In short

Bis Lab Credit Sverige AB is a credit information company licensed by the Swedish Authority for Privacy Protection, IMY. It maintains a nationwide register of people registered as resident in Sweden who are aged 15 or over. Personal credit reports are provided from age 16.

The Swedish Credit Information Act permits personal data to be processed for credit information without consent. This does not mean that anyone may obtain a personal credit report. The requester must have a legitimate need, such as an existing or proposed credit agreement or another valid reason to assess financial risk.

Want to see your information? A free register notice is available through My Page after BankID authentication, through Kivra or by post. When a report is disclosed, you receive a free credit information copy at the same time through Kivra or by post.

1. Who is the controller?

Bis Lab Credit Sverige AB
Organisation number: 559522-6076
VAT number: SE5595226076
Postal address: Mailbox 306, 411 41 Gothenburg, Sweden
IMY licence: IMY-2025-9288, decision dated 18 December 2025

Data Protection Officer (shared across the group): personvern@bislab.no

Bis Lab Credit Sverige AB is the controller for Swedish credit information. Bislab AS in Norway developed the software used for the service. If Bislab AS processes Swedish personal data, for example for operations or support, it does so as a processor on behalf of Bis Lab Credit Sverige AB, under a data processing agreement and in the systems operated in Sweden under the licence.

2. Why do we hold information about you?

The purpose is to give companies, banks, credit market companies, consumer credit providers, organisations, authorities and other public bodies reliable information for assessing creditworthiness and financial risk. The activity is governed by the Swedish Credit Information Act and the IMY licence.

Section 5 of the Credit Information Act permits personal data to be processed for credit information without consent, and the individual has no Article 21(1) right to object to that specific processing. The GDPR basis for the processing is Article 6(1)(e): processing necessary for a task in the public interest expressed through regulated credit information activity.

3. What information do we process about individuals?

The licence limits the service. A credit report about a person registered as resident in Sweden who has reached age 16 may include:

• population data: personal identity number, name, address and marital status;
• business and engagement data: current business activity, current board positions and up to three years of history;
• property designation for owned real property;
• income data: income, general deductions, deficits, property tax and final tax for the three latest tax-return years;
• remarks: orders to pay, unsuccessful enforcement, tax-account deficit, other taxes and personal bankruptcy;
• default judgments;
• current debt balance and up to two years of historical debt balance at the Swedish Enforcement Authority;
• decisions to commence and approve debt restructuring;
• referral of an application for an order to pay to court, but for individuals not the application itself before an order has been issued;
• business prohibition for an individual, including the current court and relevant dates.

For legal entities and businesses we process corresponding relevant information, as well as liquidation orders with date, reason and closure, and information about mergers, company reconstruction, liquidation and repossession cases. Credit monitoring is offered only for legal entities.

We do not process special-category data in credit information. Under the licence we do not collect or store information about criminal offences, criminal judgments, criminal procedural measures or administrative deprivation of liberty. We also do not calculate an estimated risk of economic crime.

4. Where does the information come from?

The licence specifies these official sources:

• the Population Register at the Swedish Tax Agency;
• the Swedish Enforcement Authority;
• the Swedish Tax Agency;
• the Property Register at Lantmäteriet;
• the Swedish Companies Registration Office;
• Statistics Sweden, SCB.

Data is obtained electronically. Older data is replaced by new data and deleted according to the periods below. My Page shows the current register content about you.

5. When may a personal credit report be disclosed?

For an individual, the customer must have a legitimate need arising from an existing or proposed credit agreement or a similar valid reason for making a financial risk assessment. Customers must identify themselves, obtain approved access and accept contracts prohibiting requests that breach the law or contract. Misuse may lead to warning or termination.

Reports are delivered through API-based services or an authenticated portal. A disclosure is not registered as a payment remark.

When a report is disclosed, you receive at the same time and free of charge an identical copy with the information required by Section 11 of the Credit Information Act. The copy is placed in Kivra or sent by post on the following day to your registered address. It identifies the requester. The requester may voluntarily add a brief explanation of why, or for whom, the report was requested.

Contact the requester if you want to know why the report was requested or why an agreement was declined. Contact us about the report contents, our processing or a potentially unauthorised request.

6. Credit assessment, profiling and AI

We may combine the permitted information and produce credit assessments or ratings. A score or risk class is a statistical estimate of risk. We may use only the categories and carry out only the activities covered by the application and the IMY licence.

Machine learning or other AI may be used only where it remains within the licence and complies with the Credit Information Act, GDPR, the EU AI Act and other applicable law. This means, among other things, that we use only relevant and permitted data, quality-assure and monitor our models, document them and ensure human oversight where required.

Our customer normally makes the final decision and may apply its own data and rules. If a customer draws strongly on our score when making its decision, calculating the score may itself be an automated decision under GDPR Article 22. You therefore have the right to an understandable explanation of the principles and factors actually used to calculate your score, to express your view and contest the result, and to ask for a person at our company to review it. Our customer contracts set requirements for how the score may be used.

7. Who receives the information?

Recipients are approved customers requesting a report for a permitted purpose. Suppliers may process limited data for operations, security, authentication or communication under contract and instructions. Authorities may receive data where law requires or permits it.

We do not publish credit information using a publication certificate. Registers used for the service must not be transferred or made available contrary to the Credit Information Act.

8. Where is information stored and processed?

Under the IMY licence, all storage and processing of Swedish credit data takes place in Sweden, and the cloud services used operate in Sweden.

9. How long is information retained?

• Information about individuals is deleted when no longer needed and normally no later than three years after the relevant event occurred or condition ended.
• Information about a request or disclosure of a personal report is deleted no later than one year after the request.
• Debt-restructuring information is deleted in accordance with law, normally no later than five years after the commencement decision or when a later payment plan expires.
• Information about legal entities and businesses is deleted after five years under the licence.
• Activity logs are retained for six months and then deleted.
• Information is corrected or deleted earlier when the source changes, the data is inaccurate or misleading, or processing is no longer permitted.

10. Your rights

You may request free access to your personal data, receive a copy, and request correction, completion, deletion or restriction where the conditions apply. If data may be inaccurate, misleading or unlawfully processed, we will investigate without delay. If inaccurate or misleading data was disclosed, we will send a correction or addition to recipients during the previous twelve months where the law requires it.

You do not have an Article 21(1) right to object to processing conducted under Section 5 of the Credit Information Act, but you retain your other rights under GDPR and the Act. We may require secure identity verification.

Contact us first so that we can investigate. You may also lodge a complaint with the Swedish Authority for Privacy Protection.

Changes to this notice

We may update this notice when our services, data sources, legal requirements, company roles or processing locations change. The current version and date will be published here. Any material changes will be made in accordance with the conditions of the IMY licence.