Personal data controller
The personal data controller responsible for processing your personal data is:
Betongvägen 1, SE-281 93 Finja, Sweden
What personal data do we collect, and from where?
We collect personal data from you when you contact us (e.g. when filling in forms or visiting the website). We collect your name, address, email address and telephone number, and your usage history and IP address, along with information that you supply to us.
Why we process your personal data
We process your personal data for the following purposes and on the following legal grounds:
We process personal data in order to send offers and marketing via email, post and SMS. This processing is carried out with your consent for direct marketing or in our legitimate interest in sending direct marketing.
We process personal data in order to carry out competitions that we organise.
This processing is carried out in our legitimate interest in administering competitions in which people participate.
Improvement and development
We process personal data to improve and develop our service, our products and our technical systems.
This processing is carried out in our legitimate interest in being able to update, improve and develop services, products and technical systems.
Fulfilment of legal obligations
We process personal data to comply with applicable laws covering, for example, accounting, tax and product safety.
This processing is carried out to fulfil legal requirements.
Prevention of misuse and crime
We process personal data to prevent the misuse of our services and to prevent crime, e.g. fraud.
This processing is carried out in our legitimate interest in preventing the misuse and unlawful use of our services.
Who we share personal data with
We may share personal data with others, but only when permitted by law. Personal data may be shared with, for example, public authorities, companies in the Finja Group, logistics companies, marketing companies or other suppliers. We have signed personal data processing agreements with suppliers that handle personal data on our behalf.
Transfer of personal data to countries outside the EU/EEA
In some cases we may transfer personal data to legal entities in countries outside the EU/EEA. In such cases, the transfer is made to countries in which the European Commission has decided that there is either an adequate level of protection in the use of standard contractual clauses approved by the European Commission or other appropriate safeguards. Transfers to the United States may also be made in accordance with the Privacy Shield scheme.
How long personal data is kept
We keep personal data for as long as is required for the purposes it was collected for, or for as long as required by law or other regulations.
Marketing data is kept until you request that you no longer receive marketing material or you have been inactive for three years.
Data for the prevention of misuse and crime is kept for as long as we need it to prevent or report crime (e.g. fraud).
We will respond to your request regarding any of your rights as quickly as possible but within one month.
When permitted by applicable legislation, we may charge an administrative fee to fulfil a request as described below.
You have the right to receive information about how we process your personal data along with a copy of the personal data.
You may request the correction of incorrect or incomplete personal data.
You have the right to have your personal data deleted in the following cases:
- The personal data is no longer necessary for the purposes for which it was collected or processed
- You have revoked your consent for processing your personal data and there are no other legal grounds for the processing
- You have objected to the processing of personal data that has been carried out in our legitimate interest and your interest carries more weight
- We have processed your personal data in an unlawful way
- Your personal data must be deleted to comply with a legal obligation
Limitations on processing
You have the right to request that the processing of your personal data be limited in the following cases:
- You are contesting the correctness of your personal data, and for a period that allows us to check whether your personal data is correct
- We have processed your personal data unlawfully and you oppose the deletion of your personal data, requesting that its use be limited instead
- You need your personal data in order to establish, enforce or defend legal claims, but we no longer need the personal data for the purposes for which it was processed
- You have objected to the processing of your personal data, and for a period during which we assess whose legitimate interest takes precedence.
Objection to processing
You have the right to object to processing of your personal data that we carry out on the grounds of legitimate interest. In this case processing will cease provided we do not have a legitimate interest that takes precedence over yours, or unless we have to continue processing to safeguard legal requirements.
Objection to direct marketing
You have the right to object to the processing of personal data for direct marketing purposes. You can object to direct marketing by contacting customer service. If you have made such an objection, we will stop processing your personal data for direct marketing purposes.
You have the right to obtain the personal data you have provided to us – and that we process in an automated manner based on agreements with you or with your consent – in a structured, regular and machine-readable format.
If you are dissatisfied with how we process your personal data, you can contact us or submit a complaint to a regulatory authority.