AVS safeguards your privacy and protects your personal data

1.1 Who is covered by this privacy notice?

We process personal data of the following categories of persons:

• Representatives/contact persons of existing and potential customers.

• Representatives/contact persons of organizations providing products and services to us (supplier and potential supplier).

• People who work for us as consultants.

• Other people who are in contact with us or visit our website.

1.2 What type of personal data do we process?

2.1 Communication with potential customer or potential supplier

In order to communicate with potential customers or potential suppliers, we will process contact details, company information as well as correspondence and documentation of representatives/contact persons of the organization. The processing is necessary for our legitimate interest of conducting business and taking steps prior to entering into a contract with a customer or supplier (Article 6(1)(f) GDPR). Please contact us if you would like to know more about how we balance your interests against ours. We will keep your personal data for as long as we have an ongoing mutual dialog and for a maximum of 24 months thereafter. If we have entered into an agreement with the organization you represent within the said time period, the retention periods set out in point 2.2 below apply. For pure marketing, see point 2.8 below.

2.2 Contractual obligations towards the customer or supplier

In order to enter into a contract with a customer or supplier and to manage the subsequent business relationship (e.g. fulfilling the terms of the contract, paying for purchased services or providing our own services, drawing up, issuing and storing documents, and managing, distributing and coordinating work). The data we process for the aforementioned purposes are contact details, company information, qualification information (consultants only), correspondence and documentation about you as a consultant or representative/contact person of the supplier/client. The processing is necessary for our legitimate interest of entering into and performing a contract with the supplier/customer (Article 6(1)(f) GDPR). Please contact us if you want to know more about how we balance your interests against ours. We will keep your personal data for the period that we have a contract with the organization you represent and for 24 months thereafter. Please note that the personal data will also be retained for the purposes set out in paragraph 2.12 below.

2.3 Keeping our customer records accurate and up to date

It is crucial to the success of our business that we have up-to-date and accurate customer records and we therefore work continuously to keep our records accurate and up-to-date. When managing our customer records, we process contact details, correspondence and documentation, business information about the supplier/customer. The processing is necessary for our legitimate interest in having accurate and up-to-date information about you as a contact person (Article 6(1)(f) GDPR). Please contact us if you want to know more about how we balance your interests against ours.

2.4 Access to internal systems and premises for consultants

In order to provide the consultants with access to our internal systems and applications and to give them access to our premises, we will process the consultants' contact details. The processing is necessary for our legitimate interest of being able to provide you with access to the systems, programs and premises that the consultant needs access to in order to perform your assignment (Article 6(1)(f) GDPR). Contact us if you want to know more about how we balance your interests against ours. We will keep your personal data for as long as you perform the consultancy assignment for us.

2.5 When you visit our website

In order to provide, operate, maintain, improve and customize our website, we use cookies and similar tracking technologies (collectively "Cookies"). Cookies are used to store information about your preferences and the pages you visit, both on our website and on other websites in order to, among other things, optimize your browsing experience and to improve the functionality of the website. The website contains essential, functional, statistical/analytical and marketing cookies.

Depending on your cookie settings, we will process statistical and analytical information about you as a website visitor. The legal basis for our processing of personal data collected via cookies is your consent (Article 6(1)(a) GDPR). If you have consented to non-essential cookies, you can withdraw your consent at any time. You can do this by clicking on the small 'cookie' symbol in the bottom left-hand corner of the website where you can change your settings in the control panel.

For further information on our use of cookies, please see our cookie information on our website (click on the "cookie symbol"), which contains a detailed list of the cookies we use, retention periods etc.

2.6 AVS web shop

In order to authorize you to log in to the AVS webshop and place orders and manage orders, we process contact details (for login), payment details and other information you share with us that can be linked to you as an individual. In order to provide you with a better user experience and to be able to send you relevant offers, we use cookies in the webshop, see more information about cookies in section 2.5 above. We will ask for your consent (Article 6(1)(a) GDPR) to place non-essential Cookies. The processing of login and account data is necessary for our legitimate interest in providing you with access to our services and customer tools (Article 6(1)(f) GDPR). Please contact us if you want to know more about how we balance your interests with ours. We will keep your personal data for as long as the organization you represent has an ongoing contract with us and for 12 months thereafter. Please note that the personal data will also be retained for the purposes set out in paragraph 2.12 below.

2.7 AVS application

In order to provide representatives/contact persons of our customers and suppliers with access to our application (the "AVS App") and the possibility to use its features, we process contact details, company information, correspondence and documentation as well as information on qualifications (applies to consultants). The processing is necessary for our legitimate interest of providing you with access to our services and customer tools (Article 6(1)(f) GDPR). Please contact us if you want to know more about how we balance your interests with ours. We will keep your personal data for as long as the organization you represent has an ongoing contract with us and for 12 months thereafter. Please note that the personal data will also be retained for the purposes set out in section 2.12 below.

2.8 Marketing

In order to send you relevant offers, news and information about our products and services, we will process contact and company information about you as well as information about your wish to subscribe/unsubscribe. The processing is necessary for our legitimate interest of being able to market our products and services (Article 6(1)(f) GDPR). If you want to know how we have balanced the interests, you are welcome to contact us. You can object to our processing at any time and we will then stop processing your data for marketing purposes. You can object by contacting us or by unsubscribing from our emails. In some cases, we base our processing of personal data for marketing purposes on your consent (Article 6(1)(a) GDPR). In such cases, we will obtain your consent at the time of collecting the data, e.g. when you sign up for our newsletter.

How long we keep your personal data depends on how we have collected the data. As a rule, we keep the data for the duration of the contractual relationship and for 24 months thereafter. If your data was collected for marketing purposes from a source other than you (e.g. from public registers), the data will generally be deleted three months after it was collected, unless a contractual relationship has been established between us and the organization you represent (in which case, see the retention periods under point 2.2 above) or you have given your consent to marketing communications.

We will never sell personal data you share with us.

2.9 Profiling for marketing purposes

We carry out profiling of you as a representative/contact person for marketing purposes. "Profiling" means an automated processing of your personal data for the purpose of creating a customer profile to predict your preferences as a representative/contact person of your organization, such as purchasing interests.

If you have consented to analysis and marketing cookies on avs.se, the information collected through cookies will be analyzed and combined with other customer data we have about you in our customer records. By creating customer profiles, we gain customer insights that enable us to display ads and send customized offers and news to you regarding our products and services. Profiling for these purposes has no significant impact on you as a customer.

If you have any questions about how the profiling process works, you are welcome to contact us. You can find our contact details in section 7. You can object to our marketing profiling at any time by contacting us (and we will then stop marketing profiling). You can also stop our profiling for our services by canceling the service.

2.10 Publication of image/moving image

In order to inform about our business, we publish images/moving images from corporate events, trade fairs and customer and supplier visits on avs.se, in our web shop, in our newsletters and in our social media. To the extent possible and appropriate, we choose images that do not enable the identification of an individual person. The processing is necessary for our legitimate interest to inform about our activities (Article 6(1)(f) GDPR). Please contact us if you want to know more about how we balance your interests against ours. Where appropriate for a specific image publication, we may also seek your consent (Article 6(1)(a) GDPR).

If you do not want your personal data to be processed in our information/marketing, you have the right to object to us via the contact details in section 7. Where processing is based on your consent, you can withdraw your consent at any time by contacting us.

The personal data will be processed for as long as it is necessary to fulfill the purpose, i.e. marketing or informing about our activities or until you object to the processing or withdraw your consent.

2.11 Development of products and services

In order to improve our products and services, we will process contact details, company information as well as correspondence and documentation (your reviews of our products and services). This processing is necessary for our legitimate interest of providing better products and services (Article 6(1)(f) GDPR). Please contact us if you want to know more about how we balance your interests with ours. We will retain your personal data in accordance with the retention periods otherwise specified in this notice, i. e. we will not retain identifiable data for this purpose for a period longer than the initial retention period.

2.12 Processing to comply with laws, legal obligations and voluntary commitments

2.12.1 To comply with legal obligations

2.12.2 Claims and complaints

In order to administer, investigate and respond to claims (e.g. complaints or warranty claims) and complaints, we will process your contact details and any other information you provide us with in relation to your claim or complaint. This processing is necessary for our legitimate interest of administering your claim or complaint (Article 6(1)(f) GDPR). Please contact us if you would like to know more about how we balance your interests with ours. We will keep your personal data for the period we investigate and administer your claim or complaint.

2.12.3 Disputes

In order to establish, exercise or defend a legal claim, for the purpose of protecting our legal rights, we will process the categories of personal data necessary in relation to the dispute and the parties involved. The processing is necessary for our legitimate interest to be able to protect our interests in the event of a dispute (Article 6(1)(f) GDPR). Please contact us if you would like to know more about how we balance your interests against ours. We will keep your personal data for the duration of the dispute and for up to 10 years thereafter.

2.12.4 Mergers and acquisitions

In order to transfer personal data in the event of a merger, acquisition or sale of all or part of our assets, we will process the categories of personal data involved in the merger or acquisition. The processing is necessary for our legitimate interest of being able to carry out a merger or acquisition and transfer the relevant personal data for this purpose (Article 6(1)(f) GDPR). Please contact us if you want to know more about how we balance your interests with ours. Personal data is not routinely stored for this purpose.

3.1 How we collect personal data

We mainly collect your personal data directly from you (including from your device) when you communicate or otherwise interact with us, for example through an order, personal contact, a quote request, a discussion or a visit.

In some cases, we may also collect your personal data from other sources, such as from publicly available sources/registers (e.g. if you are the designated contact person for a company we want to get in touch with). We may also collect it from the company where you are employed and through internet searches.

3.2 If you do not provide us with your personal data

When we process your personal data, we do so, among other things, to comply with legal or contractual obligations. If you do not provide the personal data we request, it may mean that we cannot enter into a contract with the organization you represent or fulfil our contractual or legal obligations towards the organization. If you have any doubts or concerns about providing certain personal data, please contact us (see point 7 below) for further information.

We may need to share your personal data with others to provide our services and to comply with laws and regulations. This includes

• IT service providers who provide the necessary operation, technical support and maintenance of our IT solutions, such as internally used systems, platforms and hosting services.

• Banking and payment service providers whose services we use to process our payment transactions.

• Group companies.

• Providers of analytical services on our website

• External advisors and consultants who help us in different areas of our business (e.g. lawyers and accountants).

• Potential buyers in the event of a merger, acquisition or sale of all or part of our assets.

• Public authorities in the event of a request.

• Courts in the event of a dispute or other proceedings.

We aim to process your personal data within the EU/EEA area, however, in some situations it may be processed outside the EU/EEA, e.g. when we use cloud services or data analytics services and these actors operate outside the EU/EEA.

We always ensure a high level of protection for your personal data, even when the personal data is processed outside the EU/EEA. In most cases, the importing party will be based in a country that has been assessed by the European Commission as offering adequate protection (e.g. the United Kingdom) or complies with the EU-US Data Privacy Framework (Article 45 GDPR). Where necessary and appropriate, we also enter into EUStandard Contractual Clauses (Article 46 GDPR). In addition, we take additional technical and organizational security measures when necessary.

We are responsible for ensuring that your personal data is processed lawfully, transparently and fairly in relation to you and that your data is accurate and up-to-date. You have certain rights in relation to our processing of your personal data. If you wish to exercise any of your rights, you can contact us using the contact details in section 7.

We will get back to you as soon as we can, and at the latest within one month of receiving your request. If we are unable to respond to your request or need more time, we will explain why.

You can find out more about your rights on the website of the Data Protection Authority (www.imy.se).

6.1 Right of access

You have the right to know whether or not we process personal data about you. If we do, you also have the right to receive information about what personal data we process and why we do it. Furthermore, you have the right to receive a copy of any personal data we hold about you. If you are interested in any specific information, please indicate this in your request. For example, you can indicate whether you are interested in a certain type of information, such as the specific contact details we hold about you, or whether you want information from a certain time period.

6.2 Right to rectification

If the personal data we hold about you is inaccurate, you have the right to have the personal data rectified. You also have the right to complete incomplete personal data, including by providing supplementary information. Once we have corrected or completed your personal data, we will inform those with whom we have shared your personal data (where applicable) of the update, unless this is impossible or too burdensome. If you ask us to, we will also tell you who we have shared your personal data with. If you request rectification, you also have the right to request that we restrict our processing for the duration of our investigation.

6.3 Right to erasure (right to be forgotten)

In certain cases, you have the right to request that your personal data be erased, for example

• If the personal data is no longer necessary for the purposes for which it was collected or otherwise processed; or

• Where the personal data has been unlawfully processed.

If we delete the personal data at your request, we will also inform those with whom we have shared your personal data (where applicable), unless this is impossible or excessively burdensome. If you ask us, we will also tell you who we have shared your personal data with.

6.4 Right to request restriction

Restriction means marking the personal data so that it can only be used for certain limited purposes in the future. The right to restriction applies:

• When you believe that the personal data is inaccurate/incomplete and you have requested rectification. In this case, you can also request that we restrict our processing while we investigate whether or not the personal data is accurate/complete,

• if the processing is unlawful but you do not want the personal data to be erased,

• When you have objected to the processing and during the time we check our legitimate grounds, or

• When we no longer need the personal data for the purposes for which we collected it, but you need it to establish, exercise or defend legal claims.

Even if you have requested that we restrict our processing of your personal data, we have the right to use it for storage, to assert or defend legal claims or to protect the rights of another person. We may also use the personal data for reasons of important public interest. We will notify you before the restriction expires.

If we restrict the processing of your personal data, we will also inform those with whom we have shared your personal data (where applicable), unless this is impossible or excessively burdensome. If you ask us, we will also tell you who we have shared your personal data with.

6.5 Right to object

You have the right to object to processing based on our legitimate interest. If you object to the use, we will, based on your situation, evaluate whether our interests in using the personal data outweigh your interests in not having the personal data used for this purpose. If we cannot provide compelling legitimate grounds that outweigh yours, we will stop using the personal data you object to - provided that we do not need to use the data to establish, exercise or defend legal claims. If you object to the use, you also have the right to request that we restrict our use while we investigate the matter.

You always have the right to object to and unsubscribe from direct marketing.

6.6 Right to data portability

If the processing is based on your consent or a contract between us, you have the right to obtain the personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller ("data portability").

6.7 Right to withdraw consent

You have the right to withdraw your consent to a particular processing operation at any time. Your withdrawal will not affect the lawfulness of the processing of your personal data that has already been carried out.

6.8 How to exercise your rights and the right to complain

If you wish to exercise any of your rights, you can contact us using the contact details below.

If you have any objections or complaints about how we process your personal data, please contact us and we will do our best to help you. You also have the right to lodge a complaint with the supervisory authority where you live, work or where you believe a breach has taken place. In Sweden, the supervisory authority is the Swedish Data Protection Authority (IMY) (Integritetsskyddsmyndigheten Box 8114, 104 20 Stockholm, imy@imy.se).

If you have questions about how we process personal data, but cannot find the answer in this information text, please contact us.

Telephone: 010-551 10 00
E-mail: dataskyddsansvarig@avs.se
Address: Pilotgatan 7, 212 39 Malmö

We reserve the right to change this information text from time to time. We will inform you of any changes by publishing the updated information text on our website. If we make any material changes, we will notify you by email.