PRIVACY POLICY

We at Upsales Nordic AB (”Upsales”, “we”, ”our” och ”us”) care about your privacy and want you to feel safe when we process your personal data.

In this privacy policy we want to inform you who interact with us in different situations, e.g. as a representative of our current or potential customer, supplier or partner. This privacy policy also applies to you who visit our website or communicate with us on social media.

With this text we provide information on how and why we process your personal data. We also describe your rights, the legal basis for processing and the storage period for which we keep your personal data.

In short: Why do we do process your personal data?

If you interact with us without having a business relationship with us, represent a business lead or visit our social media, we process your personal data to communicate with you and enable your company to try Upsales
If you visit our website, we process your personal data to analyse how you use the website and show you relevant marketing on social media and other websites you visit
If you represent our customer, your personal data will be processed to enter into an agreement with your company and administrate our relationship, send newsletters and provide customer service
If you represent our supplier or partner, we process your personal data to enter into an agreement with your company and administrate our relationship
If you subscribe to our newsletters, your personal data will be processed to send newsletters to you and analyse how our newsletters are used to improve and develop them
If you participate in one of our events or webinars, we process your personal data to enable you to take part in the event or webinar and make use of footage from such event or webinar
If you have a complaint or claim, we process your personal data to handle the complaint or claim

Depending on the relationship we have with you, we process your personal data for all or only some of the above stated purposes. A detailed description of our processing of your personal data is provided in the sections below. By clicking on the links above you can read more about what specifically applies to you.

When we refer to “your company” in this privacy policy, we refer to your employer or the organisation that you represent. We will only process data about you in your business role, which for example means that we will only send marketing to your company and not to you in your capacity as a private individual.

Below you can read more about:
- Upsales is responsible for processing of your personal data
- From where do we collect your personal data?
- The personal data you need to provide to us
- Detailed description on how we process your personal data
- Who can gain access to your personal data and why?
- Where are your personal data processed?
- What are your rights when we process your personal data?
- Balancing of interests assessments when processing personal data based on the legal basis “legitimate interests”

Upsales is responsible for processing of your personal data

Upsales Nordic AB (Swedish registration number 556641-2507), is responsible for the processing of your personal data.

Should you have any questions regarding our processing of your personal data, or if you wish to exercise any of your rights under data protection legislation, please contact us via our e-mail address info@upsales.com, or give us a call at 08-505 806 00. Our postal address is Upsales Nordic AB, Sveavägen 21, 111 34 Stockholm, Sweden.

From where do we collect your personal data?

We collect your personal data directly from you, for example when you contact us. We may also collect your personal data from your company, if they state you as their representative. We will also collect your personal data from other sources in the following situations:

If you represent a potential customer, supplier or partner (i.e. a business lead), we may collect your personal data from the internet or a third-party service.
If you use our website, we will use Google services and our own Upsales Marketing Automation tool to collect information on your browsing of our website to analyse your use of our website.

The personal data you need to provide to us
In general, you are not required to provide your personal data to us. You find a description of when you are needed to provide your personal data in the charts below when the so called legal basis is stated to be ”Legal obligation”. If you don’t provide such personal data to us, we at Upsales will not be able to administrate our relationship with your company or fulfil the agreements with your company

Detailed description on how we process your personal data
The below charts describe in detail why we process your personal data, what personal data we process, when you need to provide the personal data to us and the legal basis for our processing. The legal basis is the basis for processing your personal data according to the GDPR. You will also find information about how long we process your personal data.

Don’t hesitate to contact us if you have any questions regarding our processing of your personal data. Our contact details can be found in the beginning of this privacy policy.

If you interact with us without having a business relationship with us, represent a business lead or visit our social media
If you are in contact with us without having a business relationship with us, e.g. by sending us an e-mail or a message at our social media account, we will process your personal data as we describe in the charts below. We process the personal data which you provide to us and information from your social media account (if you use such account to communicate).

When contacting us through a social media platform, we suggest you also familiarise yourself with the privacy information of that platform.

To communicate with you

What processing we perform:
Communicate, e.g. via e-mail
Communicate via social media, e.g. if you make a comment on our site or our wall
Give you a call if you have left your phone number on our website
Answer your questions and give you the best service

What personal data we process:
Information you provide to us, e.g. name and contact information
If you visit our social media accounts (e.g. our Instagram) we also process:
Information from your profile on the social media in question (user name and any picture you have chosen for your account)
Other information regarding the matter for which you contact us

Our legal basis for the processing:
Legitimate interest
The personal data will be processed based on our legitimate interest to communicate with you who have contacted us.

Storage period:
We will delete your personal data regularly.
Communication with us via our websites or in e-mails will be stored for a period of three months after the matter for which you have contacted us has been resolved, in order for us to give you the best service.
Your comments and communication with us on social media can be deleted by you at any time. We will remove posts or comments which are in breach of the rules of the platform or in conflict with legislation as soon as possible.
If we find that your company is a business lead after we have had contact with you, we will store your personal data for six months.

To enable your company to try Upsales

What processing we perform:
Enable you to sign up for a free trial of Upsales
To verify that you are not a robot when you sign up by using a service provided by Google
Contact you if we find that your company is a business lead

What personal data we process:
Information you provide to us when signing up (name, e-mail, company belonging, password and telephone number)
When you tick the box “I´m not a robot” we will process technical information to verify that you are not a robot

Our legal basis for the processing:
Legitimate interest
The personal data will be processed based on our legitimate interest to facilitate our free trial of Upsales.

Storage period:
We will delete your personal data when the free trial period has ended, i.e. after 14 days. If we find that your company is a business lead, we will store your personal data for six months.

The chart below describes how we process your personal data if you subscribe to our newsletters. We gather your personal data directly from you and provide some personal data ourselves by analysing how you use our newsletters.

To send newsletters

What processing we perform:
Send information about news, marketing, offers and invitations (“newsletters”) to you who have chosen to subscribe to our newsletters

Improve and develop our newsletters by analysing how you open them and what you click on in the newsletters

Do you want to read more about this type of analysis? You find a more detailed description of this in our information about cookies.

What personal data we process:
E-mail address
Information about how you open our newsletters and what you click on
IP-address
E-mail address

Our legal basis for the processing:
Legitimate interest
The personal data will be processed based on our legitimate interest to send the newsletters you have stated that you wish to receive.

Consent
The personal data will be processed based on your consent. You can withdraw such consent at any time.

Storage period:
You can choose to unsubscribe or object to receiving newsletters and marketing at any time. If you object to receiving marketing from us, we keep track of this in our “unsubscribe-list ” to avoid sending you any further marketing material.

If you visit our website

We analyse how our website is used and show you relevant marketing on social media and other websites you visit based on such analysis. This means that your personal data is processed when you visit our website. To protect your privacy, we have taken measures to avoid identifying you when you visit our website. For instance, we only store an encrypted version of your IP address to reduce the risk of being able to identify you.

When you visit our website, we will gather your personal data from your device and from the companies we cooperate with (see below). Such companies will also use previous information they have about you to show you interesting offers.

When you use our website, we will gather personal data by using cookies. How we do this is described in our text about cookies which you find here.

To analyse how our website is used

What processing we perform:
Analyse how you use our website to improve our website and services. To do this we use our own analytic service and the analytic service from Google Analytics.

The analytic service means that we place a random ID on your device to distinguish your device from other visitors and to acknowledge patterns in how our website is used. We will however not know who you are.

The personal data we gather will be used e.g. to optimize functions and to adapt the websites to suit our visitors.

What personal data we process:
An encrypted version of your IP address which we at Upsales can’t connect to you as an individual
Information about your device/browser (which area in the country you use our website from and which screen resolution you have)
Information about your activities on the website
Other information Google has about you, e.g. information about from which site you found us

Our legal basis for the processing:
Consent
The personal data will be processed based on your consent. You can withdraw such consent at any time.

You can prevent Google Analytics from using your personal data by downloading and installing this browser add on.

Storage period:
We will store your personal data for a period of six months after your visit on our website.

Google will continue to store your personal data for their own purposes and Google will inform you separately about such storing.

To show you relevant marketing from us

What processing we perform:
Market our services by showing you offers we believe you or your company are interested in

We show you such marketing on Google (including YouTube), Facebook (including Instagram), Twitter and/or LinkedIn. You see marketing based on information that these companies have about you beforehand (so called profiling*)

Share information about you with Google (including YouTube), Facebook (including Instagram), Twitter and/or LinkedIn so that these marketing services will have information about which type of visitors that are interested in us

What personal data we process:
An encrypted version of your IP address which we at Upsales can’t connect to you as an individual
Thereafter you will see search results and ads based on:
An analysis of how you use our website
Information that the marketing services we use have about you from before, e.g. information about from which site you found us

Our legal basis for the processing:
Consent
The personal data will be processed based on your consent. You can withdraw such consent at any time.

Here you can make choices about the marketing you see from Google and here on Facebook, under the heading “Ad settings”, you can choose which marketing you want to see on Facebook.

Storage period:
You will see marketing from us on other websites and on social media for a period of six months after your visit to our website.

Google (including YouTube), Facebook (including Instagram), Twitter and/or LinkedIn will continue to process your personal data and will be independently responsible. Information on how long they store your personal data can be found in their respective privacy information.

* Profiling: We use so called profiling to be able to show you offers that are relevant to you and to provide you with customized marketing. We use profiling because without it, you would instead see offers and information which you are probably not interested in. You have the right to object to profiling as described below under the section explaining your rights.

If you represent our customer

To enter into an agreement with your company and administrate our relationship

What processing we perform:
Negotiate and enter into an agreement with your company
Administrate our relationship with your company (e.g. communicate with our customer)

What personal data we process:
Information you provide to us, e.g. name, organisational belonging, position in your company, telephone number and e-mail address

Our legal basis for the processing:
Legitimate interest
The personal data will be processed based on our legitimate interest to negotiate and enter into an agreement with your company and to administrate the agreement.

Storage period: Your personal data will be removed if we conclude that we will not enter into an agreement with your company.

If your company becomes our customer, we will store your personal data for this purpose as long as your company is our customer, however for a shorter period if we receive information that you no longer represent the company.

To send newsletters

What processing we perform:
Send information about news, marketing, offers and invitations (“newsletters”)

Improve and develop our newsletters by analysing how you open them and what you click on in the newsletters

Do you want to read more about this type of analysis? You find a more detailed description of this in our information about cookies.

What personal data we process
E-mail address
Information about how you open our newsletters and what you click on
IP-address
E-mail address

Our legal basis for the processing:
Legitimate interest
The personal data will be processed based on our legitimate interest to send newsletters to our customer.

Consent
The personal data will be processed based on your consent. You can withdraw such consent at any time.

Storage period:
We will process your personal data as long as your company is our customer, however for a shorter period if we receive information that you no longer represent the company.

You can choose to unsubscribe or object to receiving newsletters and marketing at any time. If you object to receiving marketing from us, we keep track of this in our “unsubscribe-list” to avoid sending you any further marketing material.

To provide customer service and enable our login service

What processing we perform:
Provide you with relevant information and communicate with you as a representative of our customer
Administrate support matters
Enable you as a representative of our customer to login to Upsales

What personal data we process:
Name, organisational belonging, position in your company, telephone number, e-mail address
Information about the support matter
E-mail address and password for our login service

Our legal basis for the processing:
Legitimate interest
The personal data will be processed based on our legitimate interest to provide customer service.

Storage period:
We will process your personal data related to support matters as long as your company is our customer, however for a shorter period if we receive information that you no longer represent our customer. Your personal data will only be processed for this purpose if it is necessary for us to be able to provide continued service and view previous support matters in relation to our customer.

We will process your account information to our login service for as long as your company is our customer, however for a shorter period if we receive information that you no longer represent our customer.

If you represent our supplier or partner

To enter into an agreement with your company and administrate our relationship

What processing we perform:
Negotiate and enter into an agreement with your company
Administrate our relationship with your company (e.g. communicate with our supplier or partner)

What personal data we process:
Name, organisational belonging, position in your company, telephone number and e-mail address

Our legal basis for the processing:
Legitimate interest
The personal data will be processed based on our legitimate interest to negotiate and enter into an agreement with your company and to administrate the agreement.

Storage period:
Your personal data will be removed if we conclude that we will not enter into an agreement with your company.

If your company becomes our supplier or partner, we will store your personal data for this purpose as long as the company you represent is our supplier or partner, however for a shorter period if we receive information that you no longer represent the company.

If you participate in any of our events or webinars

To arrange events and webinars

What processing we perform:
Administrate your registration to one of our events or webinars (“event”)
To verify that you are not a robot when you register by using a service provided by Google
Communicate with you as a representative of our current or potential customer, supplier or partner before and during the event
Send requests to participate in evaluations after the event and administrate the answers you provide in the evaluation and compile statistics of the results of our evaluations

What personal data we process:
Name, organisational belonging, position in your company, telephone number and e-mail address
When you tick the box “I´m not a robot” we will process technical information to verify that you are not a robot
Dietary preferences (if applicable)
Information you provide in an evaluation (if applicable)

Our legal basis for the processing:
Legitimate interest
The personal data will be processed based on our legitimate interest to be able to arrange events for you as a representative of a current or potential customer, supplier or partner to Upsales.

Consent
If we process sensitive personal data such as information about your allergies, we will obtain your consent.

Some events and webinars are arranged by us in collaboration with a partner who will also process your personal data. You will be given information on who that partner is and where you can find their privacy information when you register for such an event or webinar.

Storage period:
Your personal data will be stored until the event is completed. However, a participant list that you are part of will be saved in order for us to be able to follow up your participation in the event and invite you to similar events. We will remove your personal data if you ask us to.

In cases where we have sent an evaluation to you after an event, to which you responded, we will store the result of the evaluation for six months after you have answered it. We will stop sending evaluations if you object to receiving them.

To take photos/videos during an event and publish them on our website and social media

What processing we perform:
Take photos of you during an event
Publish your photo on our intranet, our website or on our social media pages to be able to market our events

Your personal data will only be processed for this purpose after you have been given information about our publication of photos and if you have not objected to our processing.

What personal data we process:
Your image, either in photos or video material

Our legal basis for the processing:
Legitimate interest
The personal data will be processed based on our legitimate interest to be able to document our events and make us of footage from the event for marketing purposes.

Consent
In cases where we want to process footage where you are clearly depicted, we will obtain your consent.

Storage period:
If we have published a photo or video of you from our event on our intranet or website, the photo or video will stay published for two years, unless you ask us to remove it before then.

Photos or videos of you that have been published on our social media pages will be published until you ask us to remove them.

If you or your company have any questions or queries

We always strive to keep a good relationship to your company and answer all questions you or your company may have. If you or your company have any questions, would want to make a complaint regarding one of our services or if we would have a claim against your company, we will process your personal data as described below. We will collect your personal data from you or your company or provide the information ourselves.

Note that the ongoing matter may mean that we cannot delete all your personal data after your request.

To handle any questions, complaints or claims

What processing we perform:
Handle any questions, complaints or claims
To defend ourselves against claims and complaints
To initiate any claims

What personal data we process:
Name, organisational belonging, position at your company, telephone number, e-mail address and information concerning your company’s complaint or claim

Our legal basis for the processing:
Legitimate interest
The personal data is processed based on our legitimate interest to handle a question, complaint and/or legal dispute in which you are the representative of a customer, supplier or partner

Storage period:
We will store your personal data from the time the matter was initiated and for the duration of the potential dispute.

To comply with our bookkeeping and accounting obligations

To handle any questions, complaints or claims

What processing we perform:
Store information in bookkeeping and accounting

What personal data we process:
Name, history regarding payments made and other information that constitutes accounting records

Our legal basis for the processing
Legal obligation
The processing is necessary to comply with legal obligations to which we are subject, i.e. bookkeeping and accounting legislation.

Storage period:
We will store any document constituting bookkeeping material and personal data included therein for seven to eight years according to bookkeeping and accounting legislation. The regulation means that we store bookkeeping material until and including the seventh year after the end of the calendar year for the fiscal year to which the personal data relates.

If you object to receiving marketing from us

We will store information about you who have chosen to object to receiving marketing from us – see the below chart for information about this. We have received the personal data we store from you.

To comply with marketing legislation

What processing we perform:
If you have stated that you do not wish to receive marketing from us, we will store such information in an “unsubscribe-list” to make sure we do not send any marketing to you

What personal data we process:
Name
E-mail address

Our legal basis for the processing:
Legal obligation
The processing is necessary to comply with legal obligations which we are subject to, i.e. marketing law which require us to not send marketing material to individuals who have objected to receiving such marketing.
We cannot make sure you will not receive marketing from us without processing your personal data for this purpose and you are therefore required to provide your personal data to us.

Storage period:
You will be listed in our “unsubscribe-list” until further notice.

Who can gain access to your personal data and why?

Your personal data is initially collected and processed by us and we do not sell your personal data. This means that your personal data will be handled by our employees, but only personnel who need such access to conduct their work.

To conduct our business, we need to work with suppliers and partners which therefore will process your personal data. We are responsible for any sharing of your personal data to such suppliers or partners and to make sure your personal data is safe when shared with third parties as set out below.

We will share your personal data with the following recipients:

We will share your personal data with our IT partners who will process these on our behalf and on our instructions to ensure good and secure IT operations. We only share your personal data with our IT partners if it is necessary for them to fulfil their obligations towards us according to the contract that we have with them.
We use third parties which on our behalf and on our instructions help us administrate our marketing and therefore will have access to your personal data.
If you interact with us on or visit our social media accounts, the social media platform that you use will process personal data about you as a user.
In order to store information that we according to bookkeeping and accounting law are required to store, we may use a company that help us archive such information. The information contains personal data but will only be processed on our behalf and on our instructions.
When you use our website and consent to us doing so, we will also share your personal data with:
- Google, which provides the service to analyse the website; and
- The companies which provide the marketing services we use (Google (including YouTube), Facebook (including Instagram), Twitter and/or LinkedIn).

If you participate in any of our events, we will share your personal data with:
- the photographer that takes your picture will gain access to your personal data and will process your personal data on our behalf and on our instructions;
- social media platforms if we publish a picture or video in which you appear. These social media platforms are either processing your personal data on our instructions or as controllers in their own right for their processing of your personal data. What role they have in a particular case depends on the specific platform and activity; and
- our partner if the event is arranged by us in collaboration with the partner.

If you have any questions regarding how we share your personal data or want to know more about who we share your personal data with, please feel free to contact us.

Where are your personal data processed?

We mainly process your personal data within the EU/EEA. In some instances, we will transfer your personal data outside of the EU/EEA to our IT-suppliers that process personal data as our data processors and according to our instructions. Such transfer only takes place in accordance with applicable data protection legislation meaning that we will transfer your personal data outside the EU/EEA when we can ensure an appropriate level of protection of your personal data. Our IT-suppliers rely on Standard Contractual Clauses for the transfer of personal data outside of the EU/EEA and have implemented additional safeguards to protect your personal data. The Standard Contractual Clauses have been issued by the European Commission and are one effort to provide a safe transfer of your personal data.

If you use our website and have consented to us using Google, Facebook and LinkedIn your personal data may be considered transferred outside of the EU/EEA. These parties may transfer your personal data to the United States since they are located there. We have anonymised your personal data as far as possible to avoid your personal data being transferred outside of the EU/EEA. Google, Facebook and LinkedIn rely on Standard Contractual Clauses for the transfer of personal data outside of the EU/EEA.

If you want to know more about where your personal data is processed and how, please feel free to contact us. Our contact information can be found at the beginning of this privacy policy.

What are your rights when we process your personal data?

You have certain rights that you can exercise to affect how we process your personal data. You can read about what those rights are below.

If you want to know more about your rights or if you want to exercise any of your rights, please contact us and we will help you. Our contact information can be found at the beginning of this privacy policy.

Right to lodge a complaint with a supervisory authority

You always have the right to lodge a complaint with a supervisory authority. You may do this in the EU/EEA member state where you live, work or where an infringement of applicable data protection laws is alleged to have occurred. The supervisory authority in Sweden is the Swedish Data Protection Authority (Datainspektionen / Integritetsskyddsmyndigheten).

Right to withdraw your consent and object to processing

You have a right to withdraw any consent you have given us, partly or completely.

You always have a right to object to our processing of your personal data when the processing is performed for marketing and profiling purposes, such as sending newsletters and customising marketing. You can read more about profiling in the charts above.

You also have a right to object to our processing of your personal data when the processing is based on the legal basis “legitimate interest”. In some instances, we may continue to process your personal data based on our legitimate interest even if you have objected to our processing (e.g. when we need to store your personal data). This can be the case if we can show compelling legitimate reasons for the processing that outweigh your interests, rights and freedoms in us not processing your personal data or if the purpose of the processing is to establish, exercise or defend against a legal claim.

Right to information and access

You have the right to obtain confirmation as to whether we are processing personal data about you or not. If we do process your personal data, you also have a right to obtain a copy of the personal data processed by us as well as information about how we process your personal data.

Right to rectification

You have a right to correct any inaccurate personal data concerning you that we may be processing and to ask us to have incomplete personal data completed.

Right to erasure (“the right to be forgotten”) and restriction of processing

Under certain circumstances, you have a right to request that we delete your personal data. This is the case for example when the personal data is no longer necessary for the purposes for which they were collected or otherwise processed or if you have withdrawn your consent the processing was based on and there is no other legal basis for processing.

Under certain circumstances, you also have a right to request that we restrict our processing of your personal data. That is the case for example when the accuracy of the personal data is contested by you, or the processing is unlawful, and you do not want us to delete your personal data but instead you request that we restrict our use of them.

Right to data portability

Under certain circumstances, you have a right to receive your personal data from us in a structured, commonly used and machine-readable format and, where technically feasible, have your personal data transferred to another company (“data portability”). This applies to personal data that you have provided to us in a structured, commonly used and machine-readable format, if our processing of your personal data is carried out by automated means and the legal basis for our processing is based on the performance of a contract or consent.

Balancing of interests assessments when processing personal data based on the legal basis “legitimate interests”

As we state above, for some purposes, we process your personal data based on our “legitimate interest”. By carrying out a balancing of interests assessment concerning our processing of your personal data, we have concluded that our legitimate interest for the processing outweighs your interests or rights which require the protection of your personal data.

If you want more information in relation to our balancing of interests assessments, please do not hesitate to contact us. Our contact information can be found at the beginning of this privacy policy.

This privacy policy was adopted by Upsales Nordic AB on [2021-06-02].

Thanks for signing up!