How we are processing personal data of our supplier contacts
9. Privacy Policy for Supplier Contacts
We process personal data about you as a contact person of one of our tenderers and/or suppliers (“Supplier Contacts”), due to the circumstance that you or your employer or principal has or has had discussions or negotiations regarding such business relations.
What personal data do we process?
We process your first and last name, email address, telephone number, address, CV, title/professional position and company affiliation and other personal data that is relevant for tenders that is transferred to us from you or your employer (“Contact Details”).
We may also process your personal identity number when we enter into a contract directly with you as a private person.
We also process information about your nationality.
What are the purposes of our processing of your personal data and what legal basis do we base such processing on?
We process your personal data as a Supplier Contact for the following purposes:
- to analyze and manage tenders that we receive and to communicate with such tenders as well as to award contract to the winning tenderer;
- to manage, administer and fulfill orders;
- to communicate in relation to past, current and upcoming orders and other necessary communication in relation to the tender or the awarded contract;
- administration, management, implementation and follow-up etc. of the current business relationship and its deliveries as well as associated communication by telephone, email address or other communication channels;
- invoicing and payment procedure, if applicable.
This processing is based upon that the processing is necessary for purposes of our legitimate interest to analyze and manage received tenders as well as to fulfill our contractual rights and obligations towards the contracting employer or principal.
When we enter into a contract directly with you as a Supplier Contact, e.g if you have an individual company, we also process your personal identity number as a part of the agreement for the purpose of ensuring your identity so that we know and can document who we enter into an agreement with. This processing is based upon that the processing is necessary for the purposes of our legitimate interest to ensure your identity as being a contracting party to us.
We process your personal data found in verifications (in relation to invoices and payments) and the like for the purpose of fulfilling the requirements in the Swedish Accounting Act (1999:1078). The legal basis for this processing is that the processing is necessary for the compliance with a legal obligation which we are subject to.
We process information about your nationality for the purpose of complying with export control regulations to which we are subject.
From where do we collect your personal data?
The personal data is collected directly from you or your employer. We may also collect personal data from third parties acting as references to your organization as a tenderer or supplier.
Who do we share your personal data with?
We share your personal data with third parties that process personal data on our behalf, so called processors, e.g., suppliers of support and maintenance of IT- and cloud services, etc.
We will also transfer personal data to third parties acting as independent controllers or joint controllers with Lindholmen Science Park, if such transfer is required by applicable law, or if we have another legal ground for such transfers.
For how long do we process your personal data?
Personal data processed for contractual and business relationship purposes will be processed as long as we may have any contractual rights and obligations towards you as Supplier Contact or your employer or principal. If the employment or contract with you is terminated with the supplier or in relation to us, we will cease to process your personal data as soon as we have received information of such termination from the supplier.
Our processing of your personal identity number for the purpose of entering into a contract directly with you as a private person will be processed as long as the agreement is effective and as long as it is possible to put forward claims as a result of the agreement.
When it comes to processing of your personal data related to invoicing or payment we will store the personal data necessary for the fulfillment of requirements under the Swedish Accounting Act (1999:1078) for a period of seven (7) years.
Our processing of your nationality based on our legitimate interest for the purpose of complying with export control regulations, to which we are subject, will be processed until we have fulfilled our obligations in accordance with relevant regulation.
Transfer of personal data to countries outside the EU/EEA
We strive to only process personal data within the EU/EEA. When we transfer your personal data to third parties acting as our processors, e.g., supplier of the supply-, support and maintenance of IT- and cloud services, these processors may transfer data outside the EU/EEA on our behalf. In cases where our processors are transferring or processing personal data outside the EU/EEA, such processing is based either on a decision from the European Commission establishing that the country in question ensures an adequate level of protection or appropriate safeguards that ensure that your rights are protected such as standard contractual clauses adopted by the European Commission and supplementary security measures to such standard contractual clauses when necessary.
..........
