​

1. Holm & Co. AB, corporate identity number 559261-4944, provides corporate customers with marketing services, which include a communication platform for digital mailings to the addresses provided by the customers, whereby the customer is specified as the sender of the mailing. In that context, Holm will have access to digital personal data regarding suppliers.
    

2. Holm processes personal data primarily to fulfill its obligations to customers and suppliers. The intention is not to process more personal data than is needed for each purpose, and Holm always strives to use the least privacy-sensitive data.
    

3. In all situations, Holm shall ensure that personal data is processed correctly and in accordance with the law in force at any given time and ensure that those who process personal data have the qualifications required to meet such requirements.
    

4. This personal data policy (the "Policy") contains rules and guidelines for the processing of personal data by Holm in their capacity as a personal data controller and, where applicable, as a personal data assistant, regardless of the type of personal data in question and whose personal data it concerns.
    

5. Holm usually requests personal data in order to fulfill statutory or contractual requirements or requirements that are necessary to enter into an agreement with, for example, an employee, a customer or a supplier. If the data subject does not provide the requested information, this may in some cases mean that Holm cannot enter into an agreement or fulfill their obligations in an agreement with the data subject.
    

6. Employees’ personal data is collected and processed in order to fulfill obligations under law, collective agreements or for the conclusion and fulfillment of individual agreements. Personal data that is processed are mainly name, social security number, contact information, bank details, salary specifications and documentation, qualifications and information about close relatives. The information is processed by the HR manager, managers, IT, sales manager, finance department and internal or external actors who administer salaries and other benefits, etc. of by authorities when required. The purpose for processing employees' data is for Holm to be able to fulfill his legal and contractual obligations to the employee. Some of the personal data processed may be sensitive, such as illness or union affiliation.
   
   The time for storing data shall not be longer than necessary with regard to the purposes of the processing, which is why a regular review of personal data is also carried out, removing the data that is no longer needed. Upon termination of employment, information about the employee is eliminated with the exception of such information that Holm must retain in order to fulfill legal requirements such as taxation or to be able to meet demands from the employee arising from the employment relationship.
    

7. Consultants’ individual personal data is collected in order for Holm to be able to fulfill legal obligations or to be able to enter into and fulfill consultancy agreements. The information that is collected and that at Holm that processes the information is essentially the same as for employees. The consultant's personal data is needed payment of consulting fees and other remuneration, general administration of consulting services, enable evaluation and review of performance and also more generally to ensure fulfillment of legal obligations.
   
   The time for storing data shall not be longer than necessary with regard to the purposes of the processing, which is why a regular review of personal data is also carried out, removing the data that is no longer needed. Upon termination of the assignment, information about the consultant is eliminated with the exception of such information that Holm must retain in order to fulfill legal requirements such as taxation or to be able to meet requirements from the consultant arising from the assignment relationship.
    

8. Corporate customers are legal persons, but to handle the agreements, Holm processes personal data regarding the persons who represent the customer such as name, telephone number and e-mail as well as personal data that the corporate customer has entered in Holm's communication platform even if the corporate customer is responsible for personal data. Holm also processes personal data regarding representatives of companies that are potential customers, such as name, telephone number, address and e-mail. The recipients of the information are mainly persons relevant to the agreement in the sales department, finance department, marketing department, managers and agreement administrators. Helpdesk and technicians may also receive the information. When entering into customer agreements, Holm processes the personal data that is relevant to the customer relationship and that is required for the fulfillment of the agreement. Representatives' personal data can also be processed to send offers to the customer company. However, the representative has the right to object at any time to the processing of personal data for direct marketing. When Holm processes personal data regarding representatives of potential customers, this is done in order to contact the customer to provide offers and information or to administer scheduled meetings. The representative always has the right to object to processing for direct marketing.
   
   Holm never stores data longer than necessary with regard to the purposes of the processing and the company therefore carries out a regular review of stored personal data and removes the data that is no longer needed after the customer relationship has ended. In some cases, Holm may need to store personal information after the customer relationship has ended, for example to administer guarantees and complaint deadlines, handle any legal requirements or to market services and send offers. Personal data regarding representatives of potential customers is deleted when the dialogue with the customer has ended, unless a customer agreement has been reached or directly if the person objects to direct marketing.
   
   In Holm's communication platform and thus on Holm's servers, there may be personal data about customers stored by Holm's corporate customers. For such storage, Holm is the personal data assistant and the corporate customer is responsible for personal data. Personal information provided by the corporate customer for their own distribution through Holm's communication platform will be deleted from Holm's system as soon as the corporate customer's campaign is over.
    

9. Suppliers are usually legal persons, but Holm processes personal data concerning representatives of supplier companies or companies with which Holm intends to enter into agreements for the purpose of entering into or handling agreements with suppliers. Personal data that is processed can include name, telephone number, e-mail, address and professional title. Those who receive the information are mainly the responsible manager, the CEO, the finance department and the IT department. The purpose of the processing of personal data is to administer purchasing agreements, handle invoices and to be able to ask questions to the supplier.
   
   Holm never stores data longer than necessary with regard to the purposes of the processing and therefore carries out regular thinning out of stored personal data and removes the data that is no longer needed after the contractual relationship has ended. Holm may store the personal data after the contractual relationship has ended, for example to administer any guarantees and complaint deadlines or handle legal claims.
   
   In Holm's communication platform and thus on Holm's servers, there may be personal information about suppliers stored by Holm's corporate customers. For such storage, Holm is the personal data assistant and the corporate customer is responsible for personal data.
    

10. Sensitive personal data may be stored at Holm. Sensitive data refers to personal data revealing racial or ethnic origin, personal opinions, religious or philosophical beliefs or trade union membership and processing of genetic data, biometric data to uniquely identify a natural person, health data or data on a natural person's sexual life or sexual orientation.
    
    Holm never processes sensitive data without the consent of the data subject or without the support for the processing according to the Data Protection Ordinance, for example in relation to labor law, social security and social protection or when the processing is necessary to protect the data subject's or someone else's fundamental interests. physically or legally prevented from giving consent, in certain cases within the framework of trade union activities, if the information has already been published by the data subject, if it is necessary in the interest of an important public interest, if it is necessary for reasons related to, inter alia, assessment; of the work capacity of workers or the provision of health care or, if necessary, for statistical purposes.
    
    During each processing of sensitive data, Holm takes security measures to protect the data.
    
    In Holm's communication platform and thus on Holm's servers, there may be sensitive personal data stored by Holm's corporate customers or by those whom the customer has invited to use Holm's communication platform. For such storage, Holm is the personal data assistant and the corporate customer is responsible for personal data.
     

11. Collection, processing and storage of personal data shall be transparent and only to the relevant extent. Personal data must be processed in a way that avoids violating the data subject's personal privacy and adequate security measures must be taken. Holm can process personal data either by collecting and processing the data for its own part or as part of the provision of the communication platform to corporate customers. Holm can therefore be responsible for personal data, but also a personal data assistant through the communication platform.
     

12. When transferring information to third parties for the purpose of securing legal obligations or safeguarding rights where Holm is responsible for personal data, Holm shall, where applicable, establish a written agreement with each external party that processes personal data on Holm's behalf regarding the basis for processing, period of processing, type of personal data and Holm's obligations and rights as personal data controller.
    
    Holm is a personal data assistant in relation to the corporate customers that Holm provides its communication platform. Through the use of the communication platform, customers and the customers' invited users will, where applicable, store personal data on Holm's servers. Material stored by customers' users may contain personal data, which means that Holm, by storing the data, is a personal data assistant in relation to his corporate customers. The corporate customer is responsible for personal data. For each new customer, Holm must therefore enter into a personal data assistant agreement. It is the customer in his capacity as personal data controller who determines access, purpose and storage times for the personal data. When Holm is a personal data assistant, the personal data is therefore always processed in accordance with the personal data assistant agreement and in accordance with the personal data controller's instructions.
     

13. Where Holm is responsible for personal data, the data subject has the right to contact Holm and request access to the personal data that Holm processes and is also informed about, among other things, the purposes of the processing and who received the personal data, whereby the data subject receives a free copy being treated.
    
    The data subject has the right to have his personal data corrected or, under certain conditions, restricted or deleted without undue delay. If the data subject considers that Holm processes personal data about him that are incorrect or incomplete, the data subject may demand that these be corrected or supplemented. The data subject also has the right to have his data deleted, among other things in cases where they are no longer necessary or if the processing is based on consent and this has been revoked. If the data subject requests that the data be corrected, deleted or restricted in processing, Holm will also try to inform each recipient of the personal data of the data subject's request.
    
    The data subject has the right to object at any time to the processing of his personal data if the legal basis for the processing consists of a public interest or balancing of interests in accordance with the Data Protection Ordinance. The data subject also has the right to object to the processing of his personal data at any time if these are processed for direct marketing.
    
    The data subject has the right to obtain the personal data that he has provided to Holm and has the right to transfer this data to another personal data controller. However, this applies provided that it is technically possible and the legal basis for the processing consists of consent or that the processing has been necessary for the fulfillment of an agreement.
    
    If the processing of personal data is based on the data subject's consent, he or she has the right to revoke this consent at any time. Such revocation does not affect the legality of the processing of personal data before the consent was revoked.
    
    The data subject has the right not to be subject to decisions based solely on automated processing, including profiling, and which may have legal consequences or the equivalent for the data subject. However, this does not apply if such processing is necessary for the conclusion or performance of an agreement with the data subject, if such processing is permitted under applicable law or if the legal basis is the data subject's consent.
    
    The registered person has the right to lodge a complaint with the Privacy Protection Authority.
     

14. For questions about the Policy or for other requests regarding personal data, please contact the personal data representative Michaela Holm, +46702 43 00 94, michaela@holmandco.se.
     

15. Holm may change and update the Policy. In the event of important changes in the Policy or if existing information is to be processed in a manner other than that specified in the Policy, Holm will inform about this in an appropriate manner.