 October 2026.

Data controller

norrifrån (website: https://norrifran.se)
Contact: [email protected]

What data we process

  • Signatories of annual reports: name, role (board member, chair, CEO, deputy CEO, deputy board member, employee representative), signing date and the company concerned. Also the auditor and audit firm named in the annual report.
  • Insiders of listed companies (PDMR): name, position, reported transactions (date, instrument, volume, price) and the company through which a notification was made (e.g. a holding company). Persons closely associated with insiders are not stored by name, only as a flag on the transaction.
  • Project leads of publicly funded research and innovation projects: name, role and organisation.
  • Contact persons in public job advertisements: name, title and the contact details the advertisement itself gives.
  • Sole traders and undivided estates in SCB's business register: the full SCB record for the business and its workplaces, with the personal identity number (a sole trader's organisation number is the owner's personal identity number) and the names, addresses, phone numbers and e-mail addresses the record contains.
  • Applicants, holders and agents in PRV's trademark register: name, address and country, the register event texts for every mark (they may name previous holders), and the text of the mark when the applicant is a person.
  • Planned: buyers and sellers who are private individuals in deals notified to Konkurrensverket or the European Commission: we will store the name, whether the person buys or sells, the company the deal concerns, case number, dates and outcome. No addresses, personal identity numbers or contact details will be stored. This starts only after our assessment of the processing is complete. Law firms acting as counsel will be stored as companies. Individual lawyers and officials of Konkurrensverket and the Commission are not added; their names appear only in the case documents we keep in unprocessed form.
  • For every item we keep its provenance (source, document and date).

Personal identity numbers. The person register contains no personal identity numbers. SCB's records of sole traders and estates do contain them, because a sole trader's organisation number is the owner's personal identity number and an estate may have the deceased's personal identity number as its number. Those records are stored in the separate part of the database intended for personal data, are accessible only to the operator and are not shown to customers. When the employer in a job advertisement is a sole trader, its organisation number is stored only as a one-way keyed hash that cannot be reversed to the identity number. A reference in PRV's register that reads as a personal identity number is likewise stored only as a keyed hash. Sole traders in Bolagsverket's company file are not imported.

Raw source files and backups may contain personal identity numbers and private addresses as they appear in the public sources (e.g. SCB's company register for sole traders, the raw Bolagsverket file and c/o lines in Bolagsverket responses, pages from the FI register, case documents from Konkurrensverket and the Commission). They are kept in unprocessed form and are not used for the person register. The only planned exception is buyers and sellers as described above.

We do not use private phone numbers or private e-mail. SCB's records include phone numbers and e-mail addresses for some sole traders; they stay in the part of the database that only the operator can access and are not used or shown. Private addresses appear only as they stand in SCB's and PRV's records and in raw source files.

Where the data comes from

All data is taken from public sources:

  • Bolagsverket (Swedish Companies Registration Office) – annual reports and the company file (open data).
  • Finansinspektionen (Swedish FSA) – the insider register.
  • Vinnova and Formas – open data on funded projects.
  • Arbetsförmedlingen/JobTech – public job advertisements (CC0).
  • SCB (Statistics Sweden) – the business register, records of sole traders and undivided estates.
  • PRV (Swedish Intellectual Property Office) – the trademark register (open data).
  • Konkurrensverket (Swedish Competition Authority) – the public case register and decisions in merger cases (public records).
  • European Commission – notifications of concentrations in the Official Journal of the European Union and the Commission's merger case list (planned).
  • Cision – press releases. We fetch Cision's lists of press releases and keep them as raw files. In the database we store only the address and the headline words of press releases about acquisitions, no text. The headline words can contain a name.

Why, and on what legal basis

The purpose is to identify and assess possible buyers of companies: who leads a company, which people sit on several boards, and which companies are therefore connected.

SCB's records are used for a complete business register for statistics by industry and region. The person register does not use them, and sole traders from SCB's records are never ranked in buyer lists. PRV's trademark register is used to spot trademark transfers as a signal of an acquisition. Decisions from Konkurrensverket are used to see which companies bought and sold which; the Commission's notifications will be used the same way. Planned: buyer lists will also be able to include buyers and sellers who are not companies, for example a private individual buying a company for the first time. A private individual who has bought or sold in a notified deal may then appear in our internal lists.

We rely on legitimate interest (Article 6(1)(f) GDPR). Our legitimate interest is to build and provide company intelligence for business purposes. We consider the processing reasonable because the data is already public, concerns professional roles and reveals nothing about private life. The assessment is documented and can be requested at the contact address above. For the data from SCB and PRV the assessment is being completed and will be ready by 2026-11-30.

Planned: for buyers and sellers who are private individuals, our legitimate interest is to be able to show who buys and sells companies, also when it is a person and not a company. A deal can reveal something about a person's finances. We will therefore store only the name and facts about the deal itself, never addresses or personal identity numbers, and only for ten years from the decision. The assessment for this processing will be ready by 2026-11-30, and the processing starts only once the assessment is complete.

Who receives the data

Today: no one. The data is visible only to us as operators. It is not shared with customers, not shown on the website and not sold.

Later: if Varp becomes a paid service, paying customers may see personal data as part of the service. Before that happens we will update this page and make a new assessment. Personal data combined with bankruptcy or liquidation signals is never shared with customers. Varp is not a credit reference service.

Where the data is kept

The data is stored in Sweden on our own equipment (computer and external storage device), except operational status (see below). Personal data is held in a separate part of the database that only the operator can access. Manual access through the service's commands is logged. Backups are kept by the data controller. Stored data is not transferred outside the EU/EEA. Operational alerts are sent to Discord, a US service. The alert texts are filtered to remove personal identity numbers and quoted values, but it has not been verified for every alert that no personal data can be included. Operational status (run statistics and error texts, which may contain personal data) is sent every 15 minutes to varp.se's server at our hosting provider in the EU, is shown only after sign-in, is not filtered and is deleted after 14 days.

How long we keep the data

Data about a role is kept for five years after the role ends, then deleted. Automatic deletion will be in place no later than before the launch of the paid service; until then deletion is done manually.

Planned: data about buyers and sellers who are private individuals will be kept for ten years from the decision date. Deals older than that are never added to the person register; they are kept only as facts about the companies.

For contact persons in job advertisements, SCB's records of sole traders and estates, PRV's applicants, holders and agents, and raw source files, the retention period is not yet decided. It will be decided by 2026-11-30.

Visitor statistics on varp.se

We measure visits to varp.se with Umami, which we run on our own server (stats.nmspc.com). Umami uses no cookies. Your IP address is not stored in the statistics: it is used only in the moment to calculate an anonymous identifier (a hash with a salt that changes every month and differs for each website) and an approximate location. We do not track you across websites, and we look only at aggregate statistics on pages and visits.

No automated decisions

Varp makes no automated decisions that have legal effects on you or similarly significantly affect you. The ranking concerns companies. Planned: a private individual who has bought or sold a company in a notified deal may appear as a possible buyer in a list that only we see, but no decision is made about the person.

Your rights

You have the right to:

  • know whether and what data we hold about you (access),
  • have inaccurate data corrected (rectification),
  • have data deleted (erasure),
  • have processing restricted (restriction),
  • object to the processing (Article 21 GDPR). If you object we remove you from all outputs within 30 days, unless we can show compelling legitimate grounds that override your interests. You may limit the objection to one company or have it apply to all companies, including companies where you appear in the future. Contact persons in job advertisements are removed by deleting their contact details; this is handled manually within 30 days.

Write to [email protected]. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), https://www.imy.se.