Privacy

Introduction

We value your privacy. The purpose of this information is to describe how Preventai AB (the "Company", "we", "us") processes your personal data in a legal, suitable and safe manner, and what rights you have when you or the company or organisation you represent request or buy our services and/or products, when you provide your services and/or products to us, when you visit our website, when you apply for a job, or when you are in contact with us.

If you have any questions or wish to exercise any of your rights, you are most welcome to contact us at ●.

Data controller

Preventai AB, reg. no 559445-6468, having its registered address at Hästholmsvägen 28, 131 30 Nacka, is the data controller for the processing of personal data in accordance with this information.

Processing of your personal data

In the table below, you can find information about our processing of your personal data. We describe the purpose of the processing, i.e., why we process your personal data. For each purpose, we also specify which categories of personal data we may process, the legal basis for the processing, and for how long we will process the data.

‍

Purpose	Categories of personal data	Legal basis	Deletion period
To provide services and/or products that you as a customer have requested.	Contact information (name, email address, delivery address), billing information, information about your purchase.	Fulfilment of the agreement with you or the company/organisation you represent.	During the warranty period and the following 12 months.
To administer our contractual relationship regarding services and/or products you provide us.	Contact information (name, email address, delivery address), billing information, information about your services/products.	Fulfilment of the agreement with you or the company/organisation you represent.	During the time we have an active business relationship with you and 12 months after the last purchase.
To comply with applicable legislation, such as accounting legislation.	Billing information, information regarding your purchase.	Legal obligation.	Seven years.
For handling any potential warranty or complaint issues.	Contact information (name, email address, delivery address), information regarding your purchase.	Fulfilment of the agreement with you or the company/organisation you represent. Legal obligation.	During the warranty period and the following 12 months.
To safeguard and protect the legal interests of the Company.	Contact information (name and email address), correspondence, information regarding your purchase.	Legitimate interest of the company to protect and assert its rights in the event of a dispute.	Until the legal process is completed, if applicable.
To market our services and/or products as well as our business through channels such as mailings, website, special offers, and via social media.	Contact information (name, email address, delivery address), information about your purchase, information about your device (e.g. IP address), any social media usernames.	Legitimate interest to market our services/products and our business.	12 months after your latest purchase.
To provide customer service.	Contact information (name, email address, delivery address), information about your purchase.	Fulfilment of the agreement with you or the company/organisation you represent.	Two years.
To enable general customer and supplier care (quality work, statistics, market and customer/supplier analysis, as well as business, method, and product development).	Information about your purchase, postal address.	Legitimate interest to develop our business.	Ten years from the date of completion of the assignment.
To administer and implement an efficient recruitment process and to recruit new staff.	Name, social security number, address, contact details, photograph, professional title, current and former place of work, CV and other application documents and certificates, grades, marks, testimonials and the like.	Balance of interests — the Company's legitimate interest to evaluate your merits and personal qualities in connection with recruitment decisions.	Until the recruitment process is finalised and the position is filled and for two years thereafter. If you agree, application documents may be kept for future recruitments.

‍

We only process personal data that is necessary to achieve the purposes stated above and only for the time necessary to achieve those purposes. Exactly which personal data we process about you depends on how you have come into contact with us and which of our services and/or products we provide to you or which of your services and/or products you provide to us.

To enable the Company to comply with legal obligations or to safeguard our legal interest, we may keep the personal data for a longer period than stated above. However, personal data is never processed longer than necessary or legally required for each purpose.

In addition to the personal data that you provide to us or that we collect from you, we may also collect personal data from third parties, such as providers of address information from public records.

When asked to provide personal data to us, you can choose not to do so. If you choose not to provide personal data that is necessary for us to fulfil our commitments to you, it may lead to us being unable to fulfil such commitments.

Your rights

You are entitled to receive information regarding our processing of your personal data. Below is a summary of the rights that you can exercise by contacting us.

Right to access

You have the right to request information about the processing of your personal data, free of charge, and to receive a copy of the personal data we process about you. This request should be made in writing to us. We will respond as soon as we can. If we cannot meet your request, we will provide a justification. The copy of your personal data will be sent to your registered address, unless otherwise agreed in writing.

Right to rectification

If you inform us that personal data you have provided is no longer correct, we will promptly correct, block, or delete such personal data.

Right to erasure

You have the right to request that the Company deletes your personal data without undue delay in the following cases:

The personal data is no longer necessary for the purpose for which it was collected;
You have withdrawn your consent and the processing is based solely on consent;
The processing is for direct marketing and you object to it;
You object to the processing based on legitimate interest and your interest outweighs ours;
Your personal data has not been processed in accordance with applicable data protection legislation; or
Deletion is required to comply with a legal obligation.

There may be obligations imposed by applicable legislation (e.g. accounting regulations) that prevent us from immediately deleting all personal data. If so, we will inform you and ensure the data is only used to fulfil such obligations.

Right to restriction

You have the right to request that the Company temporarily restrict the processing of your personal data in the following cases:

You believe the personal data we have about you is incorrect and have requested correction;
The processing is not in compliance with applicable legislation but you prefer restriction over deletion; or
We no longer need your personal data for our processing purposes but you need it to establish, assert or defend a legal claim.

When restricting your personal data, the Company will only store it and will seek your consent for any further processing.

Right to data portability

You have the right to request that we provide all personal data we process about you (when processed with your consent or to fulfil a contractual obligation) in a machine-readable format (e.g. Excel or CSV). If technically possible, you may also request that we transfer your personal data to another data controller.

Right to object

You have the right to object to our processing of your personal data when the processing is based on our legitimate interest. The Company will only continue processing if it has legitimate interests that outweigh yours, and will always inform you of this.

Right to withdraw consent

If we process your personal data based on your consent, you have the right to withdraw that consent at any time by contacting us using the information below.

Right to submit a complaint

If you have a complaint regarding the Company's processing of personal data, you can contact us at ●, or file a complaint with the supervisory authority in the member state where you reside or where the alleged breach occurred. The current supervisory authority in Sweden is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten):

Webpage: https://www.imy.se/en/

Phone: +46 86 57 61 00

Email: imy@imy.se

To whom may we transfer your personal data?

Only those individuals at the Company who need access to your personal data to perform their job duties will have access to it.

To provide certain services, we use selected third parties. The sharing of your personal data with third parties is based on the same purposes and legal bases as they were collected for. The Company takes technical and organisational measures to ensure that your personal data is handled safely and securely. The categories of recipients with whom your personal data may be shared include:

Suppliers and subcontractors: Third-party suppliers managing parts of our business (technical support, IT systems, marketing services). We enter into data processing agreements and take appropriate measures to ensure secure processing.
Banks and other collaborating companies: Independent data controllers such as banks and partners who are independently responsible for their processing of your personal data.
Social media: When using social media, your personal data is collected and processed by those companies. Please see each company's privacy policy for more information.
Courts, authorities, and other public bodies: We will disclose your personal data if required by law, government decision, court order, or if we reasonably believe disclosure is necessary to protect the Company's rights.

The Company will not sell your personal data to third parties without your prior approval. We may transfer your personal data to a buyer/investor in connection with a restructuring, sale, or other transfer of all or part of the Company's shares, assets, or business. Before such transfer, we will take measures to ensure the receiving party processes your personal data in a manner consistent with this information.

Transfer of personal data to third countries

As a main rule, the Company only processes your personal data within the EU/EEA. Sometimes, however, we may share your personal data with a party in a country outside the EU/EEA where the GDPR does not apply. We protect your personal data by basing such transfers on an adequacy decision by the European Commission, or by taking appropriate security measures such as the European Commission's standard contractual clauses combined with organisational and technical protective measures.

We conduct a risk assessment before any transfer takes place and implement technical and organisational protection measures to ensure an appropriate level of protection. We transfer as few personal data as possible and anonymise it before transfer whenever possible.

The following recipients outside the EU/EEA might receive your personal data:

Suppliers and subcontractors: We may share your personal data with suppliers and subcontractors located outside the EU/EEA, including providers of IT services.
Microsoft Office 365: Your personal data is processed by Microsoft Corporation and may be transferred to the United States.
Google Workspace: Your personal data is processed by Google Ireland Limited and may be transferred to the United States.
Social media (Instagram/Meta): Your personal data is processed by Meta Platforms Ireland Ltd. and may be transferred to the United States.
Social media (LinkedIn): Your personal data is processed by Microsoft Corporation and may be transferred to the United States.

How do we protect your personal data?

To protect your privacy and to detect, prevent, and mitigate the risk of attacks, the Company takes a variety of technical and organisational information security measures. The Company also takes measures to protect your personal data from unauthorised access, misuse, disclosure, alteration, and destruction. The Company ensures that access to your personal data is only given to personnel who need it to perform their duties and that they observe confidentiality.

Changes

We may make updates or changes to this information from time to time due to changes in applicable laws or regulations, or due to changes in our personal data handling procedures. We will notify you of any material changes that affect your personal data.

If you have questions

If you have any questions regarding this information or the processing of personal data, you are most welcome to contact us.

‍