This policy

This Policy is issued by each of the controller entities listed in Section 12 below (together, “Advania”, “we”, “us” and “our”) and is addressed to individuals outside our organisation with whom we interact, including customers, visitors to our websites, other users of our services, personnel of corporate customers and suppliers, applicants for employment, and visitors to our premises (together, “you”). Defined terms used in this Policy are explained in Section 14 below.

This Policy may be amended or updated from time to time to reflect changes in our practices with respect to the processing of personal data, or changes in applicable law. We encourage you to read this Policy carefully, and to regularly check this page to review any changes we might make in accordance with the terms of this Policy.

Advania protects your privacy, and we want you to feel safe when submitting your personal data to us. It is important to us to be open about how we manage your personal data and give you information in a way that makes you understand how we will process them.

In this Policy, which applies to all of Advania's customers, suppliers and partners in the local country, we want to inform you about how we handle your personal data as it relates to visits to our websites, registering an account in our e-shop or mailing list, when your employers buy our products or services, or in other contacts made with us.

Advania works continuously with privacy matters, and therefore we may update this Policy. You will find the latest version on this page. This Policy was last updated on May 2022.

We collect personal information:

• when those data are provided to us (e.g., where you contact us);
• in the course of our relationship with you (e.g., we provide a service to you or the organization you work for); • when you make personal data public (e.g., if you make a public post about us on social media);
• when you visit our websites; and
• when you register to use any of our websites or services.

We may also receive personal data about you from the customer, supplier or partner by whom you are employed. In some cases, we may also collect personal data from public registers (e.g., from the Companies Registration Office if you are a board member, managing director or authorized signatory). We also create personal data about you in certain circumstances, such as records of your interactions with us, and details of your past interactions with us.

Advania uses your personal data for the purposes and on the legal bases provided below:

Purpose	Personal data	Reason for processing
Management of the relationship with contact persons at customers, suppliers or partners, i.e., communication before and during contractual relationship.	Name and job title of contact person E-mail address Company/employer Telephone number Communication content Home address (used only if the ordered products are to be sent to the home address)	Advania's legitimate interest in managing the relationship with contact persons at customers, suppliers and partners, to the extent that such legitimate interest is not overridden by their interests, fundamental rights or freedoms (Article 6.1f of the GDPR), and/or The processing is necessary in connection with a contract that you have entered into with us, or to take steps prior to entering into a contract with us (Article 6.1b of the GDPR) if you run business through a sole proprietorship.
Management of customer service inquiries, e.g., reception, investigation and responding to requests.	Name and job title of contact person E-mail address Company/employer Telephone number Communication content	Advania's legitimate interest in being able to manage customer service inquiries, to the extent that such legitimate interest is not overridden by the interests, fundamental rights or freedoms of customers (Article 6.1f of the GDPR).
Sending of newsletters, including marketing.	Name and job title of contact person E-mail address Company/employer Telephone number	Advania’s legitimate interest in being able to inform about and market its operation, to the extent that such legitimate interest is not overridden by your interests, fundamental rights or freedoms (Article 6.1f of the GDPR).
Management of events organized by us or in cooperation with our partners.	Name and job title of contact person E-mail address Company/employer Telephone number Health information (allergies) Clothing size Communication content	Advania's legitimate interest in managing events, to the extent that such legitimate interest is not overridden by the interests, fundamental rights or freedoms of the relevant data subjects (Article 6.1f of the GDPR), and/or If you submit health data (allergies), we will ask for your express consent (Article 9.2a of the GDPR).
Conducting surveys.	Name E-mail address Answers to the survey	Advania’s legitimate interest in conducting surveys, to the extent that such legitimate interest is not overridden by your interests, fundamental rights or freedoms (Article 6.1f of the GDPR).
Updating and improving services and products as well as the technical functionality of our computer systems and websites.	IP-address	Advania’s legitimate interest to improve services and products as well as the technical functionality of our computer systems and websites, to the extent that such legitimate interest is not overridden by your interests, fundamental rights or freedoms (Article 6.1f of the GDPR).
Maintaining records of the people who have communicated that they do not wish to receive marketing from Advania.	E-mail address	The processing is necessary to fulfil our legal obligations (Article 6.1c of the GDPR).
Maintaining records of sales, finance, corporate audit, and supplier management.	Name and job title of contact person Address E-mail address Company/employer Telephone number	Advania’s legitimate interest to carry out the processing for the purpose of managing and operating the financial affairs of our business, to the extent that such legitimate interest is not overridden by your interests, fundamental rights or freedoms (Article 6.1f of the GDPR).
Complying with our legal and regulatory obligations under applicable law.	As relevant, adequate, and limited to what is necessary under the circumstances.	The processing is necessary to fulfil our legal obligations (Article 6.1c of the GDPR).
Ensuring physical safety of our premises	Name Visitor logs CCTV recordings Electronic security (including login records and access details)	Advania’s legitimate interest to ensure the physical and electronic security of our business and our premises and persons visiting Advania’s premises and to prevent and investigate crime, to the extent that such legitimate interest is not overridden by your interests, fundamental rights or freedoms (Article 6.1f of the GDPR). CCTVs are clearly sign-posted.
Establishing, exercising and/or defending legal claims: managing legal claims; establishing facts and claims (including collection, review and production of documents, facts, evidence and witness statements), and exercising and defending legal rights and claims (including formal legal proceedings).	Name Address As relevant, adequate, and limited to what is necessary under the circumstances	Advania’s legitimate interest to establish, exercise and/or defend our legal rights, to the extent that such legitimate interest is not overridden by your interests, fundamental rights or freedoms (Article 6.1f of the GDPR).
Engaging in recruitment activities (advertising positions, interviewing, analysing suitability for the relevant position, and recording hiring decisions, offer details and acceptance details).	Name Address Contact details CV and certifications	The processing is necessary to fulfil our legal obligations, especially in respect of applicable employment law (Article 6.1c of the GDPR), Advania’s legitimate interest in carrying out its recruitment activities and handling job applications (to the extent that such legitimate interest is not overridden by your interests, fundamental rights, or freedoms) (Article 6.1f of the GDPR); and/or We have obtained your prior consent for the processing (this legal basis is only used in relation to processing that is entirely voluntary – it is not used for processing that is necessary or obligatory in any way) (Article 9(2)a of the GDPR).

 

We care about your personal data and therefore want to inform you that based on your express consent, we may collect health information (allergies) to organize events according to your desires and needs when food or drinks are served (the legal basis of your consent is only used in relation to processing that is entirely voluntary – it is not used for processing that is necessary or obligatory in any way). We will ask for your express consent to the processing of this information alongside the invitation or registration to the specific event. Your personal data is stored for 1 month after the event has ended. Please contact us (our contact details are in Section 12below) to revoke your consent or to update the information that is registered about you. Read more about how we process your personal data in our privacy information below.

Advania ensures that your personal data is handled in accordance with appropriate technical and organisational security measures to protect against illicit or unauthorized access to said information as well as destruction, loss, alteration, unauthorized disclosure and other unlawful or unauthorized forms of processing, in accordance with applicable law. At Advania, we only handle necessary information, and only by those who need it in order to provide the best service to our customers, suppliers and other people who come into contact with Advania.

Because the internet is an open system, the transmission of information via the internet is not completely secure. Although Advania will implement all reasonable measures to protect your personal data, we cannot guarantee the security of your data transmitted to us using the internet – any such transmission is at your own risk and you are responsible for ensuring that any personal data that you send to us are sent securely.

We may disclosure your personal data to the following categories of recipients:

 

Summary

We take every reasonable step to ensure that your personal data are only retained for as long as they are needed in connection with a lawful purpose.

We take every reasonable step to ensure that your personal data are only processed for the minimum period necessary for the purposes set out in this Policy. The criteria for determining the duration for which we will retain your personal data are as follows:

(1) we will retain personal data in a form that permits identification only for as long as:

(a) we maintain an ongoing relationship with you (e.g., where you are a user of our services, or you are lawfully included in our mailing list and have not unsubscribed); or
(b) your personal data are necessary in connection with the lawful purposes set out in this notice, for which we have a valid legal basis (e.g., where your personal data are included in a contract between us and your employer, and we have a legitimate interest in processing those data for the purposes of operating our business and fulfilling our obligations under that contract; or where we have a legal obligation to retain your personal data), fulfilling our obligations under that contract; or where we have a legal obligation to retain your personal data),

plus:
(2) the duration of:

(a) any applicable limitation period under applicable law (i.e., any period during which any person could bring a legal claim against us in connection with your personal data, or to which your personal data are relevant); and
(b) an additional two (2) month period following the end of such applicable limitation period (so that, if a person brings a claim at the end of the limitation period, we are still afforded a reasonable amount of time in which to identify any personal data that are relevant to that claim),
and:

(3) in addition, if any relevant legal claims are brought, we continue to process personal data for such additional periods as are necessary in connection with that claim.

During the periods noted in paragraphs (2)(a) and (2)(b) above, we will restrict our processing of your personal data to storage of, and maintaining the security of, those data, except to the extent that those data need to be reviewed in connection with any legal claim, or any obligation under applicable law.
Once the periods in paragraphs (1), (2) and (3) above, each to the extent applicable, have concluded, we will either:
- permanently delete or destroy the relevant personal data; or
- anonymize the relevant personal data.

Because of the international nature of our business, we may transfer personal data within the Advania group, and to the third parties listed above. For this reason, we may transfer personal data to other countries that may have different laws and data protection compliance requirements to those that apply in the country in which you are located.

If an exemption or derogation applies (e.g., where a transfer is necessary to establish, exercise or defend a legal claim) we may rely on that exemption or derogation, as appropriate. Where no exemption or derogation applies, and we transfer your personal data from the EEA to recipients located outside the EEA who are not in jurisdictions that have been formally designated by the European Commission as providing an adequate level of protection of personal data, we do so on the basis of appropriate Standard Contractual Clauses. You may be entitled to request a list of the relevant countries to which your personal data may be transferred and a copy of our Standard Contractual Clauses by reaching out to us using the details provided in Section 12 below.

Please note that when you transfer any personal data directly to any Advania entity established outside the EEA, we are not responsible for that transfer of your personal data. We will nevertheless process your personal data, from the point at which we receive those data, in accordance with the provisions of this privacy information.

You are welcome to contact us with questions or complaints regarding the processing of your personal data, using the details provided in Section 12below. However, you also always have the right to file a complaint regarding the processing of your personal data to the relevant Data Protection Authority. Details of the Data Protection Authorities for each EEA jurisdiction can be found here. Details of the UK Information Commissioner’s Office can be found here.

For the purposes of this Policy, the relevant controllers are:

Advania has appointed a data protection officer whose task it is to help Advania to comply with current data protection legislation. You are always welcome to contact our data protection officer at the email address compliance@advania.se.

Each of the controllers established outside the EEA and listed in Section 12above has appointed Advania Sverige AB, reg. no. 556214-9996, compliance@advania.se to be its representative for the purposes of Article 27 of the GDPR.

Each of the controllers established outside the UK and listed in Section 12 above has appointed Content+Cloud Limited, reg no. 03645998, privacy@contentandcloud.com to be its representative for the purposes of Article 27 of the UK GDPR.

• “controller” means the entity that decides how and why Personal Data are Processed. In many jurisdictions, the controller has primary responsibility for complying with applicable data protection laws.
• “Data Protection Authority” means an independent public authority that is legally tasked with overseeing compliance with applicable data protection laws.
• “EEA” means the European Economic Area.
•  “GDPR” means the General Data Protection Regulation (EU) 2016/679.
• “personal data” means information that is about any individual, or from which any individual is directly or indirectly identifiable, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.
• “process”, “processing” or “processed” means anything that is done with any Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• “processor” means any person or entity that Processes Personal Data on behalf of the controller (other than employees of the controller).
• “Standard Contractual Clauses” means template transfer clauses adopted by the European Commission or adopted by a Data Protection Authority and approved by the European Commission.
• “UK GDPR” means the GDPR as it forms part of the laws applicable in the UK by virtue of section 3 of the European Union (Withdrawal) Act 2018, and as applied and modified by Schedule 2 of the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (SI 2019/419) or as modified from time to time by other laws applicable in the UK).