Privacy Notice – How we use cookies and handle personal data
We respect your privacy
We respect your privacy when we use your personal data for our legitimate business purposes. We therefore take measures to ensure that your personal data is protected and used in accordance with data protection regulations, including the General Data Protection Regulation (GDPR), and our internal policies and procedures.
Lakeway Link is responsible for the collection and use of your personal data.
How we use personal data
We use personal data for various legitimate business purposes. For which specific purposes we use your personal data depend on your relationship with us and how you interact with us. In general, we process personal data to:
- Manage our business relationship with customers, suppliers and business partners,
- Making analyses to follow-up and evaluate for example our business or the use of our websites,
- Communicate about us, with you and others,
- Ensure the security of our IT systems and our staff,
- Fulfill our legal obligations, and
- Manage, defend and exercise legal claims.
We only keep your personal for such period as is necessary for the specific purpose. Generally, this means that if you are contact person, we keep your personal data for the duration of the business relationship and otherwise for the period necessary to satisfy our legitimate business interest or to fulfill legal obligations.
For more information on our use of your personal data, please see our information about our processing of personal data.
Your rights
You have certain rights in relation to your personal data, for example the right to request access and receive a copy of your personal data. Our information on our processing of personal data, includes more information on your rights and how to exercise them.
How to contact us
You have certain rights in relation to your personal data, for example the right to request access and receive a copy of your personal data. Our information on our processing of personal data, includes more information on your rights and how to exercise them.
- send an e-mail to info@lakewaylink.com, or
- a letter to Lakeway Link AB, Slakterigatan 10, 721 32 Västerås, Sweden.
Lakeway Link AB
Company registration number: 559441-3410
Slakterigatan 10
721 32 Västerås, Sweden
Telefon: +46 8 772 05 00
E-mail: info@lakewaylink.com
Information about our processing of personal data
Updated: May 2024
Introduction
In this information about our processing of personal data, we describe what personal data about you that we use and why and what rights you have in relation to your personal data under the General Data Protection Regulation (GDPR).
This information about our processing of personal data is divided into two parts:
- This general information, which for example describes from which sources we collect personal data, for which purposes we process personal data, and how we share personal data.
- A detailed information, which for example describes which categories of personal data that are being processed for each purpose and based on which legal basis, including for how long the personal data is stored for each purpose.
Processing of personal data
Personal data means any information that, directly or indirectly, can be related to an identified or identifiable individual. Examples of personal data are your name, e-mail address, or IP address.
Processing means any action taken in relation to personal data, for example collection, storage and transmission. Each processing of personal data must be carried out for a specific purpose. We outline further below for which purposes we process personal data.
Who is covered by this information
This information covers you who:
- Represent or who are a contact person of a customer, supplier or business partners to us.
- Visits our websites and our digital channels, for example our pages on social media platforms.
- Otherwise interact with us, for example in connection with communication or meetings.
Responsibility for the processing of personal data
Lakeway Link AB, company registration number 559441-3410, (“we”, “us” or “our”) is responsible (controller) for the collection and processing of your personal data as described in this information.
From which sources we collect personal data
The personal data that we collect about you is mainly collected directly from yourself when you provide your personal data to us, for example when we interact with you or when you otherwise communicate with us.
We also collect, where necessary, personal data from other sources:
- The company or organisation that you work for, and which provides your personal to us.
- Group companies that have collected your personal data, for example when interacting with you, and provide your personal data to us.
- Business partners, that we collaborate with, and which have collected your personal data, for example when interacting with you or in connection with a meeting, event or similar activity, and which provide your personal data to us.
- Social media platforms, if you follow or interact with us on social media platforms or if we otherwise collect your personal from such platforms.
- Publicly available sources, for example information online and available in public records.
- External persons that that we communicate or otherwise interact with for the purposes described in this information.
Contact persons of customers, suppliers and business partners
If you are a contact person of a customer, supplier or business partner, we process your personal data to:
- Prepare and carry out procurements
- Manage the business relationship
- Manage orders of goods and services from customers and suppliers
- Carry out analysis for obtaining insights to develop and improve our business, our strategies and business methods
- Follow-up on and analyse sales
- Follow-up on and analyse the business relationship with our customers, suppliers and business partners
- Provide offers and marketing
- Carry out trainings and product demonstrations
Customers, suppliers and business partners also include prospective customers, suppliers and business partners.
Users of our website and digital channels
If you visit our website and our digital channels we process your personal data to:
All categories of individuals above and other external persons
In relation to all categories of individuals stated above and other external persons, we process personal data to:
- Communicate about us and our business
- Follow up and evaluate our communication
- Carry out meetings, events, and similar activities
- Follow-up on and evaluate activities carried out
- Respond to questions and requests
- Carry out surveys
- Provide newsletters
- Communicate in the course of the business
- Document and record decisions and supporting information in the course of the business
- Manage sale and restructuring of all or parts of the business
- Manage, defend and exercise legal claims
- Ensure technical functionality and security in our IT systems
- Fulfill legal obligations
- Respond to legal requests
- Protect and ensure the safety of our staff and assets
How we share personal data
Transfer of personal data to other external recipients (controllers)
We share, where necessary, your personal data with the following recipients:
- The company or organisation that you work for, for example to manage the business relationship with the company or organisation.
- Group companies for various purposes, for example to communicate with you. For information about which group companies that are a part of Soya Group, please visit Soya Group’s website.
- Business partners, for example in connection with meetings, events or similar activities.
- External persons, that we communicate or otherwise interact with for the purposes described in this information.
- Other recipients, for example authorities, courts and external advisors in certain situations, including to fulfil our legal obligations or to manage, defend and exercise legal claims.
Transfer of personal data to service providers (processors)
We also transfer personal data to service providers that we have engaged when necessary for the purposes for which we process personal data as described in this information. Examples of service providers are external IT suppliers and suppliers of communication services.
Moreover, Soya Group Support AB provides internal shared services, such as finance and IT services, to group companies. Where Soya Group Support processes personal data on our behalf, the company acts as a processor to us.
The services providers which process personal data on our behalf and in accordance with our instructions act as data processors in relation to us. These service providers may not process your personal data for their own purposes and are legally and contractually obligated to protect your personal data.
Where we process your personal data
We store your personal data within the EU/EEA.
Additionally, we transfer, in certain cases, your personal data to recipients located in third countries outside the EU/EEA, for example to service providers which we engage in such third country.
To ensure an essentially equivalent level of protection for your personal data when transferred (or otherwise made available) to service providers in third countries outside of the EU/EEA, which do not provide an adequate level of protection, we normally use the EU Commission’s adopted standard contractual clauses for international transfers according to decision 2021/914 and implement – in light of the law and practices of the third country – necessary supplementary measures to ensure an essentially equivalent level of protection of the personal data transferred.
We also rely upon adequacy decisions by the EU Commission where personal data is transferred to countries and recipients covered by such decision. Adequacy decisions are issued by the EU Commission when it has decided that such country or recipient provides an adequate protection for personal data.
For more information on the safeguards that we have taken to protect your personal data, please contact us on info@lakewaylink.com.
Additional information on your rights
You have certain rights in relation to your personal data under the GDPR.
Użytkownik ma prawo:
- Access to and receive a copy of your personal data together with additional information on our processing of your personal data.
- Rectification of or request that we supplement your personal data if you consider that your personal data is incorrect, incomplete, or misleading.
- Erasure of your personal data.
- Object to our processing of your personal data, for example our processing of your personal data for direct marketing purposes or when we rely on a legitimate interest for the processing.
- Restrict our processing of your personal data, which means that you can, at least for a certain period, stop us from using your personal data (other than storing your personal data).
- Obtain a copy of the personal data that you have provided to us in a structured and commonly used format and, where it is technically feasible, have this personal data transferred to an external recipient (data portability).
- Withdraw your consent to processing of your personal data when we rely on your consent for the processing.
- Lodge a complaint with your supervisory authority. In Sweden, we are under the supervision of the Swedish Authority for Privacy Protection (IMY).
Please note that certain rights only apply in certain situations, and that there are several exceptions from certain rights. For more information on your rights under the GDPR, please see the information available on IMY’s website.
Exercise your rights
If you wish to exercise your rights at any time, please contact us on info@lakewaylink.com.
If possible, we would grateful if you use the e-mail address that you have registered with us or used when previously being in contact with us. This would facilitate our handling of your request.
We normally respond to your request within one month
We normally respond to your request within one month following the date we received your request. However, if your request is complicated or if you have submitted several requests, we may need additional time to handle your request. We will in such a case notify you and the reasons of the delay at the latest within one month from when your request was submitted. If we cannot, wholly or in part, comply with your request we will notify you and the reasons for this within one month from when your request was submitted. If you have submitted your request electronically, for example contacted us via the website or via e-mail, we will respond to the request electronically, unless you request otherwise.
We need to confirm your identity in order to respond to your request
When you submit a request to exercise your rights, we need to confirm your identity to ensure that you are not somebody else than who you claim to be. This to avoid that we for example disclose personal data to an unauthorised person or in error delete personal data. If we do not have sufficient information to confirm your identity, we can request that you provide supplementary information about yourself to confirm your identity. We only request such information that is reasonable and necessary to your identity. The time to respond to your request starts when we have confirmed your identity.
Automated individual decision-making
We do not carry out any automated individual decision-making which have legal effects or similar significant effects on you.
Use of cookies and similar technologies
We use cookies and similar technologies on our website. This to, among other things, collect statistics in order to better understand how our website are used. This allows us to develop and improve our website to provide a better user experience.
In our cookie information, we describe how we use cookies and similar technologies, for which purposes and what options and settings you may choose for our cookies.
Updates to this information
If our processing of personal data changes, for example if we collect and process personal data for new purposes, collect additional categories of personal data or share your personal data with other recipients than outlined in this information, we will update the information to reflect such changes. In the beginning of this information, you can see when the information was last updated.
Version history
Version:
1.0
Comment:
The first version of this privacy notice.
Acess to version:
The version that you are currently reading is the latest version.
Detailed information about our processing of personal data
Updated: May 2024
Introduction
In this detailed information about our processing of personal data we describe which categories of personal data that are being processed for each purpose. which legal basis that we rely on for the processing, and for how long the personal data is stored for each purpose. We also describe with which recipients (in their role as separate controllers) that we share your personal data for each purpose.
Further down, we describe which categories of personal data that we process and examples of the type of personal data that is covered by each category.
Contact persons of customers, suppliers and business partners
Personal data means any information that, directly or indirectly, can be related to an identified or identifiable individual. Examples of personal data are your name, e-mail address, or IP address.
Processing means any action taken in relation to personal data, for example collection, storage and transmission. Each processing of personal data must be carried out for a specific purpose. We outline further below for which purposes we process personal data.
Prepare and carry out procurements
In connection with procurements, we process your personal data, for example to collect and register you as a contact person, to issue or respond to requests for information (RFIs) or requests for proposal (RFPs), and to negotiate and conclude agreements.
Categories of personal data:
- Communication
- Contact information
- Identity information
- Profile information
Legal basis:
Legitimate interest (Article 6.1 f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of preparing and carrying out procurements.
It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, given the purpose of the processing.
External recipients:
- The company or organisation that you work for
- Group companies
Storage period:
Personal data is stored for this purpose during the relevant procurement process.
Manage the business relationship
We process your personal data to manage our business relationship with the company or organisation that you work for or represent, for example to register you as a contact person, manage invoices and to communicate with you.
Categories of personal data:
- Communication
- Contact information
- Identity information
- Profile information
Legal basis:
Legitimate interest (Article 6.1 f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of managing the business relationship with our supplier and partners.
It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since we otherwise would not be able to manage the relationship with the company or organisation that you represent.
External recipients:
- The company or organisation that you work for
Storage period:
Personal data is stored for this purpose as long as there is an active business relationship with the company or organisation that you work for or represent.
Manage orders of goods and services from customers and suppliers
We process your personal data to manage orders of goods and services from customers or from our suppliers, for example to register the order, manage order confirmations and complaints.
Categories of personal data:
- Communication
- Contact information
- Identity information
- Order information
- Profile information
Legal basis:
Legitimate interest (Article 6.1 (b) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest in managing the relevant order and, if you work for or represent a customer to us, the relevant agreement between us and the customer.
External recipients:
- The company or organisation that you work for
Storage period:
Personal data is stored for this purpose until the order has been registered and managed, including any complaint if relevant.
Carry out analysis for obtaining insights to develop and improve our business, our strategies and business methods
We process your personal data to carry out analyses for obtaining insights on an aggregated level, for example to better understand how our services and products are used. This helps us to develop and improve our business, strategies, and business methods.
We do not carry out any profiling as a part of the processing of personal data for this purpose, since we are not interested in your specific behaviour or interests.
Categories of personal data:
- Communication
- Identity information
- Order information
- Profile information
Legal basis:
Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of carrying out analyses for customer insights. This in order for us to develop and improve our business, strategies and business methods.
Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, since the result of the analysis is presented on an aggregated level and therefore cannot be directly linked to you.
External recipients:
Storage period:
Personal data is stored for this purpose during 27 months from the date of collection.
Follow-up on and analyse sales
We process your personal data follow up on and analyse sales, for example to compile statistics of the number of ordered services and products ordered. We do not carry out any profiling as a part of the processing of personal data for this purpose.
Categories of personal data:
- Communication
- Identity information
- Order information
- Profile information
Legal basis:
Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of follow up on and evaluate our sales and campaigns that we carry out.
Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since reports and statistics only are saved on an aggregated level and that the information therefore cannot be related to you.
External recipients:
Storage period:
Personal data is stored for this purpose during 27 months from the date of collection.
Follow-up on and analyse the business relationship with our customers, suppliers and business partners
We process your personal data to evaluate the relationship with the company or organisation that you work for or represent, for example by generating statistics on orders of products and services. This to better understand how the relationship is working between us and the company or organisation that you work for.
Categories of personal data:
- Communication
- Contact information
- Identity information
- Order information
Legal basis:
Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of following up and evaluating the supplier or partner relationship.
It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since reports and statistics only are saved on an aggregated level and that the information therefore cannot be related to you.
External recipients:
- The company or organisation that you work for
Storage period:
Personal data is stored for this purpose during 27 months from the date of collection.
Provide offers and marketing
We process your personal data to provide you with offers and marketing in different channels, for example via e-mail or on social media platforms.
We do not carry out any profiling as a part of the processing of personal data for this purpose. However, we may tailor which target groups that shall receive a certain offer or marketing communication to ensure that the content is relevant for you.
We will only send you communication for marketing purposes if you have not objected to such communication.
Categories of personal data:
- Contact information
- Identity information
- Order information
- Profile information
Legal basis:
Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of providing you with offers and marketing.
Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since you always may decline or unsubscribe to such communication for this purpose.
External recipients:
Storage period:
Personal data is stored for this purpose as long as there is an active business relationship with the company or organisation that you work for or represent and for a period of twelve (12) months thereafter. If there is no relationship the personal data is stored for a period of three (3) months calculated from the date of the collection.
Carry out trainings and product demonstrations
We process your personal data to carry out trainings and product demonstrations, for example to register your participation, carry out the activity and to communicate with you about the activity.
Categories of personal data:
- Audio and video material
- Identity information
- Communication
- Contact information
- Profile information
Legal basis:
Legitimate interest (Article 6.1 (f) of the GDPR). The use of your personal data is necessary to satisfy our legitimate interest of carrying out trainings and product demonstrations.
It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially if you have voluntarily signed up for or participates in the activity.
External recipients:
Storage period:
Personal data is stored for this purpose during the period the activity is carried out.
Users of our website and digital channels
Follow-up on and analyse the use of our website and digital channels
We process your personal data to better understand how our website and digital channels are used, which allows us to develop and improve our website and our digital channels to provide you with a better user experience. We use cookies and similar technologies for this purpose, which allow us to analyse visitor and user statistics.
Categories of personal data:
- Digital information
- Technical data
Legal basis:
Consent (Article 6.1 (a) of the GDPR). The processing relies on the consent that you provide by a accepting the use of cookies and similar technologies for the same purpose.
External recipients:
Storage period:
Information in cookies, including personal data, is stored during the period stated in our cookie policy.
Communicate information about our services and products
We process your personal data to provide you with information about our services and products, for example if you have provided your contact information on our website.
Categories of personal data:
- Communication
- Contact information
- Identity information
- Profile information
Legal basis:
Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of communicating information about our services and products.
It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially when you always can unsubscribe from our communications at any time.
External recipients:
Storage period:
Personal data is stored for this purpose as long as there is an active relationship and for a period of twelve (12) months thereafter. If there is no relationship the personal data is stored for a period of three (3) months calculated from the date of the collection.
Communicate and interact with you in our digital channels
We will process your personal data in connection with communication and interactions in our digital channels, for example when you comment on our posts, or otherwise mention us on social media platforms.
Categories of personal data:
- Audio and video material
- Communication
- Identity information
- Profile information
Legal basis:
Legitimate interest (Article 6.1 f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of communicating and interacting with you in our digital channels.
It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially when you have taken the initiative to such communication or interaction.
External recipients:
Storage period:
Personal data is stored for this purpose until further notice.
All categories of individuals and other external persons
Communicate about us and our business
We process your personal data to publish information about us and our business on our website and in our digital channels.
Moreover, we process your personal data to send you communications about us and our business in different channels, for example via e-mail. This to for example provide you with updates regarding our business.
Categories of personal data:
- Communication
- Contact information
- Identity information
- Profile information
Legal basis:
Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of communicating about us and our business.
It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially when you always can unsubscribe from our communications at any time.
External recipients:
Storage period:
Personal data is stored for this purpose as long as there is an active relationship and for a period of twelve (12) months thereafter. If there is no relationship the personal data is stored for a period of three (3) months calculated from the date of the collection.
Personal data published on our website and in our digital channels is normally stored until further notice.
Follow-up and evaluate our communication
We process your personal data to better understand how you interact with communication that we send. This is done by way of tracking technologies that collect and allow us to analyse opening and click statistics.
Categories of personal data:
- Digital information
- Technical information
Legal basis:
Consent (Article 6.1 (a) of the GDPR). The processing of information obtained from your device relies on the consent that you provide by accepting or subscribing to communication on our website.
External recipients:
Storage period:
Personal data is stored for this purpose during a period of twelve (12) months following the date of collection.
Carry out meetings, events, and similar activities
We process your personal data to carry out meetings, events and similar activities, for example to register your participation, carry out the activity and to communicate with you about the activity.
Categories of personal data:
- Audio and video material
- Identity information
- Communication
- Contact information
- Profile information
Legal basis:
Legitimate interest (Article 6.1 (f) of the GDPR). The use of your personal data is necessary to satisfy our legitimate interest of carrying out meetings, events and similar activities.
It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially if you have voluntarily signed up for or participates in the activity.
External recipients:
Storage period:
Personal data is stored for this purpose during the period the meeting, event or activity is carried out.
Follow-up on and evaluate activities carried out
If you have participated in an activity that we have carried out, we process your personal data to follow up and evaluate the activity, for example to compile statistics of the number of participants and to plan for future activities.
Categories of personal data:
- Audio and video material
- Identity information
- Communication
- Contact information
- Profile information
Legal basis:
Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of following up and evaluating activities carried out.
It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since it only concerns harmless personal data.
External recipients:
Storage period:
Personal data is stored for this purpose for a period of twelve (12) months calculated from the date of relevant activity being carried out.
Respond to questions and requests
We process your personal data to respond to questions and requests when you contact us.
Categories of personal data:
- Communication
- Contact information
- Identity information
- Order information
- Profile information
Legal basis:
Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of responding to questions and to provide customer service.
It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially when you yourself have reached out to us.
External recipients:
- The company or organisation that you work for
Storage period:
Personal data is stored for this purpose for a period of twelve (12) months calculated from the date the support matter was closed or the last communication in the same matter.
Carry out surveys
We process your personal data to carry out surveys, for example to determine to which target group we shall send a survey, which questions to be asked in a survey, send out the survey and to collect and analyse the results from a survey.
Your opinions about our business and services are important to us and necessary in order for us to improve our business and services. We may use your personal data that we have collected at an earlier stage (for example to manage our business relationship) for this purpose as well.
You can always unsubscribe from our communication about surveys by clicking on the unsubscribe link in the e-mail or similar communication field or by contacting us.
Categories of personal data:
- Communication
- Contact information
- Identity information
- Order information
- Profile information
Legal basis:
Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of carrying out customer surveys in order to obtain your opinions of our business and Services.
Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since it is voluntary to participate in customer surveys.
External recipients:
Storage period:
Personal data is stored for this purpose during the period the survey is carried out and for a period of three (3) months thereafter to compile the responses in a report. Thereafter your personal data is deleted or anonymised.
Provide newsletters
If you have signed up for our newsletter, we process your personal data to send you our newsletter, including registering you in our sending list.
We will only send you communication for marketing purposes if you have not objected to such communication.
Categories of personal data:
- Identity information
- Contact information
Legal basis:
Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of sending you newsletters and similar communication.
Our assessment is that this legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since you always may decline or unsubscribe to such communication for this purpose.
External recipients:
Storage period:
Personal data is stored for this purpose until you unsubscribe to the newsletter.
You can always unsubscribe from the relevant communication by clicking on the unsubscribe link in the communication or by contacting us.
Communicate in the course of the business
We process your personal that you and others share with us in connection with internal and external communication in the course of the business, for example when our employees communicate with each other and external persons via e-mail to carry out their work duties.
Categories of personal data:
- Audio and video material
- Communication
- Contact information
- Identity information
- Profile information
Legal basis:
Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of communicating internally and externally in the course of the business.
It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since the processing normally concerns harmless personal data.
External recipients:
- Group companies
- Business partners
- External persons
Storage period:
Personal data is stored for this purpose for a period of two (2) years calculated from the date of the last communication in the same conversation. If the communication falls within the scope of another purpose under this privacy notice, for example to manage the business relationship, the communication is stored for the applicable longer period to fulfil such purposes.
Document and record decisions and supporting information in the course of the business
We process your personal data where necessary to document and record decisions, including supporting information, in the course of the business, for example in connection with internal and external meetings or otherwise when employees and other engaged personnel perform their work.
Categories of personal data:
Relevant categories of personal data as necessary for the purpose.
Legal basis:
Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of documenting and recording decisions in the course of the business to ensure traceability.
It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, especially since it normally concerns harmless personal data.
External recipients:
Storage period:
Personal data is stored for this purpose until further notice.
Manage sale and restructuring of all or parts of the business
If all or parts of the business would be sold, or in any other way transferred or restructured, we process your personal data where necessary for this purpose. Should the business be transferred to a buyer, your personal data would also be transferred and disclosed to the buyer. The buying company would in such case be responsible (controller) for your personal data and the processing that is carried out for the same purposes as stated in this privacy notice, unless you receive any other information in connection with the sale.
Categories of personal data:
Relevant categories of personal data as necessary to manage the sale or restructuring of all or parts of the business in each case.
Legal basis:
Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of managing a sale or restructuring of all or parts of the business.
It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose if the buyer carries out the same or similar type of business that we do.
External recipients:
- Buyers
- Potential buyers
- External advisors
- Public authorities
Storage period:
Personal data is stored for this purpose for the period that is necessary to manage the sale or the restructuring.
Manage, defend and exercise legal claims
We process your personal data where necessary to manage, defend and exercise legal claims in an individual case, for example in connection with a dispute or court proceeding.
Categories of personal data:
Relevant categories of personal data needed for managing and defending a legal claim in the individual case.
Legal basis:
Legitimate interest (Article 6.1 (f) of the GDPR). The processing of your personal data is necessary to satisfy our legitimate interest of managing, defending and exercising legal claims.
It is our assessment that our legitimate interest clearly outweighs your interest of not having your personal data processed for this purpose.
External recipients:
- Counterparty
- External advisors
- Relevant authorities
- Courts
- Debt collecting companies
- Legal counsel
Storage period:
Personal data is stored for this purpose for the period as necessary to manage, defend and/or exercise the legal claims.
Ensure technical functionality and security of our IT systems
We process your personal data to ensure necessary technical functionality and security in our IT system, for example in connection with backups, ensuring that that there are appropriate access controls in place and when we need to troubleshoot.
Categories of personal data:
All categories of personal data that are stated in relation to the purposes of processing your personal data.
Legal basis:
Fulfil legal obligation (Article 6.1 (c) of the GDPR). To the extent the processing of your personal data is necessary to implement sufficient technical and organisational security measures in accordance with Article 32 of the GDPR, the processing is carried out to fulfil this legal obligation.
Legitimate interest (Article 6.1 f) of the GDPR). To the extent the processing is not necessary to fulfil our legal obligation under Article 32 of the GDPR, the processing of your personal data is necessary to satisfy our legitimate interest of ensuring technical functionality and security of our IT systems.
It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, given the purpose of the processing.
External recipients:
Storage period:
Personal data is stored for the same period as stated in relation to each relevant purpose of the processing.
Personal data in logs is retained in order to satisfy our legitimate interest of troubleshooting and incident management for a period of 13 months from the date and time of the log entry.
Personal data in backups are stored for a period of 13 months from the date of the backup.
Fulfill legal obligations
We process your personal data where necessary to fulfil our legal obligations, for example accounting obligations and the GDPR, including supplemental legislation to the GDPR.
Categories of personal data:
Relevant categories of personal data that are necessary to fulfil the specific legal obligation.
Legal basis:
Fulfil legal obligation (Article 6.1 (c) of the GDPR). The use of your personal data is necessary to fulfil our legal obligations.
External recipients:
- Relevant public authorities
- Law enforcement
- External auditors
Storage period:
Personal data is stored for such period that is necessary in order for us to fulfil the specific legal obligation. By way of example, personal data in accounting material is stored for seven (7) years calculated from the end of the calendar year when the relevant fiscal year ended according to the Swedish Accounting Act (1999:1048).
Respond to legal requests
We process your personal data to respond to legal requests from authorities, for example law enforcement, tax authorities or any other authorities.
Categories of personal data:
- All categories of personal data as necessary to respond to and evaluate the request in each case.
Legal basis:
Fulfil legal obligation (Article 6.1 (c) of the GDPR). The processing of your personal data is necessary to fulfil our legal obligations.
Legitimate interest (Article 6.1 f) of the GDPR). If there is no explicit legal obligation requiring that we respond to the legal request, but we consider that we and the public authority have a legitimate interest (which outweighs your privacy interest), we rely on this legitimate interest for the use of your personal data for this purpose.
External recipients:
- Relevant public authorities
- Law enforcement
Storage period:
Personal data is stored for this purpose for the period that is necessary to respond to the specific legal request and for a period of ten (10) years thereafter to document the request and our response to the request.
Protect and ensure the safety of our staff and assets
We process your personal data to register, investigate and take other necessary measures to manage incidents involving our employees, other personnel and our assets, for example file a police report or report the incident to the public authority concerned.
Categories of personal data:
Relevant categories of personal data needed in the specific situation.
Legal basis:
Legitimate interest (Article 6.1 (f) of the GDPR). The use of your personal data is necessary to satisfy our legitimate interest of protecting and ensuring the safety of our employees and personnel.
It is our assessment that our legitimate interest outweighs your interest of not having your personal data processed for this purpose, given the purpose of the processing.
External recipients:
- External advisors
- Relevant public authorities
- Courts
- Legal representatives
- Insurance companies
Storage period:
Personal data is stored for this purpose for the period necessary to investigate the incident and take necessary measures as a result of the incident, including for example file a police report or report the incident to the public authority concerned.
Categories of personal data
In the table below, we describe which categories of personal data that we process with examples of types of personal data covered by each category.
| Categories of personal data | Examples of personal data included in the categories |
|---|---|
| Audio and video material | Video, photos, audio recordings |
| Communication | Contents in e-mail, chats and other correspondence, published posts and communication in our digital channels |
| Contact information | Address, e-mail address, phone number |
| Identity information | Name and other information identifying you |
| Digital information | Click and visits on the website and in our digital channels, user preferences when using functionality on our website and in our digital channels |
| Order information | Type of order, order request date/time, price and discounts, order history |
| Profile information | Title, role, social media handle, the company or organisation that you work for, qualifications (where applicable) |
| Technical information | Type of device, IP address, version of web browser and operating system |
