GDPR policy

1. purpose

The purpose of this privacy policy is to provide you, as a contact person at a company, with information about how ACTE Solutions AB ("ACTE") handles your personal data, and to make you feel confident that the processing is carried out in accordance with the General Data Protection Regulation and other applicable personal data legislation. The privacy policy also describes your rights towards us and how you can assert your rights.

2. Who is the data controller?

ACTE is the data controller for the processing of the personal data collected from contact persons of business customers who purchase products from ACTE.

You can find our contact details below:

ACTE Solutions AB, 556600-8032

Box 4115, 171 04 Solna

+46 8 445 28 28

If you have any questions about ACTE's processing of your personal data, please send your enquiry to gdpr@acte.se.

3. types of personal data processed

ACTE processes the following information about you as a contact person of a client company or sole trader:

• Name of the organisation
• Address
• Telephone number
• E-mail address
• Purchase history (stored on customers/individual traders not contact person)
• Contact history
• Personal identification number (sole traders only)
• Time zone, IP address, browser, operating system and agent, in case you contact ACTE via chat function.

Please note that purchase history data in relation to the contact person of corporate customers is linked to the corporate customer and not to you as the contact person.

4. What does the company use your data for?

Customer administration

Your personal data is processed in order for ACTE to administer your (or those whose companies you represent) orders and deal with any returns, warranty claims or similar customer administration. The legal basis is that processing is necessary for the company to fulfil the contract with you as a consumer or sole trader. If you are a contact person at a client company, the processing is carried out with a balance of interests as the legal basis, where ACTE's legitimate interest is to be able to exercise its rights and obligations under the contract with the client company.

Direct marketing

ACTE also processes your, as a consumer, e-mail address for marketing purposes. The marketing consists of the company sending you newsletters and offers of goods/services via e-mail for up to 12 months after your last purchase. However, you can choose to unsubscribe from our newsletters and email marketing at any time.

Even in cases where you are a contact person at a client company or sole trader, ACTE processes your e-mail address to send marketing. The marketing is then aimed at the company you represent and is based on the type of goods/services you have previously purchased and which we consider relevant to your professional practice. The marketing is sent for up to five years after your last purchase. Newsletters and email marketing will only be sent if you have not objected to such marketing, and you can choose to unsubscribe from our newsletters and email marketing at any time.

Marketing is carried out on a "balance of interests" legal basis, where the company's legitimate interest is to market its products.

To unsubscribe, please contact us at gdpr@acte.se or use the unsubscribe link provided in each newsletter/email.

5. Who may we share your data with?

ACTE may transfer your personal data to website administrators, couriers, PR agencies and system providers. These recipients are only authorised to process your personal data on behalf of the company in connection with the performance of a service for the company, such as delivering an ordered item to you or sending you marketing emails. ACTE takes all reasonable legal, technical and organisational measures to ensure that your data is handled securely and with an adequate level of protection when transferred to or shared with such selected third parties.

ACTE may also disclose your personal data to authorities, e.g. the Swedish Tax Agency, if we are required to do so by law. In the event that all or part of ACTE's business is sold, the company may transfer your personal data to a potential buyer of the business.

6. Transfer of personal data outside the EU/EEA?

Your personal data will only be processed within the EU/EEA.

7. How long do we keep your data?

Your personal data is processed for as long as it is needed for ACTE to be able to administer the purchase and any return of the goods. In cases where there is a warranty period on the purchase, your contact details and purchase history will be saved during the warranty period to enable ACTE to fulfil any warranty obligations.

Provided you have not opted out of receiving newsletters and email marketing, we will keep your email address for marketing similar products up to five years after your last purchase if you are a business contact.

If ACTE becomes aware that your employment as a contact person with a client company is terminated or if you cease to be the corporate client's contact person for any other reason, we will anonymise your data, if you so wish.

ACTE may store your personal data for a longer period of time if it is necessary to fulfil a legal obligation that requires processing under applicable law, or to enable the company to establish, exercise or defend legal claims related to, for example, ACTE's contractual relationship with the client company or the individual trader.

8. your rights

You have certain legal rights that you can enforce against ACTE. Below is a summary of these rights. For full details of your rights, please see the General Data Protection Regulation, Sections 3-5.

• Right of access/extracts from the register: You have the right to know whether the company is processing personal data about you. If so, you have the right to information about, among other things, what personal data is processed, the purposes of the processing, which external recipients receive your personal data and how long we store your personal data.
• Right to data portability: You have the right to request a copy of the personal data you have provided to the company in a structured, commonly used and machine-readable format. You also have the right to request that ACTE transfer this personal data to another controller. The right to data portability applies to personal data processed by automated means, based on your consent or on a contract to which you are a party.
• Correction of incorrect data: You have the right to request ACTE to correct incorrect or incomplete information about yourself.
• Deletion of certain data: You have the right to request ACTE to delete your personal data under certain conditions, e.g. if the personal data is no longer necessary for the purpose for which we collected the personal data.
• Right to object to ACTE processing of personal data: You have the right to object to ACTE's processing of your personal data under certain conditions.
• Right to object to direct marketing: You have the right to object at any time to ACTE processing your personal data for direct marketing purposes. If you object to such processing, ACTE shall cease all direct marketing to you without undue delay.
• Right to restriction of processing your personal data: You have the right to request a restriction of ACTE's processing of your personal data in certain cases. For example, if you have contested the accuracy of your personal data, you can request the restriction of processing for a period of time that allows the company to verify the accuracy of the personal data.
• Complaints: If you have a complaint regarding ACTE's processing of your personal data, you have the right to lodge such a complaint with the Data Protection Authority.

If you wish to make a request for access, data portability, rectification, erasure, objection or restriction, please contact us at finance@acte.se