Privacy Policy

1. Introduction

This privacy policy outlines your rights and explains how and why Orwak AB (herein ‘Orwak’, ‘we’, ‘our’ or ‘us’) processes your personal data.

The information contained in this privacy policy is addressed to: any party which works with or represents any of our clients, suppliers or other business partners (and in that capacity has contact with us); anyone seeking employment with us; and anyone who visits our websites www.orwak.com, www.orwak.de, www.orwak.es or www.orwak.se (‘website’) or social media platforms (hereinafter referred to as ‘digital channels’) or in any other way communicates with us.

Different sections of this policy will therefore be applicable and relevant to you depending on your relationship with us and your chosen method of communication.

2. General information about the processing of personal data etc.

We take a serious, lawful and long-term approach to our work on privacy issues. This applies not only with regard to our client and supplier contacts but also to the users of and visitors to our website, as well as to those who contact us via our digital channels or other means of communication.

Our goal is to ensure that you feel confident that your own and other people’s personal privacy is being respected and that we process personal data correctly and in accordance with applicable data protection regulations, regardless of the capacity in which you contact us or provide us with your own or anyone else’s personal data.

3. Data Controller etc.

Orwak AB, VAT No. SE556055240701, with address Box 58, 57622 Sävsjö, Sweden is the data controller for the processing of your personal data as outlined in this privacy policy.

Should you have any questions about how we process your personal data or about your related rights, you are always welcome to contact us. Our contact details can be found at the bottom of this privacy policy.

We are responsible for ensuring that the personal data we process is used only for its intended purposes and protected from unauthorized access. All processing of personal data by Orwak is in accordance with applicable data protection legislation. From 25 May 2018, the General Data Protection Regulation (GDPR1) comes into force within the EU/EEA. GDPR and any other applicable privacy rules are herein referred to as the applicable data protection regulations.

¹ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

This privacy policy is valid until further notice and until we have adopted and established a new or revised privacy policy where appropriate. Should such an amendment affect you or your rights, you will be informed of this in the manner provided for us by the applicable data protection regulations.

4. What are personal data and its processing?

Personal data is any information which can be either directly or, in conjunction with other details, indirectly linked to a living natural person. Examples of personal data include names, email addresses, phone numbers and IP addresses.

The processing of personal data includes anything that happens to personal data. Any action, automated or otherwise, taken with regard to personal data may therefore constitute processing; for example, where it is collected, registered, organized, structured, stored, developed or modified, produced, read, used, distributed through transfer, disseminated or otherwise made available, adjusted or compiled, restricted, erased or destroyed. Further information about the various terms used in this privacy policy can be found at www.datainspektionen.se.

5. Our processing of personal data

Which personal data do we process and why?

We process your personal data for different purposes depending on the relationship you have with us.

In most cases, we process the personal data which you have yourself chosen to submit to us, most commonly in your professional role as a contact person or the employee responsible for one of our clients, suppliers or other partners, or alternatively when you contact us about a job vacancy. Such data may include your name, address, email address and/or phone number.

In some cases, we also collect your personal data from someone other than yourself; for example, where you or the company you represent are about to enter or have already entered into an agreement with us. We also collect certain information automatically relating to your use of our website and digital channels.

However, we do not sell personal data to nor share it with third parties unless such sharing or transfer is necessary in order to fulfil our agreement with you.

The following sections contain more detailed information about exactly which personal data we process and why we process it, this being dependent on whether you are visiting our website or other digital channels, communicating with us or seeking employment with us or are a contact person for one of our suppliers, clients or other business partners.

For which purposes do we process personal data?

Personal data, which is collected in connection with your use of our digital channels and their services, will be processed either by ourselves or our sub-processors for the following purposes:

In order to prepare, administer and fulfil agreements relating to products and/or services into which we, the company you represent and/or yourself have entered.
In order to communicate with you or the company you represent via customer services, salespersons or email.
In order to administer marketing activities such as trade fairs, exhibitions, competitions and contest wins where we receive your personal data in advance of or during the course of carrying out such activities.
For marketing purposes, including the sending of promotional material by post or via email.
For so-called ‘profiling’ – that is, analyzing and grouping visitors to our website and digital channels by selection, prioritization or preference for the purpose of providing you with relevant and customized information, recommendations, newsletters and targeted offers. Data derived from the use of our various different digital channels may be consolidated for this purpose, as well as for developing products and services.
In order to produce statistics about the use of our website and digital channels and the services they offer.
In order to maintain, develop, test and improve our website and digital channels and the technical platforms upon which they are delivered.

a. When you visit our website and/or other digital channels and communicate with us

Purpose: In order to administer and improve our website and other digital channels.

Processing:

• Analyses of the data we collect for the purpose stated above. Based on the data we process, we perform analyses on an aggregated level (without identifying you as an individual) in order to help us maintain, test and improve our website and digital channels.

Personal data processed:

• Information about your visits to our website provided via cookies (such as information about pages visited and links clicked, as well as technical data relating to your device such as IP address, geographic location and browser settings).

Lawful basis:

The processing is necessary in order to meet our legitimate interest in managing and improving our website (according to a balance of interests).

Retention period: No more than two years.

Purpose: In order to communicate with you when you contact us; for example, via email, by phone or through our website or digital channels.

Processing:

Handling your case and answering questions.
Improving the services and information we provide via our website and other channels.

Personal data processed:

Name and contact details (such as email addresses, phone numbers and postal addresses).
Other data and information which you choose to submit to us.

Lawful basis:

The processing is necessary in order to fulfil our mutual interest in communicating with you after you have contacted us (according to a balance of interests).

Retention period: As long as your case is open and thirteen months thereafter.

Purpose: In order to prevent and detect misuse of the services we offer through our website or digital channels; for instance, in the case of a cyberattack.

Processing:

The processing is required in order to protect our IT systems from cyberattacks and hackers.

Personal data processed:

Information about your visits to our website provided via cookies (such as information about pages visited and links clicked, as well as technical data relating to your device such as IP address, geographic location and browser settings).

Lawful basis:

The processing is necessary in order to meet our legitimate interest in protecting our IT systems from cyberattacks and hackers (according to a balance of interests).

Retention period: No more than two years

b. where you are the contact person for one of our suppliers, clients or other partners.

Purpose: In order to prepare, administer and fulfil agreements with suppliers, clients and other partners.

Processing:

The processing required in order to administer our rights and obligations according to a prospective (i.e. future) or actual (i.e. existing) agreement with a supplier, client or other type of partner.
Ongoing contact with our supplier, client or partner and the various contact details retained on behalf of employees and/or contact persons.

Personal data processed:

Name of the contact person for the supplier, client or partner.
Contact details (email, phone number etc.) for the contact person.
In the case of the supplier, client or partner being a private company, the organization number and/or personal identity number.

Lawful basis:

The processing is necessary in order to fulfil our legitimate interest in preparing or meeting an agreement with our supplier, client or partner or, where you as a sole trader provide us with information, for the purpose of fulfilling our agreement or taking the measures required by yourself prior to an agreement being entered into.

The processing is also necessary to meet our legitimate interest in preparing, administering and fulfilling agreements with suppliers, clients or other partners.

Certain processing is also necessary in order to fulfil our legal obligations, including the requirement to retain invoices (containing personal data) for an extended period.

Retention period: For as long as we have rights or obligations according to the agreement and for a period of two (2) years thereafter. Certain personal data may be retained for as long as bookkeeping regulations or other rules require, which may be until the end of the seventh (7th) year following the current fiscal year. We do not require you to submit your personal data to us. Should we not be permitted to process your personal data, we will be unable to enter into or fulfil our agreement with you (or will be able to do so only with some delay) or administer our contractual relationship with you or the company you represent/are the contact person for.

Purpose: In order to administer complaints, warranties, claims and any other similar requirements.

Processing:

The processing required in order to administer our rights and obligations according to an agreement with a supplier, client or other partner.

Personal data processed:

Name of the contact person for the supplier, client or partner.
Contact details (email, phone number etc.) for the contact person.
In the case of the supplier, client or partner being a private company, the organization number and/or personal identity number.

Lawful basis:

In order to administer complaints, warranties and the like according to our legal obligations. The processing of your personal data in this context is necessary in order to fulfil our legitimate interest in meeting our legal obligations and defending ourselves against any potential legal claims.
Retention period: Until warranty periods, periods of responsibility and the like according to their respective agreements have expired and in all cases for two (2) years from the termination or completion of the agreement in question.

We do not require you to submit your personal data to us. Should we not be permitted to process your personal data, we will be unable to enter into or fulfil our agreement with you or administer our contractual relationship with you or the company you represent/are the contact person for.

Purpose: In order to carry out marketing and administer newsletters and the like.

Processing:

Sending out news, product and service offers, and events and other marketing material via email and/or other digital channels.

Personal data processed:

The name and contact details (email, phone numbers etc.) of the contact person for the client or potential client.

Lawful basis:

The processing is necessary in order to fulfil our legitimate interests in marketing our products and services, maintaining our business relationship with you and communicating with you in your professional role (according to a balance of interests).

Retention period: If you are the contact person for any of our current or previous clients, your data will be retained for the duration of the agreement and for a period of [two (2) years] thereafter. If you are the contact person for one of our potential clients, your data will be retained [for the duration of the marketing campaign]. Click the ‘unsubscribe’ link if you no longer wish to receive information from us. You may at any time unsubscribe from further communications from us. If you choose to unsubscribe, we will immediately terminate our processing of your personal data for this purpose.

c. When you seek employment or contact us regarding vacancies or the like via our recruitment partners

Purpose: In order to administer and organize our recruitment work

Processing:

Evaluating different candidates based on their experience, qualifications and grades.
Administering interview times and invitations.
Administering CVs, covering letters, grades and tests.
Administering phone contact and email correspondence with us.
Transferring data to or from our recruitment partner(s).
Other necessary processing in order to administer and organize our ongoing and/or specific recruitment work.

Personal data processed:

Name
Personal identity number
Address
Phone number
Email address
Picture, where applicable
Education details
Professional experience details
Any other data which you may submit to us in your CV or otherwise provide.

Lawful basis:

The processing is necessary in order to meet our legitimate interest in recruiting staff as well as our mutual interest in communicating with you in such cases (according to a balance of interests). Your personal identity number will be processed where this is clearly justified by the purpose of the processing and in order for us to identify you.

Retention period:Until the application process has been completed and, in the case of personal data in the form of names, contact details and positions applied for, two years according to period of limitation of the Discrimination law. The collection of information is necessary in order for us to administer your application and offer you employment with us. If personal data is not submitted, we will not be able to administer your application and will not therefore be able to offer you employment with us.

Purpose: In order to administer prospective recruitment

Processing:

Evaluating candidates in our candidate database for future recruitment.
Administering phone contact and email correspondence with candidates.
Administering interview times, as well as times for tests and meetings.
Other necessary processing in order to administer and organize our ongoing and/or specific recruitment work.

Personal data processed:

Name
Contact details
Details contained in your CV (such as your date and place of birth, address, phone number, email address, photo (where applicable), educational background and professional experience).

Lawful basis:

Balance of interests. If upon the completion of the application process you are not offered a position with us, you may notify us that you wish to unsubscribe from our processing of your name, contact details and CV for future recruitment and vacancies.

Retention period: Two years after a dialogue has been concluded or until such time as you unsubscribe.

Purpose: In order to meet our obligations and observe our rights in labour law.

Processing:

The processing required in order to uphold our rights in the event of a claim being made under the applicable legislation.

Personal data processed:

Personal data which you have submitted in connection with an application process.

Lawful basis:

The processing is necessary in order to meet our obligations and observe our rights in labour law (a legal duty).

Retention period: The duration of the application process and two years thereafter unless otherwise required by law.

This collection of personal data is a legal requirement. If data is not provided, we will be unable to meet our legal obligation or administer your employment application.

6. Would you like to know more about how we balance interests when processing personal data?

As outlined previously, in some cases we process your personal data based on our legitimate interest (that is to say, according to a so-called balance of interests). A balance of interests is one of several legal grounds for the processing of personal data according to applicable data protection rules.

If you have any questions or would like to know more about how we balance interests, please feel free to contact us.

7. Who is granted access to your personal data?

Your personal data is shared with so-called ‘data processors’, the companies which process personal data on our behalf. For example, access to your personal data is granted to business partners and other suppliers, including IT and systems providers delivering operations and development services and systems and cloud services support.

We have signed personal data agreements with them requiring them to process data safely, accurately and confidentially in accordance with our instructions. Should you send us an employment application, your data will, in some cases, be shared with recruitment agencies which process applications and application documents, or, if you have provided such a company with personal data, this will be transferred to us.

8. Will your personal data be transferred to other countries?

Some of our IT providers conduct their business activities outside the EU/EEA. As a result, your personal data may be transferred outside the EU/EEA. When such transfers take place, we take special security measures to ensure an adequate level of protection for your personal data, which may mean, for example, that we sign agreements including standardized data transfer clauses adopted by the EU Commission.

9. Our cookie policy

Our websites use cookies. Cookies are small text files stored on your computer which we use to track what you do on our website. There are two types of cookies: persistent cookies and session cookies.

Persistent cookies
A persistent cookie remains on your computer for a pre-defined period of time. On www.orwak.com, www.orwak.de, www.orwak.es and www.orwak.fr , such cookies are used to improve our website by gathering statistics on how you as a visitor use it; for example, providing data about which articles are read the most and about how users navigate around the site.

Session cookies
A session cookie is stored temporarily in the computer’s memory during the course of a browsing session. Session cookies are erased when you close your browser. On this website, session cookies are used to handle information which you provide when using our services.

Should you not agree to cookies being used, you may disable them in your browser’s security settings. You can also set up your browser to prompt you each time a website tries to place a cookie on your computer. Previously stored cookies can also be deleted in your browser – see the browser’s help pages for more information.

Security measures for the protection of personal data

We maintain a high level of security with regard to your personal data and take appropriate technical and organizational security measures to protect your personal data from unauthorized access, modification, dissemination or destruction.

10. Right to information and right to lodge a complaint etc.

Depending on the context, you have a number of rights relating to our processing of your personal data in accordance with applicable data protection rules.

Right to information You have the right to receive information about the personal data about you which we process and to request an extract of the data being processed.

Right to revoke consent
Where you have consented to the processing of your personal data, you have the right to revoke this at any time with future effect.

Right to rectification
You have the right to have incorrect data rectified.

Right to erasure, right to restriction of processing and right to object
Under certain circumstances you have the right to have your personal information removed, to require that the processing of your personal data be restricted and to object to our processing of your personal data.

Right to data portability
You have the right to require that personal data be transferred from ourselves to another company, authority or organization. However, this right applies only to the data you yourself have submitted to us.

Right to lodge a complaint
You also have the right to lodge a complaint at any time with the appropriate regulatory authority (www.datainspektionen.se) if you believe that your personal data is being processed in violation of applicable data protection rules.

11. Contact information

The data controller for the processing of your personal data according to the above is Orwak. Should you have any questions about how we process your personal data, please contact us via email or send us a letter: Email: info@orwak.com

Letter: Orwak AB, Box 58, 57622 Sävsjö, Sweden

12. Amendments to this privacy policy

In striving to comply with applicable data protection rules, we will amend and add to this privacy policy in the future. However, the latest version of the privacy policy is always available on the website www.orwak.com.

Last updated: 24 May 2018