Your privacy is important to us. At Intervaro, we have a few fundamental principles:

• We don't ask for personal information unless we truly need it.
• We don't share your personal information with anyone except to comply with legal requirements, in our work, or to protect our rights.
• We don't sell any of your personal information.

What constitutes personal data and its processing?

Any information relating to an identified or identifiable natural person is considered personal data. This includes not only names and addresses but also details regarding an identifiable person's finances and audiovisual recordings.

Almost all activities involving personal data are considered data processing. This encompasses collection, storage, handling, sharing, and deletion. Both digital and, in some cases, analog activities fall under data processing.

Certain rules govern the processing of personal data. In this policy, we outline how we handle personal data.

Who is the data controller?

Intervaro AB, org. no. 559051-3544, is the data controller for the processing described below. Our postal address is Davidshallsgatan 21, 211 45 Malmö. You can also reach us at 046-378 15 70 or kontakt@intervaro.se.

How do we process your personal data?

We detail the personal data we process, the purpose of processing, the methods of processing, the legal basis for processing, and the duration for which we retain the data in the following sections.

01. Clients

Purpose

Quoting, entering into, and fulfilling agreements regarding our services.

Processing activities

Collection/registration and storage of data. Additionally, using the data for quoting, contract execution, ensuring both we and the client fulfill obligations under the agreement, including invoicing, and for communication with the client regarding contract fulfillment (especially regarding delivery, payment, and the ordered service).

Categories of personal data

Corporate client with a sole proprietorship: Name, phone number, email address, and organization number. Also, information about the scope and price of the service, as well as about incoming and unsettled payments.

Corporate client (all), contact person: Name, phone number, email address, current company, authority/role, and details of what has been requested/ordered (when the contact person is the purchaser).

Legal basis

Corporate client with a sole proprietorship: The processing of personal data relies on the agreement between the parties as the legal basis.

Contact person (corporate client): The processing of personal data relies on a legitimate interest as the legal basis.

Storage period

Personal data is deleted 12 months after the end of the customer relationship.

For quoting that did not result in an agreement, data is deleted 6 months after the quote was provided.

Where do these data come from?

The data comes from you or is based on our agreements. Information about contact persons can also come from the company, and information about a sole proprietorship can come from a contact person.

Is it mandatory to provide this information?

There is no obligation for you to provide this information to us. However, it is a requirement to provide this information for us to enter into an agreement with you or with your company through you as a representative or attorney. Without this information, the contractual relationship cannot be fulfilled.

02. Suppliers and Partners

Purpose

Requesting, entering into, and fulfilling agreements with our suppliers/partners.

Processing activities

Collection/registration and storage. Additionally, using the data to request, enter into, and fulfill agreements, including through payment, and to contact the supplier/partner regarding contract fulfillment.

Categories of personal data

Company, contact person: Name, phone number, email address, current company, authority/role, and organization number/personal identity number for sole proprietorships. Additionally, information about what has been offered/sold (when the contact person handles quotation requests/enters into the agreement).

Legal basis

The legal basis for processing the data is a legitimate interest. We believe that it is in our legitimate interest to easily contact our suppliers/partners regarding the negotiation of new agreements and the fulfillment of existing ones, benefiting both us and the corporate client. Additionally, it is important for us to document which individual has negotiated or entered into agreements on behalf of the supplier/partner.

Please note that as a registered contact person, you have the right to object to this legitimate interest balancing.

Storage period

Personal data is deleted 12 months after the end of the contractual relationship.

Where do these data come from?

The data comes from you as the contact person, is based on our agreements, or is obtained from the supplier.

Is it mandatory to provide this information?

There is no obligation for you to provide this information to us. However, there is a requirement to provide this information for us to enter into an agreement with your company through you as a representative or attorney; without this information, the contractual relationship cannot be fulfilled.

03. Newsletter

Purpose

Marketing through digital newsletter distribution.

Processing activities

Collection and storage of data. Additionally, using the data for digital dispatches to both existing and prospective corporate clients, as well as to suppliers/partners.

Categories of personal data

Email address.

Legal basis

The legal basis for the processing is your consent. You have the right to freely withdraw this consent, with future effect. Upon withdrawal, we will immediately cease the relevant processing. If you wish to withdraw your consent, please contact us, and we will assist you.

Storage period

Personal data is deleted when consent is withdrawn.

Where do these data come from?

We collect the data from you.

Is it mandatory to provide this information?

There is no obligation for you to provide this information to us for marketing purposes.

04. Offers

Purpose

Marketing through digital dispatches of offers to subscribe to our newsletter.

Processing activities

Collection and storage, as well as use for dispatching offers.

Categories of personal data

Email address.

Legal basis

The legal basis for the processing of the data is legitimate interest. We consider sending offers to subscribe to our newsletter to both our customers/suppliers/partners and other stakeholders for marketing purposes to be a legitimate interest for us.

Please note that as a registered individual, you have the right to object to this legitimate interest. This right is absolute for marketing purposes, meaning we must cease processing if you exercise this right.

Storage period

Personal data is deleted immediately after the offer is sent.

Where do these data come from?

The data is provided by you. We may also have obtained it from your company's website.

Is it mandatory to provide this information?

There is no obligation for you to provide this information to us for marketing purposes.

05. Accounting and Other

Purpose

To fulfill the company's legal obligations, such as accounting and auditing.

Processing Activities

Necessary handling to fulfill the company's legal obligations as required by law, court decisions, or regulatory decisions. For example, collection, accounting, and storage of data according to the accounting act.

Categories of Personal Data

Accounting/Auditing:

Customers – invoices regarding our services; recipient's name, address, email address, and telephone number, name of reference/contact person and current company, customer/organization number/if applicable, personal identification number for sole proprietorship, VAT number, and information about ordered service and amount.

Suppliers, contact person; supplier invoice with possible information about reference/contact person/salesperson and possible organization number/personal identification number for sole proprietorship, current company, and sold service/product.

Other Obligations: Personal data resulting from the legal obligation.

Legal Basis

The legal basis for this processing is the legal obligation, such as that following from the Accounting Act.

Retention Period

Accounting: Deletion of personal data occurs when they are no longer needed to fulfill accounting obligations according to the Accounting Act (1999:1078). Personal data is retained until the end of the seventh year after the end of the calendar year in which the fiscal year ended.

Other Obligations: Deletion occurs when the data no longer needs to be stored according to the legal obligation.

Where Do These Data Come From?

The data comes from you when we enter into an agreement or based on what we have agreed upon. Alternatively, we receive information about you as a contact person/reference from your company.

Do I Have to Provide This Data?

There is no obligation for you to provide the specific data to us. However, there is a requirement to provide this data for us to enter into an agreement with you/your company (through you as a representative or proxy); without the data, the contractual relationship cannot be fulfilled.

06. Incoming Emails

Purpose

Handle incoming emails (when there is no other relationship with you as the sender) and inquiries via our website (inquiries are sent to our email address).

Processing Activities

Receipt, storage, opening, review, and assessment of incoming emails and inquiries via our website.

Categories of Personal Data

Sender's basic information (name, email address, etc.) and the content of the email message (when it contains information pertaining to the sender) or the content of the inquiry.

Legal Basis

The legal basis for processing the data is an interest balancing. We consider handling incoming emails and inquiries to be a legitimate interest for us.

You, as a registered individual, have the right to object to our interest balancing.

Retention Period

Deletion of incoming emails and inquiries occurs no later than after 1 month (may be stored longer for other purposes).

Where Do These Data Come From?

The data comes from you when you send an email message to us. The data may also come from a supplier to us to whom you have provided the information.

Do I Have to Provide This Data?

It is entirely optional for you to provide this data and has no consequences for you if you do not.

Usage of Data

The personal data processed by Intervaro AB, acting as the data controller, will only be used for the purposes specified in this privacy policy. The data will not be used by us for automatic decision-making or profiling.

Regarding Responsibility for Personal Data in Customer Materials

Intervaro AB acts as a data processor for the information contained in the material provided by the customer when customers order a project. The material provided may consist of, for example, images and text documents. The categories of individuals to whom the personal data pertain are those found in the material.

It is the customer of Intervaro AB who is the data controller for this processing. For questions regarding this part of the processing of personal data, you should therefore primarily contact the data controller.

Cookies

Information collected via cookies is anonymous and does not contain personal data such as names or email addresses. Visitor information cannot be traced by us.

Will Your Personal Data Be Shared With Anyone Else?

Like other companies, we use our bank to manage our payment flows, and our accounting consultant audits our accounting. These entities are data controllers for their processing. This sharing only occurs for the purposes stated above (i.e., contract fulfillment/invoicing and accounting/auditing).

We will not otherwise disclose the personal data we process as the data controller to anyone else unless required by law/regulatory decision or to protect our legal rights.

In the event that Intervaro AB engages data processors or sub-processors for the processing of personal data, such processing will be carried out on our behalf and in accordance with our instructions.

Intervaro AB has the following processors handling the current personal data for us:

1. IT infrastructure system (e.g., internet provider)
2. Accounting system (cloud solution)
3. Customer/order management system (cloud solution)
4. Email (cloud solution)
5. Document management (cloud solution)

We have entered into data processing agreements with these data processors.

Transfer of Personal Data Outside the EU/EEA?

We use Google's G Suite service. Our data processor Google stores personal data outside the EU/EEA. Google's certification under the frameworks for privacy protection between the EU and the USA and Switzerland and the USA covers the G Suite service. The data processor has also obtained approval from European data protection authorities for its model contract clauses, confirming that our contractual relationship complies with the requirements of the data protection directive for lawful transfers of personal data from the EU to the USA. Thus, transfers are made either based on a decision on an adequate level of protection or in accordance with binding corporate rules or approved contract clauses. You can read more about the transfer on Google's website regarding this or contact us to obtain a copy of the safeguards.

What Rights Do You Have as a Data Subject?

Below is an overview of your rights. Please note that not all conditions for, and exceptions to, these rights are listed.

Right to Information and Access to Information ("Record Extract")

You have the right to information about which of your personal data we, as data controllers, process, etc. This right is fulfilled through this policy. You also have the right to access the personal data and certain additional information about the processing (record extract).

Right to Erasure

Under certain conditions, you have the right to erasure of your personal data. However, we have the right to refuse a request for erasure in certain cases, including if there are legal obligations that constitute obstacles to such erasure.

Right to Restriction of Processing

Furthermore, under certain conditions, you have the right to request restriction of our processing. Restriction means that the personal data is marked so that, for a certain period, it is only processed for certain delimited purposes.

Right to Data Portability

You also have the right to request that the data you have provided to us, and where our processing is based on your consent or a contract with you, be transferred to you. If a direct transfer to a third party is technically possible, you can choose this instead.

Right to Object

You have the right to object to the processing we base on a balancing of interests, or on us performing a task of public interest, and invoke reasons related to your specific situation. As data controllers, it is then up to us to demonstrate compelling legitimate grounds for our processing, which outweigh your interests or fundamental rights and freedoms (however, we have a right to process your personal data to assert our possible legal claims).

You always have the right to object to personal data processing used for direct marketing, in which case the processing must cease (for marketing purposes).

Right to Avoid Automated Decision-Making and Profiling

You have the right to avoid decisions based on automated decision-making, including profiling, which have legal effects on you or otherwise significantly affect you.

Right to Withdraw Consent

When personal data processing is based on your consent, you have the right to withdraw this consent at any time, with effect for the future.

Exercising Your Rights

To exercise any of these rights, you can contact us using any of the contact details provided above. Contact us if you need assistance, and we will help you.

Complaint

You also have the right to complain about our handling of personal data to a supervisory authority for data protection matters. If you live, work, or believe that the incorrect handling occurred in Sweden, you have the right to contact the Swedish supervisory authority, currently named Datainspektionen.

Changes

In the event that this policy is changed while we are still processing your personal data, we will notify you to the extent required by applicable data protection legislation. If there is a significant change in our processing, or if the change may otherwise have a relevant and significant impact on you, such mandatory notification will be made even before the new version comes into effect.

Last Updated: 2023-03-29