CLVR Benefits

GDPR overview

GDPR implementation is concrete and documented rather than merely asserted. A data protection officer is named and reachable at dpo@clvrbenefits.com, with a five-working-day response commitment. The privacy policy sets out four legal bases, enumerates seven data subject rights and names the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), as the route for complaints; the Trust Center commits to a thirty-day turnaround on access, correction, deletion and portability requests. Article 22 is addressed explicitly: AI expense decisions are human-in-the-loop, every decision carries a confidence score, anything below 85% confidence goes to manual review, and HR can reverse any decision. A record of processing activities is maintained internally and reviewed each release, breach notification is set at 72 hours, and material policy changes are notified 30 days in advance.

Who owns the data?

For the employee data held in the platform, the employer is the data controller and CLVR Benefits AB acts as its processor under a Data Processing Agreement signed as an annex to the commercial contract. The employer therefore decides what is held and why, and CLVR may only process it within the bounds that agreement sets. CLVR is controller in its own right only for the marketing site, prospects and its own staff. Any benefit provider an employee transacts with becomes a separate controller for the order it fulfils. The privacy policy, effective 21 May 2026, states that CLVR does not sell personal data.

Reuse rights

Employees cannot freely reuse platform data on their own initiative, because the data belongs to the employment relationship rather than to the user account. What the GDPR guarantees is nevertheless available: the right to obtain a copy of personal data and to port it to another provider in a structured, commonly used and machine-readable format, exercised by writing to the data protection officer. On the employer side, reuse is a designed feature rather than a concession: monthly payroll reports carrying benefit value, taxable benefit and VAT lines can be exported in whatever format the existing payroll system expects, with no proprietary format and no lock-in, and audit and sign-in logs can be exported to Excel on request. CLVR itself uses the data to run the service, to report usage back to the employer, and, where consent is given, for marketing; aggregated statistical data may be used for any purpose so long as it identifies nobody.

Data retention & training

Hosting summary

All servers and data are hosted within Europe only, and the vendor states that customer data never leaves the EU or EEA. Primary infrastructure runs on Microsoft Azure for virtual machines and managed storage, while database backups and file storage sit on Amazon AWS S3 in EU regions. Data at rest is encrypted with AES-256 using platform-managed keys, with a further application-level layer of AES-256-GCM over stored integration credentials and passwords hashed using scrypt. Traffic is encrypted with TLS 1.2 or above, HSTS is set for two years with includeSubDomains and preload, and application-to-database connections use full certificate verification; the database itself is not exposed to the internet. Backups run every 24 hours and are kept for seven days with server-side encryption. Eight sub-processors are published by name with their location and purpose. Note that the ISO 27001 and SOC 2 certifications cited belong to those providers, not to CLVR itself, and that two marketing and sales CRM sub-processors are US-based under standard contractual clauses, with no customer, employee or payroll data sent to them.