Privacy Notice Full
1. General
1.1 Your privacy is very important to ProptechOS AB, org. no. 559016-1245 (“Data Controller”). Our mission is that you feel comfortable with us processing your personal data. The purpose of this Privacy Notice (“Privacy Notice”) is to explain how we ensure that your personal data is processed in compliance with applicable legislation.
1.2 To provide our products and services to you as our customer or to your employer or the legal entity that you represent, we need to process certain personal data about you. If you are an individual who work for, or on behalf of, a supplier, we need to process certain personal data to be able to manage our contractual and business relationship with the supplier that you represent. We may also process personal data collected through the use of cookies and similar technologies if you are a website visitor to ensure the functioning of our website and, if you consent, to analyse your behaviour on our website. We also need to process certain personal data if you apply for a job position with us in order to carry out and administer the recruitment process, and to potentially enter into an agreement with you. This Privacy Notice applies to you who, e.g.:
- work for, or on behalf of, one of our business customers (“Business Customer”);
- work for, or on behalf of, a supplier that provides goods or services to us (“Supplier Contact”); or
- visits our website (“Website visitor”);
- apply for a job position with us (“Job Applicant”).
- engage in professional contact with us or is a potential customer to us (“Prospective Business Customers”)
2. Data Controller
1.1 The Data Controller (ProptechOS AB is the Data Controller) is processing your personal data and is thus responsible for ensuring that the processing of personal data complies with applicable legislation. If you have any questions regarding the processing of your personal data, you will find our contact details at the end of this Privacy Notice.
1.2 If you have applied for a job position with us through a recruitment agency, the recruitment agency is solely responsible for its processing of your personal data including the collection of personal data from you and/or other sources and for the transfer of your personal data to us. Please refer to the relevant recruitment agency’s Privacy Notice for further information regarding its processing of your personal data. The Data controller is responsible for the processing of personal data when we have received personal data about you and process such data in the context of our own recruitment process which is administrated on our recruitment platform or another communication platform such as email.
3. Our Processing of Personal Data
1.2.1 We use your personal data for the following purposes:
Business Customers and Supplier Contacts
– Management and administration of business customer relationships (business to business, B2B),
– Direct marketing via e-mail and text messages, including individually targeted direct marketing (Sole traders),
– Direct marketing via e-mail and text messages, including individually targeted direct marketing (Business Customers),
– Management and administration of supplier relationships,
– Administration in connection with mergers and acquisitions, restructuring, etc.,
– Complying with legal obligations, and
– Defending our legal interests in the event of a dispute
Website visitors
– To analyse the use of our website and ensure functionality
Job Applicant
– To administrate the process of reviewing job applications and selecting relevant candidates for a given position or spontaneous job applications,
– To interview and select a candidate to be offered a position,
– To gather references for relevant candidates,
– To draft employment agreement that will be concluded if you are hired, and
– To handle potential claims relating to the recruitment process (e.g. discrimination claims)
Prospective Business Customers
– Direct marketing via e-mail and text messages, including individually targeted direct marketing (Sole traders),
– Direct marketing via e-mail and text messages, including individually targeted direct marketing (Business Customers),
– Administration in connection with mergers and acquisitions, restructuring, etc.,
– Complying with legal obligations, and
– Defending our legal interests in the event of a dispute
More information about our processing of personal data is provided in the tables below, including information about why we process your personal data, what personal data we process to achieve those purposes and for how long we retain your personal data for each specified purpose.
Purposes
Business Customers and Supplier Contacts
Business Customers and Supplier Contacts
What we do:
We use your personal data as a Business Customer to manage and administer our customer relationship with your employer or the legal entity that you represent, which includes taking pre-contractual steps and enter into agreement(s), providing products and services in accordance with our agreement(s), as well as to provide relevant customer service and communication in connection with our customer relationship.
Categories of personal data:
Contact details and work related data such as your name, job title and position, name of organization, social security number (only sole traders), business telephone number and business e-mail address.
Additional personal data provided by you in your correspondence with us regarding customer service matters (through e.g., chat, e-mail, text messages, etc.).
Legal basis:
Legitimate interest as we assess that our interest in managing and administering our business customer relationship, including customer service, outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this Privacy Notice.
The criteria used to determine the retention period:
The personal data is retained for the duration of the contractual relationship and for up to 24 months after the expiration of our business customer relationship. Personal data is processed in a customer service matter for as long as your matter is being handled and thereafter for up to 12 months.
We process personal data for as long as necessary for the defined purpose. When a user is removed by the Client or by ProptechOS the information is removed from ProptechOS’ system automatically. Backup copies are kept no longer than 24 months unless the Client has stated otherwise (could be shorter or longer).
Direct marketing via e-mail and text messages including individually targeted direct marketing (Sole traders)
What we do:
Direct marketing via e-mail and text messages
If you are a Business Customer who is a sole trader, we process your personal data to provide direct marketing to you via e-mail and text messages about other products and services that we offer that are similar to those you have already purchased or ordered from us.
We also process your personal data for market segmentation purposes which entails that we target our direct marketing towards specific segments of our customer base. The segmentation is based on demographic selection criteria such as age and/or city. Segmented marketing measures are not targeted on the basis of individual customers but rather the relevant segments of our customer base.
Even if we use marketing segmentation you will only receive marketing from us about other products and services that we offer that are similar to those you have already purchased or ordered.*
* Note that this does not apply to individual targeted direct marketing.
Individually targeted direct marketing
If you wish to receive individually targeted direct marketing via e-mail and/or text messages, which is personalised based on your individual preferences, you may consent to such targeted marketing. Targeted marketing may entail, for example, that we analyse your use of our services and products such as when you usually make purchases and tailor our direct marketing content based on such individual insights. We may also analyse your purchase history for the purposes of targeted marketing. Your personal data may be collected through the use of cookies and similar technologies for individually targeted direct marketing.
Categories of personal data:
Contact details such as name, telephone number and e-mail address.
Order and payment data such as purchase and order history.
Demographic information such as age and/or address (i.e., city).
Browsing habits and visit history such as which pages you have visited on our website, IP-address and the duration of the visit.
Legal basis:
Legitimate interest as we assess that our interest in sending direct marketing to you, including segmented marketing, outweighs your interests or fundamental rights and freedoms requiring protection of personal data. We ensure that the regulatory requirements for marketing via automatic systems are fulfilled.
Consent is the legal basis for processing of personal data for the purposes of individually targeted direct marketing or direct marketing via e-mail and text messages if we do not have a previous contractual relationship with you as a previous or potential sole trader customer.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.
When we process your personal data based on your consent, you have right to withdraw your consent at any time.
If you do not want to receive direct marketing from us, you can object to processing of your personal data at any time.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this Privacy Notice.
The criteria used to determine the retention period:
If the processing is based on legitimate interest, the personal data is stored and used throughout the contractual relationship and up to twelve (12) months after the contractual relationship ends assuming that you have not objected to our direct marketing before that.
If you have provided your consent, we will process your personal data for the purpose you consented to for up to two (2) years assuming that you have not objected and/or revoked your consent regarding our direct marketing before that.
We may request to renew your consent within this period of two (2) years assuming that you have not objected and/or revoked your consent regarding our direct marketing before that.
If you have renewed your consent, we will process your personal data for the consented purpose for a period of two (2) additional years.
Direct marketing via e-mail and text messages including individually targeted direct marketing (Business Customers)
What we do:
Direct marketing via e-mail and text messages
If you are a Business Customer (not sole trader), we process your personal data for marketing purposes, including for the purpose of marketing segmentation. Our marketing measures may consist of digital newsletters, information from us about our and other group companies’ products and services with which we have a collaboration, special offers and invitation to events.
We process your personal data for market segmentation purposes which entails that we target our direct marketing towards specific segments of our customer base. The segmentation is based on demographic selection criteria such as business address but also other work-related data such as your job title, position and the name of your employer and/or the organisation you represent including your business industry. Segmented marketing measures are not targeted on the basis of individual customers but rather the relevant segments of our customer base.
Individually targeted direct marketing
If you wish to receive individually targeted direct marketing in your professional role via your business e-mail and/or text messages to your business mobile number, which is personalised based on your preferences, you may consent to such targeted marketing. Targeted marketing may entail, for example, that we analyse your use of our services and products such as when you usually make purchases and tailor our direct marketing content based on such individual insights. We may also analyse your purchase history for the purposes of targeted marketing. Your personal data may be collected through the use of cookies and similar technologies for individually targeted marketing.
Categories of personal data:
Contact details and work related data such as your name, job title and position, name of organization, business industry, business telephone number and business e-mail address.
Demographic information such as business address.
Browsing habits and visit history such as which pages you have visited on our website, IP-address and the duration of the visit.
Legal basis:
Legitimate interest as we assess that our interest in sending direct marketing concerning our and other group companies’ products and services, special offers and invitation to events, including segmented marketing to you in your professional role outweighs your interests or fundamental rights and freedoms requiring protection of personal data. We ensure that the regulatory requirements for marketing via automatic systems are fulfilled.
Consent is the legal basis for processing of personal data for the purposes of individually targeted direct marketing.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.
When we process your personal data based on your consent, you have right to withdraw your consent at any time.
If you do not want to receive direct marketing from us, you can object to processing of your personal data at any time.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this Privacy Notice.
The criteria used to determine the retention period:
If the processing is based on legitimate interest, your personal data is stored and used throughout the contractual relationship and up to twentyfour (24) months after the contractual relationship ends assuming that you have not objected to our direct marketing before that.
If you have provided your consent, we will process your personal data for the purpose you consented to for up to two (2) years assuming that you have not objected and/or revoked your consent regarding our direct marketing before that.
We may request to renew your consent within this period of two (2) years assuming that you have not objected and/or revoked your consent regarding our direct marketing before that.
If you have renewed your consent, we will process your personal data for the consented purpose for a period of two (2) additional years.
Management and administration of supplier relationships
What we do:
We use your personal data as a Supplier Contact to manage and administer our contractual and business relationship with your employer or the legal entity that you represent, such as taking pre-contractual steps and enter into agreement(s), as well as administering invoices, handling orders and complaints/deviations, communication including conducting meetings.
Categories of personal data:
Contact details and work related data such as your name, job title and position, name of organization, social security number (only sole traders), business telephone number and business e-mail address.
Additional personal data provided by you, your employer or the legal entity you represent in the course of the supplier’s performance of its services to us or in communications about our business relationship.
Legal basis:
Legitimate interest as we assess that our interest in managing and administering our contractual and business relationship with suppliers outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this Privacy Notice.
The criteria used to determine the retention period:
The personal data is retained for the duration of the contractual relationship and thereafter for a period of 10 years after the expiration of our supplier relationship to handle and respond to legal requirements.
Administration in connection with mergers and acquisitions, restructuring, etc.
What we do:
If The Data controller is to be restructured, e.g. divided into several different businesses, or if a third party acquires the Data controller or our customer database, the Data Controller will disclose your personal data and that of other customers to the acquiring company. That company will continue to use your personal information for the same purposes as those stated in this Privacy Notice, unless you are informed otherwise in connection with the disclosure.
Categories of personal data:
Contact details and work related data such as your name, job title and position, name of organization, social security number (only sole traders), business telephone number and business e-mail address.
Legal basis:
Legitimate interest as we assess that our interest in enabling an acquisition or restructuring process, assuming that the acquiring company carries out similar operations as the Data Controller, outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this Privacy Notice.
The criteria used to determine the retention period:
If the Data Controller ceases to exist, e.g. through a merger, liquidation or bankruptcy, or if the Data Controller’s customer database is transferred to an acquiring company, we will erase the personal data as long as the retention of such personal data is not required by law. In such case your personal data will be processed in accordance with this Privacy Notice.
Complying with legal obligations
What we do:
We may process your personal data to comply with our legal obligations under applicable law, e.g., legislation regarding accounting, audit and tax.
Categories of personal data:
Contact details and work related data such as your name, job title and position, name of organization, social security number (only sole traders), business telephone number and business e-mail address.
Legal basis:
Compliance with a legal obligation.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this privacy notice.
The criteria used to determine the retention period:
The personal data is retained for as long as necessary to comply with the applicable legal obligation, for example seven years when it comes to our obligations under the Accounting Act.
Defending our legal interests in the event of a dispute
What we do:
In the event of a dispute, such as a payment dispute, we have the right to use your data for the purpose of establishing, defending or enforcing the legal claim.
Categories of personal data:
Contact details and work related data such as your name, job title and position, name of organization, social security number (only sole traders), business telephone number and business e-mail address.
Additional personal data provided by you in your correspondence with us regarding customer service matters (through e.g., chat, e-mail, text messages, etc.).
Legal basis:
Legitimate interest as we assess that our interest in defending our interests in the event of a dispute outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this Privacy Notice.
The criteria used to determine the retention period:
The personal data is retained as long as they are needed to establish, defend or enforce a legal claim, for example in the event of a dispute over payment, however a maximum of three (3) years.
Website
To analyse the use of our website and ensure functionality
What we do:
We analyse and process your personal data to improve, develop, maintain and manage our website and service including to ensure website functionality. For these purposes, we also use third party tracking services that employ to collect aggregated data about visitors to our websites. For more information about our use of cookies and similar technologies, please read our Cookie Policy: https://webdev.proptechos.com/legal/cookie-policy/
Categories of personal data:
Usage data such as cookie information and behaviour on web site such as browsing habits and visit history (e.g. which pages you have visited on our website and the duration of the visit).
Device data such as IP-number.
Legal basis:
When processing personal data in the form of cookies which is necessary for the functioning of the website, we base such processing on our legitimate interest.
However, when processing personal data in the form of non-necessary cookies in order to analyse the use of our website we base the processing on your consent.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.
You can change or withdraw your consent at any time by erasing and blocking cookies from our domains.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this Privacy Notice.
The criteria used to determine the retention period:
Please see our Cookie Policy for more information about for how long we process your information for this purpose.
Job Applicants
To administrate the process of reviewing job applications and selecting relevant candidates for a given position or spontaneous job applications
What we do:
We collect, store and review your application provided by you or by a recruitment agency.
The provision of your personal data is necessary for us to evaluate whether or not you are suitable for the advertised position. If you do not provide us with your personal data, we will not be able to include you in the recruitment process.
Categories of personal data:
Contact details such as your name, postal address, email address and telephone number.
Personal data included in the documentation related to a job application, for example information which is included in the CV and cover letter such as information regarding prior working experience and education, picture if included, etc.
Legal basis:
We have a legitimate interest in administrating the recruitment process and reviewing you job application for a given position as well as spontaneous job applications. Since you have submitted your job application directly to us or through a recruitment agency, we consider your interests to be consistent with our interest in processing necessary personal data relating to the job application. Hence, the Data Controller’s interests outweighs your interest with regards to your rights to privacy.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this Privacy Notice.
The criteria used to determine the retention period:
The personal data will be retained until the recruitment process is concluded.
After a recruitment process is concluded, the relevant personal data is archived for a period of two (2) years which entails that only persons with specific authorization are able to access the personal data.
To interview and select a candidate to be offered a position
What we do:
We will select some job applicants to be interviewed. In such case we may internally share your personal information with those persons involved in the recruitment process.
The provision of your personal data is necessary for us to evaluate whether or not you are suitable for a given position. If you do not provide us with your personal data, we will not be able to include you in the recruitment process.
Categories of personal data:
Contact details such as your name, postal address, email address and telephone number.
Personal data included in the documentation related to a job application, for example information which is included in the CV and cover letter such as information regarding prior working experience and education, picture if included, etc.
Notes from interviews with you.
Legal basis:
We have a legitimate interest in processing personal data which is necessary to interview and select a candidate to be offered a position at The Data Controller. Since you have expressed your interest in being considered for a position and accepted an invite to an interview, we consider your interests to be consistent with our interest in processing necessary personal data for this purpose. Hence, The Data Controller’s interests outweighs your interest with regards to your rights to privacy.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this Privacy Notice.
The criteria used to determine the retention period:
The personal data will be retained until the recruitment process is concluded.
After a recruitment process is concluded, the relevant personal data is archived for a period of two (2) years which entails that only persons with specific authorization are able to access the personal data.
To gather references for relevant candidates
What we do:
We gather references for relevant candidates by contacting persons indicated by the candidate. CV, cover letter and notes taken during the recruitment process may be consulted in connection with the communication with the reference person. We may take notes about the conversation with the reference person.
The provision of your personal data is necessary for us to evaluate whether or not you are suitable for the advertised position. If you do not provide us with your personal data, we will not be able to include you in the recruitment process.
Categories of personal data:
References:
Contact details of the references provided by the Job Applicant such as job title and position, name of organization/employer, business telephone number, relationship to the Job Applicant and business e-mail address.
Notes from the interview with the reference person.
Job Applicant:
Personal data included in the documentation related to a job application, for example information which is included in the CV and cover letter.
Notes from interviews with you and your references.
Legal basis:
We have a legitimate interest in processing personal data which is necessary to receive insights about your previous experience from persons you have indicated as reference persons.
Since you have expressed your continued interest for a position at the Data Controller, we consider your interests to be consistent with our interest in processing necessary personal data for this purpose. Hence, the Data Controller’s interests outweighs your interest with regards to your rights to privacy.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this Privacy Notice.
The criteria used to determine the retention period:
The personal data will be retained until the recruitment process is concluded.
After a recruitment process is concluded, the relevant personal data is archived for a period of two (2) years which entails that only persons with specific authorization are able to access the personal data.
To draft employment agreement that will be concluded if you are hired
What we do:
We will collect information which is necessary to draft an employment agreement with you.
The provision of your personal data is necessary for us to conclude the employment agreement with you for the advertised position. If you do not provide us with your personal data, we will not be able to enter into an employment agreement with you.
Categories of personal data:
Contact details such as your name, social security number, postal address, email address and telephone number.
Information about salary.
Legal basis:
Performance of a contract.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
As the legal basis of this data processing is performance of a contract, you have the right to data portability.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this Privacy Notice.
The criteria used to determine the retention period:
The personal data will be retained as long as you are employed at the Data Controller and after that to the extent it is necessary for any of the purposes provided for in the privacy notice which you will receive when entering into an employment agreement with the Data Controller.
To handle potential claims relating to the recruitment process (e.g. discrimination claims)
What we do:
After a concluded recruitment process, we will archive your personal data which has been relevant for the recruitment process. The access to these personal data is heavily restricted and may be accessed by authorized persons only in case it is necessary to handle concrete claims relating to the recruitment process.
Categories of personal data:
Contact details such as your name, postal address, email address and telephone number.
Personal data included in the documentation related to a job application, for example information which is included in the CV and cover letter such as information regarding prior working experience and education, picture if included, etc.
Notes from interviews with you and your references.
Legal basis:
We have a legitimate interest in being able to handle and defend ourselves in claims relating to a recruitment process. We consider that this interest overweighs your right to privacy as the data processing is necessary for the Data Controller to be able to handle and investigate any claims you may present.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this Privacy Notice.
The criteria used to determine the retention period:
Your personal data will be stored in archived form for this purpose for two (2) years from the conclusion of the recruitment process.
Prospective Business Customers
Management and administration of prospective business customer relationships (business to business, B2B)
What we do:
We use your personal data as a Business Customer to manage and administer our customer relationship with your employer or the legal entity that you represent, which includes taking pre-contractual steps and enter into agreement(s), providing products and services in accordance with our agreement(s), as well as to provide relevant customer service and communication in connection with our customer relationship.
Categories of personal data:
Contact details and work related data such as your name, job title and position, name of organization, social security number (only sole traders), business telephone number and business e-mail address.
Additional personal data provided by you in your correspondence with us regarding customer service matters (through e.g., chat, e-mail, text messages, etc.).
Legal basis:
Legitimate interest as we assess that our interest in managing and administering our business customer relationship, including customer service, outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this Privacy Notice.
The criteria used to determine the retention period:
The personal data is retained for the duration of the contractual relationship and for up to 24 months after the expiration of our business customer relationship. Personal data is processed in a customer service matter for as long as your matter is being handled and thereafter for up to 12 months.
We process personal data for as long as necessary for the defined purpose. When a user is removed by the Client or by ProptechOS the information is removed from ProptechOS’ system automatically. Backup copies are kept no longer than 24 months unless the Client has stated otherwise (could be shorter or longer).
Direct marketing via e-mail and text messages including individually targeted direct marketing (Sole traders)
What we do:
Direct marketing via e-mail and text messages
If you are a Business Customer who is a sole trader, we process your personal data to provide direct marketing to you via e-mail and text messages about other products and services that we offer that are similar to those you have already purchased or ordered from us.
We also process your personal data for market segmentation purposes which entails that we target our direct marketing towards specific segments of our customer base. The segmentation is based on demographic selection criteria such as age and/or city. Segmented marketing measures are not targeted on the basis of individual customers but rather the relevant segments of our customer base.
Even if we use marketing segmentation you will only receive marketing from us about other products and services that we offer that are similar to those you have already purchased or ordered.*
* Note that this does not apply to individual targeted direct marketing.
Individually targeted direct marketing
If you wish to receive individually targeted direct marketing via e-mail and/or text messages, which is personalised based on your individual preferences, you may consent to such targeted marketing. Targeted marketing may entail, for example, that we analyse your use of our services and products such as when you usually make purchases and tailor our direct marketing content based on such individual insights. We may also analyse your purchase history for the purposes of targeted marketing. Your personal data may be collected through the use of cookies and similar technologies for individually targeted direct marketing.
Categories of personal data:
Contact details such as name, telephone number and e-mail address.
Order and payment data such as purchase and order history.
Demographic information such as age and/or address (i.e., city).
Browsing habits and visit history such as which pages you have visited on our website, IP-address and the duration of the visit.
Legal basis:
Legitimate interest as we assess that our interest in sending direct marketing to you, including segmented marketing, outweighs your interests or fundamental rights and freedoms requiring protection of personal data. We ensure that the regulatory requirements for marketing via automatic systems are fulfilled.
Consent is the legal basis for processing of personal data for the purposes of individually targeted direct marketing or direct marketing via e-mail and text messages if we do not have a previous contractual relationship with you as a previous or potential sole trader customer.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.
When we process your personal data based on your consent, you have right to withdraw your consent at any time.
If you do not want to receive direct marketing from us, you can object to processing of your personal data at any time.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this Privacy Notice.
The criteria used to determine the retention period:
If the processing is based on legitimate interest, the personal data is stored and used throughout the contractual relationship and up to twelve (12) months after the contractual relationship ends assuming that you have not objected to our direct marketing before that.
If you have provided your consent, we will process your personal data for the purpose you consented to for up to two (2) years assuming that you have not objected and/or revoked your consent regarding our direct marketing before that.
We may request to renew your consent within this period of two (2) years assuming that you have not objected and/or revoked your consent regarding our direct marketing before that.
If you have renewed your consent, we will process your personal data for the consented purpose for a period of two (2) additional years.
Direct marketing via e-mail and text messages including individually targeted direct marketing (Prospective Business Customers)
What we do:
Direct marketing via e-mail and text messages
If you are a Business Customer (not sole trader), we process your personal data for marketing purposes, including for the purpose of marketing segmentation. Our marketing measures may consist of digital newsletters, information from us about our and other group companies’ products and services with which we have a collaboration, special offers and invitation to events.
We process your personal data for market segmentation purposes which entails that we target our direct marketing towards specific segments of our customer base. The segmentation is based on demographic selection criteria such as business address but also other work-related data such as your job title, position and the name of your employer and/or the organisation you represent including your business industry. Segmented marketing measures are not targeted on the basis of individual customers but rather the relevant segments of our customer base.
Individually targeted direct marketing
If you wish to receive individually targeted direct marketing in your professional role via your business e-mail and/or text messages to your business mobile number, which is personalised based on your preferences, you may consent to such targeted marketing. Targeted marketing may entail, for example, that we analyse your use of our services and products such as when you usually make purchases and tailor our direct marketing content based on such individual insights. We may also analyse your purchase history for the purposes of targeted marketing. Your personal data may be collected through the use of cookies and similar technologies for individually targeted marketing.
Categories of personal data:
Contact details and work related data such as your name, job title and position, name of organization, business industry, business telephone number and business e-mail address.
Demographic information such as business address.
Browsing habits and visit history such as which pages you have visited on our website, IP-address and the duration of the visit.
Legal basis:
Legitimate interest as we assess that our interest in sending direct marketing concerning our and other group companies’ products and services, special offers and invitation to events, including segmented marketing to you in your professional role outweighs your interests or fundamental rights and freedoms requiring protection of personal data. We ensure that the regulatory requirements for marketing via automatic systems are fulfilled.
Consent is the legal basis for processing of personal data for the purposes of individually targeted direct marketing.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.
When we process your personal data based on your consent, you have right to withdraw your consent at any time.
If you do not want to receive direct marketing from us, you can object to processing of your personal data at any time.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this Privacy Notice.
The criteria used to determine the retention period:
If the processing is based on legitimate interest, your personal data is stored and used throughout the contractual relationship and up to twentyfour (24) months after the contractual relationship ends assuming that you have not objected to our direct marketing before that.
If you have provided your consent, we will process your personal data for the purpose you consented to for up to two (2) years assuming that you have not objected and/or revoked your consent regarding our direct marketing before that.
We may request to renew your consent within this period of two (2) years assuming that you have not objected and/or revoked your consent regarding our direct marketing before that.
If you have renewed your consent, we will process your personal data for the consented purpose for a period of two (2) additional years.
Administration in connection with mergers and acquisitions, restructuring, etc.
What we do:
If the Data Controller is to be restructured, e.g. divided into several different businesses, or if a third party acquires the Data Controller or our customer database, the Data Controller will disclose your personal data and that of other customers to the acquiring company. That company will continue to use your personal information for the same purposes as those stated in this Privacy Notice, unless you are informed otherwise in connection with the disclosure.
Categories of personal data:
Contact details and work related data such as your name, job title and position, name of organization, social security number (only sole traders), business telephone number and business e-mail address.
Legal basis:
Legitimate interest as we assess that our interest in enabling an acquisition or restructuring process, assuming that the acquiring company carries out similar operations as the Data Controller , outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this Privacy Notice.
The criteria used to determine the retention period:
If the Data Controller ceases to exist, e.g. through a merger, liquidation or bankruptcy, or if The Data Controller ‘s customer database is transferred to an acquiring company, we will erase the personal data as long as the retention of such personal data is not required by law. In such case your personal data will be processed in accordance with this Privacy Notice.
Complying with legal obligations
What we do:
We may process your personal data to comply with our legal obligations under applicable law, e.g., legislation regarding accounting, audit and tax.
Categories of personal data:
Contact details and work related data such as your name, job title and position, name of organization, social security number (only sole traders), business telephone number and business e-mail address.
Legal basis:
Compliance with a legal obligation.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this privacy notice.
The criteria used to determine the retention period:
The personal data is retained for as long as necessary to comply with the applicable legal obligation, for example seven years when it comes to our obligations under the Accounting Act.
Defending our legal interests in the event of a dispute
What we do:
In the event of a dispute, such as a payment dispute, we have the right to use your data for the purpose of establishing, defending or enforcing the legal claim.
Categories of personal data:
Contact details and work related data such as your name, job title and position, name of organization, social security number (only sole traders), business telephone number and business e-mail address.
Additional personal data provided by you in your correspondence with us regarding customer service matters (through e.g., chat, e-mail, text messages, etc.).
Legal basis:
Legitimate interest as we assess that our interest in defending our interests in the event of a dispute outweighs your interests or fundamental rights and freedoms requiring protection of personal data.
Your rights:
You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.
You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.
As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.
Information about what these rights entail in practice and how you can exercise your rights is found in Section 9 of this Privacy Notice.
The criteria used to determine the retention period:
The personal data is retained as long as they are needed to establish, defend or enforce a legal claim, for example in the event of a dispute over payment, however a maximum of three (3) years.
4. Collection of Personal Data
From where do we collect your personal data
4.1 Business Customer: We receive the personal data we process from you, your employer or the legal entity that you represent. We do not collect personal data from other sources.
4.2 Supplier Contact: We receive the personal data we process from you, your employer or the legal entity that you represent. We do not collect personal data from other sources.
4.3 Website visitor: We receive the personal data we process from you as a website visitor. We do not collect personal data from other sources.
4.4 Job Applicant: We collect personal data either directly from you and/or from a recruitment agency which you have been in contact with. We also collect personal data about you from your references (e.g., prior employers).] [In addition, we also collect personal data online concerning your professional experience to the extent you have chosen to make this information publicly available (e.g., LinkedIn or other business and employment-focused websites).
4.5 We will collect information which is necessary to draft an employment agreement with you. The provision of your personal data is necessary for us to conclude the employment agreement with you for the advertised position. If you do not provide us with your personal data, we will not be able to enter into an employment agreement with you.
5. Automated Decision-Making
5.1 We do not use automated individual decision-making.
6. Retention of Personal Data
6.1 We will only retain your personal data for as long as it is needed for the purposes we collected the personal data and as described in this Privacy Notice. When we no longer need your personal data we will remove the personal data from your systems and databases, including any back-ups. More specific retention periods are provided in the tables above under the heading “The criteria used to determine the retention period”.
7. With Whom Do We Share Your Personal Data?
7.1 We may share your personal data with reliable external parties, such as to other group companies, IT providers and companies with whom we partner to provide our services. We may also need to disclose personal data at the request of public authorities or to other parties in the context of court proceedings, mergers and acquisitions or similar. In the tables below, you will find information about which external parties we may disclose personal data to and which categories of personal data will be disclosed in such case.
| We may share your data with: | Categories of personal data that are shared: |
|---|---|
| Mautics Ltd | Contact information such as name, company name, email, and telephone number. |
| Saldo Redovisning AB | Contact information such as name, company name, social security number (for payroll processing), email, and telephone number. |
7.2 We will not sell your personal data to any other party.
8. Where is Your Data Processed?
8.1 We aim to always process your personal data in the EU/EEA. In some circumstances we may need to transfer your personal data to a country outside of the EU/EEA (“Third Country”). In case your personal data is transferred to a Third Country, we will ensure that your personal data will continue to be subject to an essentially equivalent level of protection as in the EU/EEA.]
When we transfer personal data to a Third Country which is not subject to an adequacy decision, we apply a relevant transfer mechanism, that is applicable safeguard to ensure that an essentially equivalent level of data protection is ensured in the Third Country, specified in the table below.
| Country outside of the EU/EEA: | Appropriate safeguards: |
|---|---|
| Ukraine | Standard Contractual Clauses or Data Protection Agreements |
| USA | Standard Contractual Clauses or Data Protection Agreements |
Please contact us for more information about the legal basis for a specific transfer or if you want to receive a copy of the relevant transfer mechanism or information about the security measures taken in the context of the transfer. The contact details are provided in the end of this Privacy Notice.
9. Your Rights
9.1 Our responsibility for your rights
9.1.1 In our capacity as data controller, we are responsible for ensuring that your personal data is processed in compliance with applicable legislation and that you can effectively exercise your rights as a data subject. You may contact us at any time if you wish to exercise your rights. You will find the contact details in the end of this Privacy Notice.
9.1.2 We have an obligation to respond to your requests to exercise your rights within one month from receiving your request. If your request is complex or if we have received many requests, we have the right to extend this deadline by two more months. If we are unable to take the action you have requested within one month, we will inform you of the reason for the delay and of your right to lodge a complaint with a supervisory authority and to seek a judicial remedy.
9.1.3 You will not be charged for any information, communication or measures that we implement. However, if your request is manifestly unfounded or excessive, we may charge an administrative fee for providing the information or taking the action requested or refuse to act on your request altogether.
9.2 Your right to access, rectification, erasure and restriction
9.2.1 You have the right to request:
a) Access to your personal data. This means that you have the right to request access to personal data that we hold about you. You also have the right to be provided, at no cost, with information about which personal data we are processing about you. We have the right to charge a reasonable administration fee if you request further copies. If you make a request by electronic means, e.g. via email, we will provide you with the information in commonly used electronic format.
b) Rectification of your personal data. At your request or on our own initiative, we will correct, anonymise, delete or complete data that we know to be inaccurate, incomplete or misleading. Also, you have the right to complete any incomplete personal data if something relevant is missing.
c) Erasure of your personal data. You have the right to request that we erase your personal data if there is no compelling reason for us to continue processing the data. Compelling reasons for use to continue processing may be:
i. Processing is necessary for the right of freedom of expression and information,
ii. Processing is necessary to comply with a legal obligation,
iii. Processing is necessary for reasons of public interests in the area of public health,
iv. Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes or
v. Processing is necessary for the establishment, exercise or defence of legal claims.
Your personal data will be erased if none of the circumstances above are applicable and if
i. The personal data is no longer needed for the purpose for which we collected them,
ii. We process your personal data based on your consent and you withdraw your consent,
iii. You object to us processing your personal data which is based on a legitimate interest assessment, and we have no compelling interests that overrides your interests or rights and freedoms,
iv. We have processed the personal data unlawfully,
v. We have a legal obligation to erase the personal data or
b) Right to restrict processing. This means that we temporarily restrict the processing of your data. You have the right to request restriction when:
i. you consider your data to be inaccurate and you have requested rectification as defined in paragraph 9.2.1 b), while we establish the accuracy of the personal data,
ii. the processing is unlawful, and you do not want the data to be erased,
iii. as the personal data controller, we no longer need to process the personal data for our processing purposes, but you need them to be able to establish, exercise or defend a legal claim, or
iv. you have objected to processing as defined in paragraph 9.3, while waiting for our assessment of whether our legitimate interests override yours.
9.2.2 We will take all reasonable measures possible to notify everyone who has received personal data as stated in Section 7 above if we have rectified, erased or restricted access to your personal data after you have requested us to do so. At your request, we will provide you with more information about the recipients of your personal data.
9.3 Your right to object to processing
9.3.1 You have the right to object to the processing of your personal data if our processing is based upon legitimate interest or performance of a task carried out in the public interest (see Section 3 above). If you object to such processing, we will only continue to process your data if we have compelling reasons for doing so that override your interests or rights and freedoms or if the processing is necessary for the establishment, exercise or defence of legal claims.
9.3.2 If you do not wish that we use your personal data for direct marketing purposes, you always have the right to object to such processing by contacting us. We will cease to use your personal data for that purpose when we have received your objection.
9.4 Your right to withdraw consent
9.4.1 If we process your personal data based on your consent as the legal basis, you always have the right to withdraw your consent. You can do this at any time by contacting us. Our contact details are found in the end of this Privacy Notice.
9.5 Your right to complain to the supervisory authority
9.5.1 You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten, IMY) if you are not satisfied with our processing of your personal data.
10. We protect your personal data
10.1 We are committed to ensuring that you always feel comfortable when providing your personal data to us. We have therefore implemented both technical and organisational security measures, including access restrictions and regular internal controls, to best protect your personal data against, for example, unauthorised access, alteration or loss. Should a data breach that materially impacts you or your personal data, e.g. entailing risk of fraud or identity theft, occur, we will contact you to explain what has happened and to provide you with advice on how you can mitigate any potential adverse effects of such data breach relevant for you.
11. Cookies
11.1 We use cookies and similar technologies (“cookies”) on our website in order to, inter alia, improve, develop and maintain our website and to improve your experience with us including to simplify and adapt our website to your needs and preferences. In our Privacy Notice for Website Visitors, we inform you about how we process your personal data when you visit our website. If you would like to know more about our use of cookies, please refer to our Cookie Policy https://webdev.proptechos.com/legal/cookie-policy/ .
12. Changes to this Privacy Notice
12.1 This Privacy Notice was updated in April 2023.
12.2 We have the right to change this Privacy Notice at any time. The latest version of the notice will always be available on our website.
12.3 When we make changes that are not purely linguistic or editorial, you will be notified of the changes within a reasonable time prior to the changes taking effect. If you do not agree to the changes, you have the right to object to the processing before the changes take effect.
13. Contact details
If you have any complaints or questions about how we use your personal data, please do not hesitate to contact us:
ProptechOS AB company registration number 559016-1245.
Postal address:
c/o VASAKRONAN AB (PUBL)
BOX 30074
104 25 Stockholm
Sweden
Visiting address:
Nybrogatan 8
114 39 Stockholm
Sweden
E-mail:
[email protected]
Telephone:
+46 70 412 49 00
Website:
https://webdev.proptechos.com/
