1. Who is responsible for your Personal Data?
This privacy notice (“Privacy Notice”) applies when Gigapay Sweden AB (559070-3616), Box 3181, 103 63 Stockholm, Sweden (”Gigapay” also referred to as “we”) provides the service (“Service”) described in our Terms and Conditions - International Payouts and Terms and Conditions - Swedish Payouts (“Terms and Conditions”). The Purpose of the Service is to facilitate the administration and operational work surrounding payouts to Independent Contractors (“Creative”) who provide services in the creator economy (“Assignments”) for external principals (“Client”) in an international setting. The Client, the Creative, or an employee/representative of the Creative or Client may use the Service.
Data Subjects will need to share data about themselves (“Personal Data”) to claim a payout or use the Service. During the use of the Service, several parties may be involved. This Privacy Notice only applies to the processing performed by Gigapay in its capacity as a data controller. Therefore, we recommend that you also read the privacy policies of the other parties who may be involved in the use of the Service, for example, the Client may in certain cases process the Creative’s Personal Data beforehand and share it with Gigapay prior to the Creative’s onboarding in the Service.Gigapay is the data controller for Gigapay’s processing of the Creative’s and Client’s (“Data Subjects”) Personal Data and is responsible for ensuring that the processing takes place in accordance with the applicable EU Data Protection Regulation (“GDPR”).
2. Contact details
Gigapay has appointed a Data Protection Officer, who can be contacted for any question regarding the processing of your Personal Data. Data Subjects may submit inquiries regarding Personal Data protection, privacy and security matters to security@gigapay.se, +46 (0) 79 104 29 29. Please write GDPR - DPO in the subject line for a quicker response and describe your case.This Privacy Notice is designed to explain how your Personal Data is processed following applicable legislation. To use the Service, you must, in addition to the requirements outlined in the Terms and Conditions, acknowledge this Privacy Notice. Please do not hesitate to contact Gigapay if you have any questions about this Privacy Notice, the processing of your personal information, or if you would like an extract from the registry.
3. How is Gigapay processing your Personal Data
Gigapay will process your Personal Data for the following purposes and legal reasons.
|
Purpose of the processing
|
Legal basis for processing
|
Categories of Personal Data
|
When the purpose of using the Personal Data ends.
|
|
For the Service in general - Swedish payouts
The Service provided by Gigapay as merchant of record and an employer of record (Swedish: egenanställningsföretag), includes (i) administrative support for the Client and the Creative; (ii) the handling of billing; (iii) a compliance engine enabling the onboarding of the Creative; (iv) offering various payout solutions to the Creative; (v) salary payments and short term employment (“särskild visstidsanställning” in Swedish) for Swedish Creatives using the merchant of record Service; (vi) and reporting to the relevant tax authority, when applicable.
|
The processing is necessary for the performance of the contract between Gigapay and you (or the entity you represent), or to take steps at your request prior to entering into such a contract (Article 6(1)(b) GDPR). Where an element of this processing is not strictly necessary to perform that contract — for example, improving or securing the Service more generally — Gigapay relies on its legitimate interest in being able to provide a functioning and reliable Service to the Creative and Client (Article 6(1)(f) GDPR).
Where the Personal Data described in the Section includes special categories of personal data within the meaning of Article 9 GDPR (such as a medical certificate), Gigapay processes this data only to the extent necessary for carrying out its obligations and exercising specific rights in the field of employment and social security law, in accordance with Article 9(2)(b) GDPR, or, where no such obligation applies, with your explicit consent under Article 9(2)(a) GDPR.
As part of the compliance engine's onboarding process, an approval decision may in some cases be made through automated processing without human review. Where such a decision is based solely on automated processing and produces legal effects concerning you or similarly significantly affects you, Gigapay relies on the necessity of that processing for entering into the contract between you and Gigapay (Article 22(2)(a) GDPR). Any decision to refuse, reject, or decline an onboarding application is always reviewed and made by a person, and is never based solely on automated processing. Where you are subject to an automated decision as described in this paragraph, you have the right to obtain human intervention on Gigapay's part, to express your point of view, and to contest the decision, as further described in Section 7.
The reporting to the relevant tax authority described in this item is carried out on the basis that it is necessary for Gigapay to comply with a legal obligation to which it is subject (Article 6(1)(c) GDPR), as further described below.
|
Creative:
Name; Legal name; Personal number; Coordination number; Social media handle; Gender; Date of birth; Address; Email address; Bank account number; Bank name; Phone number; Details on income; ID documents; residence permit (Swedish: uppehållstillstånd); LMA card (Swedish: LMA-kort); Medical certificate; Nationality; SINK tax document; tax information and other documents; VAT number; Company registration number; IP-number; Information about your contacts with Gigapay’s customer service - Chat conversations and email correspondence; Your contacts between Creative and Client; Information about how the Creative and Client are interacting together such as messages, description of campaigns paid out through the Service and other interactions; Other information related to the employment of the Creative, such as contracts, termination of contract, scheduling, accidents, etc.
Client:
Administrator name; Administrator email; Phone number; Your contacts between Creative and Client; Information about how the Creative and Client are interacting together such as messages, description of campaigns paid out through the Service and other interactions; Bank account number
|
Service account:One (1) year after the Creative or Client stops using the Service or when they request the deletion of their Service account.
Merchant of record service:seven (7) years (Swedish Bookkeeping Act).
Employment of record service:10 years.
Gigapay may need to keep the data for a longer period. Please refer to Section 4 on the retention period for more information. Contact Gigapay for information (Section 2).
|
|
For the Service in general - International payouts
The Service provided by Gigapay includes (i) administrative support for the Client and the Creative; (ii) the handling of billing; (iii) a compliance engine enabling the onboarding of the Creative; (iv) offering various payout solutions to the Creative; (v) and reporting to the relevant tax authority, when applicable.
|
The processing is necessary for the performance of the contract between Gigapay and you (or the entity you represent), or to take steps at your request prior to entering into such a contract (Article 6(1)(b) GDPR). Where an element of this processing is not strictly necessary to perform that contract — for example, improving or securing the Service more generally — Gigapay relies on its legitimate interest in being able to provide a functioning and reliable Service to the Creative and Client (Article 6(1)(f) GDPR).
As part of the compliance engine's onboarding process, an approval decision may in some cases be made through automated processing without human review. Where such a decision is based solely on automated processing and produces legal effects concerning you or similarly significantly affects you, Gigapay relies on the necessity of that processing for entering into the contract between you and Gigapay (Article 22(2)(a) GDPR). Any decision to refuse, reject, or decline an onboarding application is always reviewed and made by a person, and is never based solely on automated processing. Where you are subject to an automated decision as described in this paragraph, you have the right to obtain human intervention on Gigapay's part, to express your point of view, and to contest the decision, as further described in Section 7.
The reporting to the relevant tax authority described in this item is carried out on the basis that it is necessary for Gigapay to comply with a legal obligation to which it is subject (Article 6(1)(c) GDPR), as further described below.
|
Creative:
Name; Legal name; Date of birth; Address; Email address; Social media handle; Gender; Bank account number; Bank name; Phone number; Details on income; ID documents; Nationality; Country of work; A1 certificate; Influencer Licence; Tax information and other documents; Electricity bills; VAT number; Taxpayer identification number (“TIN”); Company registration number; Information about your contacts with Gigapay’s customer service - Chat conversations and email correspondence; Your contacts between Creative and Client; Information about how the Creative and Client are interacting together such as messages, description of campaigns paid out through the Service and other interactions; IP-number; other information that may be requested by Gigapay during an audit.
Client:
Administrator name; Administrator email; Phone number; Your contacts between Creative and Client; Information about how the Creative and Client are interacting together such as messages, description of campaigns paid out through the Service and other interactions; Bank account number; Bank name.
|
Service account:One (1) year after the Creative or Client stops using the Service or when they request the deletion of their Service account.
Merchant of record service:seven (7) years (Swedish Bookkeeping Act).
Gigapay may need to keep the data for a longer period. Please refer to Section 4 on the retention period for more information. Contact Gigapay for information (Section 2).
|
|
Report and/or store Personal Data for legal requirements
Fulfilling statutory requirements as an employer of record and merchant of record.
Depending on the Creative’s status, Gigapay may be required to report Personal Data tied to the employment relationship and the compensations paid out through the Service to e.g. the Swedish tax authority (Swedish: Skatteverket), foreign tax authorities, the Swedish migration office (Swedish: Migrationsverket), the Swedish social insurance authority (Swedish: Försäkringskassan) and the Swedish enforcement agency (Swedish: Kronofogden).
|
The processing is necessary for Gigapay to comply with a legal obligation to which it is subject, including its reporting obligations as an employer of record and merchant of record to the Swedish tax authority, foreign tax authorities, the Swedish migration office, the Swedish social insurance authority, and the Swedish enforcement agency (Article 6(1)(c) GDPR).
Where the Personal Data described in this Section includes special categories of personal data within the meaning of Article 9 GDPR (such as a medical certificate), Gigapay processes this data only to the extent necessary for carrying out its obligations and exercising specific rights in the field of employment and social security law, in accordance with Article 9(2)(b) GDPR, or, where no such obligation applies, with your explicit consent under Article 9(2)(a) GDPR.
|
Name; Personal number; Date of birth; Address; Country of residence; Nationality; Gender; Email address; Bank account number; Bank name; Phone number; Details on income; ID documents; SINK tax document; A1 certificate; tax information and other documents; VAT number; TIN; Company registration number; information relating to a work accident; residence permit (Swedish: uppehållstillstånd); LMA card (Swedish: LMA-kort); Medical certificate; Information about your contacts with Gigapay’s customer service - Chat conversations and email correspondence; Social media handle.
|
Service account:One (1) year after the Creative or Client stops using the Service or when they request the deletion of their Service account.
Merchant of record service:seven (7) years (Swedish Bookkeeping Act).
Employment of record service:10 years.
Gigapay may need to keep the data for a longer period. Please refer to Section 4 on the retention period for more information. Contact Gigapay for information (Section 2).
|
|
Purpose of the processing
|
Legal basis for processing
|
Categories of Personal Data
|
When the purpose of using the Personal Data ends.
|
|
Share Personal Data
To share your Personal Data with the categories of recipients described in Section 5.
|
The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Gigapay has determined that we have a legitimate interest in sharing certain Personal Data with third parties such as banks, Clients, service providers, and different authorities. We ensure that the processing this entails is necessary to achieve the purpose of the processing, that the information shared is limited to what is necessary, and that our interest outweighs your right not to have your data processed for this purpose.
|
The Personal Data varies depending on the recipient of the Personal Data. The Personal Data shared may include any Personal Data defined in this Section 3.
|
Service account:One (1) year after the Creative or Client stops using the Service or when they request the deletion of their Service account.
Merchant of record service:seven (7) years (Swedish Bookkeeping Act).
Employment of record service:10 years.
Gigapay may need to keep the data for a longer period. Please refer to Section 4 on the retention period for more information. Contact Gigapay for information (Section 2).
|
|
For marketing
After obtaining your consent. We may use your Personal Data to generate and send ads, newsletters, notifications, information, surveys, and invitations through multiple communication channels. Ads, promotions, and other direct marketing communication may be distributed through email, SMS, phone calls, or postal mail as well as displayed in your mobile app, social media channels, or web browser.
|
The processing is based on your consent (Article 6(1)(a) GDPR). You may withdraw your consent at any time, free of charge and with effect for the future, by clicking ‘Unsubscribe’ in any newsletter, updating your settings, or contacting us as described in Section 2.
|
Name; Address; Email address; Phone number; IP number; Social media handle.
|
Targeted marketing is done after obtaining your consent. You can remove your consent at any time by clicking on “Unsubscribe” in any of our newsletters, by updating your settings on your page, or by contacting us on the contact form. Contact Gigapay for information (Section 2).
|
|
For business development, market, statistics, reports, performance analysis, economic analysis, Client analysis, and Creative analysis
Enable business follow-ups, market, Creative analysis, Client analysis, market research, and developing businesses and methods via regular mail, email, phone call, SMS, or in the Service. Gigapay always tries, if possible, to anonymize the data for these purposes. If the data is anonymized, no Personal Data processing is performed.
|
The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Gigapay has determined that we have a legitimate interest in performing data analysis for product development and testing purposes. We ensure that the processing this entails is necessary to achieve the purpose of the processing, and that our interest outweighs your right not to have your data processed for this purpose. Furthermore, our Creatives and Clients benefit from the processing because it helps us deliver a good Service.
|
Name; Address; Social media handle; Email address; Phone number; Social media handle; IP number; Country of residence; Gender; Nationality; information regarding the choice of payment method; information on your use of the Service; Device information; Information about your contacts with Gigapay’s customer service - Chat conversations and email correspondence; response time for web pages; download errors and date; time when you used the Service; Your contacts between Creative and Client; Information about how the Creative and Client are interacting together such as messages, description of campaigns paid out through the Service and other interactions; Browser version, language, time zone and settings, operating system, platform and similar information about your device settings; Information about the Creative’s and Client’s use of the Service (usage history, personal preferences).
|
This processing takes place for the entire period during which Gigapay must retain the information in its systems, for example, to perform the Service or to comply with applicable law.
Please refer to Section 4 on the retention period. Contact Gigapay for information (Section 2).
|
|
Legal rights and legal claims
The processing is necessary to protect Gigapay from legal claims and safeguard Gigapay’s legal rights.
|
The processing is based on a balancing of interests (Article 6(1)(f) GDPR). When balancing interests, Gigapay has determined that we have a legitimate interest in processing certain Personal Data to protect Gigapay from legal claims and safeguard Gigapay’s legal rights.
|
Name; Legal name; Address; Email address; Phone number; IP number; TIN; Gender; Personal number; Coordination number; Country of residence; Nationality; ID document (if available); Information about your contacts with Gigapay’s customer service - Chat conversations and email correspondence; Bank name; Name; TIN; Personal number; Address; Citizenship; Country of work; Social media handle; Your contacts between Creative and Client; Information about how the Creative and Client are interacting together such as messages, description of campaigns paid out through the Service and other interactions.
|
Service account:One (1) year after the Creative or Client stops using the Service or when they request the deletion of their Service account.
Merchant of record service:seven (7) years (Swedish Bookkeeping Act).
Employment of record service:10 years.
Gigapay may need to keep the data for a longer period. Please refer to Section 4 on the retention period for more information. Contact Gigapay for information (Section 2).
|
Please read Section 8 for more information on our obligations and right to retain information according to law.
4. Retention Period
Your Personal Data is stored as long as is needed to fulfill the objectives that require the data to be collected in accordance with this Privacy Notice and to comply with laws and regulatory requirements. The retention period for your Personal Data depends on the purposes for which Gigapay is collecting and using the Personal Data.
You may cancel the use of the Service at any time. Gigapay does not retain your Personal Data after you have canceled the use of the Service according to this Section, unless it is required by law or to protect Gigapay’s legitimate interests, for example, in case of a legal proceeding.
Personal Data requested from Creatives using the employer of record Service is stored for ten (10) years. Some Personal Data, such as employment contracts, may be stored until the Creative’s pension age.
Personal Data requested for the use of the merchant of record Service (both in Sweden and internationally) is stored for seven (7) years due to Swedish bookkeeping laws.
If you have created a Service account, but have never used the Service to receive compensation, you may request Gigapay to delete your data earlier. In that case, your Personal Data will be deleted as soon as possible. We aim to delete your Personal Data within one (1) week in this particular case.
In exceptional cases, Gigapay may retain Personal Data for a period longer than stated above where necessary to establish, exercise, or defend legal claims; to comply with a legal obligation that requires longer retention (for example, an ongoing tax audit, investigation, or legal proceeding); or, where applicable, on the basis of your explicit consent to extended retention for a specified purpose. In each such case, the relevant Personal Data will be retained only for as long as the underlying claim, obligation, or purpose subsists.
5. Who do we share your Personal Data with?
You are entitled to object to us sharing your Personal Data, for reasons connected to personal circumstances. However, we may not always be able to respect your objection, depending on the case at hand. We share your Personal Data as follows:
5.1 Clients and Creatives
In some cases, Gigapay is required to disclose Personal Data about the Creative to the Client. The Client needs, from time to time, to access and process the Personal Data of the Creative who undertakes assignments on its behalf. The Client signs a Data Processing Agreement when starting to use the Service and is required to ensure the security of Personal Data at all times.
In some rare cases, Gigapay may disclose Personal Data about the Client to the Creative. This may for example happen if the Creative needs the Client’s contact information for a matter that is outside the scope of Gigapay’s Service.
Gigapay has a legitimate interest in sharing your Personal Data with the Client or the Creative. The processing is necessary (Article 6(1)(f) GDPR) for Gigapay to enter into and fulfill our contractual obligations with the Client and to ensure that the Service is functioning properly.
5.2 Payment Service Providers, other suppliers, and subcontractors
Gigapay partners with payment Service providers (“PSP”) to collect payments from Clients, and transfer such payments to the Creatives. The payment services connected to payouts and pay-ins are all performed by Gigapay’s PSP partners.
Apart from Gigapay’s PSP partners, Gigapay also works with suppliers and subcontractors. Examples of such suppliers and subcontractors are software and data storage providers, software, and external consultants.
Gigapay has a legitimate interest in sharing your Personal Data with the PSP, supplier, or subcontractor. The processing is necessary (Article 6(1)(f) GDPR) for Gigapay to access these services and functionality. We ensure that the processing this entails is necessary to pursue that interest and that our interest outweighs your right not to have your information processed for this purpose.
5.3 Tax authorities and other competent authorities
Depending on the Creative’s status, Gigapay may be required to report the employment relationship and the compensations paid out through the Service to e.g. the Swedish tax authority, a foreign tax authority, migration office, social insurance authority, and enforcement agency.
In addition, Gigapay may provide necessary information to authorities such as the police, government authorities, or other authorities and courts of law.
Personal Data is shared with the relevant authority when required by law, or in some cases if you have asked Gigapay to do so. An example of a legal obligation to provide information is tax reporting as required by DAC7 (Directive (EU) 2021/514). Depending on the relevant authority and purpose of sharing, the legal bases are the obligation to comply with the law, to fulfill the agreement with you, or Gigapay’s legitimate interest in protecting itself from crime (Article 6(1)(b), Article 6(1)(c), Article 6(1)(f) GDPR).
5.4 Gigapay Group
Gigapay may share your Personal Data with companies in the Gigapay Group.
This is required for Gigapay to be able to provide you with services and functionality. Gigapay has a legitimate interest in being able to access these services and functionality (Article 6(1)(f) GDPR).
5.5 Third parties
Gigapay may share your Personal Data in other cases where you have given your consent to share it or when we are otherwise legally entitled to do so.
Gigapay may disclose your Personal Data with other parties in connection with corporate transactions (i.a. mergers, joint ventures, assignments, spin-offs, acquisitions, reorganizations, transfers, or sale or disposition of all or any portion of Gigapay’s business, including bankruptcy or similar proceedings).
Gigapay has a legitimate interest in sharing your Personal Data with a third party if you have given your consent or if Gigapay is entitled to do so. The processing is necessary (Article 6(1)(f) GDPR) for Gigapay to enter into and fulfill our contractual obligations with the Creative or Client and to ensure that the Service is functioning properly. We ensure that the processing this entails is necessary to pursue that interest and that our interest outweighs your right not to have your information processed for this purpose.
6. Transfer of Personal Data to third countries
Gigapay will not store or process your Personal Data in any country outside the EU/EEA.
However, recipients of your Personal Data, as defined in Section 5, may move, store, transfer, or otherwise process your Personal Data outside of the EU/EEA, provided such transfer meets the requirements and undertakings that follow from the General Data Protection Regulation. Countries outside of the EU/EEA may have different legislation that allows authorities to request access to Personal Data stored in the country to e.g. combat crime. Regardless of whether Gigapay or any of the parties described in Section 5 process your Personal Data, we will ensure that a high level of protection is guaranteed when transferring that data and that appropriate protection measures have been taken, following applicable data protection requirements (such as the GDPR). Such appropriate safeguards include but are not limited to (i) signing a Data Processing Agreement; (ii) signing agreements with standard contractual clauses for the protection of your Personal Data; (iii) verifying the terms and conditions of the supplier; and (iv) limiting the Personal Data shared with the recipient.
For data transfers to the U.S., we prioritize partners who maintain an active certification under the EU-U.S. Data Privacy Framework (DPF). Before any transfer, Gigapay verifies the recipient's status on the official DPF List. For non-certified partners, we implement Standard Contractual Clauses (SCCs) to ensure your data receives a level of protection essentially equivalent to that within the EU.
7. Your rights as a Data Subject
Gigapay, in its capacity as the data controller, is responsible for ensuring that your Personal Data is processed in accordance with applicable law.
You have the right to object to the processing of your Personal Data based on legitimate interest, regarding personal circumstances. You can see for which purposes we process your data based on legitimate interest in sections 3 and 5.
Gigapay will, at your request or on your own initiative, correct, de-identify, delete, or complete information that is determined to be incorrect, incomplete, or misleading. You have the right to require from Gigapay access, correction, or deletion of your Personal Data (for example, if deletion is required according to applicable legislation), request restrictions on continued processing of your Personal Data as well as the right to object to the processing (for example, if you question whether the Personal Data is correct or if the processing is legal).
You are entitled to data portability, in other words, the right under certain circumstances to receive and transfer your Personal Data to another data controller in a structured, generally usable, and machine-readable format.
Where Gigapay is processing your Personal Data based on your consent or explicit consent (e.g. for marketing), you have the right to revoke that consent at any time. When you revoke your consent, Gigapay will stop processing your data for such purposes.
At reasonable time intervals, you are entitled to obtain an extract from the registry from Gigapay, free of charge, indicating which Personal Data about you has been recorded, the purposes of processing the data, and the recipients who have received the data or will receive the data.
Where Gigapay makes a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, you have the right to obtain human intervention on Gigapay's part, to express your point of view, and to contest the decision, by contacting Gigapay as described in Section 2.
If you have complaints about how Gigapay is processing your Personal Data, you have the right to lodge a complaint with a supervisory authority — in particular, in the EU/EEA member state of your habitual residence, place of work, or the place of the alleged infringement. In Sweden, the competent authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten), www.imy.se/en.
8. Protection of your Personal Data
Gigapay has implemented appropriate technical and organizational measures to protect your Personal Data against unauthorized access, alteration, disclosure, or destruction, in accordance with Article 32 GDPR. These measures are reviewed and updated on an ongoing basis to address emerging risks. While no system can guarantee absolute security, Gigapay takes its security obligations seriously and works to minimize risk to your Personal Data.
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of Data Subjects, Gigapay will notify the competent supervisory authority and, where required, the affected Data Subjects, in accordance with Articles 33 and 34 GDPR.
Where you choose to send Personal Data to Gigapay outside the secure channels provided as part of the Service, Gigapay cannot guarantee the security of that data in transit and is not responsible for its protection until it is received into Gigapay's systems.
9. Cookies
We use cookies to personalize content and ads, to provide social media features, and to analyze our traffic. We also share information about your use of our site with our social media, advertising, and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. Cookies are small text files that can be used by websites to make a Creative's experience more efficient.
The law states that we can store cookies on your device if they are strictly necessary for the operation of this site. For all other types of cookies, we need your permission. This site uses different types of cookies. Some cookies are placed by third-party services that appear on our pages. You can at any time change or withdraw your consent from the Cookie Declaration on our website.
For more information see our Cookies Policy.
10. Changes to this Privacy Notice
Gigapay has the right to modify this Privacy Notice at any time. Gigapay will provide reasonable advance warning of changes to the Privacy Notice. The new Privacy Notice shall automatically commence thirty (30) days after they have been published in the Service or otherwise approved by you. By visiting or using the Service, you acknowledge that such changes may occur and that you are responsible for keeping up to date on any changes. If you do not approve of the modified terms, you have the right to cancel the agreement with Gigapay before the modified Privacy Notice takes effect.
Last updated: Aug 4, 2026
