WOODEYE AB’s PRIVACY POLICY

WoodEye AB respects the privacy of individuals and does not collect or process any personal data unless it has been provided to WoodEye by the individual concerned or has been obtained from a third party, which has rightful access to and the right to transfer such personal data to WoodEye AB (and in which case WoodEye AB will inform the concerned individuals of its use and processing of such data).

WoodEye AB continuously strives to comply with all applicable data and integrity protection laws that control the processing of personal data. This Privacy Policy has been adopted to harmonize WoodEye AB’s processing of personal data with the requirements of the General Data Protection Regulation (“GDPR”) 1 and other applicable data protection legislation.

(“GDPR”)1 – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data

This privacy policy therefore describes how and why WoodEye AB (“WoodEye”, “we” or “us”) processes your personal data when you access or use any part of the website www.woodeye.com (the “Website”), purchase products from WoodEye or communicate or interact with us in any other way; regardless of whether such interaction occurs as a result from your own interest or on behalf of your employer or other entity which you represent. To a certain extent, the Website is joint between different entities in the WoodEye company group (see further under “the WoodEye Company Group”).

WoodEye AB does not sell or share personal data with third parties, unless (i) your prior consent has been obtained or (ii) such transfer is necessary for the purposes set out in this Privacy Policy.

THE WOODEYE COMPANY GROUP

WoodEye is the parent company of the WoodEye Company Group and is also the primarily responsible entity for the WoodEye company group operation. WoodEye is the company, which has the direct controlling influence of the other subsidiaries in the WoodEye Company Group and also controls, manages and defines certain intra company group responsibilities.

WoodEye’s subsidiaries may therefore have a legitimate interest to transfer certain personal data to WoodEye for its internal administrative, marketing, statistical and other purposes for the entire WoodEye Company Group.

To the extent such transfer is made, WoodEye and the relevant subsidiary therefore are joint controllers of such personal data and have entered into a corresponding understanding in order to define their roles as joint controllers of such personal data. Your primary contact in these matters is and will remain WoodEye.

WoodEye primarily trades and interacts with other companies and thus is active in the “Business to Business” segment.

However, in connection with such interaction, WoodEye both needs to receive and process personal data from and relating to employees and other individuals employed by and otherwise acting in the name of or for the benefit of its customers, agents, partners and other third parties – both received by WoodEye and company group companies.

PURPOSE OF THIS PRIVACY POLICY

This privacy policy is meant to help you understand what personal data we collect, why we collect it and what we do with it. You will also find information about how you can affect the processing of your personal data and what rights you have.

WHAT IS PERSONAL DATA?

Personal data means any information relating to you that, directly or indirectly, may be used to identify you, for example your name, phone number and your e-mail address, but also information such as your IP-number, pictures of you and your user behavior when using the Website, may be personal data.

WHO IS RESPONSIBLE FOR PROCESSING OF YOUR PERSONAL DATA?

When your personal data is being processed by us for our purposes, in the way set out in this Privacy Policy, WoodEye, Swedish corporate reg. no 556131-2611, is the data controller regarding such processing, subject to what is set out above regarding intra company group processing of WoodEye.

If you have any questions about our processing of your personal data or your rights connected hereto, you can always contact WoodEye.

Please see our contact details under “Do you have any questions?”.

FROM WHOM DO WE RECEIVE PERSONAL DATA ABOUT YOU?

Most of the personal data that we process about you is information that you have chosen to provide us with regarding yourself in different situations; normally in your capacity as an employee or consultant of one of our customers, partners or as a candidate for a job opportunity. For example when sending us e-mails, in connection with quotations and orders for WoodEye’s products, when you register for an event or market activity hosted by us and/or when you sign up for our newsletter, as well as when you contact us in any other way (for example contacting our customer service or through social media channels, if and to the extent applicable).

We also collect personal data when you, or the entity that you represent, purchase or sell products and/or services from or to us, visit the Website or interact with us in any other way. Personal data we collect from you normally only relates to your name, contact details (address, phone number and e-mail address), possibly also your use of the Website, information about your geographical location and interaction data. Some of the information we collect is collected through our use of cookies.

When you sign up for participation at an WoodEye event (exhibits, trade fairs and similar), a survey, or other activity that we arrange together with our business partners we receive the information that you have chosen to provide us or our partner with at such event, survey or activity.

WHAT DO WE DO WITH YOUR PERSONAL DATA AND WHY DO WE DO IT?

We process your personal data for different purposes. Below you can read more about why and how we process your personal data, what legal basis we have for the processing and more.

When you visit or our Website and make purchases and/or sales of products from or to WoodEye

To enable WoodEye to complete any purchase of a product that has been made by the entity that you represent and fulfil our obligations, we need to process certain personal data about you in addition to certain information regarding your employer. If the data is not provided to us, we may be unable to carry out such purchases or they may be subject to unnecessary delays. Accordingly, if the entity that you represent, sells products or services to WoodEye, we normally record the name, contact details and possibly also other data exchanged between us during discussions and interaction, for the purpose to make business decisions and to enable us to execute WoodEye’s orders for such products and/or services.

Purpose: To administer and complete purchases of products and services from WoodEye (including follow-up and complimentary orders of previously purchased products and services) and to administer WoodEye’s purchases of products and services for its own account

Processing made:

• Confirmation of your identity and verification of your contact information

• Administration of delivery of purchased products (including potential notices or contacts to contact persons regarding possible delays and other particulars relating to delivery)

• Administration of possible cancellations, complaints and claims for warranties

Personal data processed:

• Identity and contact information – name, postal address, e-mail address, phone number etc.

• Order information (for example what product and /or services that has been ordered with you as a reference person)

• IP-address

Legal basis: The processing is necessary to fulfil a contract or in order to take steps at your request prior to entering into a contract with your employer or other entity that you represent. If you do not provide us information of your identity and contact details (name, e-mail address, phone number) we may not be able to complete the relevant sale or purchase or may only be able to do that with delays.

To administer possible cancellations, complaints and claims for warranties is necessary for us in order to comply with applicable legislation. WoodEye also has a legitimate interest of defending itself in connection with a potential claim in relation to the purchase.

When you communicate with us Purpose: To provide you and your employer with support and customer service and to communicate with you in relation to such and similar matters

Processing made:

• Confirmation of your identity and contact information

• Communication and correspondence with you by e-mail, telephone or our digital channels

• Reply to your comments and questions

• Internal administration of your support matter or comments or questions to our customer service

Personal data processed:

• Contact information – name and e-mail address etc

• Information that you provide us for example in such communication, such as information on products or the questions you ask about our products and services

• If you interact with us via social media channels (Facebook, Instagram, Twitter, YouTube), if applicable: your profile name and photo

Legal basis: The processing is necessary for the purposes of our legitimate interest of helping you with your query, product support matter or reply to your comments and questions and in order to meet your request for communication with us.

When we send you newsletters, offers or other marketing material

Purpose: To send you information about WoodEye’s products and services and information about special offers or campaigns

Processing made:

• Administration and sending of newsletters with information about our products and services and information about special offers or campaigns

• Administration and sending of adapted recommendations, offers and communication so that you receive offers and information about products and services that we think you are interested in

Personal data processed:

• E-mail address

For adapted communication, we also process this personal data:

• Information about your product preferences (if you have provided it to us)

• Purchase history with regard to purchases made by your employer with you as a contact person and other user generated data (for example information about the pages you have visited and time spent on our Website, what links you have clicked and what content you have watched )

• Technical data regarding the units you use and its settings (for example IP-address, geographical location, browser settings, platform)

Legal basis: Your consent or our legitimate interest.

If you want information about our products and services and information about offers or campaigns you can sign up for our newsletters and/or personally adapted recommendations, offers and communication. You can withdraw your consent at any time (read more about this under “What rights do you have relating to the processing of your personal data?”) and we will stop sending you newsletters and/or personally adapted recommendations, offers and communication.

If your employer or other entity that you represent recently has purchased one of our products (with you as a contact person), we may send you newsletters and/or personally adapted recommendations, offers and communication based on our legitimate interest of marketing our products and services. You have the right to object to such marketing at any time and we will stop sending you newsletters and/or personally adapted recommendations, offers and communication.

When we process data in order to comply with legal obligations or to prevent fraud/abuse

Purpose: To comply with legal obligations and to prevent fraud

Processing made:

• Necessary processing in order to comply with legal obligations that we are subject to, for example applicable sale of goods legislation, the Swedish Accounting Act, Swedish tax legislation, the Swedish rules on product liability or Swedish rules on statutes of limitation

• Necessary processing to ensure that you are entitled to act for your employer and/or other party that you represent, as to ensure that only valid orders are made, offers accepted and the like

Personal data processed:

• Identity and contact information for purchases where you are named as a contact person

• Information about purchased products by your employer or other entity

• Information about time/date for purchases and possible cancellations, complaints and claims for warranties

• Excerpts from business registers and other publicly available data sources

Legal basis: The processing is necessary in order for us to comply with legal obligations we are subject to. If the information is not processed we are unable to comply with our legal obligations and will therefore be forced to deny your purchase. Further we have a legitimate interest to ensure that we interact with relevant and duly authorized representatives of such companies, with which we interact and conduct business together.

Purpose: To prevent and investigate abuse of our services or potential violation of law

Processing made:

• Necessary processing in order to prevent potential violation of law

• Necessary processing in order to protect our IT environment towards attacks and intrusions

• Necessary processing in order to prevent unpermitted use possible customer/partner log-in areas on the Website.

Personal data processed:

• Customers purchase history connected to contact persons contact details

• Technical data regarding the units you use and its settings (for example IP-adress, geographical location, browser settings, platform)

Legal basis: The processing is necessary for the purpose of our legitimate interest of protecting our IT environment and our products and services from attacks and intrusions and other abuse.

When we process data relating to recruitment matters/procedures

Purpose: To conduct our recruitment procedures of employees and/or consultants of WoodEye

Processing made:

• Necessary processing in order to administer, organize and finalize our continuous ongoing and specific recruitment procedures. Such processing that is necessary to ensure that we in connection such recruitment comply with legal obligations that we are subject to, for example applicable labor law rules, non-discrimination regulations or Swedish rules on statutes of limitation

Personal data processed:

• Identity and contact information where you are named as an applicant for a position at WoodEye or an WoodEye group company

• Such information about you that you have provided with your application or that has been provided by you during interviews and tests

• Information about education and school courses, professional certificates, earlier employments, grades and certificates

• Excerpts from official registers and other publicly available data sources, including social media platforms where you are active as a member

Legal basis: We have a legitimate interest to ensure that we interact with the individual named in the application and to evaluate his/her application and the data submitted together with it. The legitimate interest also relates to such additional data, which may derive from interviews, tests and other results from the recruitment procedure.

The processing is necessary in order for us to comply with legal obligations that WoodEye is subject to. If the information is not processed we are unable to comply with our legal obligations and may, in some instances, be forced to deny your application.

If and when a recruitment procedure has been finalized by you entering into an employment at WoodEye, you will be informed about WoodEye’s processing of personal data in relation to its employees according the relevant internal policies.

DO YOU WANT TO KNOW MORE ABOUT OUR LEGITIMATE INTERST?

As we have described above under “What do we do with your personal data and why do we do it?” we sometimes process your personal data based on our legitimate interest. If you have any questions about this or want to know more about how we have determined our legitimate interest, you are welcome to contact us.

DO WE TRANSFER YOUR PERSONAL DATA TO THIRD PARTIES?

Yes, in some cases we share your personal data with third parties. We conduct reasonable technical, organizational and legal security measures in accordance with applicable data protection regulation in order to ensure that your personal data is handled in a secure way when the data is transferred or shared with third parties.

WoodEye will however not sell your personal data to any third party without your consent.

If you want more information about the third parties that we share your personal data with, you are always welcome to contact us. Below a description of such third parties (and what type of personal data is subject of such transfers) is listed:

Suppliers of ICT systems and their partners for use, development and support: We use different types of IT systems and services which is necessary in order for us to be able to provide you with the services you request and for us to conduct our business. Your personal data is stored and processed in some of these. We also use certain third party providers for web analytic services . The suppliers are engaged by us as our data processors and only processes the personal data on our behalf and according to our instructions; subject to written data processing agreements (DPA).

Partners who administer payments: We may share your personal data (as a contact person) with a third party payment solution provider that administrates payments for our products and ensures rightful payments. The payment solution provider can also share the data with credit institutions or contractual partners if this aids processing of an order for which you are named as contact person.

Freight companies/Carriers: If your employer has purchased a product that WoodEye shall deliver, we share information about your employer shipping address (possibly with you as named contact person) with a third party carrier in order to send you the product. Marketing partners: In order to market WoodEye’s products to you (as a customer or partner representative or as a customer), for example by sending you newsletters, offers or other information we may share your personal data with the marketing company that provides us with marketing services.

Recruitment partners: If you have contacted us (or our employment partner) in an employment matter, we may share your personal data in such matter with the recruitment partner that provides us with such services and we may also, in some instances, receive personal data from that partner in relation to such information that you have provided them during the recruitment procedure such as, but not limited to, application documentation, interview memorandums, test results and other personal data collected by the partner (or us).

DO WE TRANSFER YOUR PERSONAL DATA TO THIRD COUNTRIES?

Yes, we do. Some of our suppliers and partners have their businesses in countries outside EU/EEA. Therefore, we transfer your personal data to such countries. When such transfer is made, we will take all reasonable legal, technical and organizational measures in order to ensure that your personal data is handled securely and with an adequate security level and in accordance with current data protection legislation. This means that the transfer of personal data may be based on for example an adequacy decision by the European Commission, Model Contract Clauses or to a company subject to the Privacy Shield-certification.

HOW LONG DO WE STORE YOUR PERSONAL DATA?

Personal data may be processed for various purposes and in different systems Please note that the same type of personal data may be processed for different purposes and based on different legal grounds, for example processing which is based on our obligations to fulfill a contract, based on our legitimate interest or based on your consent. This means that certain personal data may still be stored by us even if you withdraw your consent and the processing that your consent concern ceases.

This also means that certain personal data may be eliminated from one system because it is no longer necessary for one particular purpose, but still be stored in another system based on your consent or for another purpose for which the personal data is still necessary.

Cookies

In some cases, the cookies we use may include personal data. You will find information about the storage time on your computer for our cookies in our cookies policy.

Any personal data (normally in your capacity as a contact person) that we process in connection with purchases of products and in order to administrate or to fulfill our obligations to a customer or supplier under a contract (with you named as a contact person) will be processed for as long as we have any remaining contractual obligations in relation to such transaction.

If a cancellation, claim or warranty request is made (with you named as a contact person) we will process your personal data for as long as the process regarding the cancellation, claim or warranty request is active.

When we process personal data as a result of your communication with us, in for example support and customer service matters, the processing will continue until the latest of (i) WoodEye’s responsibilities or rights under the relevant sale or purchase of products have terminated, (ii) your support matter or customer service matter has been completed or, in any event, (iii) for six (6) months following such contact or communication.

When processing is made in order for us to comply with legal obligations, your personal data will be processed for as long as is set out in the relevant legal obligation. When processing is made in order to prevent and investigate abuse or violations of law the processing may be made up to twenty-four (24) months after collection of such data.

When we process user generated data from the Website [(for example information about the pages you have visited, and time spent on our Website, what links you have clicked and what content you have watched)] which is collected through our use of cookies, the processing will continue for n/a months.

When we process your personal data in an employment matter such processing will be continue until we have taken a final decision in the employment matter and such following period, that is necessary to ensure that WoodEye timely and rightfully has complied with its legal obligations in such matters. If and to the extent a recruitment results in an employment with you, our processing will thereafter continue for as long as the employment is active and such following period that is necessary to determine that WoodEye timely and rightfully has complied with its legal obligations during the employment and/or possible termination of the same, as more detailed set out in WoodEye’s relevant internal policies.

When personal data is processed based on your consent the processing will continue until you withdraw your consent, or otherwise indicate to us that you no longer wish to be subject to the processing.

When we process your personal data based on our legitimate interest, you have the right to object to the processing at any time.

Your personal data may be stored longer than the above, to the extent WoodEye is required to do so by law, regulation or decisions made by authorities.

WHAT RIGHTS DO YOU HAVE RELATING TO THE PROCESSING OF YOUR PERSONAL DATA?

Below you will find a description of your rights regarding the processing of your personal data. If you wish to exercise any of these rights, you are welcome to contact us by using the contact details set out below [link ].

Right to obtain access to information You have the right to obtain access to information about the personal data we process about you and you also have the right to request correction of your personal data.

Right to control of your personal data You have the right to object, at any time, to processing of your personal data which is based on our legitimate interest. Under certain circumstances, for example if you withdraw all or part of a given consent on the processing of personal data, object to our processing or if you think that the processing is not necessary for the stated purposes, you have the right to request deletion or restriction of your personal data. Under certain circumstances, you also have the right to receive the personal data concerning you that you have provided us with, in a structured, commonly used and machine-readable format and have the right to transfer such data to another data controller.

Right to withdraw your consent You have the right to withdraw a given consent at any given time. The withdrawal of consent may, however, have no effect on our processing of your personal data for the period prior to the withdrawal took place. You also have the right, at any time, to object to the processing of your personal data for direct marketing purposes.

Right to submit complaints If you have any complaints regarding our processing of your personal data, you have the right to submit such complaint to the Swedish Supervisory Authority (www.datainspektionen.se) or to another applicable supervisory authority.

All communication and measures taken by us in connection with you exercising your rights is provided free of charge. If you make an obviously unreasonable or unjustified request, we do, however, reserve the right to charge you with a reasonable fee for the costs that arise for us in order to provide you with the requested information or to take the steps necessary to fulfil your request or to decline such request.

DO WE USE COOKIES?

Yes. We use cookies at the Website in order to provide you with access to various functions and the full user experience on the Website as well as for analyzes and profiling.

For more information on our use of cookies including the storage time in relation to the different cookies, your rights connected to our use of cookies and how you can decline the use of cookies and other tracking devises, please read our cookie policy here.

WHAT DO WE WANT TO DO IN THE FUTURE?

We always want to develop and improve our products and services that we offer you. If we introduce new features that affect the purposes for which we process your personal data or features that we think is, in any other way, of importance to you we will notify you of the changes at our website and by e-mail (if we have your e-mail address) before the relevant changes come into effect.

If you, for any reason, do not like the changes we make, your rights under applicable data protection legislation will of course remain. You will always find the latest version of the Privacy Policy on the Website.

DO YOU HAVE ANY QUESTIONS?

If you have any questions regarding the way WoodEye handles personal information, regarding the information in this Privacy Policy or if you have any requests regarding the processing of personal data, do not hesitate to get in touch with us through the WoodEye team or send us an e-mail to info@woodeye.com.

Our postal address is, WoodEye AB, Idögatan 10, 582 78 Linköping, Sweden, Switchboard, +46 13 460 5100 and E-mail: info@woodeye.com