UNIBAP AB (publ.) Privacy policy

Please note that this is a translation of the original Privacy policy in Swedish, which is available in pdf here.

1. Introduction

The privacy of individuals and the security of their personal data is important to Unibap AB (publ.), (“Unibap”) which is responsible for ensuring that all personal data is processed correctly and in accordance with applicable data protection legislation. This privacy policy (the “Privacy Policy”) describes Unibap’s processing of personal data. We ask you to carefully read the Privacy Policy before you share personal data with us.

Unibap company in this Privacy Policy also refers to Unibap’s subsidiary Unibap Incentive AB unless otherwise stated.

2 Scope of the Privacy Policy

2.1 To whom does the policy apply

This Privacy Policy applies to individuals who are employees, customers, suppliers and other stakeholders. Different chapters will be relevant to you depending on your relationship with Unibap.

2.2 To what does the policy apply

This Privacy Policy regulates how Unibap collects and processes personal data when you:

apply for or have taken up employment
use our range of services that are consulting services
sign up for our newsletter
as a shareholder, you register for a general meeting
have a question and/or contact us
you visit our website
are part of a business relationship as a supplier or customer or act as a representative of
supplier or customer

2.3 When does the policy not apply

The Privacy Policy does not apply in cases where Unibap’s services are advertised on third-party websites that are not owned or managed by Unibap.

3. Processing of personal data

Unibap’s processing of personal data is described below based on your relationship with Unibap.

3.1 For you as an employee
3.1.1 The purposes of processing personal data

Personal data is processed only for the purposes and purposes described in this Privacy Policy. If you choose not to provide us with certain personal data, it may affect Unibap’s ability to enter into a contract (Employment) with you. Unibap only processes personal data to the extent that such processing is necessary for Employment or for such other purposes as described below. This also applies to sensitive personal data.

Unibap processes employees’ personal data in order to:

administer our relationship with you (Employment)
offer you the opportunity to perform work tasks according to specific customer requirements
handle any cases of alleged discrimination, handle disputes internally and
with Unibap’s customers and suppliers
optimise Unibap’s operations

3.1.2 Personal data

By entering into an agreement (Employment) with Unibap, you agree that Unibap processes your personal data in accordance with this Privacy Policy. If you do not accept the Privacy Policy, you should not provide us with personal data, however, this may affect Unibap’s ability to enter into an agreement with you.

Below you will find information about the types of personal data Unibap processes and how Unibap may receive or obtain this information.

3.1.2.1 Employees

The personal data we will process about you, according to the legal basis of the employment contract with you, mainly consists of salary and account information and contact details of relatives.

Unibap may also need to process sensitive personal data about you, such as data concerning your health. Health data may, for example, need to be processed in order for Unibap to fulfil its obligations as an employer based on the legal obligations required of the company by law.

In connection with your employment, you may, at our request, be required to agree to additional conditions for the processing of your personal data.

Based on Unibap’s legitimate interest in being able to conduct its business and the fact that some of Unibap’s customers place high security requirements on individuals, Unibap may in some cases need to perform background checks, health checks and/or drug tests on you. Such checks may include sensitive personal data about you and you will be asked to give your consent before a background check, health check or drug test is/should be carried out.

As part of a background check, Unibap may ask you to submit an extract from the criminal record. It is up to you to order such an extract from the relevant authority. It is always up to you to decide whether you want to order an extract from the criminal record. If you choose not to do so, it may affect your chances of being considered for employment or working on certain client assignments. The extract will be opened by you together with Unibap. The information in a criminal record extract is handled with the utmost confidentiality and will not be saved by Unibap. However, the result may be verbally reconciled with Unibap’s customer in order to provide the Service. This is based on Unibap’s legitimate interest in protecting its interests.

3.1.3 Storage of personal data

The duration for which personal data is stored depends on the personal data in question and the purpose of its processing.

The data Unibap registers in Unibap’s business system will be saved during the ongoing contractual relationship and thereafter, in some cases, for a period that follows from law.

As a general rule, Unibap will save personal data relating to:

employment contracts, during the current employment and thereafter ten (10) years
customer and supplier agreements and data on business events, such as data on time sheets, participants, assignments, salary, invoice, declarations, financial statements, during the contract period and thereafter for ten (10) years
control data, until the termination of Unibap pension obligations

3.2 For you as a customer or supplier
3.2.1 Purposes of processing personal data

Personal data is processed only for the purposes and purposes described in this Privacy Policy. If you choose not to provide us with certain personal data, it may affect the use of the Service or the provision of the Service.

Unibap only processes personal data to the extent that such processing is necessary for the Service and for services provided by suppliers to Unibap or for such other purposes as set out below. This also applies to sensitive personal data.

Unibap processes personal data about customers’ and suppliers’ employees in order to:

enable you to access the Service or provide other services to Unibap
administer our relationship with you
enable Unibap to fulfil its obligations towards you or the individual concerned, handle
cases of alleged discrimination, handle disputes and complaints
enable future business relationships

3.2.2 Personal data

By entering into a business relationship or agreement with Unibap, you agree that Unibap processes, where applicable, personal data about your employees and/or suppliers in accordance with this Privacy Policy. You also confirm that you have informed all affected individuals in your organisation prior to giving your consent to Unibap’s processing of personal data in accordance with this Privacy Policy.

If you do not accept the Privacy Policy, you should not provide us with personal data, however, it may affect Unibap’s ability to enter into agreements with you.

Unibap may also request that the individual provides additional personal data than what is stated below. Such personal data provided/processed by special authorisation will also be subject to this Privacy Policy.

3.2.2.1 Customers

Unibap may process the personal data of contact persons. Such data consists of, among other things, name, address, e-mail address, position, responsibilities and other information necessary for the provision and follow-up of the Service and to enable future business relationships. The basis for the above processing is Unibap’s legitimate interest in providing the Service.

3.2.2.2 Suppliers

Unibap may process the personal data of contact persons and other employees. Such personal data consists, among other things, of the data specified in sections 3.2.2.1 (Customers) and 3.1.2.1 (Employees) and other data necessary for the provision and follow-up of the Service, to ensure a good delivery of services to Unibap and to enable future business relationships. The basis for the above processing is Unibap’s legitimate interest in initiating or maintaining business relations.

3.2.3 Storage of personal data

How long a personal data will be stored depends on the personal data in question and the purpose of its processing. Unibap does not retain personal data for a longer period than is necessary for the purposes for which it was collected, unless otherwise provided by law.

The data that Unibap registers in the Unibap business system, after approval from you or the individual concerned, will be stored during the ongoing contractual relationship. As a general rule, Unibap will save personal data that appears in customer and supplier agreements as well as data on business events, such as data on time sheets, participants, assignments, salary, invoice, declarations, financial statements, during the contract period and thereafter for ten (10) years.

3.3 Personal data for marketing purposes

Unibap may request your consent for information you provide to Unibap to be used for marketing purposes, under the legal basis for consent. How long a personal data will be stored depends on the personal data in question and the purpose of its processing. Unibap does not retain personal data for a longer period than is necessary for the purposes for which it was collected, unless otherwise provided by law.

3.4 Personal data from Other Stakeholders

Unibap will request your consent to save information you provide Unibap with when you subscribe to a newsletter (according to the legal basis for consent), register for the annual general meeting for others than shareholders and other corporate arrangements based on Unibap’s legitimate interest in administering corporate arrangements. How long a personal data will be stored depends on the personal data in question and the purpose of its processing. Unibap does not retain personal data for a longer period than is necessary for the purposes for which it was collected, unless otherwise provided by law.

3.5 Use of the Unibap website

For a more detailed description of the personal data processing that takes place when you use the Unibap website, see our website www.unibap.com.

4 Protection of personal data

Unibap has taken appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration and destruction. To ensure that personal data is processed in a secure and confidential manner, we use data networks that are intrusion-protected with, among other things, firewalls and password protection according to industry standards. To ensure the privacy of the personal information you provide over the Internet, we may use encryption technology when transmitting such personal information over the Internet to our servers. Unibap employees and suppliers are bound by confidentiality agreements and are required to comply with Unibap’s information and IT security rules, this Privacy Policy and other internal regulations that further regulate the processing of personal data.

5 Sharing of personal data between companies in Unibap

As a general rule, Unibap shares personal data originating from employees with the subsidiary Unibap Incentive AB. Sharing is necessary in order to carry out measures within the decided employee option programme.

As a general rule, sensitive personal data is not shared between the companies in Unibap. Before sharing sensitive personal data, Unibap always makes an assessment of whether such sharing is necessary for the purpose for which the sensitive personal data was collected and whether further consent is needed for the sharing or whether there is legal support for sharing the personal data. A prerequisite for sharing personal data between Unibap companies is that it is done in accordance with this Privacy Policy and relevant personal data legislation.

6. Sharing of personal data outside Unibap companies

Unibap will not sell, disclose or disseminate personal data to third parties, except as stated in this Privacy Policy. Within the framework of the Service, personal data may be disclosed to a Unibap customer, suppliers, subcontractors, and partners if it is necessary for the performance and provision of the Service. Unibap may also disclose your personal data to other third parties, such as Unibap’s suppliers for our business, for example for payroll administration, technical support, operation of IT systems, external testing companies or suppliers who handle job applications on our behalf. Parties to whom Unibap may disclose personal data may be located outside the European Economic Area, EEA, which means that personal data may be transferred to countries outside the EEA. If Unibap discloses personal data to Unibap suppliers outside the EEA, we will take steps to ensure that the personal data continues to be protected and also take the necessary measures to legally transfer personal data to countries outside the EEA. Countries that may be involved include Taiwan, Israel, Argentina, Uruguay and the United States.

Furthermore, we may disclose personal data if we are required to do so by applicable law, court order or if such disclosure is otherwise necessary to assist in a legal investigation. In the event that Unibap is subject to a reorganisation, merger or sale, we may transfer personal data to the relevant third party, provided that the third party undertakes to process the personal data in accordance with this Privacy Policy.

7. Controller of personal data

Unibap AB, org no 556925-1134,
Unibap Incentive AB, corporate identity number 559148-9868,

are the data controllers for the processing of your personal data and are responsible for ensuring that such processing is carried out in accordance with applicable legislation.

8. Unibap as data processor

Unibap is the data controller for Unibap’s processing of personal data, but there may be situations where Unibap is not the data controller, but only a data processor for a third party.

When Unibap processes personal data as a data processor, it is on behalf of a third party and Unibap is then bound by the instructions that Unibap has received from the data controller. In these situations, Unibap cannot guarantee that such processing will take place in accordance with this Privacy Policy, but Unibap will always ensure that processing takes place in accordance with applicable legislation and, as far as possible, in accordance with this Privacy Policy.

9. Your rights

You as an individual have the right, free of charge, upon application to Unibap at the address above (under “Data Controller”) or via email, legal@unibap.com, to be informed of what personal data Unibap processes about you and information about the scope and purpose of such processing. In some cases, you also have the right to data portability of personal data. You have the right to have your personal data rectified if it is inaccurate, incomplete or misleading and the right to restrict the processing of personal data until it is amended. You have the right to be forgotten, but deletion of personal data cannot take place if it is required to fulfil the agreement or if another Swedish or European law, court or authority decision says otherwise, and if it is based on a balance of interests. If you think that there are no legitimate reasons or that the balance of interests is incorrect, you have the right to object to the processing. You also have the right to withdraw your consent, lodge a complaint about the processing with the Data Protection Authority, object to automated decision-making, profiling and object to direct marketing.

10. Changes to this privacy policy

Unibap reserves the right to revise this Privacy Policy if necessary. The date of the last amendment is indicated at the end of the Privacy Policy. If we make any changes to the Privacy Policy, we will publish these changes on the website. You are therefore advised to read this Privacy Policy regularly to take note of any changes. If we change the Privacy Policy in a way that is materially different from what was stated when your consent was collected, we will notify you of these changes and, if necessary, ask you to re-consent to Unibap personal data processing.

11. Contact us

If you have any questions about this Privacy Policy or our use of your personal data, please contact us at legal@unibap.com.

Uppsala 2018-05-15