Privacy Policy – Cuviva

Data privacy is of great importance to Cuviva, and we aim to be open and transparent about how your personal data is processed. Therefore, we have created a policy explaining how your personal data will be processed and protected.

What personal data is collected and for what purposes?
We collect personal data, for instance, when you use our products and related services, subscribe to our newsletter, apply for a job, or contact us for other reasons. Cuviva collects personal data necessary for managing customer and supplier relationships and providing services in accordance with mutual agreements. We collect data such as your name, address, email address, and phone number, but personal data may also include other information such as your IP address. This data can be collected directly from you or other sources. We use personal data for the following purposes:

To comply with legal and regulatory requirements
For internal administrative purposes related to the company
To communicate with customers, suppliers, and other stakeholders
To send our newsletter
For internal web statistics analysis

If you apply for a job at Cuviva, we collect personal data such as your name, personal identification number, email address, phone number, address, work experience, other personal information provided in your CV or cover letter, and references (from other sources).

Where is your data stored?
The data we collect from you is stored within the European Economic Area (EEA) and in the United States. Any transfer of your personal data is carried out in compliance with applicable laws.
For transfers outside the EEA, Cuviva will use standard contractual clauses and shields as safeguards for countries without adequacy decisions from the European Commission.

How long is the data stored?
The data we collect about you is retained as long as our business relationship with you exists. No information about you is stored longer than necessary or in a manner that violates the law.

Who can access your data?
When we share your personal data, we ensure that the recipient processes it in accordance with this privacy statement, for example, by entering into data transfer or processing agreements with the recipients. These agreements ensure that your data is processed in compliance with GDPR and this privacy policy.
We want to emphasize that we do not sell your personal data to third parties.

What is the legal basis for processing?
For marketing purposes, our legitimate interest lies in promoting our products and maintaining a valuable relationship with our customers. For job applications, our legitimate interest is in conducting a recruitment process.

Third parties in business-related transactions
If we, or a significant part of our business, were to be sold or merged with a third party, all personal data we have collected about you may be shared with our advisor, potential buyer, and their advisor, and subsequently transferred to the new owner of the business. This applies regardless of how we collected your personal data through the aforementioned services. In such cases, we have a legitimate interest in providing potential buyers with sufficient information about our business to execute the transaction. If sharing your personal data is necessary to fulfill that interest, and that interest outweighs your right to prevent processing, sharing may occur based on the legal basis of legitimate interest.

What are your rights?
Under applicable laws, you have certain rights regarding the processing of your personal data. Below, we describe each right and what it means concerning the personal data we process.

If you wish to exercise any of these rights, learn more, or have questions, feel free to contact us at dpo@cuviva.com or use the contact information provided at the end of this privacy policy.

Right to Information
You have the right to be informed about how we process your personal data. In this privacy policy, we generally describe what personal data we process in different contexts. If you want to know more about whether we process your personal data and to what extent, you can contact us as described above and request information about the personal data we process.

Right to Access Your Personal Data (Register Extract)
We can provide you with a copy, known as a register extract, of the personal data we process. The extract includes information such as the categories of personal data processed, the purposes of processing, how long the data is stored, with whom the data is shared, and where the data originates.

Right to Rectification
We strive to always have accurate personal data about you and update it as necessary. If you find that we process inaccurate data about you, you have the right to contact us to correct it. You may also request us to complete incomplete data by providing additional information if relevant to the purposes of processing.

Right to Erasure (Right to be Forgotten)
You have the right to request the erasure of your personal data. However, this right is not absolute. Certain conditions must be met for your data to be erased. For instance, you may have the right to erasure if the data is no longer necessary for the purposes for which it was collected, if you withdraw your consent, or if you object to the use of your data for direct marketing.

The right to erasure is also limited when exceptions apply to the data in question. For example, we have the right to retain data if it is necessary for establishing, exercising, or defending legal claims.

Right to Object
You always have the right to object to our processing if the legal basis for the processing is that it is necessary for purposes related to our legitimate interest (the legal basis is specified in the various processing operations above in Section 1).

If you object, we will no longer have the right to process your data unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights, and freedoms, or if it is necessary for the establishment, exercise, or defense of legal claims. If we determine that such legitimate grounds exist, or if the data is required for legal claims, we will inform you of this, including the reasons for our assessment.

You can also object to the processing of your personal data for marketing purposes (including profiling if this is part of the process). If you do so, we will cease processing for these purposes.

Right to Restriction
You can request that we restrict the processing of your personal data, for instance, if you believe the information we hold about you is incorrect or if you think the processing is unlawful. Such a request can also be made while we are investigating whether our legitimate interests outweigh your privacy interests when you object to the processing (see more under the Right to Object above).

Right to Data Portability
You have the right to receive your personal data, which you have provided to us (if the legal basis for our processing is your consent or the performance of a contract), in a structured, commonly used, and machine-readable format. This applies only to processing carried out by automated means (i.e., not on paper). If technically feasible and desired by you, we can also transfer such personal data to another data controller.

Right to Withdraw Consent
You may withdraw all or part of the consent you have given at any time, effective from the moment of withdrawal (i.e., any processing of personal data carried out before withdrawal will not be affected). For direct marketing via email, you can withdraw consent by using the link included in every email.

Right to File a Complaint with the Relevant Supervisory Authority
You can lodge a complaint with the Swedish Authority for Privacy Protection (or another supervisory authority, such as the Information Commissioner’s Office for matters in the UK) if you believe our processing of your personal data does not comply with applicable law.

Requirements for Exercising Your Rights
To protect your privacy, we may require you to verify your identity when you contact us to exercise your rights.

We aim to process your request to exercise your rights promptly. Your request will typically be responded to within one month from the date we receive it. In the case of particularly complex requests or a high volume of requests, the response time may be extended by up to two months. If an extension is necessary, you will be informed.

Recruitment Supplement
Data Processing and Platform Use
We use data processors, such as recruitment platforms, to assist in processing your personal data, including your CV and application materials, for recruitment purposes.

Legal Basis for Processing
We process your data based on consent, contractual necessity, legal obligations, or legitimate interests, as applicable.

Data Sharing and Access by Third Parties
We may share your data with service providers, such as recruitment platforms, and in cases of business-related transactions or legal requirements.

Security and Data Retention
Your data will be retained for as long as necessary for the purpose or as legally required and is protected by security measures in line with industry standards.

International Data Transfers
Data may be transferred outside the EEA with appropriate safeguards, such as standard contractual clauses.

Automated Decision-Making
We do not use automated decision-making processes that have significant consequences for you.

Children’s Data
We do not knowingly collect data from individuals under the age of 16. Please contact us if you believe we have done so.

Changes and Updates to This Privacy Policy
We may make changes to this privacy policy. All such changes will be available here on the website in the latest version of the privacy policy. We recommend reviewing the privacy policy regularly and each time you use our services.

How to Contact Us
If you have questions or comments about the processing of your personal data, you can contact our Data Protection Officer via the email address provided below.