Information about our personal data processing
It is important to Wästbygg Gruppen AB (publ) and all its subsidiaries (collectively referred to as ‘the Wästbygg Group’) that you trust us to process your personal data in a secure and legal manner. We want to be as open and transparent as possible about how we collect and process your data during your dealings with us. This information regards the processing of personal data of, for example:
- Users of our websites and of other digital channels such as social media;
- Contact persons and other parties representing our customers, suppliers and partners; and
- External parties who are in contact or communication with us, or who are otherwise affected by our personal data processing and are not covered by the categories above, for example if you contact us via email, register interest in one of our projects or sign up for our press releases.
Different companies in the Wästbygg Group can be the data controller for your personal data. The company in the Wästbygg Group that acts as the data controller of your personal data in a specific situation varies according to how you came into contact with the Wästbygg Group and what the processing regards.
The Wästbygg Group collects personal data about you when, for example, you register via our website to receive mailings, participate in various sales activities, trade fairs and events, contact the Wästbygg Group’s main number or communicate with us in other ways.
The Wästbygg Group only processes personal data that are necessary for specific purposes; this means that the Wästbygg Group processes different personal data in different situations. Examples of personal data that the Wästbygg Group processes include name, email address, phone number, postal address, correspondence, user-generated data and/or other information which you provide to us or which is otherwise necessary in order for us to fulfil our obligations or operate our business.
We primarily collect your personal data from you when you provide them to us and our employees, for instance when you visit our website or contact us through other social channels.
Partners
We sometimes obtain personal data from partners and other external parties, e.g. when we conduct activities with our partners, when we carry out KYC checks on entering into contracts with customers and suppliers, or when we receive a whistleblower report.
Group companies
All companies in the Wästbygg Group collaborate with each other. This means that in some cases we obtain personal data from other group companies, e.g. as part of our contact with customers and suppliers.
Public registers and databases
We may collect personal data from public registers and databases or authorities, e.g. to manage our relationship with the company you represent.
The Wästbygg Group processes your personal data for different purposes in different situations. We primarily process your data to fulfil our obligations to you, to provide a high level of service and well-functioning, efficient and simple services.
In order for the Wästbygg Group to process your data, there needs to be a legitimate legal basis for processing the data. Legal bases might be, for example, that processing is necessary to enable us to fulfil our contractual obligations to you, or in order for us to comply with legal obligations Another valid basis for processing your data is a legitimate interest where we have made the assessment that our interest in processing your data outweighs your interests or fundamental rights and freedoms. In certain cases, the Wästbygg Group may need your consent in order to process your personal data. When you give your consent in such cases, you will always be given clear information about what you are consenting to and how to withdraw your consent.
| Processing of whistleblower reports
We process personal data contained in whistleblower reports in order to receive, investigate and respond to these reports. |
|
| Personal data processed | Legal grounds for processing |
| Name and contact details | Legal obligations and legitimate interest
Processing takes place to meet our legal obligation to receive whistleblower reports and to fulfil our legitimate interest in taking actions based on such reports.
Any data regarding criminal offences are processed in order to comply with our legal obligations and to assert and defend legal claims. |
| Communication | |
| Other information that is necessary in the specific case | |
| Managing and complying with legal obligations
We process personal data if necessary in order to establish, assert and defend legal claims, for instance in connection with a dispute. |
|
| Personal data processed | Legal grounds for processing |
| Name and contact details |
Legitimate interest
Processing takes place to meet the Wästbygg Group’s legitimate interest in establishing, asserting and defending legal claims.
Any data regarding criminal offences are processed in order to comply with our legal obligations and to assert and defend legal claims. |
| Communication | |
| Technical information | |
| Other information that is necessary in the specific case | |
| To ensure compliance with our policies, guidelines and applicable law
We process personal data if necessary in order to ensure that our suppliers and partners comply with the requirements and guidelines that we have imposed, as well as with applicable law. |
|
| Personal data processed | Legal grounds for processing |
| Name and contact details | Legitimate interest
Processing takes place to meet the Wästbygg Group’s legitimate interest in ensuring compliance with policies, guidelines and laws.
Any data regarding criminal offences are processed in order to comply with our legal obligations and to assert and defend legal claims. |
| Communication | |
| Data regarding suspected misconduct or criminal offences | |
| Data regarding routine inspections | |
| Other information that is necessary in the specific case | |
| To develop and improve our business
We process personal data when we conduct comprehensive analysis to monitor, develop and improve our business as a whole. We also process personal data when we archive contracts, decision-making documentation, presentations, etc. |
|
| Personal data processed | Legal grounds for processing |
| Name and contact details | Legitimate interest
Processing takes place to meet the Wästbygg Group’s legitimate interest in continuously improving our business and archiving key documentation. |
| Communication | |
| Other information that is necessary in the specific case | |
| To register visitors
We process personal data in order to register and provide parking permits to visitors at our offices or work sites. |
|
| Personal data processed | Legal grounds for processing |
| Name and contact details | Legitimate interest
Processing takes place to meet the Wästbygg Group’s legitimate interest in receiving visitors at our offices and work sites. |
| Registration number | |
| To monitor use of and develop our websites
We process personal data when people visit our websites in order to monitor how the websites are used and how we can develop and improve them. |
|
| Personal data processed | Legal grounds for processing |
| User-generated data | Legitimate interest
Processing takes place to meet the Wästbygg Group’s legitimate interest in being able to develop and improve our websites. |
| Technical data | |
| KYC checks on suppliers, partners and business customers
We process personal data if it is necessary in order to perform KYC checks on entering into contracts. |
|
| Personal data processed | Legal grounds for processing |
| Name and contact details | Legitimate interest
Processing takes place to meet the Wästbygg Group’s legitimate interest in being able to make well-informed business decisions.
Any data regarding criminal offences are processed in order to comply with our legal obligations and to assert and defend legal claims. |
| Personal identity number | |
| Financial data | |
| Board member assignments | |
| Communication | |
| Other information arising in connection with checks | |
| To provide information and communicate news and updates
We process your personal data if you subscribe to our mailings and press releases, if you order reports or other information on single occasions, or if you communicate with us via email for the purpose of receiving a response from us. |
|
| Personal data processed | Legal grounds for processing |
| Name and contact details | Legitimate interest and consent
Processing takes place to meet the Wästbygg Group’s legitimate interest in being able to supply you with information and respond to your written enquiries.
For example, when you subscribe to our press releases, you consent to us processing your contact details. You can withdraw your consent at any time by unsubscribing.
|
| Communication | |
| Compliance with legal obligations
We process personal data in order to comply with legal obligations, e.g. with regard to tax and accounting. |
|
| Personal data processed | Legal grounds for processing |
| Name and contact details | Legal obligations
Processing takes place to meet our legal obligations with regard to tax and accounting.
|
| Communication | |
| Invoicing data | |
| Other information that is necessary in the specific case | |
| Tenders, purchasing enquiries, orders, etc.
We process your personal data if you contact us to make tender request, purchase our services or enter into a similar contract with us. |
|
| Personal data processed | Legal grounds for processing |
| Name and contact details | Fulfilment of contractual obligations and legitimate interests
We process your personal data to fulfil our obligations under our contract with you or the company you represent.
The Wästbygg Group has a legitimate interest in responding to and processing tender requests and orders. |
| Personal identity number | |
| Communication | |
| Invoicing data | |
| Corporate identity number | |
| Order data | |
| Other company-specific and financial information that is available and necessary in each specific case. | |
The Wästbygg Group is a large group in which all the group companies collaborate to varying degrees. For this reason, your personal data may be shared within the group. In the event personal data is shared by us and processed in accordance with our instructions, the recipient acts as the data processor and we are responsible for the processing.
We may also share your personal data with our service providers, e.g. IT providers, who process your personal data in the capacity of data processor on our behalf. Our service providers will only process your personal data in accordance with our instructions to meet their individual obligations towards us.
We always strive to process your personal data in the EU/EEA. However, in some cases your personal data are shared with parties outside the EU/EEA, e.g. service providers engaged by us. We ensure that your personal data continue to be protected in such cases by making sure that suitable protective measures are in place with all service providers that process personal data outside the EU/EEA.
If you would like further information about which countries we may transfer your personal data to (outside the EU/EEA) and which protective measures we take to protect your personal data, please contact us at the email address below.
The Wästbygg Group keeps your personal data for as long as needed to fulfil the purposes we collected them for, or for the length of time we are obliged to keep them in compliance with laws, regulations, government decrees, or according to standard business practices. We determine the length of time we are permitted and able to store your personal data on the basis of, for example, the following criteria.
- While we have an ongoing relationship with you and/or with the company where you are employed.
- As long as required in order for the Wästbygg Group to meet its legal obligations, e.g. under tax law.
- As long as is appropriate to ensure our legal position, e.g. under statutory limitation provisions.
- As long as is necessary for legitimate business reasons.
The Wästbygg Group has strict internal policies and guidelines on how we protect your personal data. We also apply suitable and reasonable technical and organisational safety measures, including IT security measures, to protect your personal data in a correct manner.
You have certain rights regarding our processing of your personal data, of which some examples are listed below. The rights that apply to you depend on our specific processing of your personal data.
Right to withdraw consent
If you have consented to certain processing of your personal data, you have a right to fully or partially withdraw this consent at any time.
Right of access
You have a right to receive confirmation that we are processing your personal data, as well as information about how we process your data (e.g. our reasons for processing the data and the categories of data we process). You also have a right to receive a copy of the personal data we process about you.
Right to rectification and right to object to processing
You have a right to request that inaccurate or incomplete personal data be corrected or completed without undue delay (e.g. if you have changed your telephone number). You also have a right to object at any time to processing of information on the basis of a legitimate interest.
Right to erasure and right to restrict processing
Under certain circumstances, you have the right to request that your personal data be erased. Examples of such conditions are if the personal data are no longer needed for the purpose they were collected or processed for, or if the data were processed illegally. You also have the right to ask for the processing of your personal data to be restricted, e.g. if you believe that we are processing incorrect personal data.
Right to lodge a complaint
You have a right to lodge a complaint regarding our processing of your personal data with a competent supervisory authority. Such complaints should preferably be lodged with the authority in the member state in the EU/EEA where you reside or work, or where a violation of the applicable data protection laws and regulations allegedly took place. The competent supervisory authority in Sweden is the Swedish Authority for Privacy Protection.
Right to data portability
In certain cases, you have the right to receive your personal data from us in a structured, commonly used and machine-readable format and, where technically possible, to have your personal data transferred to a different company (data portability).
If you have any questions about our processing of your personal data, or if you want to assert any of your rights in relation to our processing of your data, please contact us via privacy@wastbygg.se.