This privacy notice provides information on how the Swedish private limited company Protectia AB (org. no: 559365-5169) ("we", "our" or "us") processes personal data. This privacy notice includes information about, among other things:
References to "you", "your" or "yours" refer to the data subject whose personal data we process.
In addition to the terms defined in the body of this privacy notice, the following definitions shall have the meanings set forth below, whether used in the singular or plural, definite or indefinite form:
User Account: refers to a user account for the Web Application.
Processing: means any operation or set of operations which is performed on personal data, whether or not by automated means. Processing includes, but is not limited to, collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of personal data.
GDPR: means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Personal Data: means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
Data Controller: means the entity that determines the purposes and means of the processing of personal data.
Data Processor: means the entity that processes personal data on behalf of the data controller, according to the data controller's instructions.
Data Subject: means the individual who can be identified from the personal data.
Third Party: means any entity other than the data controller, data subject, or data processor (and those persons authorized to process personal data).
Third-party Services: means third-party information, services, products, systems, websites, software, networks, databases, and platforms.
Website: means the Supplier's official website available via protectia.se (including any subdomains, such as app.protectia.se).
Web Application: means app.protectia.se.
Any other GDPR-related terms not defined herein shall have the same meaning in this privacy notice as set forth in Article 4 of the GDPR.
Firstborn Group AB is the data controller for all processing of personal data performed by us or on our behalf, to the extent that we determine the means and purposes of the processing (under the principle of accountability). All our processing of personal data is carried out in accordance with the GDPR and the fundamental data protection principles.
Unless otherwise expressly stated, we are the data controller for the processing described in this privacy notice.
We typically receive personal data in the following situations:
a. when someone contacts us,
b. when we enter into an agreement with you or another Third Party,
c. in connection with the fulfillment of a concluded agreement,
d. when a user adds information to their User Account,
e. when someone subscribes to receive our newsletter,
f. when someone visits our website, and
g. through interaction with us via our social media.
We only process personal data that is adequate, necessary, and relevant to fulfill the purpose for which it was collected (according to the principle of data minimization).
We primarily process the following categories of personal data:
In accordance with the principle of purpose limitation, we only process personal data for specific, explicitly stated, and legitimate purposes. Additionally, each processing activity is legally grounded in compliance with GDPR regulations.
We primarily process personal data based on one of the following legal grounds:
In some cases, it is optional for you to provide us with your personal data. However, for example, if you do not do so, we may not be able to provide the requested support or handle the matter.
You may need to disclose your personal data to enter into a contract with us or for us to comply with legal or contractual obligations. Unless otherwise specified, you will not suffer any negative legal consequences if you do not provide your personal data to us.
When processing personal data based on legitimate interests as a legal basis, our assessment is that the processing does not infringe upon your right to privacy and personal integrity. We have reached this conclusion after balancing the interests and rights to privacy on one hand, and our legitimate interests in the processing on the other. However, we never process sensitive personal data based on legitimate interests as a legal basis.
Below you can read more about the legal basis and purposes of processing personal data.
The Website uses cookies. The use of non-essential cookies only occurs if you consent to it. You can withdraw your consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal). Legal basis for the above processing: Consent.
You can find more information about how cookies are used in the cookie notice published on the Website.
You can contact us, and we can contact you, via email, phone, or social media. Additionally, you can send us a message via the contact form on the Website. In such cases, we will have access to your personal data as disclosed in connection with such contact.
For example, we may access the following personal data during contact: first name, last name, phone number, email address, social media user ID (if applicable), message content, and other information you provide to us.
According to our assessment, we have a legitimate interest in processing the personal data to identify who we are communicating with and to maintain contact regarding the matter.
Our assessment also considers that the processing is necessary for a purpose related to a legitimate interest, and that your interest in protecting your personal data does not outweigh ours, and that the processing does not infringe upon your fundamental rights and freedoms.
Providing your personal data to us is voluntary, meaning it is not a statutory or contractual requirement or a requirement necessary to enter into a contract with us, and you are not obligated to provide your personal data, but the potential consequences of not providing such data are that we will not be able to handle the matter.
Legal basis for the above processing: Legitimate interests.
When entering into a contract with us for the purchase of our services/products, we will process your first name, last name, personal identification number, registered address, phone number, email address, and billing address information. If the purchaser is a business entity/legal person, we process corresponding categories of personal data belonging to the purchaser's representative, such as the authorized signatory or contact person.
There are several purposes for collecting and processing the aforementioned personal data, including:
a. Entering into and performing the contract: Primarily, these are used to enter into and perform the contract correctly. Personal data will only be processed to the extent necessary to achieve this purpose. Legal basis for these processing activities: Contract.
b. Billing: The data is also used for billing and payment processing, which is necessary to ensure smooth and accurate handling of financial transactions in accordance with agreed terms. Legal basis for these processing activities: Contract.
c. Customer service: Additionally, we use this information to effectively communicate with the purchaser, and if applicable, their representatives, send information about our services, and improve our overall customer service. Legal basis for this processing: Legitimate interests.
d. Complaints: In case of any complaints regarding our services/products, we also process the personal data to handle the complaint and fulfill our legal obligations, especially under applicable consumer protection laws. Legal basis for these processing activities: Legal obligation.
e. Accounting: We also process accounting records as part of our business operations, including invoices and receipts. This processing is necessary to comply with requirements from the Tax Agency and applicable legislation, including the Accounting Act (SFS 1999:1078). These accounting records may include personal data, such as first name, last name, address details, and other contact information. Such records will be stored for the period required by law and/or the Tax Agency. Legal basis for these processing activities: Legal obligation.
You may consent to receive newsletters from us by actively consenting to us processing your email address to send newsletters to you. Providing your email address to us for this purpose is voluntary, meaning it is not a statutory or contractual requirement or a requirement necessary to enter into a contract with us, and you are not obligated to provide your email address, but the possible consequences of not providing your email address to us are that we will not send our newsletters to you.
You can unsubscribe from our newsletter at any time by clicking the unsubscribe link in the newsletter and thereby withdrawing your consent. If you withdraw your consent, we will no longer send newsletters to you.
Legal basis for the above processing: Consent.
If you unsubscribe from the newsletters, you will be removed from the email list of newsletter recipients, but your email address will remain in the database with a block on receiving newsletters. The purpose of this is to ensure that you do not receive multiple newsletters from us.
If you want your email address to be deleted from the blocklist as well, you can contact our support via email and request this. You are hereby informed that if your email address is deleted from the blocklist, it means that you may receive newsletters from us again if you or someone else registers your email address to receive newsletters again.
According to our assessment, we have a legitimate interest in processing the personal data for the aforementioned purposes. The processing is necessary for a purpose related to a legitimate interest, and your interest in protecting your personal data does not outweigh ours. Our assessment is that the processing in question does not infringe upon your fundamental rights and freedoms.
Legal basis for the above processing: Legitimate interests.
Legitimate interests: We process personal data based on our legitimate interests for the following purposes:
We always strive to process personal data within the European Union (EU) or European Economic Area (EEA). However, in some cases, personal data may be transferred and processed outside the EU/EEA. To ensure adequate protection of your personal data during such transfers, we implement appropriate safeguards. This may include obtaining your consent, using standard contractual clauses approved by the European Commission, or ensuring that the recipient country has adequate data protection laws.
We may provide necessary information to authorities, such as the police, tax authorities, or other authorities if we are legally obligated to disclose or share personal data in order to comply with our legal obligations.
Personal data may also be disclosed to authorities in response to legal requests or when necessary to prevent, detect, or investigate criminal activities. This disclosure is made to protect our and other relevant parties' property, interests, and safety.
We may share personal data with our suppliers and business partners, including data processors, to protect our legitimate interests, fulfill contractual and legal obligations, detect and prevent issues, and improve our services and digital channels.
Suppliers include companies providing server and hosting services, accounting firms, cloud service providers, accounting systems, web-based platforms, associated applications, and other partners contributing to the support and operation of our business. Before sharing personal data with a data processor, we enter into data processing agreements to ensure proper processing and security in accordance with Article 28 of the GDPR.
Legal basis for the above processing activities: Legitimate interests.
In connection with or during negotiations of a transfer of our company's assets, merger, sale, financing, or acquisition of all or parts of our business, personal data may be disclosed to the potential buyer or seller involved in such transactions, including their personnel/providers.
We have determined that we have a legitimate interest in processing personal data for the purposes stated above, and that our legitimate interest does not outweigh your right to privacy and confidentiality.
Legal basis for the above processing activities: Legitimate interests.
Below is a summary of the rights you have as a data subject under the GDPR:
Right to Information: You have the right to receive information about our collection and use of your personal data. This includes information about the purposes of processing, the categories of personal data involved, and any third parties with whom your personal data may be shared.
Right of Access: You have the right to access your personal data held by us. You can request information about the processing of your personal data, obtain a copy of the personal data in a machine-readable format (subject to any applicable exceptions to the right of access), and be informed about the safeguards for cross-border transfers. However, this does not mean that you have the right to obtain documents containing the processed personal data.
Right to Rectification: You have the right to request rectification of inaccurate or incomplete personal data about you that we process. If we process personal data about you that is inaccurate or incomplete, we will, upon your request or on our own initiative, supplement, correct, or delete the relevant personal data. Once we have corrected the personal data, we will notify you of this, provided that it is not unduly burdensome for us.
Right to Erasure: Under certain circumstances, you have the right to have your personal data erased. This applies, for example, if the data is no longer necessary for the purposes for which it was collected, or if you withdraw your consent and there is no other legal basis for processing. However, legal obligations may prevent us from immediately deleting parts of the personal data. These obligations arise from accounting and tax legislation, banking and anti-money laundering legislation, and potentially consumer law. When we delete personal data upon your request, we will inform you after the deletion, provided that this is possible and not unduly burdensome for us.
Right to Restriction of Processing: You have the right to restrict the processing of your personal data under certain conditions. This means that your data can only be stored and not further processed, or only processed for specific and limited purposes. An example of when this right applies is when the personal data we process needs to be corrected. If you request us to correct your personal data, you may also ask us to restrict the processing of the specific data until it has been corrected. We will inform you when the restriction ends.
Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You can also request the transfer of your data to another data controller, where technically feasible. This right applies only if the processing of personal data is carried out automatically and only if our processing is based on a contract in which you are a party or on your consent.
Right to Object: You have the right to object when your personal data is processed based on legitimate interests. If you object to this right, we will cease processing unless our interests outweigh your interests, rights, and freedoms. However, you always have the right to request that your personal data not be processed for direct marketing. Such objections can be made at any time. If an objection is made to direct marketing, personal data cannot be processed for such purposes, and we will inform you when we have deleted the personal data if you request it.
Right not to be Subject to Automated Decision Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, if these decisions significantly affect you. Exceptions apply if the decision is necessary for the performance of a contract or is permitted by law. If an automated decision has been made, with or without profiling, you may request a review or challenge of it. We do not conduct automated decisions, whether with or without profiling.
You are welcome to contact us using the contact details provided below if you wish to invoke any of the above rights regarding your personal data that we process.
There is no charge to exercise these rights, provided that your requests are not excessive, repetitive, or clearly unfounded. In such cases, we have the right to charge a reasonable fee for handling your request or the right to refuse to comply with your request.
Before handling or responding to your request, we may request additional information from you if needed to confirm your identity.
We will inform you of our handling of your request without undue delay and no later than one month after receiving the request. If the request is complex or, for example, if we have received a large number of requests, this period may be extended by an additional two months. In such cases, we will notify you of the extension within the first month after receiving your request.
It is important to note that these rights are subject to certain limitations and conditions under the GDPR. Some of the rights apply only in certain situations and only if it is lawful and feasible for us to comply with your request.
If we cannot fulfill your request due to applicable law or other exceptions, we will inform you of this and provide the reasons why we cannot fulfill your request, within the limits imposed by law.
We review the content of this privacy notice regularly to ensure that the information is accurate and up-to-date. The content may be updated as needed, with or without prior notice. You are responsible for reviewing the content of our current privacy notice and staying informed about any changes.
We will notify you of any significant changes if such notification is mandatory under applicable law.
The applicable version is always published on the Website.
If you have any questions regarding the content of this privacy notice or our processing of personal data, or if you are dissatisfied with our processing of your personal data, you are always welcome to contact us using the following contact details:
Company: Protectia AB
Organization number: 559365-5169
Email: info@protectia.se
Postal address: c/o Talenom Järfälla AB, Järfällavägen 106 floor 5, 177 41 Järfälla
Phone: 08-580 981 11 (opening hours: weekdays 08:00-11:00)
If you are not satisfied with how we process your personal data, you also have the right to lodge a complaint with our supervisory authority, which is the Swedish supervisory authority:
Name: Swedish Authority for Privacy Protection (IMY).
Phone: 08-657 61 00.
Email: imy@imy.se
Postal address: Swedish Authority for Privacy Protection, Box 8114, 104 20 Stockholm.
Please note that depending on your country of residence, there are different supervisory authorities you can contact regarding questions or complaints about the processing of your personal data. You can find information about the various supervisory authorities in EU Member States via the following link: https://edpb.europa.eu/about-edpb/about-edpb/members_en
Last updated: 10/04/2024