Privacy Policy
This Privacy Statement informs about processing of personal data by Ovako AB and its affiliates. It is an information about how we use, store, and above all protect your personal data as well as for what purposes the data is collected and what rights you have. Data processing regarding employees is described in a separate privacy statement.
Data Controller
The Data Controller of your data is the Ovako company that initially collected your data and decided the purposes and means for using your data. If you have questions about who the Controller of your data is or any other questions about your data, please contact privacy@ovako.com.
The Data Controller for all data processing on a corporate level is Ovako AB (registration number: 556813-5338, address: P.O. BOX 1721, SE-111 87 Stockholm, Sweden. Tel no +46(0)8-6221300. E-mail: privacy@ovako.com.
Personal data processing at Ovako
Personal data (hereinafter” data”) is the data about you as an individual that we collect and store for different purposes as part of our day-to-day operations.
Type of data we collect
Contact persons at customers, potential customers and suppliers
To have an efficient communication with you; keep you informed on order status, deliveries etc., respond to your questions, send information about new Ovako products and services of interest to you (newsletters, invitations to fairs and events), we store data in our registers. The registered data are contact details related to the position in the company you work for, for instance name, e-mail address and phone number.
Job applicants, trainees etc.
When it comes to job applicants and trainees etc., the candidate´s/trainee´s personal data is registered to carry out the recruitment/admission process, for instance name, e-mail address, phone number and CV. In some cases, results from different types of tests may also be collected and stored.
Digital visitors
When it comes to digital visitors visiting the website, we collect navigational data such as IP address, cookies, session identifiers, browser type, web pages viewed, and links clicked.
Facility visitors
When it comes to facility visitors visiting any of our offices or facilities, we collect contact details related to the position in the company you work for, for instance name, e-mail address, phone number and at some industrial areas, license plate number of vehicle and video/photo, time and location of recording.
How we collect data
We collect and process data that:
- you shared with us or we have received from the company you work for
- was automatically collected by the use of the website and other services
- is publicly available and;
- from time to time, from third parties such as marketing companies.
What we use data for
Supplying and receiving products and services from customers and suppliers
We process data on you as a representative for your company, to manage and deliver or receive orders according to agreement. We process data for the products your company sells or buys to handle invoices and payments, credit information as well as claims.
Legal ground: Fulfillment of agreement
Direct marketing to customers and potential customers
We process data to be able to market our products and services to you and to the company you work for. You may receive information through letters, phone, sms and e-mail.
Legal ground: Legitimate interest
Recruitment/admission process for job seekers, trainees, among others
We process data on you to carry out the recruitment/admission process.
Legal ground: Consent
Compliance of laws
We process data to fulfill legal requirements.
Legal ground: Legal obligation
Improve the page content, navigation and structure of the website
We evaluate digital visitor statistics to the site in order to improve page content, navigation and structure.
Legal ground: Legitimate interest
For safety reasons and to prevent property damages and related crimes
We protect our facilities in order to prevent unauthorized persons gain access to industrial areas, for example when opening gates.
Legal ground: Legitimate interest
For how long we retain your data
Regarding retention periods, we store personal data only as long as necessary to fulfill the purposes outlined in this Privacy Statement unless a longer storage period is required for legitimate reasons, required by law or as necessary to justify or defend a legal claim.
If you gave your consent for the use of your data, you may withdraw that consent at any time, and we will stop using your data. Your withdrawal of consent rights, as well as the specific retention periods, are provided to you in the information where we initially collected your personal data.
With whom we share your data
We may share your data with other companies within the Ovako Group. We may also share your data with:
- trusted service providers, such as service providers for the purposes listed above. However, these trusted service providers act on Ovako's behalf and Ovako is responsible for the use of your data;
- when permitted or required by law to comply with requests by competent public authorities or similarly binding acts;
- if Ovako is involved in a merger, acquisition, or sale of all or a portion of its assets;
- when Ovako believes in good faith that disclosure is necessary to protect Ovako's rights, protect your safety and rights, investigate fraud, or respond to a government request.
Transfer of data to third country
Some of Ovako AB´s subsidiaries and suppliers have operations in countries outside of EU/EES (third country). In these cases, and only when necessary, we transfer and process your personal data in countries outside of EU/EEA (third countries). When we, or one of our suppliers, process your personal data in a third country, we ensure that an adequate level of protection is assured before transferring your personal data. Primarily, we rely on the decision of the European Commission that the third country to which your personal data is transferred upholds an adequate level of protection. Read more about decisions about adequate level of protection here. Secondarily, if the European Commission has not deemed the level of protection in a third country adequate, we enter into the European Commission’s Standard Contractual Clauses (SCC) with the recipient in the third country. When relying on the SCC:s, we also assess whether the legislation in the recipient country affects the protection of your personal data granted by the SCC:s. If necessary, we will adopt supplementary measures to ensure the protection of your data when transferred to the third country.
If you have further questions regarding the transfer of your personal data outside the EU/EEA, please contact us by sending an email to privacy@ovako.com.
How we protect data
We work continuously to protect our stakeholders´ integrity. Our security work consists of protection of individuals, information, IT-infrastructure as well as of facilities and industrial areas. Specific attention is put on information security to prevent, detect and block any unauthorized access or loss of your data.
Access to your data is only shared with those who need it to perform their work. Data encryption is done when needed based on commonly known and secure encryption methods. We work continuously against spam and virus attacks in our networks.
Your rights
You have a right to access data that Ovako holds about you.
You have the right to request Ovako to correct, update or remove your data at any time. However, please note that certain information is strictly necessary in order to fulfil the purposes defined in this Privacy Statement and may also be required by law. Therefore, the deletion of such data may not be allowed by applicable law, which prescribes mandatory retention periods.
You have also right to object to a processing that is based on legitimate interest of Ovako on grounds relating to a particular situation at any time. In that case, you need to specify what data processing you object to. To the extent required by applicable data protection law, you have a right to restrict data processing.
You have a right to data portability, i.e. the right to receive the personal data in a structured, commonly used machine-readable format and transmit the personal data to another data controller, to the extent required by applicable law. This applies only for data based on a customer contract or consent.
If we collect personal data based on your consent, you have the right to withdraw your consent at any time.
Please send any requests regarding the above-mentioned rights to Ovako at privacy@ovako.com.
If you think there is a problem with the way Ovako is processing your data, you have a right to file a complaint to the national data protection authority in the EU/EEA.
Last updated Sept 2023