Privacy Policy for Oneo

Last updated: 31 July 2026

About this policy

Oneo is a digital service that helps consultants and companies find relevant matches based on, among other things, skills, experience and assignment requirements.

This privacy policy describes which personal data we process, why we process it, who may access it and which rights you have.

The policy applies to you if you:

create or use a consultant account,
use Oneo as a representative of a company,
contact us or visit our website.

Who is responsible for your personal data?

Oneo is operated by:

Rendly AB
Company registration number: 559569-5577
Storängsparken 9 C
614 32 Söderköping
Sweden

Rendly AB is the data controller for the processing of personal data described in this policy.

Questions about personal data and requests to exercise your rights can be sent to:

privacy@oneo.se

Which personal data do we process?

Which data we process depends on how you use Oneo.

Consultants

When you create and use a consultant account, we may process:

name and contact details,
email address and account details,
professional role and specialisation,
skills, technologies and areas of work,
education, certifications and language skills,
previous employments and assignments,
years of experience and experience level,
CV, profile text, portfolio and links,
preferences regarding assignments, work location and remote work,
availability, desired workload and rate level,
matches, expressions of interest and contacts with companies,
messages and other communication through the service,
information you provide when contacting our support.

Company users

When you use Oneo on behalf of a company, we may process:

name and work-related contact details,
position or role,
which company or organisation you represent,
login and account details,
information about the company's consultant needs and published assignments,
requirements regarding skills, experience, location, availability and workload,
matches, selections and contacts with consultants,
messages and other communication through the service,
invoicing and contract details, where relevant,
information you provide when contacting our support.

Technical information

When you use Oneo, we may also process technical data, for example:

IP address,
type of device, operating system and browser,
time of logins and activity,
security and error logs,
cookies and similar technologies,
information about how the service is used.

We use this information to make the service work, for troubleshooting, for statistics and to protect Oneo and our users.

Data you should not provide

Oneo is not intended for the processing of sensitive personal data.

Therefore, do not provide data about, for example:

health or disability,
political opinions,
religion or other beliefs,
trade union membership,
sexual orientation or sex life,
genetic or biometric data,
criminal offences, convictions or suspicions of crime.

Also avoid entering personal identity numbers or other data that is not needed to create relevant matches.

If such data is provided without being needed, we may remove it.

Where do we get the data from?

We mainly receive personal data directly from you when you:

create or update your account,
fill in a consultant profile,
upload a CV or other material,
publish an assignment,
communicate with other users,
contact us,
use the service.

We also generate certain information through the service, for example matching results, security logs and usage history.

If another user provides data about you, for example in connection with an invitation or communication through the service, we may also receive data from that user. In that case, we inform you in accordance with applicable data protection rules.

Why do we process the personal data?

Creating and administering accounts

We process contact, profile and account data to create your account, verify logins and give you access to the service.

For consultants, the processing is necessary to perform the agreement on the use of Oneo, Article 6(1)(b) of the GDPR.

For people using Oneo on behalf of a company, we base the processing on our legitimate interest in providing the service and administering the relationship with the company, Article 6(1)(f) of the GDPR.

Matching consultants and companies

We process consultant profiles and companies' assignment requirements to:

compare skills and experience with assignment requirements,
produce and rank relevant matches,
show suitable assignments to consultants,
show relevant consultant profiles to companies,
facilitate contact between consultants and companies.

For consultants, the processing is necessary to provide the matching service the consultant has registered for, Article 6(1)(b) of the GDPR.

For company users, the processing is based on our legitimate interest in providing a functioning consultant and matching service to the company, Article 6(1)(f) of the GDPR.

Communicating and providing support

We process contact details and communication to:

send important information about the account and the service,
answer questions,
handle support cases,
inform about changes to the service or our terms.

For account holders, the processing is normally necessary to perform the agreement, Article 6(1)(b) of the GDPR. For company representatives and other people who contact us, the processing is based on our legitimate interest in answering questions, providing support and administering the service, Article 6(1)(f) of the GDPR.

Administering contracts and payments

We process necessary contact, contract and invoicing data to administer contracts, payments and business relationships.

When the data subject is a party to the contract, the processing is necessary to perform the contract, Article 6(1)(b) of the GDPR. For contact persons and representatives of companies, the processing is based on our legitimate interest in administering the relationship with the company, Article 6(1)(f) of the GDPR.

Protecting and improving Oneo

We process technical data and usage information to:

prevent misuse and unauthorised access,
detect and investigate security incidents,
troubleshoot technical problems,
measure the service's functioning and performance,
develop and improve the service.

The legal basis is our legitimate interest in operating a secure, stable and useful service, Article 6(1)(f) of the GDPR.

When analysis requires cookies or similar technology that is not necessary for the service, we obtain consent where required, Article 6(1)(a) of the GDPR.

Complying with legal obligations

We may process and retain certain personal data to comply with law, for example accounting and tax rules as well as binding decisions by authorities and courts.

The legal basis is that the processing is necessary to comply with a legal obligation, Article 6(1)(c) of the GDPR.

Optional mailings

If you choose to subscribe to news or other optional mailings, we process your email address based on your consent, Article 6(1)(a) of the GDPR.

You can unsubscribe at any time via the link in the message or by contacting us.

Legal claims and changes to the business

We may process necessary personal data to establish, exercise or defend legal claims. We may also process necessary data in connection with a possible sale, reorganisation or transfer of all or part of Oneo or Rendly AB.

The processing is based on our legitimate interest in protecting our rights and carrying out legitimate changes to the business, Article 6(1)(f) of the GDPR. The data is limited to what is needed and protected through appropriate confidentiality commitments.

How does the matching work?

Oneo uses automated processing to compare data in consultant profiles with companies' assignment requirements. The automated matching constitutes profiling under the GDPR, since profession-related data is used to assess how well a consultant profile corresponds to a specific assignment.

The matching may, for example, take into account:

skills,
professional experience,
roles,
experience level,
availability,
work location and remote work options,
other requirements and preferences specified in the service.

The result is used to rank or recommend relevant matches. The matching may therefore affect which consultant profiles or assignments are shown and in which order they are shown.

The matching does not on its own make decisions about employment, assignments or contracts. The company and the consultant decide themselves whether they want to make contact and proceed with a match.

We do not use data about, for example, gender, ethnic origin, religion, appearance or sexual orientation to calculate matches.

You can contact us if you want to know more about how the matching works or if you believe a match is based on incorrect data.

How are consultant profiles displayed?

Oneo is designed so that the consultant's skills and experience are at the centre.

In the first matching step, a company may see a de-identified or pseudonymised version of the consultant profile. It may contain, for example:

professional roles,
skills,
experience,
location or geographic area,
availability,
other data relevant to the assignment.

Directly identifying data, for example name and contact details, is shown or disclosed only when needed in the matching process and in accordance with how the service's contact and approval features are designed.

A consultant's full profile is not automatically available to all companies merely because the consultant has created an account.

Who may access the personal data?

Personal data may be disclosed to the following categories of recipients.

Other users of Oneo

Companies may access consultant and matching information when needed to find and evaluate a possible match.

Consultants may access information about companies, assignments and relevant contact persons when needed for the matching.

Which data is shown depends on the user's role, the matching flow and the settings available in the service.

When a company receives personal data and itself decides how the data is to be used for the company's own evaluation or continued contact, the company may be an independent data controller for that further processing. The company's own privacy information then applies to that processing.

Suppliers

We engage suppliers who help us operate Oneo, for example suppliers of:

hosting and data storage,
databases and technical infrastructure,
email and messaging,
login and account management,
security, monitoring and error logging,
web analytics and other web technologies,
support,
payment and invoicing.

Suppliers who process personal data on our behalf may only use the data according to our instructions and are bound by data processing agreements.

Authorities and legal advisers

We may disclose data if required by law, a decision by an authority or a court order.

We may also share necessary data with legal advisers or other experts to establish, exercise or defend legal claims.

Changes to the business

If all or part of Oneo or Rendly AB is sold, reorganised or transferred, relevant personal data may be disclosed to a potential buyer or adviser. Only the data needed for the process may then be shared, and the data must be protected through appropriate confidentiality commitments.

Processing within the EU

All storage and other processing of personal data within Oneo takes place within the EU.

We only engage suppliers established within the EU that process and access Oneo's personal data within the EU.

We do not transfer or make personal data available to recipients outside the EU or the EEA.

If this changes, we will update this privacy policy and ensure that any transfer takes place in accordance with the GDPR before the transfer begins.

How long do we keep the data?

We do not keep personal data longer than needed for the purpose for which the data was collected.

As a general rule, the following applies:

Account and profile data is kept as long as the account is active.
When an account is deleted, the data is removed from our active systems within 30 days, unless it needs to be kept to comply with a legal obligation or handle a legal claim.
Data may remain in backups for up to 90 days before the backups are overwritten.
Security and error logs are kept for a maximum of 12 months from when the log data was created.
Support cases and related communication are kept as long as the case is active and thereafter for 12 months from when the case was closed.
Contract, invoicing and accounting data is kept as long as required by applicable law. Accounting records are normally kept for seven years after the end of the calendar year in which the financial year ended.
Data needed to establish, exercise or defend a legal claim may be kept until the claim has been finally settled or can no longer be pursued.

When the data no longer needs to be kept, it is deleted or anonymised.

Cookies and similar technologies

Oneo uses cookies and similar technologies that are necessary for the service to work.

The following necessary technologies are currently used:

_oneo_key is a session cookie used for session management, security, login and language settings. It is stored for the duration of the browser session.
phx:theme is local storage in the browser used to remember your choice of colour theme. The data is stored until you change your choice or clear the browser's storage.

Necessary cookies and technologies may be used without consent, since the service otherwise cannot work as intended.

Oneo also uses cookie-free web analytics to produce aggregated statistics about how the website is used. The analytics does not place any analytics cookie or persistent identifier on your device and is not used to follow you across different websites.

We currently do not use cookies for advertising or cross-site tracking.

If we use optional cookies or similar technologies in the future, you will be given the opportunity to accept or decline them before they are used. You will then also be able to change or withdraw your choice.

How do we protect the personal data?

We use technical and organisational security measures adapted to the nature and risks of the processing.

This may include:

encrypted transfer,
access control,
protected user accounts,
logging and security monitoring,
backups,
limited internal access,
incident management procedures,
regular updates of systems and dependencies.

Only people who need the personal data for their work should have access to it.

No digital service can guarantee complete security. If we discover a personal data breach, we handle it in accordance with applicable data protection legislation.

Is it mandatory to provide the data?

An email address and certain basic account details are needed for you to create and use an account.

As a consultant, you need to provide sufficient information about your skills and experience for Oneo to create relevant matches. If you do not provide such information, the service cannot work as intended and you may receive fewer or no matches.

Data that is optional should, where possible, be indicated as optional in the service.

Your rights

Depending on the situation, you have the following rights.

Access your data

You can request information about which personal data we process about you and receive a copy of the data.

Correct inaccurate data

You can request that inaccurate or incomplete data be corrected. Many profile details can also be changed directly in your account.

Delete your data

You can request that your account and your personal data be deleted.

The right to erasure does not always apply, for example if we must keep certain data by law or need it to handle a legal claim.

Restrict the processing

In certain situations, you can request that the processing of your data be restricted, for example while we verify whether the data is accurate.

Object to the processing

When the processing is based on our legitimate interest, you can object to the processing.

We must then stop processing the data unless we can demonstrate compelling legitimate grounds for continued processing or need the data for legal claims.

You always have the right to object to direct marketing.

Move your data

When the processing is based on a contract or consent and is carried out automatically, you may have the right to receive the data you have provided to us in a structured, commonly used and machine-readable format.

Withdraw consent

When the processing is based on consent, you can withdraw the consent at any time. The withdrawal does not affect processing that has already taken place before the consent was withdrawn.

Request information about the matching

You can contact us if you want to know more about how Oneo's automated matching works or if you believe a match is based on incorrect data.

How to exercise your rights

Send your request to:

privacy@oneo.se

State which right you want to exercise and which email address is linked to your account.

We may need to ask for additional information to ensure that we disclose or change data for the right person. We do not request more information than is needed to verify identity.

We respond to your request without undue delay and at the latest within one month. If the request is complicated or if we have received many requests, the response time may be extended by a maximum of two months. In that case, we will inform you of the extension and the reason for it within one month of receiving the request.

Exercising your rights is normally free of charge.

Complaints

Please contact us first if you have questions or are dissatisfied with how we process your personal data.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

Information about how to lodge a complaint is available at www.imy.se.

Changes to this policy

We may update this privacy policy as the service evolves, our ways of working change or new legal requirements are introduced.

The latest version is always available on Oneo's website. The date at the top shows when the policy was last updated.

If a change is important to you as a user, we will inform you in an appropriate way, for example through the service or by email.

Contact

Questions about this privacy policy or our processing of personal data can be sent to:

Rendly AB
Company registration number: 559569-5577
Storängsparken 9 C
614 32 Söderköping
Sweden

Email: privacy@oneo.se