Privacy Policy

1. INTRODUCTION

This privacy policy (the "Privacy Policy") describes how Prisjakt Sverige AB, company registration no. 556665–1799, with address Kamengatan 6, 262 32 Ängelholm ("Prisjakt", "we", "our" and "us"), processes personal data about you who visit and use our website and/or mobile apps (the Services), as well as about you who come into contact with us in connection with recruitment.

We are the controller for the processing of personal data described in the Privacy Policy. If you have any questions about how we process your data, or if you wish to exercise your rights as a data subject, please contact our Data Protection Officer at [email protected].

We want you to feel confident about how we process your personal data and therefore ask you to read the Privacy Policy, which we may update from time to time. If we change the Privacy Policy, the new version applies from publication on our website. You can see when we last made updates at the top of the Privacy Policy.

2. HOW WE COLLECT YOUR PERSONAL DATA

The data we process about you is mainly collected directly from you when you visit and use our Services or in connection with our contact with you - for example by email, social media, telephone or similar occasions. We may also collect data about you from third parties.

3. HOW WE PROCESS YOUR PERSONAL DATA

3.1 Introduction

We only process your personal data if the processing is permitted under applicable data protection legislation. This means, amongst other things, that we must have support for the purposes of the processing in the form of a so-called legal basis, which for our part mainly means one of the following grounds:

Performance of a contract – the processing is necessary for us to be able to provide you with our services or otherwise perform the contract between us, or to take steps at your request before entering into a contract.

Compliance with legal obligations – the processing is necessary to comply with our legal obligations under, for example, legislation or other regulation that applies to us, or court or authority decisions requiring us to process data about you.

Balancing of interests – the processing is necessary for purposes relating to our or a third party's legitimate interests, provided that your interests or fundamental rights or freedoms do not override them (in which case the processing may not take place).

Consent – the processing is based on your prior consent, where we, amongst other things, have a responsibility to clearly inform you of which processing you consent to, as well as the possibility to withdraw your consent to our continued processing in an easy way.

Below we explain in more detail the categories of personal data we process, the purposes for which we process them and the legal bases on which our processing of your personal data is based, including how long the data about you is retained by us and with whom we share your personal data.

3.2 Maintain and improve our Services

Purpose of processing : Collect statistics on and analyse traffic in our Services and their use, as well as the functions and services available in them. We also use other technical information generated when visiting or using the Services in order to maintain and improve their functions and your user experience (including through tailored ads from third parties on our website or through relevant product recommendations and other personalised content). We also process technical information and user-generated data in our work to detect and counter errors, breaches and incidents.

Categories of personal data : The personal data we process concerns:

• IP address in connection with the use of cookies
• User-generated data, such as search queries and conversation history shared with the search assistant (see more about this under point 3.3) or other data created in connection with your use of the Services
• Other technical information generated when visiting our Services, such as the type of technical device you have used, browser, click history, pages visited and times of visits, browser information, geographical information from the location from which you visited the Services and other web traffic information.
• Device and app information, such as device model, operating system, app version and crash reports.

Legal basis : Balancing of interests, where our legitimate interest is to collect material to maintain and improve the functionality, content and security of our Services and to be able to deliver a personalised experience of our Services and its functions. Collection and continued use/processing of information collected through cookies and similar technologies takes place on the basis of your consent, except for such use that is strictly necessary for you to use our Services in an appropriate way. For more information on how we use cookies and other similar technologies, see our Cookie Policy.

Retention period : Information collected via cookies and similar technologies is retained in accordance with the information set out in our Cookie banner. In most cases, these and other personal data are converted into aggregated and/or anonymised data in connection with our production of statistics.

Sharing of personal data : We will share your personal data with our IT suppliers. Some parts of our maintenance and improvement work are carried out with the support of analytics services from third parties. The statistics we compile and the analyses we conduct with the support of these services are carried out using data in aggregated form and on the basis of de-identified or anonymised data.

3.3 Administer your membership and provide personalised features

Purpose of processing : Create and administer your membership and provide the personalised features of the member service, such as the ability to create lists, alerts and use our search assistant. This includes, amongst other things, identifying you as the account user and being able to give you a personalised experience of the account and the services provided. We also use the information shared with the search assistant to personalise and improve the user experience of the search assistant by adapting responses and recommendations based on previous searches, preferences and interests.

Please note that the search assistant and certain other features, such as personal lists and alerts, are only available to logged-in members. It is a prerequisite for being able to provide these features that we are permitted to process your personal data for these purposes. However, we have a standard search function that is available when logged out. We refer you to that function if you do not want us to use the search assistant's history to personalise your user experience.

Categories of personal data : The mandatory personal data we process concerns:

• Email address (mandatory)

Other, optional personal data concerns:

• Username (if different from email)
• Profile picture
• Settings and your personal choices
• Your personal lists
• Alerts
• Search queries, conversation history and images shared with the search assistant

Legal basis : Performance of a contract, where the collection of your email address is required for us to create a membership account and thereby provide the member service to you.

The collection of other personal data as set out above is not required to create an account with us and is therefore optional data that you may choose whether or not to provide. Our processing of such personal data takes place on the basis of a balancing of interests, where our legitimate interest is to be able to provide as relevant a service as possible and improve the experience for our users.

If you add products from which it is possible to draw conclusions about special categories of personal data (in accordance with Article 9 GDPR), for example your religion, your sex life or sexual orientation, or your political opinions, to your lists or choose to track them, we will process the data as meaning that you have saved the relevant products on the basis of your consent. Your decision to add the relevant product(s) to your list or alert constitutes your consent to our processing of the relevant data in such cases.

Retention period : We process and store your personal data for as long as you have a membership account with us.

Sharing of personal data : We will share your personal data with our suppliers, such as providers of IT services and/or marketing services

3.4 Newsletters and other marketing communications

Purpose of processing : Administer and send email communications, in order to inform you about our business, our services and ongoing activities.

Categories of personal data : The personal data we process concerns: Email address

Legal basis : We only send marketing communications by email to you if you have signed up for such communications and thereby consented to receive them.

Retention period : We process and store your personal data in order to send you marketing communications by email for as long as you have not unsubscribed from receiving further communications. You may unsubscribe at any time by using the unsubscribe link included in our communications.

Sharing of personal data : We will share your personal data with our providers of marketing services.

3.5 Administer and manage customer support cases

Purpose of processing : Communication and handling of enquiries, investigation of complaints, as well as provision of technical support and improvement of customer experience.

Categories of personal data : The personal data we process concerns: contact details such as name and email address, as well as such personal data as you provide yourself in your contact with us.

Legal basis : Balancing of interests, where our legitimate interest is to be able to respond to users' questions and manage customer enquiries in order to improve the functionality, content and security of our Services.

Retention period : We process and store your personal data for as long as is required for us to be able to help you with your matter and handle possible legal claims from you as a customer. The personal data is stored for 24 months after a closed case.

Sharing of personal data : We will share your personal data with our providers of support systems for customer support cases and external advisers where necessary.

3.6 Publication of reviews

Purpose of processing : Enable the publication of user reviews, ensure that the reviews are genuine, and improve the user experience by providing reliable and useful information to other users.

Categories of personal data : The personal data we process concerns:

• Contact details such as username and email address.
• Personal data that you provide yourself in your contact with us.

Legal basis : Balancing of interests, where our legitimate interest is to be able to ensure the authenticity of reviews, which is crucial to improving the user experience, providing reliable information and maintaining transparency in our communication.

Retention period : We process and store your personal data for as long as the product or shop is listed. If a user has been inactive for more than three (3) years, we anonymise the review.

Sharing of personal data : We will share your personal data with our providers of marketing services.

3.7 Use of Conversion Pixel

Purpose of processing: Some of our business customers have chosen to activate our Conversion Pixel. This means that if you click through to a customer's website that has chosen to activate the Conversion Pixel, the customer will be informed that you have arrived at the customer's website via our Services. We will receive information about how you interacted with the company's website (for example, seeing how/whether a purchase is completed). The purpose of this processing is to show which clicks lead to purchases for these business customers. It also enables us to show our customers that visibility in our Services contributes to increased sales.

Categories of personal data : Information about how you act on our customer's website (for example, how/whether a purchase is completed).

Legal basis : Consent; please note that this is obtained by our customer in connection with your visit to their website – before that, we do not process your personal data via the Conversion Pixel.

Retention period : 30 days.

Sharing of personal data : We share your data with our customer to see how you interact with the customer's website (for example, how/whether a purchase is completed). We will also share your personal data with our IT suppliers.

3.8 Competition administration

Purpose of processing : Administer and run competitions, including selecting winners, contacting winners and delivering prizes.

Categories of personal data : The personal data we process concerns:

• Username if you participate in our competitions via social media
• Name and contact details (email address and phone number)
• Address for delivery of prizes

Legal basis : Balancing of interests, where our legitimate interest is to be able to run the competition, select and contact winners and deliver prizes.

Retention period : We process and store your personal data for as long as required to administer the competition and fulfil any legal obligations (for example, requirements under marketing and consumer protection legislation).

Sharing of personal data : We may share your personal data with suppliers who help us administer competitions and deliver prizes.

3.9 Selection and recruitment of candidates based on submitted application documents

Purpose of processing : Selection and recruitment of candidates based on submitted application documents (such as CV and cover letter), interviews, reference checks and, where applicable, personality and intelligence tests.

Categories of personal data : The personal data we process concerns:

• First and last name
• Address
• Contact details such as email address and phone number
• Application documents such as CV and cover letter
• Image (where applicable)

Legal basis : Balancing of interests, where our legitimate interest is to be able to assess your merits and personal qualities in connection with selection for, and decisions on, recruitment. Compliance with a legal obligation to document information on education, professional experience and other merits for the persons who are employed in order to meet the legal requirements in Chapter 2, Section 4 of the Discrimination Act (2008:567).

Retention period : Data collected about you in connection with your job application is, as a rule, deleted after the recruitment process has ended and at the latest two (2) years thereafter.

Sharing of personal data : We will share your personal data with our recruitment system provider.

3.10 Comply with legal obligations and safeguard legal claims

We may process your personal data in order for us to comply with our legal obligations under, for example, legislation or other regulation that applies to us, or court or authority decisions requiring us to process data about you.

We may also process your personal data so that you or the company or organisation you represent, we or the relevant third party can establish, assert or defend legal claims, for example in the event of an impending or ongoing dispute.

4. SECURITY MEASURES

We take security measures to ensure that our handling of your personal data is carried out securely. For example, the systems in which the personal data is stored are only accessible to our employees and service providers who need the data to perform their duties. They are also informed about the importance of security and confidentiality in relation to the personal data we process. We take appropriate security measures and standards to protect your personal data against unauthorised access, unauthorised disclosure and misuse. We also monitor our systems to detect vulnerabilities. In addition, we have entered into data processing agreements with our service providers (see further in sections 5 and 6 below).

5. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

Access to your personal data is limited to recipients who need such access for the purposes described in section 3 above or otherwise set out below. Your personal data will therefore be shared with the following recipients:

Our suppliers : We use third-party suppliers to manage parts of our business. We will share personal data with these suppliers so that they can perform services on our behalf, such as providing us with support and business systems, social media platforms, or carrying out assignments as subcontractors to us in connection with our own services. When we use suppliers under this point, we enter into data processing agreements and take other appropriate measures to ensure that your personal data is processed in a manner consistent with this Privacy Policy.

Business partners/Collaboration partners : We sometimes work with external parties in order to improve our services and business, for example advisers and sellers. These actors process personal data either as controllers under their own terms and guidelines for handling personal data, or as processors to us under our instructions for the processing. In the latter case, we enter into data processing agreements and take other appropriate measures to ensure that your personal data is processed in a manner consistent with this Privacy Policy.

Sale or transfer : We will transfer your personal data to a buyer/investor or potential buyer/investor in connection with the sale or other transfer of all or part of our shares, assets or business. In such transfer, we will take steps to ensure that the receiving party processes your data in a manner consistent with this Privacy Policy. The purpose of such transfer is to allow a (potential) buyer/investor to conduct due diligence of our business and, where applicable, take actions and preparations for a possible purchase or investment, where the transfer takes place with reference to the legitimate interest in such a possibility of review and any actions and preparations.

Authorities : We will also share your personal data with, for example, the police, the tax authority or other authorities when we are obliged to do so under, for example, legislation or other regulation or pursuant to court or authority decisions.

6. WHERE WE PROCESS YOUR PERSONAL DATA

We aim always to process your personal data within the EU/EEA. As some of our suppliers operate internationally, your personal data will be transferred to countries outside the EU/EEA under the agreements we have with the suppliers. In such cases, we are obliged to ensure that the transfer takes place in accordance with applicable data protection legislation before the data is transferred, for example by ensuring that the country to which the data is transferred meets requirements for an adequate level of protection according to the European Commission's decision and UK adequacy regulations, or by ensuring that the transfer is covered by appropriate safeguards in the form of, for example, standard contractual clauses decided by the European Commission together with the UK International Data Transfer Addendum, or the UK International Data Transfer Agreement (IDTA), and taking additional appropriate measures to protect your rights and freedoms.

Via the following link you will find information on the countries outside the EU/EEA which the European Commission has decided meet an adequate level of protection for permitted transfers of personal data: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_sv
Via the following link you will find the standard contractual clauses decided by the European Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_sv

Via the following link you will find information on UK adequacy regulations and on the UK International Data Transfer Addendum and the IDTA: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/

The countries outside the EU/EEA to which our suppliers currently transfer personal data are as follows: the United States. Prisjakt ensures that processors storing user data in the United States are certified under the Data Privacy Framework (DPF) and the UK Extension to the DPF.

7. YOUR RIGHTS

You have rights in relation to us and our processing of your personal data. Information about your rights and how you can exercise them is set out below.

Please note that your rights apply to the extent provided by applicable data protection legislation and that exceptions to the rights may apply where relevant. Please also note that we may need more information from you in order, amongst other things, to confirm your identity before proceeding with your request to exercise your rights.

To exercise your rights or request more information about them, please contact us, preferably by email: [email protected]

7.1 The right of access

You have the right to obtain confirmation as to whether we process personal data relating to you. If so, you also have the right to access this personal data through a so-called register extract, as well as further information about the processing in question, such as the purpose or purposes for which the processing is carried out, the categories of personal data concerned and the recipients to whom the personal data has been disclosed.

7.2 The right to rectification

You have the right to have inaccurate data about you corrected without delay. You may also have the right to complete incomplete data.

7.3 The right to erasure

You may request that we erase your personal data without undue delay if:

• The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• Our processing of personal data takes place on the basis of your consent and you withdraw your consent to the processing in question;
• You object to processing that we carry out on the basis of a balancing of interests and your objection outweighs our or another party's legitimate interest in the processing;
• The personal data has been processed unlawfully;
• The personal data must be erased in order to comply with a legal obligation.

7.4 The right to restriction of processing

You have the right to request that we restrict the processing of your personal data if:

• You dispute the accuracy of the personal data, for a period enabling us to verify whether the data is accurate or not;
• The processing is unlawful and you oppose us erasing your personal data and instead request that we restrict its use;
• We no longer need to process the data for the purposes for which it was collected, while you need the data in order to establish, assert or defend legal claims;
• You have objected to the processing that we carry out on the basis of a balancing of interests and are awaiting verification of whether your objection outweighs our or another party's legitimate interest in continuing the processing.

7.5 The right to object

You have the right to object to such processing of your personal data as takes place on the basis of our or another party's legitimate interest. If so, in order to continue the processing, we must be able to demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

7.6 The right to data portability

If we process your personal data on the basis of a contract with you or on the basis of your consent, you have the right to receive the personal data you have provided to us and which concerns you in electronic format. You have the right to have the data in question transferred from us directly to another controller, where technically feasible.

Please note that this right to so-called data portability does not include data processed manually by us.

7.7 Right to withdraw your consent

If our processing of your personal data is based on your consent, you always have the right to withdraw your consent at any time. Withdrawal of your consent does not affect the lawfulness of processing carried out on the basis of the consent before it was withdrawn.

8. COMPLAINTS TO THE SUPERVISORY AUTHORITY

The Swedish Authority for Privacy Protection (IMY) in Sweden is the supervisory authority responsible for monitoring our compliance with the General Data Protection Regulation (GDPR) and other applicable data protection legislation.

If you consider that our processing of your personal data violates applicable data protection rules, we encourage you first to contact us at [email protected] so that we have the opportunity to address your concerns.

Regardless of this, you always have the right to lodge a complaint with a supervisory authority. In particular, you may contact the supervisory authority in the EU/EEA state where you have your habitual residence, your place of work or where the alleged infringement has occurred, in accordance with Article 77 GDPR. For our business, IMY is the competent supervisory authority in Sweden and can be contacted at imy.se .

If the processing is covered by UK data protection legislation (UK GDPR), you have a corresponding right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), which can be contacted at ico.org.uk.