Privacy policy

Version 2024 Oct 13

1. Who is responsible for your personal data?

ReCarber AB Reg. No. (559449-2240) ("ReCarber", "we", "us", "our") is the Controller in accordance with the EU General Data Protection Regulation (”GDPR”). This Privacy Policy (the ”Policy") provides information on how we handle Personal Data when you communicate with us, use the Services or visit our website www (dot) recarber (dot) com.

The information in this Policy covers Personal Data Processing for which ReCarber is the Controller. As a Controller we are responsible for the Processing for which we decide the purpose of ("the why") and the means for the Processing (what methods, what personal data and for how long it is stored).

The intended recipient of the information provided in this Policy is:

• Visitors of our website
• Potential or existing partners
• Potential or existing suppliers
• Potential or existing customers
• Employees of potential or existing partners
• Employees of potential or existing suppliers
• Employees of potential or existing customers

2. Definitions

• "Applicable Law" refers to the legislation applicable to the processing of Personal Data, including the GDPR, supplementary national legislation, as well as practices, guidelines and recommendations issued by a national or EU supervisory authority.
• "Controller" is the company/organisation that decides for what purposes and in what way personal data is to be processed and is responsible for the Processing of Personal Data in accordance with Applicable Law.
• "Data Subject" is the living, natural person whose Personal Data is being processed.
• "Personal Data" is all information relating, directly or indirectly, to an identifiable natural person.
• "Processing" means any operation or set of operations which is performed on Personal data, e.g. storage, modification, reading, handover and similar.
• "Processor" is the company/organisation that processes personal data on behalf of the Controller and can therefore only process the Personal Data according to the instructions of the Controller and the Applicable Law.

3. Your rights in relation to your personal data

Access

You always have the right to receive information about the Processing of data that concerns you. We only provide information if we have been able to verify that it is you that are requesting the information.

Rectification

If you find that the Personal Data we process about you is incorrect, let us know and we will fix it!

Erasure 

Do you want us to completely forget about you? You have the right to be forgotten and request deletion of your Personal Data when the Processing is no longer necessary for the purpose for which it was collected. If we are required to retain your information under Applicable Law or a contract that we have entered with you, we will ensure that it is processed only for the specific purpose set forth in such Applicable Law or contract. We will thereafter erase the information as soon as possible. 

Objections

Do you disagree with our assessment that a legitimate interest for Processing your Personal Data overrides your interest in protecting your privacy? In such a case, we will review our legitimate interest assessment. Of course, we add your objection to the balance and make a new assessment to see if we can still justify our Processing of your Personal Data. If you object to direct marketing, we will immediately delete your personal information without making an assessment.

Restriction

You can also ask us to restrict our Processing of your Personal Data

• Whilst we are Processing a request from you for any of your other rights;
• If, instead of requesting erasure, you want us to limit the Processing of Personal Data for a specific purpose. For example, if you do not want us to send advertising to you in the future, we still need to save your name in order to know that we should not contact you; or
• In cases where we no longer need the information in relation to the purpose for which it was collected, provided that you do not have an interest in retaining it to make a legal claim.

Data portability

We may provide you with the data that you have submitted to us or that we have received from you in connection with a contract that we have entered with you. You will receive your information in a commonly used and machine-readable format that you can transfer to another personal data manager.

Withdraw consent

If you have given consent to one or several specific processing(s) of your Personal Data, you have the right to withdraw your consent at any time and thus ask us to terminate the Processing immediately. Please note that you can only withdraw your consent for future processing of Personal Data and not for Processing that has already taken place.

Right to file a complaint

You have the right to submit a complaint to the Swedish Authority for Privacy Protection. More information about our obligations and your rights can be found at https://www.imy.se/. You can contact the authority via e-mail at: imy (at) imy.se.

How you use your rights

Please contact us directly at privacyquestions (at) recarber.com if you wish to exercise any of your rights related to our processing of your personal data.

4. How do we collect, store and use personal data?

We collect the Information that you decide to provide when browsing our Websites or when you otherwise interact with us. For example, we collect Information when you enquire about our Services, apply for a job at ReCarber, sign up for our newsletter, submit a request, submit information, leave a comment or otherwise contact us. This Information might include your name, email address, address, phone number, company information, billing and purchase information and any other Information you choose to provide. 

We also automatically collect certain Information from you when you browse our Websites. This includes:

• Log information: we log Information about your use of our Websites, including the type of browser you use, access times, pages viewed, your IP address and the page you visited before navigating to our Websites.
• Device information: we collect Information about the computer or mobile device you use to access our website, including the hardware model, operating system and version, unique device identifiers and mobile network information.
• Information collected by cookies and other similar technologies: we and our service providers use various technologies, including cookies and web beacons, to store user preferences, count visits and understand usage of our Websites. 

We don’t correlate the Information that we collect in the ways described above with any Information collected from any other sources.

We use the Information we collect for the following purposes:

• Provide, maintain and improve our Websites;
• Send you technical notices, updates, security alerts and support and administrative messages;
• Respond to your comments, questions and requests and provide customer service;
• Communicate with you about our Services and any products, offers, promotions, rewards and events offered by ReCarber and others, and provide news and information we think will be of interest to you;
• Monitor and analyze trends, usage and activities in connection with the websites; and
• Carry out any other purpose for which the Information was explicitly collected.

Some of this Information may also be shared with our product or service providers or sub-contractors, in order for us to deliver our Services. 

We use Information for the above purposes where it’s necessary in our legitimate interest to do so, where we have a legal obligation or where you’ve provided your consent.

5. How is personal data used and on what lawful basis?

In this section we describe the purpose for which we will use your personal data and which categories of personal data we use for that purpose. In section 3 above, you can see which data points are included in each category of personal data. In this section, we also describe the lawful basis we have identified under data protection legislation, such as GDPR, to process the information about you. We also describe when ReCarber stops using the personal data for each purpose. Finally, we inform you if the personal data is information that you yourself actively provide to us, or whether it is information that ReCarber receives from another source.

Processing and purpose of processing of personal data

Customers 

To administer our customer relationship in accordance with our agreements with you for each service you use. This requires creating and sending information to you in electronic format (not for marketing purposes).

Personal Data: Contact and identification information, technical information generated through your use of ReCarber’s services.

Source: Directly from the data subject, from ReCarber’s services, and from project partners.

Lawful basis: Performance of a contract (Art. 6(1)(b) GDPR).

Storage period: During the contractual relationship.

Partners and suppliers 

To administer our partner and supplier relationships in accordance with our agreements. This requires creating and sending information in electronic format.

Personal Data: Contact and identification information, technical information generated through your use of ReCarber’s services.

Source: Directly from the data subject, from ReCarber’s services, and from project partners.

Lawful basis: Performance of a contract (Art. 6(1)(b) GDPR).

Storage period: During the contractual relationship.

Marketing 

To be able to perform customer, partner, and customer satisfaction surveys and marketing, via e-mail, text message, telephone or through other communication channels. If you do not want us to perform this processing, you can let us know by contacting us, see more about your rights in section 3 above.

Personal data: Contact and identification information, Information about your use of ReCarber’s services, technical information generated through your use of ReCarber’s services.

Source: Directly from the data subject and from ReCarber’s services.

Lawful basis: Balance of interests (Art. 6 (1) (f) GDPR). In balancing that interest, ReCarber has assessed that we have a legitimate interest in being able to carry out these types of surveys, that the processing of personal data is necessary to achieve that purpose and that our interest outweighs your right not to have your data processed for this purpose.

Storage period: During the contractual relationship.

Network and information security 

Ensure network and information security in ReCarber’s services. 

Personal Data: Contact and identification information, Information about your use of ReCarber’s services, technical information generated through your use of ReCarber’s services.

Source: Directly from the data subject and from ReCarber’s services

Lawful basis: The lawful basis for the processing constitutes a balance of interests (Art. 6 (1) (f) GDPR). In balancing that interest, ReCarber has assessed that we have a legitimate interest in being able to ensure network and information security, that the processing is necessary to achieve that purpose, and that our interest outweighs your right not to have your data processed for this purpose. That we ensure good information security is also in your interest as a customer.

Storage period: During the time when you are using the Service. 

Service and product development

To perform data analysis for service and product development to improve our services (if possible, we first anonymize the data, which means that there is no personal data processing thereafter).

Personal Data: Contact and identification information, Information about your use of ReCarber’s services, technical information generated through your use of ReCarber’s services.

Source: Directly from the data subject and from ReCarber’s services.

Lawful basis: The lawful basis for the processing constitutes a balance of interests (Art. 6 (1) (f) GDPR). In balancing that interest, ReCarber has assessed that we have a legitimate interest in performing data analysis for product and service development. We ensure that the processing this entails is necessary to achieve the purpose of the processing, and that our interest outweighs your right not to have your data processed for this purpose.

Storage period: During the entire time that ReCarber must retain the information in its systems, for example to fulfill the agreement with you, or comply with applicable law.

Accounting and audit

Personal Data: Contact and identification information, payment information, information about your contact with ReCarber, information about your use of ReCarber’s services and technical information generated through your use of ReCarber’s services.

Source: Directly from the data subject and from ReCarber’s services

Lawful basis: The processing is necessary for compliance with a legal obligation to which the controller is subject (Art. 6(1)(c) GDPR) (Bokföringslag (1999:1078).

Storage period: During the time that the accounts are compiled and 7 years after the end of the year in which the information was registered.

Social media

If you contact us via social media, such as LinkedIn, your personal data will also be collected and processed by these companies, in accordance with their data protection information. This also applies to the answer you get from us. ReCarber processes this information to answer your questions.

Personal Data: Contact and identification information, information about your contact with ReCarber.

Source: Directly from the data subject and from ReCarber’s services.

Lawful basis: Performance of a contract (Art. 6(1)(b) GDPR).

Storage period: Until we have answered your question.

6. Who do we share your personal data with?

When we share your personal data, we ensure that the recipient processes it in accordance with this information, for example by entering into so-called data sharing agreements or data processing agreements with the recipients. Those agreements include all reasonable contractual, legal, technical and organizational measures to ensure that your information is processed with an adequate level of protection and in accordance with applicable law. Below follows a description of categories of recipients that ReCarber may share your personal data with in connection to our Services.

Suppliers and subcontractors 

Description of recipients: 

Suppliers and subcontractors are companies that only have the right to process the personal data they receive from ReCarber on behalf of ReCarber, so-called personal data assistants. Examples of such suppliers and subcontractors are software and data storage providers, project partners and business consultants.

Purpose and lawful basis: 

ReCarber needs access to services and functionality from other companies that ReCarber cannot offer itself. ReCarber has a legitimate interest in having access to these services and functionalities (Article 6 (1) (f) GDPR). We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose.

Authorities 

Description of recipients: 

ReCarber may provide necessary information to authorities such as the Swedish Tax Agency or other authorities and courts.

Purpose and lawful basis: 

Sharing of personal data with the authority is done when we are required by law to do so, or in some cases if you have asked us to do so, if it is required to administer tax deductions, or counter crime. Depending on the authority and purpose, the lawful basis are an obligation to comply with law (Article 6 (1) (c) GDPR), to fulfill the agreement with you (Article 6 (1) (b) GDPR) or that ReCarber has a legitimate interest in being able to protect themselves from crime (Article 6 (1) (f) GDPR).

Divestment of operations or assets

Description of recipients: 

In the event that ReCarber sells business or assets, ReCarber may provide your personal information to a potential buyer of such business or assets. If ReCarber or a significant part of ReCarber’s assets is acquired by a third party, personal information about ReCarber's customers may also be shared.

Purpose and lawful basis: 

ReCarber has a legitimate interest in being able to carry out these transactions (Article 6 (1) (f) GDPR). We ensure that the processing this entails is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for this purpose. You have the right to object to this treatment, due to circumstances in your individual case.

Social media 

Description of recipients: 

Social media companies such as LinkedIn.

Purpose and lawful basis: 

If you contact us via social media such as LinkedIn, your personal information will also be collected and processed by these companies, in accordance with their data protection information. The processing takes place to fulfill the agreement with you (Article 6 (1) (b) GDPR).

7. Where do we process your personal data?

We always strive to process your personal data within the EU / EEA. In certain situations, such as when we share your personal data with a supplier or subcontractor with operations outside the EU / EEA, your personal data may also be processed outside the EU / EEA. In cases where our Processors transfer Personal Data outside the EU/EEA, we have ensured that the level of protection is adequate, and in compliance with Applicable Law, by controlling that either of the following requirements are fulfilled: 

• the EU Commission has determined that the level of protection is adequate in the third country where the data is processed;
• the Processor has signed up to the EU Commission's standard contract clauses (SCCs) for data transfer to non-EU/EEA countries; or
• the Processor has taken other appropriate safeguards prior to the transfer and that such safeguards comply with Applicable Law.

8. For how long do we store. your personal data?

We will keep your personal data as long as it is necessary for the purpose for which it was collected. Depending on the lawful basis on which we support the Processing, this may a) be regulated in a contract, b) be dependent on valid consent, c) be stated in legislation or d) followed by an internal assessment based on a legitimate interest assessment (LIA). In Section 5 above we indicate, where possible, the period during which the Personal Data will be stored.

9. How do we use cookies and other tracking technologies?

In order to provide a tailored experience, ReCarber uses cookies and similar tracking technology in our various interfaces such as our website and portal interface. You can find information about the tracking technology that ReCarber uses, and information about how you accept or decline the tracking technology in our Cookie Policy (link).

10. Updates to this Policy

This policy will be reviewed and updated as necessary. The Chief Legal Officer of ReCarber is responsible for updating this policy.

11. Contact details

Please contact us if you have questions about your rights or if you have any other questions about how we process your personal information.

For legal or general enquiries:

privacyquestions (at) recarber (dot) com