Privacy policy.
Privacy Policy only available in English. Contact info@vekst.se if you have questions.
1 GENERAL
1.1 This privacy policy (the "Privacy Policy") always applies, unless otherwise agreed in writing, between Vekst AB, reg.no 556998-1920, (“Vekst”), and each person who provides Vekst with their personal data (the "Data Subject").
1.2 Concepts in this Privacy Policy, e.g. “personal data”, “data controller”, “processing”, “data processor”, “standard contractual clauses” and “supervisory authority”, shall have the meaning ascribed to them in Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”), unless the circumstances obviously require another order of interpretation.
1.3 Vekst is the personal data controller for the processing of personal data which is registered with Vekst via the webpage www.vekst.se, or any of its sub-domains or connected webpages (together the “Website”), or which Vekst collects directly from a Data Subject or from a third party. Vekst may also process personal data on behalf of one of Vekst’s clients, in which case Vekst acts as a data processor, and the client as the data controller.
1.4 This Privacy Policy serves to assure the Data Subject that Vekst, in its capacity of personal data controller, processes personal data in accordance with applicable privacy laws and regulations. Vekst, in its capacity of data processor, shall also strive to adhere to this Privacy Policy when processing personal data on behalf of a data controller, however, such processing is always subject to the instructions given by the data controller.
1.5 Below follows a description of how Vekst processes the Data Subject's personal data. Information is also given regarding the Data Subject’s rights, and how the Data Subject can get in contact with Vekst in case the Data Subject has any questions or wants to exercise his or her rights.
1.6 By using the Website or in any other way soliciting Vekst’s services (together hereinafter referred to as the "Services"), the Data Subject agrees to Vekst’s processing of the Data Subject's personal data in accordance with this Privacy Policy. By using the Website, the Data Subject also agrees to Vekst cookie policy.
2 CHANGES TO THE PRIVACY POLICY
2.1 Vekst may at any time, and at its sole discretion, update or make changes to this Privacy Policy.
2.2 Should Vekst have to change this Privacy Policy, the Data Subject will be informed through announcements on the Website.
3 PROCESSING, OBJECTIVES AND LEGAL BASIS
3.1 The purpose of processing the personal data is to enable Vekst to offer the Services in full, provide information about the Services and market the Services. Vekst may use personal data for email marketing, facilitating sales, newsletter dispatches, webinar invitations, or re-targeting through advertisement platforms such as LinkedIn, Google or Facebook etc.
3.2 The collection and processing of the Data Subject's personal data is conducted solely with the Data Subject's consent or on the premise of an existing agreement or legal obligation, e.g. when Vekst must save the data according to accounting rules. Exceptions are made for cases where a prior consent is not possible for practical reasons, when the processing of the data is permitted by law, or when Vekst has a legitimate interest in processing the personal data, e.g. for marketing, follow-up of the Services, or for exercising or defending Vekst against legal claims, in accordance with a so-called balance of interests.
3.3 Any personal data that Vekst processes in connection with the registration of the Data Subject’s use of the Services is referred to below as "Registration Data".
3.4 Vekst processes the Registration Data to administer the Data Subject's to be able to offer and market the Services to the Data Subject. The legal basis for the processing is the Data Subject’s consent and/or Vekst's contractual relationship with the Data Subject in accordance with Vekst’s general terms and conditions.
3.5 When a Data Subject contacts Vekst via Vekst's support service, Vekst saves the personal data that Vekst needs to be able to provide the support service as part of the Services, administer support and complaint cases and be able to contact the Data Subject. In addition to Registration Data, Vekst may process personal data relating to case/ticket numbers. The legal basis for the treatment is Vekst's contractual relationship with the Data Subject in accordance with Vekst’s general terms and conditions.
3.6 Vekst processes the Data Subject’s Registration Data for direct contact with the Data Subject via email, in order to conduct Data Subject surveys or to deliver updated purchase terms, newsletters etc. The legal basis for the processing is a so-called balance of interests.
3.7 Vekst may process the Registration Data to fulfill its legal obligations based on legal requirements, judgments or decisions by authorities etc. In such cases, the legal basis for the processing is Vekst’s legal obligation.
4 SENSITIVE PERSONAL DATA
Vekst does not process any sensitive personal data, i.e. data which reveals a Data Subject’s ethnic origin, political opinions, religious beliefs or membership of the trade union, as well as personal data relating to health or sex life.
5 SHARING OF PERSONAL DATA TO THIRD PARTIES
5.1 Without the Data Subject's explicit permission, Vekst will not share the Data Subject's personal data with any third party in any other way than what follows from this Privacy Policy, unless Vekst is obliged to do so following the applicable regulations or unless the personal data is shared in connection with an ongoing legal-, administrative- or recovery procedure in which the Data Subject and Vekst are both parties.
5.2 Vekst uses subcontractors for services in connection with Vekst's Services (so-called data processors). These data processors may process personal data and may need some access to personal data collected in connection with the Services. Vekst may also need to use the data processors’ services to store personal data. Vekst always ensures that data processors only process the Data Subject's personal data in accordance with Vekst's instructions and only for the purpose of providing the agreed upon services to Vekst.
6 STORING OF PERSONAL DATA
6.1 The Data Subject's personal data will not be stored for any longer than necessary, with regards to the purpose of the processing and taking into account Vekst’s legal obligations, e.g. regarding to accounting regulations etc.
6.2 Vekst regularly deletes all personal data which is no longer needed with regards to the purpose of the processing, in accordance with the relevant laws and regulations in force at any time.
7 TRANSFER OF PERSONAL DATA OUTSIDE THE EU
Vekst only transfers personal data to data processors in third countries (i.e. countries outside the EU/EEA) if the third country has an adequate level of protection according to applicable privacy laws and regulations and the data processor has agreed to the EU Commission’s standard contractual clauses for data transfers between EU and non-EU countries.
8 THE RIGHT TO REQUEST INFORMATION
8.1 The Data Subject has a right to request and obtain, free of charge, information regarding what personal data (if any) that is being processed by Vekst (a so-called register extract). The Data Subject also has the right have any incorrect personal data corrected. If the Data Subject wishes to know if Vekst processes any personal data about the Data Subject, he or she can send a written and signed request to Vekst in accordance with section 17 below. In the request, the Data Subject needs to indicate specifically what kind of information the Data Subject is interested in receiving (unless the Data Subject is interested in receiving information about all personal data). That way, Vekst can provide the Data Subject with information that is relevant. If the Data Subject repeatedly sends requests for an extract from the register, Vekst may charge a fee or, in some cases, in accordance with statutory law, refuse to comply with the request.
8.2 The extract from the register will be sent to the Data Subject within 30 days from the time Vekst received the request. If the extract is extensive and Vekst needs more time or if Vekst for some reason cannot comply with the Data Subject’s request, Vekst will without undue delay notify the Data Subject thereof.
9 THE RIGHT TO RECTIFICATION
9.1 In order to fulfill its obligations to always have accurate and relevant personal data, Vekst systematically works with its registers and updates personal data where necessary. If the Data Subject notices that the personal data Vekst processes is incorrect or if Vekst lacks important personal data, the Data Subject has the right to have their personal data corrected. Vekst normally performs simple data corrections without consideration, but in some cases Vekst may need to consider the Data Subject's request. Vekst will not approve the Data Subject's request if it is impossible or requires an unreasonable amount of work. Upon a request by the Data Subject, Vekst will inform the Data Subject about whom the correction has been submitted to.
9.2 In the event that the Data Subject's personal data is changed at the Data Subject's request, Vekst will inform any data processors and partners that processes the personal data about the change.
10 THE RIGHT TO ERASURE
10.1 The Data Subject has the right to request that Vekst erases the Data Subject's personal data when:
a) they are no longer needed for the purposes for which they have been collected and for which they are being processed;
b) Vekst processes personal data under the Data Subject's consent and the Data Subject withdraws said consent;
c) Vekst processes personal data for direct marketing and the Data Subject opposes the continued processing for this purpose;
d) Vekst processes personal data on the legal basis of a balance of interests and there are no legitimate interests that weigh heavier than the Data Subject's interest;
e) Vekst does not process personal data in accordance with applicable rules;
f) It is required that personal data is erased in order to fulfill a legal obligation; or
g) there is another relevant legal basis for the Data Subjects request to erase the personal data.
10.2 Vekst has the right to refrain from erasing the Data Subject's personal data if Vekst needs to retain such data in order to fulfill a legal obligation or in order to make/defend against legal claims towards/from the Data Subject.
10.3 When Vekst receives the Data Subject’s request regarding erasure, Vekst will conduct an assessment in order to evaluate if there are reasons to erase the Data Subject’s personal data. The Data Subject will then be informed about Vekst’s assessment. If the Data Subject’s personal data are erased at the Data Subject’s request, Vekst will inform potential suppliers and third-party partners to which personal data has been transferred that the personal data has been erased. However, Vekst will not do this if it is impossible or requires an extensive amount of work.
11 THE RIGHT TO RESTRICTION OF PROCESSING
11.1 The Data Subject has the right to request the restriction of Vekst’s processing of the Data Subject's personal data when:
a) the Data Subject has disputed the accuracy of the personal data, during the time Vekst has the opportunity to check whether the personal data are correct;
b) the processing is illegal, and the Data Subject opposes that the personal data is deleted and instead requests a limitation of its processing;
c) Vekst no longer needs the personal data for the purposes of the processing, but the Data Subject needs the personal data to be able to determine, enforce or defend legal claims; or
d) the Data Subject has objected to processing in accordance with section 13 below, when awaiting information of the legitimacy of whether Vekst’s interests weigh heavier in relation to the interests of the Data Subject.
11.2 Restriction of processing implies that the personal data will be marked, so that they in the future may only be processed for certain limited purposes.
12 DELETION OF PERSONAL DATA
12.1 The personal data will not be retained for any longer than is necessary with regard to the purposes of the processing, and Vekst will otherwise delete personal data in the manner that follows from applicable legislation, where an examination is made on a case-by-case basis when different types of personal data should be culled.
12.2 If the Data Subject requests that the Data Subject’s personal data shall be deleted, Vekst will delete or de-identify the personal data no later than 30 days from the reception of the request. This is provided that the personal data is not required to be saved in the future in order for Vekst to fulfill its legal obligations or to be able to exercise its legal claims.
13 THE RIGHT TO WITHDRAW CONSENT AND OBJECT TO PROCESSING
13.1 The Data Subject has the right to object to Vekst's processing of the Data Subject's personal data which Vekst conducts with the support of so-called balancing of interests according to law. If the Data Subject wishes to exercise this right, the Data Subject needs to specify in writing which processing the Data Subject objects to. In the event of such an objection, Vekst may only continue to process the Data Subject’s personal data if Vekst can show that there are compelling and entitling reasons for why the personal data must be processed, and provided such reasons weigh heavier than the Data Subject's interests.
13.2 If the Data Subject's personal data is processed for direct marketing, the Data Subject always has the right to object to the processing at any time.
14 THE RIGHT TO DATA PORTABILITY
If the Data Subject has provided his or her personal data to Vekst, the Data Subject may, in some cases, be entitled to extract his or her personal data in order to, for example, move them to another company. In order for the Data Subject to be able to use his or her right to so-called data portability, the Data Subject's request must relate to personal data that the Data Subject himself/herself has provided to Vekst and which Vekst processes with the consent of the Data Subject or to fulfill an agreement with the Data Subject. The right to data portability does not apply when Vekst's processing of the Data Subject's personal data is based on a balance of interests or a legal obligation for Vekst. The right to data portability does not apply when data portability is technically difficult to implement.
15 THE RIGHT TO COMPLAIN
In the event that the Data Subject has complaints or objections in connection with Vekst's Processing of the Data Subject's personal data, Vekst kindly asks the Data Subject to initially contact Vekst, so that Vekst can help the Data Subject in the best way possible. However, the Data Subject always has the right to submit his or her complaints directly to the relevant data protection authority.
16 SECURITY
Vekst undertakes all appropriate technical and organizational security measures, that are required in accordance with applicable regulatory frameworks governing the processing of personal data, to ensure a high level of security appropriate to the risks and to protect the personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to processed personal data.
17 CONTACT INFORMATION
If a Data Subject wishes to exercise its rights under these Terms, or If the Data Subject has any questions about this policy or Vekst's personal data processing, a request shall be made in written form and sent to Vekst by email to info@vekst.se.