1. INTRODUCTION

This privacy notice provides information on how the Swedish private limited company Protectia AB (org. no: 559365-5169) ("we", "our" or "us") processes personal data. This privacy notice includes information about, among other things:

  • what personal data we process,
  • why the processing is carried out,
  • where the personal data is stored,
  • who the personal data may be shared with, and
  • the rights of the data subjects under the GDPR.

References to "you", "your" or "yours" refer to the data subject whose personal data we process.

2. DEFINITIONS

In addition to the terms defined in the body of this privacy notice, the following definitions shall have the meanings set forth below, whether used in the singular or plural, definite or indefinite form:

User Account: refers to a user account for the Web Application.

Processing: means any operation or set of operations which is performed on personal data, whether or not by automated means. Processing includes, but is not limited to, collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction of personal data.

GDPR: means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Personal Data: means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Data Controller: means the entity that determines the purposes and means of the processing of personal data.

Data Processor: means the entity that processes personal data on behalf of the data controller, according to the data controller's instructions.

Data Subject: means the individual who can be identified from the personal data.

Third Party: means any entity other than the data controller, data subject, or data processor (and those persons authorized to process personal data).

Third-party Services: means third-party information, services, products, systems, websites, software, networks, databases, and platforms.

Website: means the Supplier's official website available via protectia.se (including any subdomains, such as app.protectia.se).

Web Application: means app.protectia.se.

Any other GDPR-related terms not defined herein shall have the same meaning in this privacy notice as set forth in Article 4 of the GDPR.

3. DATA CONTROLLER

Firstborn Group AB is the data controller for all processing of personal data performed by us or on our behalf, to the extent that we determine the means and purposes of the processing (under the principle of accountability). All our processing of personal data is carried out in accordance with the GDPR and the fundamental data protection principles.

Unless otherwise expressly stated, we are the data controller for the processing described in this privacy notice.

4. HOW WE ACCESS PERSONAL DATA

We typically receive personal data in the following situations:

a. when someone contacts us,
b. when we enter into an agreement with you or another Third Party,
c. in connection with the fulfillment of a concluded agreement,
d. when a user adds information to their User Account,
e. when someone subscribes to receive our newsletter,
f. when someone visits our website, and
g. through interaction with us via our social media.

5. CATEGORIES OF PERSONAL DATA WE PROCESS

We only process personal data that is adequate, necessary, and relevant to fulfill the purpose for which it was collected (according to the principle of data minimization).

We primarily process the following categories of personal data:

  • Identifying information: first name, last name, personal identification number.
  • Contractual information: agreements entered into with us and relevant contract details, such as order ID and customer number.
  • Case information: individuals' contact with us in the form of email, chat, customer service calls, and similar.
  • Consent information: information about consents given, such as for direct marketing or use of cookies.
  • Device information: data collected via cookies with the visitor's consent, such as information about the computer, tablet, or phone used to visit our Website, IP address, time zone, operating system, language settings, screen resolution, and other data provided via cookies.
  • Other: other personal data provided to us or registered by users in their User Account, such as driver's license number.

6. LEGAL BASIS FOR PROCESSING PERSONAL DATA

In accordance with the principle of purpose limitation, we only process personal data for specific, explicitly stated, and legitimate purposes. Additionally, each processing activity is legally grounded in compliance with GDPR regulations.

We primarily process personal data based on one of the following legal grounds:

  • Consent: You have given consent to the processing of your personal data for one or more specific purposes (Article 6.1.a GDPR).
  • Contract: Processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract (Article 6.1.b GDPR).
  • Legal obligation: Processing is necessary for compliance with a legal obligation to which we are subject (Article 6.1.c GDPR).
  • Legitimate interests: Processing is necessary for the purposes of legitimate interests pursued by us or a Third Party, except where such interests are overridden by your interests or fundamental rights and freedoms requiring the protection of personal data (Article 6.1.f GDPR).

In some cases, it is optional for you to provide us with your personal data. However, for example, if you do not do so, we may not be able to provide the requested support or handle the matter.

You may need to disclose your personal data to enter into a contract with us or for us to comply with legal or contractual obligations. Unless otherwise specified, you will not suffer any negative legal consequences if you do not provide your personal data to us.

When processing personal data based on legitimate interests as a legal basis, our assessment is that the processing does not infringe upon your right to privacy and personal integrity. We have reached this conclusion after balancing the interests and rights to privacy on one hand, and our legitimate interests in the processing on the other. However, we never process sensitive personal data based on legitimate interests as a legal basis.

7. SPECIFIC PROCESSING ACTIVITIES

Below you can read more about the legal basis and purposes of processing personal data.

1) When visiting the Website:

The Website uses cookies. The use of non-essential cookies only occurs if you consent to it. You can withdraw your consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal). Legal basis for the above processing: Consent.

You can find more information about how cookies are used in the cookie notice published on the Website.

2) When contacting us via email, contact form, phone, or social media

You can contact us, and we can contact you, via email, phone, or social media. Additionally, you can send us a message via the contact form on the Website. In such cases, we will have access to your personal data as disclosed in connection with such contact.

For example, we may access the following personal data during contact: first name, last name, phone number, email address, social media user ID (if applicable), message content, and other information you provide to us.

According to our assessment, we have a legitimate interest in processing the personal data to identify who we are communicating with and to maintain contact regarding the matter.

Our assessment also considers that the processing is necessary for a purpose related to a legitimate interest, and that your interest in protecting your personal data does not outweigh ours, and that the processing does not infringe upon your fundamental rights and freedoms.

Providing your personal data to us is voluntary, meaning it is not a statutory or contractual requirement or a requirement necessary to enter into a contract with us, and you are not obligated to provide your personal data, but the potential consequences of not providing such data are that we will not be able to handle the matter.

Legal basis for the above processing: Legitimate interests.

3) When entering into a contract with a customer and during performance of the contract

When entering into a contract with us for the purchase of our services/products, we will process your first name, last name, personal identification number, registered address, phone number, email address, and billing address information. If the purchaser is a business entity/legal person, we process corresponding categories of personal data belonging to the purchaser's representative, such as the authorized signatory or contact person.

There are several purposes for collecting and processing the aforementioned personal data, including:

a. Entering into and performing the contract: Primarily, these are used to enter into and perform the contract correctly. Personal data will only be processed to the extent necessary to achieve this purpose. Legal basis for these processing activities: Contract.

b. Billing: The data is also used for billing and payment processing, which is necessary to ensure smooth and accurate handling of financial transactions in accordance with agreed terms. Legal basis for these processing activities: Contract.

c. Customer service: Additionally, we use this information to effectively communicate with the purchaser, and if applicable, their representatives, send information about our services, and improve our overall customer service. Legal basis for this processing: Legitimate interests.

d. Complaints: In case of any complaints regarding our services/products, we also process the personal data to handle the complaint and fulfill our legal obligations, especially under applicable consumer protection laws. Legal basis for these processing activities: Legal obligation.

e. Accounting: We also process accounting records as part of our business operations, including invoices and receipts. This processing is necessary to comply with requirements from the Tax Agency and applicable legislation, including the Accounting Act (SFS 1999:1078). These accounting records may include personal data, such as first name, last name, address details, and other contact information. Such records will be stored for the period required by law and/or the Tax Agency. Legal basis for these processing activities: Legal obligation.

4) Newsletter

You may consent to receive newsletters from us by actively consenting to us processing your email address to send newsletters to you. Providing your email address to us for this purpose is voluntary, meaning it is not a statutory or contractual requirement or a requirement necessary to enter into a contract with us, and you are not obligated to provide your email address, but the possible consequences of not providing your email address to us are that we will not send our newsletters to you.

You can unsubscribe from our newsletter at any time by clicking the unsubscribe link in the newsletter and thereby withdrawing your consent. If you withdraw your consent, we will no longer send newsletters to you.

Legal basis for the above processing: Consent.

If you unsubscribe from the newsletters, you will be removed from the email list of newsletter recipients, but your email address will remain in the database with a block on receiving newsletters. The purpose of this is to ensure that you do not receive multiple newsletters from us.

If you want your email address to be deleted from the blocklist as well, you can contact our support via email and request this. You are hereby informed that if your email address is deleted from the blocklist, it means that you may receive newsletters from us again if you or someone else registers your email address to receive newsletters again.

According to our assessment, we have a legitimate interest in processing the personal data for the aforementioned purposes. The processing is necessary for a purpose related to a legitimate interest, and your interest in protecting your personal data does not outweigh ours. Our assessment is that the processing in question does not infringe upon your fundamental rights and freedoms.

Legal basis for the above processing: Legitimate interests.

5) Other purposes for our processing of personal data:

Legitimate interests: We process personal data based on our legitimate interests for the following purposes:

  • Direct marketing: We use personal data to conduct direct marketing of our services. This includes sending email messages with information, promotions, and offers to our existing customers via email or other communication means.
  • Technical functionality: We develop and ensure the technical functionality of our Website by engaging developers or specific programs to develop and test its features.
  • Security protection: We may process personal data to protect ourselves against misuse, crime, fraud, intrusion, or other damage to our property. In such events, we may report them and disclose necessary information to relevant authorities, such as the Police or Data Protection Authority.

8. STORAGE LOCATION

We always strive to process personal data within the European Union (EU) or European Economic Area (EEA). However, in some cases, personal data may be transferred and processed outside the EU/EEA. To ensure adequate protection of your personal data during such transfers, we implement appropriate safeguards. This may include obtaining your consent, using standard contractual clauses approved by the European Commission, or ensuring that the recipient country has adequate data protection laws.

9. STORAGE PERIOD

We process personal data for as long as necessary to fulfill the purposes for which they were collected, including to comply with any legal, accounting, or reporting requirements, in accordance with the principle of storage limitation. The exact duration of the storage period depends on the type of personal data and the purposes for which they were collected. Personal data recorded in our customer or supplier register is stored for the duration of the contract and for a period of four (4) years thereafter. When we store personal data for purposes other than our contractual obligations, such as to comply with anti-money laundering, accounting, and other statutory requirements, we only retain the data for as long as necessary and/or mandated for each purpose. We may also delete the personal data at the request of the data subject if we do not need to process the relevant personal data to fulfill contractual or legal obligations. When personal data is no longer needed for storage purposes, it will be deleted or anonymized. In the event of a claim against us, we may retain personal data until the end of the statutory limitation period. Similarly, in the event of an ongoing dispute, relevant personal data will be retained until the dispute is resolved. We ensure compliance with applicable laws and regulations regarding the storage of personal data under these circumstances.

10. SHARING OF PERSONAL DATA

We handle all personal data that we have access to with care and do not share personal data with unauthorized parties. To effectively operate and conduct our business, we may need to share your personal data with selected companies that have expertise in their respective fields or if required by us to comply with applicable laws (including social, labor, or tax legislation). All sharing of personal data is done in accordance with applicable data protection laws and regulations, with a focus on protecting the rights and privacy of data subjects. We may disclose personal data to the recipients specified below to achieve the purposes set out in section 7 (Specific Processing Activities) and as described below.

Authorities

We may provide necessary information to authorities, such as the police, tax authorities, or other authorities if we are legally obligated to disclose or share personal data in order to comply with our legal obligations.

Personal data may also be disclosed to authorities in response to legal requests or when necessary to prevent, detect, or investigate criminal activities. This disclosure is made to protect our and other relevant parties' property, interests, and safety.

Suppliers and Business Partners

We may share personal data with our suppliers and business partners, including data processors, to protect our legitimate interests, fulfill contractual and legal obligations, detect and prevent issues, and improve our services and digital channels.
Suppliers include companies providing server and hosting services, accounting firms, cloud service providers, accounting systems, web-based platforms, associated applications, and other partners contributing to the support and operation of our business. Before sharing personal data with a data processor, we enter into data processing agreements to ensure proper processing and security in accordance with Article 28 of the GDPR.

Legal basis for the above processing activities: Legitimate interests.

Other Third Parties

In connection with or during negotiations of a transfer of our company's assets, merger, sale, financing, or acquisition of all or parts of our business, personal data may be disclosed to the potential buyer or seller involved in such transactions, including their personnel/providers.

We have determined that we have a legitimate interest in processing personal data for the purposes stated above, and that our legitimate interest does not outweigh your right to privacy and confidentiality.

Legal basis for the above processing activities: Legitimate interests.

11. YOUR RIGHTS

Below is a summary of the rights you have as a data subject under the GDPR:

Right to Information: You have the right to receive information about our collection and use of your personal data. This includes information about the purposes of processing, the categories of personal data involved, and any third parties with whom your personal data may be shared.

Right of Access: You have the right to access your personal data held by us. You can request information about the processing of your personal data, obtain a copy of the personal data in a machine-readable format (subject to any applicable exceptions to the right of access), and be informed about the safeguards for cross-border transfers. However, this does not mean that you have the right to obtain documents containing the processed personal data.

Right to Rectification: You have the right to request rectification of inaccurate or incomplete personal data about you that we process. If we process personal data about you that is inaccurate or incomplete, we will, upon your request or on our own initiative, supplement, correct, or delete the relevant personal data. Once we have corrected the personal data, we will notify you of this, provided that it is not unduly burdensome for us.

Right to Erasure: Under certain circumstances, you have the right to have your personal data erased. This applies, for example, if the data is no longer necessary for the purposes for which it was collected, or if you withdraw your consent and there is no other legal basis for processing. However, legal obligations may prevent us from immediately deleting parts of the personal data. These obligations arise from accounting and tax legislation, banking and anti-money laundering legislation, and potentially consumer law. When we delete personal data upon your request, we will inform you after the deletion, provided that this is possible and not unduly burdensome for us.

Right to Restriction of Processing: You have the right to restrict the processing of your personal data under certain conditions. This means that your data can only be stored and not further processed, or only processed for specific and limited purposes. An example of when this right applies is when the personal data we process needs to be corrected. If you request us to correct your personal data, you may also ask us to restrict the processing of the specific data until it has been corrected. We will inform you when the restriction ends.

Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format. You can also request the transfer of your data to another data controller, where technically feasible. This right applies only if the processing of personal data is carried out automatically and only if our processing is based on a contract in which you are a party or on your consent.

Right to Object: You have the right to object when your personal data is processed based on legitimate interests. If you object to this right, we will cease processing unless our interests outweigh your interests, rights, and freedoms. However, you always have the right to request that your personal data not be processed for direct marketing. Such objections can be made at any time. If an objection is made to direct marketing, personal data cannot be processed for such purposes, and we will inform you when we have deleted the personal data if you request it.

Right not to be Subject to Automated Decision Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, if these decisions significantly affect you. Exceptions apply if the decision is necessary for the performance of a contract or is permitted by law. If an automated decision has been made, with or without profiling, you may request a review or challenge of it. We do not conduct automated decisions, whether with or without profiling.

12. HOW TO EXERCISE YOUR RIGHTS

You are welcome to contact us using the contact details provided below if you wish to invoke any of the above rights regarding your personal data that we process.

There is no charge to exercise these rights, provided that your requests are not excessive, repetitive, or clearly unfounded. In such cases, we have the right to charge a reasonable fee for handling your request or the right to refuse to comply with your request.

Before handling or responding to your request, we may request additional information from you if needed to confirm your identity.

We will inform you of our handling of your request without undue delay and no later than one month after receiving the request. If the request is complex or, for example, if we have received a large number of requests, this period may be extended by an additional two months. In such cases, we will notify you of the extension within the first month after receiving your request.

It is important to note that these rights are subject to certain limitations and conditions under the GDPR. Some of the rights apply only in certain situations and only if it is lawful and feasible for us to comply with your request.

If we cannot fulfill your request due to applicable law or other exceptions, we will inform you of this and provide the reasons why we cannot fulfill your request, within the limits imposed by law.

13. CHANGES

We review the content of this privacy notice regularly to ensure that the information is accurate and up-to-date. The content may be updated as needed, with or without prior notice. You are responsible for reviewing the content of our current privacy notice and staying informed about any changes.

We will notify you of any significant changes if such notification is mandatory under applicable law.

The applicable version is always published on the Website.

14. QUESTIONS OR COMPLAINTS

If you have any questions regarding the content of this privacy notice or our processing of personal data, or if you are dissatisfied with our processing of your personal data, you are always welcome to contact us using the following contact details:

Our Company and Contact Information

Company: Protectia AB
Organization number: 559365-5169
Email: info@protectia.se
Postal address: c/o Talenom Järfälla AB, Järfällavägen 106 floor 5, 177 41 Järfälla
Phone: 08-580 981 11 (opening hours: weekdays 08:00-11:00)

Supervisory Authority

If you are not satisfied with how we process your personal data, you also have the right to lodge a complaint with our supervisory authority, which is the Swedish supervisory authority:

Name: Swedish Authority for Privacy Protection (IMY).
Phone: 08-657 61 00.
Email: imy@imy.se
Postal address: Swedish Authority for Privacy Protection, Box 8114, 104 20 Stockholm.

Please note that depending on your country of residence, there are different supervisory authorities you can contact regarding questions or complaints about the processing of your personal data. You can find information about the various supervisory authorities in EU Member States via the following link: https://edpb.europa.eu/about-edpb/about-edpb/members_en

Last updated: 10/04/2024